Third-party material in this repository, and what LICENSE does NOT cover ======================================================================= LICENSE grants MIT over this project. This file names the material inside the repository that is NOT this project's to grant, and withholds it from that grant. It only ever takes away. Nothing here adds a permission. WHY THIS IS A SEPARATE FILE AND NOT A PARAGRAPH IN LICENSE Because appending it to LICENSE would silently revoke the whole grant. GitHub's licence detector matches LICENSE against the canonical MIT text and returns NOASSERTION when anything follows it — this repository has already been through that exact failure and wrote the lesson down in LICENSE-HARDWARE: "Put the clarification beside the licence, never inside it." It matters more here than cosmetics, because this repo is the seed of the Wish It Better network and that network's second criterion is "a LICENSE with a real SPDX identifier", read from the licence API. A carve-out written in good faith in the wrong file would fail the project against the rule it wrote. THE GUATEMALA (GT-001) CARD ARTWORK — EXCLUDED FROM THE MIT GRANT ----------------------------------------------------------------- src/web/templates/gt-archive-front.jpg src/web/templates/gt-archive-back.jpg src/web/templates/gt-sleek-front.jpg src/web/templates/gt-sleek-back.jpg The two sleek faces were ALSO carried inside src/site/gt/index.html, as lossless PNG re-encodes at the same resolution, as base64 data: URIs. They are not any more, as of 2026-08-15: that page now references the JPGs named above, which this site was already serving at /studio/templates/. This withholding did not shrink — the same faces are named, and what went away is a second copy of them, not an exclusion. It is written here because this file was the only place in the repository that ever recorded the duplication, and it was right: measured before the change, mean absolute pixel difference 1.61 (front) and 1.89 (back) against those JPGs at an identical 1011x638, where the nearest wrong candidate sat at 40.33. An inventory that quietly stops matching the tree is how a reader learns to discount the entries beside it. This artwork was commissioned from Meta AI by the card's owner and included here at their instruction. src/web/app.js records it at the head of the GT-001 template block, which covers all four faces: "Finished artwork, placed and not rebuilt... a card someone has already designed... the original was approved." It is not this project's work, so this project cannot license it. Every verb the MIT grant offers over the software — use, copy, modify, merge, publish, distribute, sublicense, sell — is NOT offered over these files. They are present so the owner can reprint their card and so the page the chip opens keeps working. To reuse them, ask the owner. Where this project has re-exported or reframed a face, that does not enlarge what may be reused — the commission underneath it is still the owner's, and a derivative of something we cannot license is something we cannot license. THE EMBEDDED TYPEFACES — SIL OPEN FONT LICENSE 1.1, NOT MIT ------------------------------------------------------------ Fragment Mono and Instrument Serif, embedded as two woff2 data: URIs inside src/site/gt/index.html. Full text in OFL.txt at the repo root, and served at https://mrdirno.github.io/vibe-cards/OFL.txt Embedding is redistribution and subsetting to Latin is modification, so the fonts travel under OFL 1.1 and NOT under LICENSE. Clause 5 is explicit: the Font Software "must be distributed entirely under this license, and must not be distributed under any other license." This entry exists because the first draft of this file left it out and then swept it back in by accident. That draft closed its exclusion list with "and everything else in the tree remains MIT under LICENSE" — a sentence written to stop the narrowing from over-reaching, which instead re-granted OFL font software under MIT and contradicted the OFL.txt this repo ships beside it. A blanket affirmative is how a carve-out file acquires the exact defect it was written to fix, and it survived one draft because the file was checked for what it EXCLUDED and not for what it QUIETLY GRANTED. PRIOR ART CARRIED UNDER A COMPATIBLE LICENCE src/web/vendor/qr.js states in its own header that its structure and table derivation follow Project Nayuki's QR Code generator (MIT), reimplemented as a single self-contained script. MIT into MIT is the direction that flows, so nothing is withheld — it is recorded because this file's title promises an inventory of third-party material, not a list of exceptions. THE TRES RAÍCES CARD ARTWORK — EXCLUDED FROM THE MIT GRANT ----------------------------------------------------------- src/site/raices/card-front.png src/site/raices/card-back.png src/web/cards/raices-front.png src/web/cards/raices-back.png examples/raices-card/designs/*.png and the photographs embedded as data: URIs inside src/site/raices/garden/index.html These files are built around photographs of paintings — hand-painted paper daisies and ladybugs — made by the child the card was made for. The commit that brought them into this repository says so, and the card back says it in three words: "You made these." The painter is not this project, so this project cannot license the paintings. Every verb the MIT grant offers — use, copy, modify, merge, publish, distribute, sublicense, sell — is NOT offered over the artwork in these files. The layout, the type and the code around it are this project's and stay MIT; the paintings are not, and no arrangement of them around a page makes them so. They are here so the card can be reprinted and so the page its chip opens keeps working. To reuse them, ask the card's owner. Nothing above adds a name, and nothing should: the package was built name-free on purpose and stays that way in the file that withholds it. THIS ENTRY IS THE FOURTH INSTANCE OF ONE MISTAKE, and it is the one that matters. The section below used to close this file with a blanket — "everything else in the tree" — which swept in the GT artwork's siblings, then the OFL fonts, and then this. For one commit, the file whose entire purpose is to stop this project granting what it does not hold offered a stranger the right to SELL A CHILD'S PAINTINGS. A blanket affirmative in a carve-out is not a tidy ending; it is an unbounded grant over everything the author did not happen to think of, and the author will always fail to think of something. Withholdings get named. Never blanketed. THE TIERRA Y TRAZO, ABRAZO NICA AND ASIN AT SALA CARD ARTWORK — COMMISSIONED BY THE OWNER, EXCLUDED FROM THE MIT GRANT --------------------------------------------------------------------- PROVENANCE ANSWERED 2026-08-17, and this entry no longer says "pending". The owner commissioned these cards from Meta AI as concept pieces. That is the same answer, from the same person, as the GT-001 entry above, and it gets the same treatment for the same reason: a commission is the owner's, not this project's, so this project cannot license it. The withholding below is unchanged in effect and changed in kind — it stops being a precaution against an unknown and becomes a statement of who holds the work. THE INTENT MATTERS AND IS NOT WITHHELD. These are concept pieces meant to be built by other people; the wish route on each card is there for exactly that. Nothing in this section touches that, because an idea is not owned and never was — nobody needed a licence from Star Trek to build a communicator. Build your own version of one of these objects, with your dimensions and your materials, and it is yours, including to sell. What is withheld below is the card's ARTWORK, which is a different thing from the object it depicts. WHY THIS WAS EVER A QUESTION, recorded because the answer cost more than it should have. The packages arrived finished and no page, manifest or commit recorded who made them. A curation panel then refused four cards on unrecorded authorship, and the only way to resolve it was to ask the owner — who had known all along and had said so in a terminal that kept no record. tools/intake_card.py now refuses a package that arrives with no provenance, naming the shape it wants, and copies what it finds to src/site// AUTHORSHIP.md where the published surface can see it. The question is asked once, at the door, by the tool, instead of months later about every card at once by the one person who should never have had to answer it twice. --------------------------------------------------------------------- src/site/tierra/card-front.png src/web/cards/tierra-front.png src/site/tierra/card-back.png src/web/cards/tierra-back.png src/site/nica/card-front.png src/web/cards/abrazo-front.png src/site/nica/card-back.png src/web/cards/abrazo-back.png src/site/sala/card-front.png src/web/cards/asin-front.png src/site/sala/card-back.png src/web/cards/asin-back.png examples/tierra-card/designs/*.png examples/abrazo-nica-card/designs/*.png examples/asin-sala-card/designs/*.png The three examples/ lines were added 2026-08-19. They are the same artwork at 600 dpi print size — twelve tracked files, in the tree since the packages arrived — and they were missing from this list for the reason this file keeps finding: the inventory was written from the page and the asset, and the package was a third copy nobody walked. Each of the four withheld packages (these three and Tres Raíces above) now also carries a NOTICE of its own inside its folder, because a stranger who copies one folder sees LICENSE at the root and nothing else. The right-hand names are not the page slugs. /nica/ is served by abrazo-*.png and /sala/ by asin-*.png — the page, the package (examples/abrazo-nica-card) and the asset each shorten the name differently. A withholding written from the slug would have named four files that do not exist, which is how an inventory quietly stops binding. The three cards are recorded as having "arrived from another system" — commit e4c85ca, which re-allowed their images past a deny-by-default .gitignore and checked what mattered then: one embedded image each, their own QR, no photograph of anyone, all three deliberately name-free. What that commit did NOT record was who made the artwork, and for two days this file said so and withheld on the strength of not knowing. It now withholds on the strength of knowing: the owner commissioned them from Meta AI, the same route as the GT-001 faces above, and a commission is the commissioner's. The withholding is therefore permanent rather than provisional, and it is not a judgement about the work. Every verb the MIT grant offers — use, copy, modify, merge, publish, distribute, sublicense, sell — is not offered over these files. They are here so the cards can be reprinted and so the pages their chips open keep working. To reuse the artwork, ask the owner. To build the object it depicts, you need nobody's permission, and that is the point of the cards. Each card's page now carries src/site//AUTHORSHIP.md stating this in the owner's own terms, so a reader reaches the answer without reaching this file. TRES RAÍCES IS NOT IN THIS ENTRY BECAUSE IT IS NOT UNCERTAIN — its own section below withholds it on evidence, and its #vc-card block now declares license null and replication withheld. It had declared "license": "MIT" until 2026-08-16, in the machine-readable block, over the paintings the section below describes. The prose withholding and the machine-readable grant had disagreed since the day the prose was written, and the entry below already calls that grant the fourth instance of one mistake. It was the fifth. A carve-out written only in the file humans read is half a carve-out. THE NONCOMMERCIAL COMPOUND CRAFT CARD ARTWORK (001 MANIS, 002 AUREA, 004 BLOOM) — EXCLUDED FROM THE MIT GRANT -------------------------------------------------------------------- src/site/manis/card-front.png src/site/aurea/card-front.png src/site/manis/card-back.png src/site/aurea/card-back.png src/web/cards/manis-front.png src/web/cards/aurea-front.png src/web/cards/manis-back.png src/web/cards/aurea-back.png examples/manis-card/designs/*.png examples/aurea-card/designs/*.png examples/manis-card/assets/front_editorial.png examples/manis-card/assets/back_blueprint.png examples/aurea-card/assets/front_editorial.png examples/aurea-card/assets/back_blueprint.png src/site/bloom/card-front.png src/site/bloom/card-back.png src/web/cards/bloom-front.png src/web/cards/bloom-back.png examples/bloom-card/designs/*.png examples/bloom-card/assets/front_editorial.png examples/bloom-card/assets/back_blueprint.png Thirty files. The three `qr_*.png` in those same assets/ directories are NOT withheld — they are generated codes, not card artwork, and a withholding that swept them in would be the blanket this file forbids. This paragraph read "the three 645x645 `qr_*.png`" until 2026-08-17, and the size was wrong for two of the three. Measured from the PNG headers: manis qr_fallback.png is 645x645, aurea qr_placeholder.png is 1118x1118, bloom qr_placeholder.png is 430x430. One file was measured and its number was written as though it described all three. The dimension is gone rather than corrected to a list, because it was never what made these files generated codes — it was a detail that read as evidence, in the one file whose whole asset is that its inventory matches the tree. Unlike every entry above, this material IS this project's to grant. It is withheld from LICENSE for the opposite reason: the project already granted it on other terms, in public, and LICENSE contradicts them. src/site/index.html has carried two tags since the third card landed — "Cards 1, 2, 4 CC BY-NC-4.0" and "Cards 3, 5, 6, 7 MIT" — with a comment beside them explaining that one tag could not describe two licences. Nothing joined that claim to the licence files. Measured 2026-08-16, and either result would have shown this entry was unnecessary: `grep -icE 'manis|aurea|bloom|aurelia|moku| zaria|kaze' NOTICE` returned 0, and `ls examples/*/LICENSE` returned exactly one path, examples/moku-card/LICENSE — card 003, the one the page calls MIT. So for thirty tracked files the landing page said NonCommercial while LICENSE said MIT over the whole tree unscoped, and MIT is the one that would be read. A stranger could print and sell all three cards and cite this project's own LICENSE. The withholding above removes those files from the MIT grant. It puts nothing in their place, because this file never grants. The NonCommercial terms now sit beside each card as examples/{manis,aurea,bloom}-card/LICENSE, byte-identical to Creative Commons' published legal code for CC BY-NC 4.0 (fetched from creativecommons.org/licenses/by-nc/4.0/legalcode.txt, sha256 41003d4a74749c02…, 19,347 bytes) — the same arrangement MOKU-003 has always had for its MIT, and placed beside the licence rather than inside it for the reason this file's header gives. THIS FAILURE MODE IS NOT THE ONE ABOVE, AND THAT IS WHY IT SURVIVED FOUR PASSES. Every earlier entry withholds material the project does not own, so each was found by asking "whose is this?". This one is the project's own work, so that question clears it every time. The tell was not a missing file — it was two surfaces describing the same thirty files differently, with nothing joining them. A public page is a licence claim. When a page and a licence disagree, no gate notices, because no gate reads prose. WHAT IS NOT COVERED BY ANY ENTRY ABOVE Everything not named above is this project's own work and is offered under LICENSE — named that way round, rather than as a blanket, for the reason the typeface section gives. The archive entries in src/site/gt/entries.json are the project's on the only authorship record that exists for them: git, which attributes every commit that has ever touched that file to this project. If that is ever wrong for a particular entry, this is the file that has to say so. WHY THIS FILE HAD TO BE WRITTEN AT ALL The credit already existed in three places — src/site/gt/index.html (live on the page), src/site/network.json ("Meta AI, commissioned by the card's owner"), and the app.js comment above. None of them is a licence carve-out, and that is the whole lesson: ATTRIBUTION IS NOT A CARVE-OUT. A person who forks this repo reads LICENSE, receives an unrestricted MIT grant over every byte in the tree, and is never contradicted by a credit line. Measured before this file existed: the licence API returned spdx_id MIT for an unscoped LICENSE, and git ls-files | grep -iE 'licen[cs]e|notice|copying|copyright|third.?party' matched exactly two files in 177 tracked — LICENSE and LICENSE-HARDWARE, and LICENSE-HARDWARE grants rather than withholds. That number deserves distrust in the direction it was used, so the pattern is printed rather than described: it does not match OFL.txt, which IS a tracked root-level third-party licence that scopes material out of MIT. "Nothing in this tree withholds anything" was true of what the grep saw and false of the tree — the same blanket reflex, one level up, in the measurement instead of the prose. All four JPGs were served publicly, 200 with a 404 control, from both the Pages site and raw.githubusercontent. They still are, and that is the point: the fix for an over-claim is this file, not withdrawing the bytes the owner wants printable. The over-claim was live and distributed, never theoretical. The project already knew the principle and had applied it one class over. The OFL fonts embedded in src/site/gt/index.html ship their licence WITH the bytes, because embedding is redistribution — see the comment in tools/build_site.py that puts OFL.txt on the site. The same reasoning reached the artwork that was embedded in that same file, and did not reach it at the time, because the fonts arrived with terms attached and the artwork arrived with a thank-you. (The artwork's bytes left that file on 2026-08-15; the fonts' did not, and the difference is not licensing — the fonts are embedded against a THIRD-PARTY request, an argument same-origin images never had. The withholding is unchanged either way: it follows the artwork, not the copy.) An agent that finds this file and wants to "clean it up" into LICENSE: read the second section again. That edit has already been made once, by someone acting in good faith, and it broke the machine-readable grant for the whole repository. RUN THIS GAME studio template (2026-09-05) ----------------------------------------- src/web/cards/run-this-game-front.png and run-this-game-back.png carry DRINOMAN's release artwork: Aldrin Payopay's supplied portrait and lyrics, and five AI-assisted painted portraits after Vincent van Gogh. Included for the artist's authorized release template. These artwork assets are excluded from the code's MIT grant. No source book scans are included in these assets. The template carries the release URL; it assigns no physical card or chip ID. Open Archive studio template (2026-09-05) --------------------------------------- src/web/cards/open-archive-front.png and open-archive-back.png, and the corresponding examples/open-archive-card/ renders, reproduce a cropped view of Vincent van Gogh's Wheat Field with Cypresses (1889), Met object 436535. The museum image is supplied under The Met Open Access / CC0, separately from the software's MIT license: https://www.metmuseum.org/hubs/open-access and https://creativecommons.org/publicdomain/zero/1.0/ . The institutional record, original/derivative hashes, and exact source URLs travel in src/web/cards/open-archive-provenance.json. Card layout and code are by Aldrin Payopay / Persona500 under MIT. No museum endorsement is implied. This printable design assigns no physical card ID and no programmed chip.