Licences & SBOM

A signed SBOM will be published alongside the first deployment. Until then, the third-party licences in scope are listed below — taken from the production sweep and the build map.

Component	Licence	Notes
Next.js 15	MIT	App shell
React 19	MIT	Render
MapLibre GL JS v6	BSD-3	Globe (when shipped)
deck.gl	MIT	Overlay (when shipped)
Protomaps PMTiles	BSD-3	Tiles on R2
DuckDB-WASM	MIT	GeoParquet query (when shipped)
@noble/ed25519	MIT	Fallback verify (WebCrypto first)
c2patool / c2pa SDK 0.90.1	Apache-2.0	Manifest validation
OpenSSL 3.6.3 (server)	Apache-2.0	ML-DSA-65 signing
LiteLLM core	MIT	Adapter — MIT core only, never enterprise

Boundaries: Natural Earth (PD), geoBoundaries (CC BY). Never GADM (non-commercial).

Anchored to — current as of last watcher pass

Provision text is sourced from the registries below. The displayed timestamp is the last successful fetch; a stale anchor is never silently re-stamped.

Anchor	Status	Last passed	Licence
UK legislation.gov.uk · https://www.legislation.gov.uk/data.xml	● live	2026-07-30T05:17:00Z UTC · current as of last watcher pass	OGL v3.0
EUR-Lex CELLAR (AI Act) · https://eur-lex.europa.eu/	● degraded	2026-07-29T17:06:00Z UTC · current as of last watcher pass	EU reuse notice
C2PA 2.4 specification (raw GitHub) · https://github.com/c2pa-org/specifications	● live	2026-07-30T03:00:00Z UTC · current as of last watcher pass	CC BY 4.0
RFC 9964 (PQC for IETF protocols) · https://www.rfc-editor.org/rfc/rfc9964	● live	2026-07-30T03:00:00Z UTC · current as of last watcher pass	IETF Trust Licence
NIST IR 8547 (PQC transition) · https://csrc.nist.gov/pubs/ir/8547	● live	2026-07-29T21:00:00Z UTC · current as of last watcher pass	NIST publication
Crosswalk registry (local meta-watcher)	● live	2026-07-30T06:00:00Z UTC · current as of last watcher pass	self-hosted

What we don't claim

CSOAI is not a certifier. There is no accreditation chain behind these numbers.
CSOAI is not an enforcer. The chain is the instrument regulators enforce with.
CSOAI is not a model vendor. We measure subjects; we do not ship them.
The chain is tamper-evident today (sha256). It is not a signature of authorship until Ed25519 / ML-DSA ship — and the label on the verify button changes in the same commit as that capability, never ahead of it.
No claim on this site is an assertion that a model is "unsafe" or "non-compliant". We report measured refusals, measured survival rates, and measured intervals — the conclusions are yours to draw.

Self-scoring disclosure

MEOK's own systems (SOV, SIGIL, the chain itself) appear on the GSPC board — scored by the same harness, the same predicates, the same items, with training provenance published. We do not exempt ourselves. SIGIL-current and SIGIL-target appear in the continuity battery: current is 2/4 (NOT survivable, agile-only), target is 4/4 (PQC-ready). The measured finding about our own chain is published on the same terms as every other subject.

Required attributions

UK legislation: Contains public sector information licensed under the Open Government Licence v3.0.
EUR-Lex / EU AI Act: Reuse of European Commission documents is authorised under the EU reuse notice (Decision 2011/833/EU).
Map surfaces (when the globe ships): © OpenStreetMap contributors, licensed under ODbL. Attribution appears on the map surface itself, not only here.
C2PA specification: licensed under CC BY 4.0. ProvBench measurements reference the specification verbatim.
RFC 9964, NIST IR 8547: standard IETF / NIST publication licences.

Refutation ledger Coverage gap map Arena Verify a chain Anchored to Methodology Licences & SBOM Corrections

CSOAI measures · MEOK builds · SovSpace renders. Nothing that measures may also build or enforce.