# Third-party and data provenance

MedSeal-MBT is an original MoonBit implementation. It is not a port of another
DICOM library and contains no copied DICOM parser or de-identification code.

## MoonBit dependencies

| Dependency | Version | Purpose | Repository | License |
| --- | --- | --- | --- | --- |
| `moonbitlang/async` | 0.22.4 | Asynchronous file I/O, exclusive creation and rename | https://github.com/moonbitlang/async | Apache-2.0 |
| `moonbitlang/x` | 0.5.5 | Filesystem, path, UTF-8, and JSON support | https://github.com/moonbitlang/x | Apache-2.0 |
| `gmlewis/sha256` | 0.18.0 | SHA-256 integrity checks | https://github.com/gmlewis/moonbit-sha256 | Apache-2.0 |
| `gmlewis/base64` | 0.16.13 | Transitive SHA dependency | https://github.com/gmlewis/moonbit-base64 | Apache-2.0 |

These licenses are compatible with this project's Apache-2.0 license. Exact
versions are declared in `moon.mod` and resolved by `moon update`.

## Test and sample data

Every `.dcm` file under `samples/` is generated by
`tools/generate_samples/main.mbt`. The fixtures contain invented names,
identifiers, UIDs, institution text, and tiny synthetic Pixel Data byte arrays.
They do not originate from a patient, hospital, scanner, public clinical
dataset, or third-party DICOM project. Regeneration instructions and the role
of every fixture are documented in `samples/README.md`.

## Generated interfaces and AI assistance

`pkg.generated.mbti` files are generated by the MoonBit toolchain using
`moon info` and are committed so public interfaces can be reviewed. AI tools
assisted implementation, review, tests, and documentation; the repository
owner remains responsible for behavior, scope, licensing, and submitted data.

## New verification and standard references

pydicom 3.0.1 (MIT, https://github.com/pydicom/pydicom) is a development-only
independent parser and synthetic fixture generator. It is not used by the
MoonBit runtime. Generated data contains no clinical records.

`src/storage/entropy.c` is original project code that only calls OS random
facilities. It implements no cryptographic algorithm. gmlewis/sha256 provides
integrity hashes and is checked against standard vectors.

Research-v1 rules reference DICOM PS3.15 Annex E. No DICOM implementation is
copied, and complete confidentiality-profile conformance is not claimed.

Strict-v1 dictionary data is generated from the MIT-licensed pydicom 3.0.1
dictionary. The subset source and generator are committed under resources/rules
and tools/generate_strict_dictionary.py; generated data membership does not
imply complete IOD/Profile validation. The upstream MIT license is retained in
resources/licenses/pydicom-LICENSE. The independent official dicom3tools binary
is a development tool installed outside this repository, not a runtime or
redistributed package dependency.

## Enterprise private adapter and delivery dependencies

Python 3.12 standard library provides SQLite, local POSIX locking and filesystem
coordination. cryptography50.0.2 (Apache-2.0 OR BSD-3-Clause;
https://github.com/pyca/cryptography) provides HKDF/HMAC-related key derivation,
AES-256-GCM and Ed25519. Python hmac/hashlib use the interpreter's vetted provider.
The adapter does not implement cryptographic primitives or parse/transform DICOM.
Fixed offline wheels include cffi2.1.1 (MIT) and pycparser3.0 (BSD-3-Clause); wheel
license texts and SHA256 entries are included in generated installation packages.
The native SHA dependency remains an integrity hash, not the identity encryption
or signature provider. Development dciodvfy/pydicom executables are not bundled.
The MoonBit core/runtime is included in native compiled binaries under its Apache-2.0
license; compiler release0.10.14+7d59c7ec9 is recorded in the generated SBOM.

## Complete development/QA dependency inventory

These pinned Python packages are development-only, declared in requirements-qa.txt.
They are not MoonBit runtime dependencies or part of the private runtime wheel set.
License texts from the installed distribution are retained under resources/licenses/qa;
qa-manifest.json records their exact bytes. Offline runtime wheels carry their own
licenses and hashes in the distribution SBOM.

| Package | Version | License | Source / role |
| --- | --- | --- | --- |
| pydicom | 3.0.1 | MIT | https://github.com/pydicom/pydicom — independent reader, synthetic fixtures, dictionary |
| jsonschema | 4.23.0 | MIT | https://github.com/python-jsonschema/jsonschema — report schema validation |
| attrs | 26.1.0 | MIT | https://github.com/python-attrs/attrs — transitive QA dependency |
| jsonschema-specifications | 2025.9.1 | MIT | https://github.com/python-jsonschema/jsonschema-specifications — schema vocabulary |
| referencing | 0.37.0 | MIT | https://github.com/python-jsonschema/referencing — schema references |
| rpds-py | 2026.9.1 | MIT | https://github.com/crate-py/rpds — schema data structures |
| typing-extensions | 4.16.0 | PSF-2.0 | https://github.com/python/typing_extensions — QA typing support |
| numpy | 2.3.5 | BSD-3-Clause; bundled third-party notices retained | https://github.com/numpy/numpy — independent CT voxel/HU arithmetic |

## Research references

The 13 projects in docs/WINNER_RESEARCH.zh-CN.md are design/engineering research
references, not dependencies or ports. No implementation, assets, license text or
test fixture from them is distributed as MedSeal code. The report records fixed
source commits, links and reference scope; its license table is based on the root
LICENSE of those fixed snapshots. Future copying would require a new provenance
record and applicable license/NOTICE retention.

## DICOM standard facts and rights boundary

DICOM® is the registered trademark of the National Electrical Manufacturers
Association for its Standards publications relating to digital communications of
medical information. The DICOM Standard copyright is held by NEMA, not MedSeal.
Official rights statement: https://www.dicomstandard.org/about-home/trademark
Standard notices: https://dicom.nema.org/medical/dicom/2025e/output/chtml/part01/chapter_Notice.html

resources/rules/standard-facts-2025e.json stores selected interoperability facts
(selected tag codes and MIT-pydicom VR/VM tokens) with fixed official PS3.6/PS3.15
URLs and source hashes, not the standard document, explanatory prose, illustrations
or a complete table reproduction. This factual subset is used to check the
implementation's dictionary and policy, and is not labeled as NEMA endorsement,
a complete confidentiality profile or a grant to redistribute the standard under
Apache-2.0. Project-specific decisions and synthetic fixtures are original;
The former PS3.15 bulk action-code table was removed during the contest audit remediation; the generator now retains only selected reference tags, source links and hashes, never action table cells. The official website terms (https://www.dicomstandard.org/dicom-terms-conditions, sections 1.1/1.2) restrict reprinting/distributing copyrighted works; no written permission to reprint is claimed. The strict dictionary subset separately derives from MIT-licensed pydicom, whose
license is retained. Downloaded official HTML/PDF remains outside release archives.
The standard's public availability alone is not treated as an unrestricted
reproduction license; any future redistribution of standard text/full tables
requires an explicit rights basis and retained original notices.

> 文档核对：本文说明已与当前维护代码和实际入口核对；不扩大医疗/生产保证。见[文档账本](docs/DOCUMENTATION_STATUS.zh-CN.md)；正式申报由韩桢本人完成。


## Offline lab development dependencies (C2)

`web/package.json` pins linkedom 0.18.12 (ISC) for Node DOM event tests only.
It and its transitive packages are absent from the generated offline page.
`web/pnpm-lock.yaml` fixes versions and integrity. Transitive licenses: boolbase
1.0.0 and uhyphen 0.2.0 (ISC); cssom 0.5.0, dom-serializer 2.0.0, html-escaper
3.0.3 and htmlparser2 10.1.0 (MIT); css-select 5.2.2, css-what 6.2.2,
domelementtype 2.3.0, domhandler 5.0.3, domutils 3.2.2, entities 4.5.0 / 7.0.1
and nth-check 2.1.1 (BSD-2-Clause). linkedom is not a browser and does not verify
visual layout or CSP enforcement.

The offline lab embeds only original project synthetic fixtures selected from
`conformance/manifest.json`; the builder checks their committed hashes.

Orthanc is an external executable used only for independent integration acceptance, not linked into or redistributed with MedSeal. Official macOS bundle26.9.1 contains Orthanc1.13.0 (GPLv3+); download origin and fixed hashes are recorded in [the integration guide](docs/ORTHANC_INTEGRATION.zh-CN.md). Source availability: https://orthanc.uclouvain.be/downloads/sources/orthanc/Orthanc-1.13.0.tar.gz .

V4 bundles the non-patient mathematical Shepp–Logan pixel image from scikit-image v0.22.0 under BSD-3-Clause. Fixed origin/hash and derived-DICOM scope: `resources/phantom/manifest.json`; complete upstream copyright/license notices: `resources/licenses/scikit-image-LICENSE.txt`. Pillow12.3.0 is a QA-only PNG reader; its full license is retained at `resources/licenses/Pillow-LICENSE.txt`. The phantom is not an external patient/scanner dataset.

V5 Playwright1.56.1 (Apache-2.0) is a test-only isolated browser driver, fixed in `web/pnpm-lock.yaml`; its license and NOTICE and playwright-core license/NOTICE are retained in `resources/licenses/browser/`. Browser executables are not included in the MedSeal package.

The optional `tools/create_application_pdf.py` artifact generator uses an externally installed ReportLab (BSD license) and the local system CJK font to render the maintained one-page application. Neither ReportLab nor system font files are distributed as source/runtime dependencies; the generated PDF embeds only the glyph subset needed for the document. Source: https://www.reportlab.com/opensource/ .