# Sources and third-party material

MoonAppend is a MoonBit implementation of a published tree/proof algorithm,
not a new cryptographic construction. AI-assisted implementation consulted:

1. RFC 9162 section 2.1: https://www.rfc-editor.org/rfc/rfc9162.html
   Tree definition, inclusion/consistency generation and verification rules.
   The document itself is not copied into this repository.
2. `moonbitlang/x@0.4.44` (`crypto` package), Apache-2.0.
   Product runtime dependency providing SHA-256 and hexadecimal formatting;
   installed via Mooncakes, not copied into our production source.
3. `transparency-dev/merkle`, commit
   `c39fbf350a405f68571bf4c42a6a518eb0a46a4b`, Apache-2.0:
   https://github.com/transparency-dev/merkle
   Consulted algorithm/boundary behavior; imported unmodified Go algorithms are
   vendored **only for independent development tests**, with original copyright
   headers and LICENSE under `tools/go_reference/vendor/`. Exact file hashes:
   `tools/go_reference/vendor-source.json`. These Go files are not the MoonBit
   product implementation and must be excluded from production-code statistics.
4. The SHA-256 empty-message and single-zero-byte values are mathematical test
   results. The larger fixtures in `go_vectors_test.mbt` are generated by our
   adapter calling the pinned reference; their provenance is recorded in the file.

Python oracle uses Python's standard-library hashlib and independently implements
small-tree recursive definitions. No user datasets, private code, third-party
translation catalogs or undisclosed binary fixtures are included.

Our code and test adapter use Apache-2.0 (see LICENSE). Reference materials have
their own notices; future additions must keep source, exact version and license
records. Initial alpha is not a claim of production security certification.