Stockfish build provenance
===========================

This directory ships the upstream Stockfish binary **unmodified**.
No patches, no custom compiles, no source edits. We communicate
with the engine over the UCI protocol (strings in, strings out)
via a Web Worker, which the GPL FAQ classifies as an arm's-length
arrangement that does NOT create a derivative work.

Upstream package
----------------
  npm:        stockfish
  version:    18.0.7
  source:     https://github.com/nmrugg/stockfish.js
  based on:   https://github.com/official-stockfish/Stockfish
  license:    GPLv3  (see ../../LICENSES/STOCKFISH.txt)

Build variant
-------------
  flavor:     stockfish-18-lite-single
  means:      single-threaded (no SharedArrayBuffer / COOP+COEP
              required), lite (no bundled NNUE network)
  size:       ~7.3 MB wasm + ~20 KB js loader

File hashes  (SHA-256)
----------------------
  stockfish.js
    2278005057f381491f1c9bb3e44c9f5920b3a00bef9759e33cc6582769a1f1fe

  stockfish.wasm
    a8fbc05ec6920b56d7485826dcb02c5ffd2826bcbf751cf973046f237a9096f1

Verify
------
  sha256sum public/stockfish/stockfish.js public/stockfish/stockfish.wasm

Hashes must match the corresponding files in
  node_modules/stockfish/bin/stockfish-18-lite-single.{js,wasm}

If they ever diverge, someone has altered the build and the GPL
redistribution obligations change — the modifications would have
to be published under GPL alongside the binary. As long as the
hashes match upstream, we're only redistributing the stock engine
and our own code stays proprietary.

Attribution surfaces
--------------------
  - /legal/credits              — user-facing Stockfish credit
  - /LICENSES/STOCKFISH.txt     — full GPLv3 license text
  - /CREDITS.md                 — repo-level attribution table
  - /legal/terms                — Stockfish mention in Terms of Service