# External driver licence inputs, 2026-10-04

This pass implements the upstream-input portion of the benchmark export
licence work. It does not complete the full plan or the broad per-driver
release review. No Stage 2 adapter, preparation recipe, roster, capture,
canonical wire, SDK or runtime source changed.

## Source and reviewed inputs

Harness bindings are retained at
`748a7cec1e36d6b9b2a93aba0cffbcb12fb49a9a`. The actual Stage 2 roster command
selects 25 defaults, including nineteen external peers. The new public
[inventory](../../../bench/driver-provenance.json),
[guide](../../../bench/docs/DRIVER_PROVENANCE.md) and
[notices](../../../bench/THIRD_PARTY_NOTICES.md) retain the distinction between
licence inputs and complete driver/release admission.

| Input | Count | Identity retained |
|---|---:|---|
| External project trees | 19 | Immutable public upstream commit URL, original API tree and response receipt |
| Licence/attribution files | 39 | Exact bytes, SHA-256, Git blob, mode and immutable URL |
| Supplementary declarations | 34 | Exact README/package/source bytes and matching identities |
| Harness inputs | 72 | Seventy selected adapters plus the shared Stage 2 generator and native session controller |
| Stage 2 literal bindings | 9 | Actual assignment names checked in the retained generator AST |

The September 29 staged-source record provides thirteen of the project
review targets. Fix8/libtrading use their previous exact patch-review inputs;
Artio, Philadelphia and llfix use their separately declared next-run targets.
QuickFIX/J uses the explicitly inspected reference commit. These choices do
not change any campaign defaults. In particular, the QuickFIX/J source input
does not identify the separately supplied 2.3.1 JARs, and llfix 1.0.8 does not
replace the microbench session's different-version original reference.

## Original source-identity collection

The first read-only SCAN collection ran through a shared/high host slot after
status, process and memory checks. Seventeen cached SDK directories are
archives without their own Git identities. Philadelphia's selected cache
source is absent. Only the explicit QuickFIX/J reference owns its Git tree:
`f72feb612c7fd5d519c916874dbd00121eb71298`, expected upstream remote, no tracked
changes and an exact matching licence file.

The original output and preflight are retained unchanged. The review does
not borrow an enclosing checkout's Git identity, infer source pins from a
cache directory name, or promote the seventeen archives to complete-source
admission. Primary upstream files were collected separately at declared
immutable commits. A later high-priority shared-slot metadata comparison
waited behind another session's Chronicle soak. Only this session's request
`818753e63ff543649ee563c924f7c714` was dequeued through the helper; its original
exit 76 and output remain retained. No benchmark queue or other session's
process was changed.

The actual comparison then ran as a small read-only SSH metadata operation,
with no build, test suite, benchmark or timing process. Of 73 declared
licence/declaration inputs, 69 are present and 68 match. Philadelphia's four
selected files are absent from its cache directory; llfix's cached README
differs from the reviewed 1.0.8 README. The different file remains a different
input; its matching licence cannot identify that whole SDK. The original
comparison stdout, stderr and summary remain separate from the dequeued
attempt. Matching licence bytes do not identify an entire SDK or admit a
runtime.

## Findings retained

- **Fixer:** root `LICENSE` and the selected package manifests declare
  Apache 2.0. Its README claims the QuickFIX Software License and links an
  absent `LICENSE.txt`. The inventory retains the conflict and keeps release
  review pending. The microbench owner received this finding; candidate and
  roster hints remain unchanged.
- **FerrumFIX:** code declares MIT OR Apache 2.0. The README labels FIX
  documentation CC BY-ND 4.0, while the actual resource PDF contains a
  separate FIX Repository licence agreement. Both exact inputs are retained;
  their application to actual resources remains unresolved.
- **hffix/fixpp/llfix:** upstream declarations identify separate extras,
  specification material or benchmark/test dependencies. Their project root
  licence labels are not whole-component admission.
- **Source transformations:** the native controller's NexusFIX GCC11
  replacements, FIX Antenna prepared observer and TrueFix dictionary overlay
  also need upstream attribution/modified-source treatment. The three diff
  files retain their previous separate exact patch review.

Independently authored harness code remains Apache 2.0. This input inventory
does not establish independent authorship of every source literal or relabel
copied upstream code. Complete derivation, dependency, actual linked-product
and distribution review remain required for every enabled driver.

## Verification and retained evidence

The actual inventory audit verifies all 73 upstream input files against both
SHA-256 and original Git blob identities, all 72 harness files against their
retained source commit, nineteen-engine roster coverage, nine literal
bindings and explicit pending release status. All pass. Five negative
controls retain the expected refusals: missing engine, unretained upstream
commit, changed licence hash, changed driver hash and false release admission.
No SDK build, native load, benchmark process or timing run is represented by
these checks.

Current readiness selects 751 source files plus three export templates, with
zero scrub, unresolved/private references or dead documentation links.
The 66 textual dependency escapes remain. These counts are source checks,
not standalone engine/runtime or release qualification.

Original primary bytes and review programs remain in
`~/archive/libhft/driver-review-inputs-20261004` on BEELINK2, HP and SCAN.
Both remote hosts independently verify all **282 named completed input
files**, their bytes/modes, and `sha256-inputs.json` with SHA-256
`d756b85c2b14920d770a6c415192290b978096db8004d51801d06641eb445542`.
The seal names completed inputs only and excludes the separately queued
cache-comparison operational output, now retained in a separate operational
seal. Both hosts also verify those nine operational files and their seal
`sha256-cache-comparison.json`, SHA-256
`819badface03dc831307d59de1b717b1932de87583ce382d99ec00adfb407189`,
while independently rechecking the original 282 named inputs unchanged.
Full upstream source and terms are
kept in that private archive; this record distributes receipts, not those
SDK trees or products.

[Review evidence](evidence/driver-licence-inputs-20261004/inventory-audit.json)
retains the audit result, complete input declaration, original source-identity
receipts, readiness counts and both replication verifications. Full-plan
fixture, root-install, physical-link, rate/stability and release gates remain
open. This pass does not promote any report row.