# Dependency licences

## Bundled binder examples (checked 2026-10-07)

The two Human Bindome complexes in `examples/binders/` are CC BY 4.0, per the
[official source](https://bindome.epfl.ch/static/index.html). The three extracted
experimental PDB complexes are CC0 1.0, per the
[wwPDB usage policy](https://www.wwpdb.org/about/usage-policies).
[Attribution and processing details](examples/binders/README.md), source URLs,
model identifiers, author chain choices and hashes accompany the files.

## Dependencies

Specification `material/SPEC.md` section 12.1: "Before a dependency enters the
lockfile, its licence is recorded in `LICENCES.md` with the date checked. A
dependency whose terms are unclear goes behind a plugin boundary, not into the
core."

**Date checked: 2026-09-28.** Method: read from the installed distribution
metadata on this machine (`importlib.metadata`, `License-Expression` /
`License` / `Classifier` fields), not from recollection. Rows marked *not
verified in-session* were not read from metadata and must be confirmed before
anything ships externally.

## Core, permissively licensed

| Package | Version | Licence as declared in installed metadata | Read from |
|---|---|---|---|
| `gemmi` | 0.7.5 | MPL-2.0 | `License` field and classifier "Mozilla Public License 2.0 (MPL 2.0)" |
| `freesasa` | 2.2.1 | MIT | `License` field and classifier "MIT License" |
| `numpy` | 2.4.6 | `BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0` | `License-Expression` |
| `scipy` | 1.17.1 | BSD (classifier "BSD License"; full text in metadata, expression not declared) | classifier |
| `pydantic` | 2.13.4 | MIT | `License-Expression` |
| `requests` | 2.33.1 | Apache-2.0 | `License` field and classifier "Apache Software License" |
| `biopython` | 1.87 | `LicenseRef-Biopython-License-Agreement` | `License-Expression` |
| `pytest` | 9.0.3 | MIT | `License-Expression` |

Notes that matter for commercial use:

- **`gemmi` is MPL-2.0**, not BSD/MIT. MPL-2.0 is file-level copyleft: using it
  as a library is unproblematic, but modifications to gemmi's own source would
  have to be published. We do not modify it, and that constraint should be
  recorded rather than discovered later. It is the coordinate library named by
  specification section 13, so it stays in the core.
- **`biopython` declares its own licence agreement** rather than a standard SPDX
  identifier. The project is commonly described as dual-licensed with
  BSD-3-Clause, but that was **not verified in-session** and the metadata does
  not say so. Biopython is used in exactly one place (pairwise alignment for
  mapping an observed sequence onto the canonical isoform in
  `memprep/mapping/numbering.py`). If its terms are judged unclear, that single
  use is small enough to replace with an in-house Needleman–Wunsch, so this is a
  contained risk rather than a structural one.
- `numpy`'s expression is a conjunction covering vendored components; the
  library itself is BSD-3-Clause.

## Not installed, and deliberately behind a flag or a plugin boundary

These are named by the specification but are not dependencies of the core. Each
is reached, if at all, through an adapter that reports *unavailable with a
reason* when it is absent — so the core runs, and the output says what was
missing (section 12.6: missing is missing).

| Component | Role in the specification | Status here | Terms |
|---|---|---|---|
| TmDet 4.0 | §5, the default frame generator; §12.1, "runs as a local container" | **Container, separate process** (see Plugins below). Frame method `--frame tmdet` or cross-check `--frame-crosscheck tmdet`; our `memprep-slab-0.1` stays the default | **CC-BY-NC-4.0** (`LICENSES/CC-BY-NC-4.0.txt`, read 2026-10-01). Non-commercial: its XML adds "Usage by and for commercial entities and for commercial purpose requires a license agreement" (UniTmp). **Commercial use needs that licence** |
| PPM 3.0 / OPM | §5, optional energetic cross-check; §4.4/§5, the peripheral orientation path | Web server without an API; not scraped. **File import** instead: `--ppm-file` / `config.frame.ppm_import_file` reads a PPM or OPM membrane-oriented PDB (`memprep/membrane/ppm.py`, `oriented_pdb.py`); no PPM code is used | §17 of the spec: "Unverified. Commercial terms unknown." Using a downloaded result file raises the question for the *file*, not for code. **Not verified** |
| MemPrO | §3.2/§5, orientation cross-check (peripheral and, here, spanning) | **Plugin, subprocess only** (see Plugins below), behind `config.peripheral.mempro_crosscheck` / `config.frame.mempro_crosscheck` | **GPL-3.0** (the checkout's `LICENSE`, read 2026-10-01) |
| Merizo | §6, the default structural domain parser | **Plugin, subprocess only** (see "Plugins" below). Used when installed at `config.domains.merizo_dir`; otherwise reported missing with its reason and §6's PAE / contact-graph parsers run | **GPL-3.0**, read from the checkout's `LICENSE` on 2026-10-01 |
| Phobius | §4.1, the preferred sequence predictor channel | Licensed binary, not installed. Two backends selected by `config.topology.phobius_backend`: `binary` shells out to `config.topology.phobius_binary`; `ebi` (opt-in, needs the network) submits to the EMBL-EBI Job Dispatcher Phobius service, which runs Phobius 1.01 | Binary: academic licence; commercial terms **not verified.** EBI service: governed by EMBL-EBI's terms of use for its web services (an e-mail address is required per submission; it comes from `config.fetch.ebi_email` or `MEMPREP_EBI_EMAIL`, never from code). Whether submitting proprietary sequences to a public service is acceptable is a policy question for the user, **not decided here** |
| TMHMM | §4.1, the independent second opinion | Licensed binary, not installed. Adapter shells out when `config.topology.tmhmm_backend = "binary"` (default) and `config.topology.tmhmm_binary` is set. Alternative plugin backend `tmhmm_py`, below | Academic licence; commercial terms **not verified.** |
| `tmhmm.py` (plugin) | §4.1 TMHMM channel, `config.topology.tmhmm_backend = "tmhmm_py"` (off by default) | **Installed on this machine, 2026-10-01**, version 1.3.1, built from github.com/dansondergaard/tmhmm.py at `c25fc8c` because the PyPI release has no Python 3.14 wheel and no buildable sdist. Two local changes were needed to build: Cython installed as a build dependency, and `tmhmm/hmm.pyx` patched for NumPy 2 (`np.int_t`/`np.int` → `np.int64_t`/`np.int64`, the same 64-bit integer on this platform). The TMHMM2.0 model file is not in the GitHub repository; it was taken from the PyPI `tmhmm.py-1.3.1` wheel (sha256 `aa57306b…ffa9be`, identical to the 1.2.1 sdist's). Imported only inside `memprep.topology.tmhmm.run_tmhmm_py`; absent, the channel reports unavailable with the import error | **Split licence.** Code: MIT (`LICENSE.md` in the repository, read 2026-10-01; the installed metadata declares no licence field). **Model: DTU's TMHMM 2.0, academic licence only.** The upstream README itself says the model "cannot be distributed with tmhmm.py" due to DTU's licensing, although the PyPI artefacts contain it. For any commercial use the model must come from a DTU licence, pointed to with `config.topology.tmhmm_py_model`; the model's sha256 is recorded in every evidence version string so the model behind a call is always named. Never a core dependency |
| `pybiolib` (plugin) | DeepTMHMM channel of `/api/topology` (`memprep/topology/deeptmhmm.py`), opt-in by request only; §4.1 keeps DeepTMHMM out of the default channels (SPEC_NOTES §2.3) | **Installed 2026-10-01**, 1.4.551, `pip3 install pybiolib==1.4.551` into the service's `python3` (3.14). Declares no runtime requirements (vendored). Imported only inside `memprep/topology/deeptmhmm.py`'s functions; absent, the channel reports unavailable with the import error | Client: **MIT** (`License-Expression`, read from installed metadata 2026-10-01). Never a core dependency |
| DeepTMHMM (BioLib app `DTU/DeepTMHMM`) | the model behind that channel | Runs in BioLib's cloud: `DTU/DeepTMHMM:1.0.57` on 2026-10-01 (the version that ran is recorded on every evidence), not DeepTMHMM 2. **No account or token is needed**: jobs ran anonymously, 45-125 s for one sequence. **The query sequence leaves the machine** | BioLib's app-version record (`source_code_license`, read 2026-10-01): free for academic and commercial use on BioLib; running it on your own servers needs a commercial licence (licensing@biolib.com). Running DTU's package locally needs an academic request or that licence. Whether sending proprietary sequences to BioLib is acceptable is a policy question, **not decided here** |
| TOPCONS2 web server (topcons.net) | `topcons` channel of `/api/topology` (`memprep/topology/topcons.py`); the job's other five methods are not offered (OCTOPUS, Philius, SCAMPI excluded by the benchmark; PolyPhobius, SPOCTOPUS readable by the parser but not requested by the page) | Web service, SOAP API (WSDL `https://topcons.net/pred/api_submitseq/?wsdl`), spoken with `requests`; no SOAP library installed. No account; an e-mail is optional (`config.fetch.contact_email` / `MEMPREP_CONTACT_EMAIL`). Public queue: ~70,000 remote sequences queued on 2026-10-01 | Standalone TOPCONS2 code: **GPL-2.0** (github.com/ElofssonLab/TOPCONS2, licence read via the GitHub API 2026-10-01); the web-server code is MIT (NBISweden/predictprotein-webserver-topcons2). We run neither: only the public server's output is used. The server publishes no terms of use beyond a 30-day result archive policy. **Not verified** for commercial use; the sequence leaves the machine. Cite Tsirigos et al. 2015, NAR 43:W401 |
| Membranome database | `membranome` channel of `/api/topology` (`memprep/topology/membranome.py`) | JSON backend `https://opm-back.cc.lehigh.edu/membranome-backend` (the one Membranome's own frontend calls); only the accession is sent | No API or data licence is published on the site or backend; a free academic resource (Lomize et al. 2017 Bioinformatics 33:1581; 2018 NAR 46:D1204). **Not verified** |
| Cython | build-only, for `tmhmm.py` | Installed 2026-10-01, 3.3.0 | Apache-2.0 (`License` field). Not imported at runtime |
| Rosetta / RosettaMP | §8.2, §9, refinement and loop closure | Not used. Step 3 only, and the specification keeps it behind a plugin boundary for licensing | Non-permissive. **Blocking by Step 3 per §16.** |
| OpenMM | §9, the default refinement backend | Not used in Steps 0–1 | Permissive (MIT/LGPL components); **not verified in-session.** |

## Plugins: run as a separate process, never imported by the core

**Date checked: 2026-10-01.** Section 12.1 sends a dependency whose terms do not
fit the core behind a plugin boundary. A plugin here lives outside the package
(`~/.cache/memprep/plugins/` by default), runs in its own interpreter, and is
reached only by `subprocess` from `memprep/domains/merizo.py`: the core writes a
backbone file, runs the plugin's own command-line entry point, and parses its
printed output. No plugin module is imported into the memprep process, so no
GPL code is linked into it. If the plugin is absent the core runs unchanged and
the record says so.

| Plugin | Source and version | Licence (read from) | How it is reached |
|---|---|---|---|
| Merizo | `github.com/psipred/Merizo`, commit `41d12fb84e6e` (2025-05-22), weights bundled in the repository (`weights/weights_part_{0,1,2}.pt`) | **GPL-3.0** (the checkout's `LICENSE` file). The weights ship in the same GPL repository; no separate weights licence was found. Citation: Lau, Kandathil and Jones, *Nat. Commun.* 2023 | `merizo_env/bin/python predict.py -d cpu --iterate -i <file>` as a subprocess |
| TmDet 4 | `github.com/brgenzim/TmDet`, commit `311af38c09b1ec8636810b6f9d7ab532adaa846e` (2026-01-10; reports `tmdetVersion` 4.1.4). Image built from its own `Dockerfile` (Ubuntu 24.04, gemmi 0.7.0, pugixml 1.14) as `memprep/tmdet:4.1.1-311af38`, image id `sha256:59fcc46ca11435e08cecc0dc6836977d7a63fd6d63441064a4f52ef1f9956d33` (arm64) | **CC-BY-NC-4.0** (`LICENSES/CC-BY-NC-4.0.txt`). Non-commercial only without a UniTmp licence | `docker create --network none` + `docker cp` in/out (`memprep/membrane/tmdet.py`); only its XML is read. Its wwPDB chemical-component directory lives in docker volume `memprep-tmdet-data`, installed once by `python3 -m memprep.membrane.tmdet --bootstrap` (the only networked step) |
| MemPrO | `github.com/ShufflerBardOnTheEdge/MemPrO`, commit `c8a1f6488833163dd3e58c8b4d19254bddc920b5` (2026-04-29), package 0.1.0, installed in `~/.cache/memprep/plugins/mempro/venv` (Python 3.12 via `uv`; `uv pip install -e ./repo`) | **GPL-3.0** (the checkout's `LICENSE`). Its environment: `jax`/`jaxlib` 0.6.0 (pinned by MemPrO; Apache-2.0, not verified in-session), `matplotlib` 3.11.2, `numpy` 2.5.3, `scipy` 1.18.1 | `venv/bin/mempro -f in.pdb -o out/ -ng 8 -ni 150 -nc 8` as a subprocess (`memprep/membrane/mempro.py`); the core reads `Rank_1/oriented_rank_1.pdb`, `info_rank_1.txt`, `orientation.txt` |

The plugin's own environment (`merizo_env`, a venv with system site packages, so
it reuses the system `torch`), read from installed metadata:

| Package | Version | Licence as declared |
|---|---|---|
| `torch` | 2.12.1 | BSD-3-Clause (`License` field) |
| `einops` | 0.8.2 | MIT |
| `rotary-embedding-torch` | 0.9.1 | MIT |
| `natsort` | 8.4.0 | MIT |
| `networkx` | 3.6.1 | BSD-3-Clause (`License-Expression`) |
| `matplotlib` | 3.10.9 | PSF-based matplotlib licence (classifier "Python Software Foundation License") |

Merizo's `requirements.txt` pins `torch==2.0.1` and `numpy<2`; neither is
installable on Python 3.14, and the plugin ran on torch 2.12.1 / numpy 2.4.6
instead. The deviation was checked rather than assumed: on the bundled
`examples/2xdqA.pdb` the run reproduced the README's published result line
exactly (`6-18_296-459,19-156,157-162_192-295`, pIoU 0.98407).

Two further inputs of the section 6 path, neither a code dependency:

- **AlphaFold DB PAE documents** (`paeDocUrl`), fetched through the fetch layer
  like the coordinates. Their data licence was **not verified in-session**; it is
  the same source and the same terms as the AlphaFold DB models already used.
- **`pae_to_domains`** (Tristan Croll, MIT, `LICENSE` read 2026-10-01) is the
  published *method* the PAE parser follows and the source of its defaults. No
  code was copied: the clustering is our own implementation in
  `memprep/domains/graph.py`, so nothing of it enters the lockfile.

## Browser app

`InXBio_Membrane-Annotation_mapper_v1.html` loads exactly one external asset:

| Asset | Source | Licence | Status |
|---|---|---|---|
| 3Dmol.js, historical v1/v2 | `https://3Dmol.org/build/3Dmol-min.js`, lazy-loaded at viewer open | BSD-3-Clause per the project's repository | Historical dependency record; these immutable versions use the unpinned URL. V3's verified pinned distribution is documented below. |

No inference weights or inference runtime are bundled. The browser app requests public
UniProt/AlphaFold/RCSB/PDBe records and selected topology/binder-example resources.
Selected live Phobius jobs send the sequence and supplied email to EBI; external
prediction providers have their own terms. A connected local memprep service receives
analysis/cross-check inputs, including uploaded structures. External-tool links and
exports do not submit a structure automatically. This distinction replaces the older,
overly broad statement that no target data ever leaves the browser.

V3 pins **3Dmol.js 2.5.5**, BSD-3-Clause, alongside the app in `vendor/`.
`vendor/manifest.json` records its npm tarball and file hashes; licence notices are
shipped there. The fixed-version jsDelivr fallback serves that package's viewer asset
when the local copy is absent. No third-party inference model is redistributed by the
v3 build. Primary package source: https://registry.npmjs.org/3dmol/2.5.5 ; upstream
licence: https://github.com/3dmol/3Dmol.js/blob/master/LICENSE .

Public GET input caching in v3 is local to the browser, bounded to 64 MB and seven
days, and records content hashes and original retrieval times. Uploaded coordinates
and live-job email are excluded from this cache. Existing Phobius email preferences
may be stored separately in browser storage. Explicitly saved session files contain
the user's structure and annotations and should be shared accordingly.

## What is still open

The specification's own section 16 lists licensing as an open decision:
"PPM and TmDet terms for commercial use, and Rosetta's position in the product,
all unresolved and all blocking by Step 3." Nothing in Steps 0–1 depends on any
of them, which is why the read-only annotator can ship on a licence-clean path
while those questions stay open. The one row that deserves a decision before
Step 1 ships is Biopython's, because it is the only unclear-terms dependency
currently inside the core.

## Local model files (not part of the app)

`local/TMHMM2.0.model` and `local/TMHMM2.0.model.js` were moved out of the app root
when development v5 became public v1 on 2026-10-12. They were originally added on
2026-10-02 at the user's request. A page opened from disk may read a local script,
so the `.js` file carries the same model text in one variable.
Both are DTU's TMHMM 2.0 model -- **academic use only, not redistributable**. Do not include them
when the HTML is shared; without them the page falls back to TMHMM through the local service.

## Clash-guidance documentation links

The v3 clash panel links to the official ChimeraX documentation at
`www.cgl.ucsf.edu` and Rosetta / RosettaMP documentation at
`docs.rosettacommons.org`. These are user-opened documentation links only;
no software from either project is bundled or invoked, and no structure is
sent by the app. Their installation and use remain separate from this app.