Third-Party Notices

Last updated: 4 August 2026

1. About this notice

1.1XORCISE is distributed by XORCISE.AI operated by Fifth Domain Pty Ltd ACN 606 251 585 under the Apache License 2.0.

1.2XORCISE incorporates and depends on third-party open-source software. This page records what those components are and the licences they are distributed under, so that anyone reviewing XORCISE can see the licence surface without installing it first, and so that anyone redistributing it knows which attribution requirements apply.

1.3Licence identifiers below were read from the installed distributions rather than transcribed from a website. Where a package's metadata does not state a licence in a standard field, it is listed as unresolved rather than guessed. One package is currently in that state and is named in section 4.

2. Direct runtime dependencies

These fourteen packages are what a default `pip install xorcise` pulls in and depends on at runtime.

| Package | Version | Licence |

| --- | --- | --- |

| typer | 0.26.7 | MIT |

| rich | 15.0.0 | MIT |

| fastapi | 0.137.0 | MIT |

| uvicorn[standard] | 0.49.0 | BSD-3-Clause |

| httpx | 0.28.1 | BSD-3-Clause |

| pydantic | 2.13.4 | MIT |

| pydantic-settings | 2.14.1 | MIT |

| sqlalchemy | 2.0.50 | MIT |

| alembic | 1.18.4 | MIT |

| docker (SDK) | 7.1.0 | Apache-2.0 |

| pyyaml | 6.0.3 | MIT |

| packaging | 26.2 | Apache-2.0 OR BSD-2-Clause |

| opentelemetry-proto | 1.42.1 (pinned) | Apache-2.0 |

| tiktoken | 0.13.0 | see section 4 |

The full resolved dependency graph, including transitive packages and every optional extra, is 90 packages and is recorded in `uv.lock` in the repository. That file is the authoritative record; this table covers the direct set.

3. Optional extras

The following extras are not installed by default. Only `dev` brings in packages, and its dependency licences have not been verified by us; it is listed so that a reviewer knows it exists and can resolve it from `uv.lock`.

| Extra | Brings in |

| --- | --- |

| `control`, `runner`, `headscale`, `collector` | Nothing. They select a service role and carry no dependencies of their own — everything the runtime needs, the Docker SDK included, is in the direct set above |

| `all` | `xorcise[runner]`, and so also nothing beyond the direct set |

| `dev` | ruff, mypy, pytest and plugins, pre-commit, import-linter, anyio, pyyaml, types-pyyaml, twine, zizmor |

4. Unresolved

4.1tiktoken 0.13.0. The distribution records its licence in a non-standard metadata field rather than the standard one. We have not transcribed a licence identifier for it here because we have not yet confirmed it from the package's own source of truth. This is the single unresolved item in the direct runtime set, and it is the reason this notice is published as incomplete rather than withheld until it is complete.

4.2We would rather publish an accurate notice with one gap named than a tidy one with a guess in it. When that field is confirmed, this page and the `NOTICE` file in the repository will be updated together.

5. Frontend build dependencies

5.1The console is built with Next.js, React, TanStack Query, Zustand, Tailwind CSS and lucide-react, with TypeScript, Vitest, Testing Library, MSW, Playwright and openapi-typescript used in development.

5.2Node and npm are build-time requirements only, and neither is required at `pip install` time or at runtime. The compiled static export is baked into the wheel before it is assembled, so the packages in 5.1 are redistributed inside the distribution and their licences — MIT, except lucide-react (ISC) — apply to it.

6. Container images pulled at runtime

6.1A XORCISE install pulls the following images, each under its own upstream licence, which is not restated here:

• `docker:27-dind` (mission base)
• `tailscale/tailscale:stable` (per-run router)
• `headscale/headscale:stable` (control plane)
• `python:3.12-slim` (role images)
• per-mission images published by us, `linux/amd64`

6.2Mission images are authored and published by Fifth Domain. They are not signed and carry no software bill of materials. That is recorded on the Security page along with everything else we have not done yet.

7. Corrections

7.1If a licence identifier on this page is wrong, or a component is missing from it, tell us at legal@xorcise.ai and we will correct it. An attribution error is a defect, and we would rather hear about it than have it stand.