# Proposed corresponding-source preparation

CORRESPONDING-SOURCE PACKAGE: static inventory supports the identified pinned engine source, worklet imports, native sources and build scripts. No concrete required engine source file is identified as missing when the archive is present. Compilation was not performed; it is a recommended engineering check, not a separate GPL license condition. See source/engine-source.json. The raw upstream archive remains private-cache only. The source candidate is a deterministic 9,103,045-byte filtered archive (see engine-source.json): 207 unused audio files and 128 prebuilt synthdefs are omitted from two optional package media trees; all engine native/JS/build/license files remain unchanged. Filtering is recorded per file with hashes and scripts/prepare-engine-source.py is included. It fits the proposed host per-file limit. This filtered archive has not been compiled. That limitation is recorded as recommended engineering verification, not a mandatory self-rebuild requirement. Without its verified cache only identity and recipes are included, never a silent fallback to the raw archive.

Pinned engine source: https://github.com/samaaron/supersonic/tree/5007806c512f5a78e0cc1de23f4642c5a34b4188

Preparation on a separate build machine (not performed by this script):

    git clone https://github.com/samaaron/supersonic.git
    cd supersonic
    git checkout --detach 5007806c512f5a78e0cc1de23f4642c5a34b4188
    git rev-parse HEAD

Inspect that revision's .github/workflows/publish.yml, docs/BUILDING.md, Dockerfile and build.sh. The attested release workflow specifies Emscripten 4.0.21; the Dockerfile example uses emscripten/emsdk:4.0.17 and is not evidence of the release compiler. Follow the release workflow with Node 22.x, build.sh --release and its npm prepublish build, recording all resolved inputs. npm@latest, esbuild setup and action tags are not fully pinned; expired public logs prevent reconstructing every historical input. Do not substitute the example Docker compiler silently. Inventory src/scsynth and all vendored source/licenses; no submodules were found in the investigated tree. A local rebuild is optional engineering validation; source identity is supported by signed upstream provenance and retained files. Preserve actual build scripts and any modifications. General-purpose unmodified compiler/build tools need not be recompiled or redistributed solely to satisfy GPL section 1. Do not claim bit-identical builds without evidence.

Local JavaScript modifications are in scripts/vendor.mjs and lifecycle.js; include their exact release revisions and hashes with source. The WASM and native audio worklet are copied without patches. The included filtered source preserves all non-media upstream payloads and has no identified missing engine build input in the documented static inventory; no independent compilation is claimed. Read source/engine-compliance/BUILD-AND-SOURCE-DELIVERY.md for native/toolchain and visitor-access requirements; the pinned upstream tree has no npm lockfile, so exact historical JavaScript tool resolutions cannot be claimed; a new lockfile is a recommended reproducibility aid, not a file we can retroactively supply from upstream. Before public binary delivery, prepare accessible corresponding source and build materials under GPLv3 section 6(d), preserve full GPL/notices and verify ongoing access. Private repository links do not provide visitor source access.

Ruby grammar source: https://github.com/tree-sitter/tree-sitter-ruby/tree/7a010836b74351855148818d5cb8170dc4df8e6a (0.20.1, MIT). Wrapper build source: https://github.com/Gregoor/tree-sitter-wasms/tree/3e88dc9e36b4e8bf752ce53bea61e4b67282a2bb (pnpm lock resolves Ruby 0.20.1, top-level CLI 0.20.8). The official packaged grammar bytes are verified and the MIT notice is included. MIT does not require self-compilation, binary reproducibility or a signed build attestation. A rebuild remains optional engineering verification. The candidate wrapper workflow uses Emscripten 2.0.24 (not the engine compiler), pnpm install and pnpm build; successful run 18316823738 is supporting evidence, not a signed binary attestation.