# Audio pack credits & provenance

Last updated: 2026-07-11

Status: **UNVERIFIED — pending Phase 0 audit** (SAAS_LAUNCH_PLAN.md §10, "Audio").

This file documents the sample packs shipped under `public/sounds/`. Each pack is
88 per-note `.mp3` one-shots (`<Note><Octave>.mp3`, flats written as `b`), fetched
at build time by `scripts/fetch-pack.sh` / `scripts/fetch-piano.sh`.

## Packs

| id        | name                 | files | claimed license (per manifest.json) | source |
|-----------|----------------------|-------|-------------------------------------|--------|
| piano     | Acoustic Grand Piano | 88    | MIT — FluidR3_GM soundfont          | https://github.com/gleitz/midi-js-soundfonts |
| marimba   | Marimba              | 88    | MIT — FluidR3_GM soundfont          | https://github.com/gleitz/midi-js-soundfonts |
| musicbox  | Music Box            | 88    | MIT — FluidR3_GM soundfont          | https://github.com/gleitz/midi-js-soundfonts |
| pad       | Warm Pad             | 88    | MIT — FluidR3_GM soundfont          | https://github.com/gleitz/midi-js-soundfonts |

Each pack's `manifest.json` records `"license": "MIT (FluidR3_GM soundfont,
rendered by gleitz/midi-js-soundfonts)"` and `"source":
"https://github.com/gleitz/midi-js-soundfonts"`.

## Why this is still marked UNVERIFIED

The current repo sources these packs from **gleitz/midi-js-soundfonts** (renderings
of the **FluidR3_GM** soundfont), NOT from `tonejs-instruments` as SAAS_LAUNCH_PLAN.md
§10 originally assumed. That is a better starting point, but the provenance chain is
not yet proven for a paid product:

- The `gleitz/midi-js-soundfonts` repository is MIT-licensed, but the **underlying
  FluidR3_GM soundfont** (Frank Wen) has a historically ambiguous license — it is
  widely redistributed as "MIT / free", yet the original terms are not cleanly
  documented. A paid product needs the actual redistribution grant on file, not a
  second-hand "MIT" label in a manifest.
- No upstream license text is bundled next to the samples.

**Action before charging:** confirm the FluidR3_GM redistribution grant in writing
and archive a dated copy, OR replace the packs with CC0-sourced equivalents (below).

## Replacement policy (plan §10 — CC0 only)

If provenance cannot be cleanly proven, replace non-CC0 material with CC0 sources:

- **VSCO-2 Community Edition (CE)** — CC0 — has marimba, music box, pad, and piano
  equivalents.
- **Freesound**, filtered to **CC0** only.

Avoid **CC-BY-NC**, **CC Sampling+**, and "royalty-free" libraries whose EULAs
forbid redistributing raw one-shots.

## Proof-of-license to keep on file

- The upstream license text + a dated snapshot of each source page.
- Direct download URLs for every pack.
- Once resolved, update each pack's `manifest.json` and the table above, and flip
  this file's status from UNVERIFIED to VERIFIED with the confirmed license.