This project vendors third-party files as noted below.

## MusicXML 4.0 XML Schema (XSD)

Path: schemas/musicxml-4.0/
Files: musicxml.xsd, xml.xsd, xlink.xsd, container.xsd
Source: https://github.com/w3c/musicxml (gh-pages branch, schema/ directory)
Upstream: https://www.w3.org/2021/06/musicxml40/listings/musicxml.xsd
Publisher: W3C Music Notation Community Group
License: W3C Community Final Specification Agreement (FSA)
  https://www.w3.org/community/about/agreements/fsa-deed/
Fetched: 2026-08-09
Modifications: none (byte-for-byte as downloaded)

These files are used only for offline, local XML Schema validation of MusicXML documents
(mxl_agent.xml.schema). Schema compilation is configured to resolve only these four vendored
files and never fetches anything over the network, even though musicxml.xsd itself references
its imports by http://www.musicxml.org/xsd/... URLs.

## MusicXML 3.1 XML Schema (XSD)

Path: schemas/musicxml-3.1/
Files: musicxml.xsd, xml.xsd, xlink.xsd, container.xsd
Source: https://github.com/w3c-cg/musicxml (git tag v3.1, schema/ directory)
Publisher: W3C Music Notation Community Group
License: W3C Community Final Specification Agreement (FSA)
  https://www.w3.org/community/about/agreements/fsa-deed/
Fetched: 2026-08-13
Modifications: none (byte-for-byte as downloaded), except container.xsd, which is not part of
  the v3.1 tag and is instead a local copy of the byte-identical file already vendored above --
  the MusicXML container (META-INF/container.xml) format has been unchanged since MusicXML 2.0.

Used the same way as the 4.0 schema above (mxl_agent.xml.schema.schema_dir_for_version), so a
document declaring version="3.1" is validated against its own real schema rather than always 4.0.

Note: musicxml.xsd and xlink.xsd as originally authored contain CRLF line endings (unlike the 4.0
files, which are LF-only) -- schemas/**/*.xsd is marked `-text` in .gitattributes so git never
normalizes them, keeping the committed content genuinely byte-for-byte with upstream.

## MuseScore-exported cross-producer test corpus

Path: tests/fixtures/corpus/musescore/
Files: chord_symbols.musicxml, piano_two_staves.musicxml, annotated_score.musicxml
Source: this project's own hand-authored tests/fixtures/minimal/ fixtures of the same names,
  re-exported to MusicXML through a real, locally installed MuseScore Studio 4.7.4 via
  mxl_agent.adapters.musescore.export_artifact (Slice 9.4's adapter).
Generated: 2026-08-13
License: same as this project -- the content originates entirely from fixtures already owned by
  this repository; MuseScore is used here only as an external producer to prove cross-producer
  compatibility (Section 9.5/18.4's corpus policy), not as a source of third-party material.

These files are real MuseScore output (DOCTYPE declaration, page/appearance layout defaults,
default-x/y positioning, print-frame attributes, and an encoding-date/platform stamp from the
run that produced them) used to verify this project's reader, schema validator, and inspector
handle another program's honest MusicXML -- not just its own generator's output
(tests/unit/test_corpus_cross_producer.py). They are static, checked-in snapshots: using them
never requires MuseScore to be installed, only regenerating a fresh snapshot does.

## MCP Apps client library (@modelcontextprotocol/ext-apps)

Path: src/mxl_agent/adapters/vendor/ext_apps_client.js
Source: https://unpkg.com/@modelcontextprotocol/ext-apps@1.7.5/dist/src/app-with-deps.js
  (npm package @modelcontextprotocol/ext-apps, version 1.7.5, the "with dependencies" bundle --
  self-contained, no further imports needed)
Publisher: Model Context Protocol (github.com/modelcontextprotocol/ext-apps)
License: MIT (per the package's own npm registry metadata)
Fetched: 2026-08-14
Size: 337419 bytes; sha256 5bc0452b9994217df506cb505af20e97e766700513afb7d0b45d255785bb051f
Modifications: byte-for-byte as downloaded, plus one line appended at the end of the file
  (clearly marked with a comment) that assigns `window.McpApp = {App, applyDocumentTheme,
  applyHostStyleVariables, applyHostFonts}` using this exact bundle's own local binding names
  (read from its own trailing `export {...}` statement) -- the upstream bundle only makes these
  names importable by URL, which an inline `<script type="module">` resource has no way to do;
  this line makes them reachable by mxl_agent's own initialization code appended after it at
  render time (adapters.mcp).

Used to implement Slice 10.3's embedded score view: an MCP "App" (a still-evolving MCP extension,
specification dated 2026-01-26, github.com/modelcontextprotocol/ext-apps) that renders a
read-only Verovio SVG of the current session inside a compatible MCP client. This library
implements the extension's JSON-RPC-over-postMessage handshake; mxl_agent never reimplements
that protocol itself, matching Section 22's "prefer reusing tested machinery over re-deriving
it." Server-side registration and the tool's own output are covered by this project's test
suite; end-to-end rendering inside a real compatible host is not, since no such host is
available in this environment -- an explicit, documented limitation (Section 21).
