# Browser experiment provenance

## Optional lyric lookup

User-initiated title/artist lookup uses LRCLIB's public API at
https://lrclib.net/api/search (documentation: https://lrclib.net/docs).
Only song title and artist are sent; audio and local detector inputs stay on
the visitor's device. No API credential is bundled. Returned lyrics belong to
their respective rights holders; availability, wording and timing are not
verified. Lyrics are displayed only at runtime and are not included in the
distributed static assets or source repository.

## Chordino / NNLS Chroma

Chordino 1.1 by Matthias Mauch and Queen Mary University of London, GPL-2.0-or-later.
Upstream: https://github.com/c4dm/nnls-chroma at
`4c5f214a75cb354f8d8c933e161377c5b4d83713` (plugin version 5).
The browser recompiles the original spectral, tuning, NNLS and HMM/Viterbi code.
The only detector-source change removes optional external filesystem dictionary
loading and its Boost dependency; the built-in dictionary is unchanged and
matches the desktop installation. No recognition model was retrained.

The mono host uses Vamp SDK buffering and input-domain adapters, Hann window,
ShiftData timestamps, 2048-sample step and 16384-sample block, matching Sonic
Annotator's configuration. Vamp SDK at
`63e0c3b37b6fb9ce6f074ea8222b4903e4f5568a` is MIT/BSD-style licensed and
includes the BSD-style KissFFT implementation. Retain assets/VAMP-LICENSE.txt
and the embedded upstream copyright notices.

Built with Emscripten 4.0.21, scalar CPU WebAssembly, no GPU, threads or shared
memory requirement. Build rules: source/build_browser_chordino.py and
source/chordino_host.cpp. SHA-256 hashes and settings are recorded in
assets/chordino-provenance.json. The browser verifies the WASM checksum.
assets/chordino-source.zip contains the complete upstream detector/SDK source,
modified dictionary loader, host, JavaScript adapter and reproducible build
script. Download it from the footer alongside assets/CHORDINO-LICENSE.txt.
The host and browser adapter are GPL-3.0-or-later, compatible with the
detector's GPL-2.0-or-later license. Retain the source download with the binary
when moving this static site to another host.

## Deep Chroma

Deep Chroma + CRF by Filip Korzeniowski and Gerhard Widmer. This browser
implementation adapts the madmom pipeline and CRF decoding; madmom source is
BSD licensed. Its original notice is included in assets/MADMOM-LICENSE.txt.

Upstream source: https://github.com/CPJKU/madmom

The numerical weights are exported from the unchanged, pinned desktop model.
No training is performed. The export repackages coefficients and preprocessing
constants into a little-endian float32 buffer. Model source, commit IDs,
original weight hashes, and the exported-buffer checksum are recorded in
assets/model.json. Exported model bytes remain CC BY-NC-SA 4.0; a copy of the
license is included in assets/MODEL-LICENSE.txt. This experiment is for
noncommercial use. Retain all notices and provenance when moving hosts.

Upstream models: https://github.com/CPJKU/madmom_models

The polyphase resampling convention matches scipy.signal.resample_poly:
zero extension, a Kaiser beta-5 FIR filter, and centered output. Coefficients
are generated at build time with the already-bundled SciPy runtime. Original
SciPy notices are retained with the desktop runtime.

App code is GPL-3.0-or-later, as the parent Chord Room project. The source is
in web-experiment/ and source/export_browser_chroma.py. The included demo is
the parent app's original synthesized recording, under the same app license.
No personal audio, lyric exports, or study data is distributed with this site.

## Sign-in SDK

Configured sign-in loads Firebase JavaScript SDK **13.0.0** (App, Auth, and optional Analytics)
from Google's `www.gstatic.com/firebasejs/13.0.0/` CDN. The SDK is provided under
Apache-2.0; source and license are at https://github.com/firebase/firebase-js-sdk.
It is not bundled with the chord engines. Firebase handles email/password and
Google identity. Analytics sends processing-count and workflow categories plus standard browser/session information on production hosts; it never receives audio, song metadata, lyrics or account identity from this app. A browser-local opt-out is available under About & licenses. Cloud song storage remains unused.