# Attribution and baseline

AegisFlow uses **go-httpbin**, by Will McCutchen and its contributors, from [the original repository](https://github.com/mccutchen/go-httpbin). The imported baseline is **13bbdedd7133f44b3a7e87e35dc70c7ce1335cfd**, selected and cloned on 2026-10-06. The root `LICENSE` is byte-for-byte identical to that commit: MIT, copyright 2016 Will McCutchen. Its SHA256 and every original tracked file's SHA256 are recorded in `provenance.json`. The local Git checkout retains upstream history and an `upstream` remote. The public GitLab repository preserves the baseline and its ancestry under [upstream-baseline-13bbdedd](https://gitlab.com/circuitsai/aegisflow/-/tags/upstream-baseline-13bbdedd); its AegisFlow publishing branch has separate history.

`httpbin/`, `internal/`, `cmd/go-httpbin/`, the root Go module, upstream examples and original tests originate upstream. An operator-authored [Range header whitespace compatibility correction](https://gitlab.com/circuitsai/aegisflow/-/commit/74e2a8898c0b8c8f93f9b49110811dfed36f5a1e) changes `httpbin/handlers.go`; it is separate from incident recovery. Exact reviewed hashes are recorded alongside unchanged upstream hashes in `provenance.json`. The application baseline was tested before adding recovery automation. `UPSTREAM_README.md` preserves the original README. Existing packaging files and the root README/ignore configuration are adapted for the new project; their original content remains accessible at the baseline commit.

New AegisFlow work is `automation/`, `cmd/aegis-app/`, `dashboard/`, `policies/`, `infra/`, `scripts/`, `tests_aegis/`, `.gitlab-ci.yml`, `.gitlab/duo/`, `CODEOWNERS`, new dependency locks, the two new Dockerfiles, and AegisFlow documentation/evidence. It is MIT licensed, copyright 2026 AegisFlow contributors, under `LICENSE-AEGISFLOW`. Both notices are copied into shipped containers.

The separate fault-injection script intentionally changes decoder error handling in an operator-created isolated checkout and a disclosed [fault setup commit](https://gitlab.com/circuitsai/aegisflow/-/commit/97d2d674ed6807428adb777d47a301f71c7cedff), deployed to a tagged revision with zero production traffic. It is a new, disclosed demonstration regression, not an upstream bug claim. No inverse patch or target repair is bundled. A live Duo-created repair and regression test must appear in an incident-linked MR, retaining upstream attribution.

The WebSocket secret-scan exception covers only the exact public RFC 6455 nonce in the exact original test file. It does not authorize skipping credentials or modifying upstream tests.

Python dependencies, build images, Terraform providers and scanner binaries retain their respective licenses. `Package` produces a container SBOM for dependency inventory; the delivered `evidence/source-sbom.cdx.json` is a separately labeled source-tree inventory, including examples and development tools, not an image SBOM.