Third-party code and services
What counts as third-party work
Third-party work is code, a generated runtime, a font, data or an online service that the team did not create. We document it because it affects reproducibility, licensing, availability and security. This page is an inventory, not legal advice.
The simulation plugins, experiment schema, arena presets, researcher website, local backend, headless adapter and test code are project code. Godot's generated web runtime and the libraries listed below are third-party components used by that code.
Application components
| Component | Version used | Where it is used | Licence or terms | Why it is used |
|---|---|---|---|---|
| Godot Engine | 4.7.1 stable | Editor, 3D simulator, headless runtime and generated web export | MIT. Distributed engine copies require the copyright and licence notice. | Godot was a project prerequisite and supports both 3D rendering and headless fixed-step execution. |
| Supabase JavaScript | Major version 2 CDN import | Hosted authentication, Postgres queries and RPC calls from web/app.js | MIT | It provides the browser client for the hosted Supabase project. |
| Open-Meteo | Hosted API | Location lookup and optional weather-derived setup suggestions | API data is CC BY 4.0. Free use has attribution and usage conditions. | It avoids manually looking up basic environmental conditions for a place and time. |
| Inter | Bundled variable font | Godot UI, website and documentation | SIL Open Font License 1.1 | It keeps the simulator and website visually consistent and readable. |
| Python standard library | Python 3.12 in CI | Local HTTP server, SQLite access, JSON, networking and tests | Python licence applies to the interpreter | The local backend deliberately avoids a large third-party framework. |
| Coverage.py | 7.10.7 in CI | Measured Python test coverage | Apache 2.0 | It enforces the 60% Python application coverage gate. |
The website currently imports Supabase JavaScript from https://cdn.jsdelivr.net/npm/@supabase/supabase-js@2/+esm. That pins the major version but not the exact release. Before a research release, the team should pin an exact tested version or bundle it with the website. Otherwise a new compatible-looking version could arrive without a repository change.
The Godot web export contains generated JavaScript, WebAssembly and package files. These files are build output from Godot, not manually authored simulation code. When the project redistributes that runtime, the Godot notice must remain available in the release documentation.
Documentation components
The documentation's exact direct dependencies are recorded in package.json and resolved by package-lock.json.
| Package | Resolved version in the checked build | Licence |
|---|---|---|
| Docusaurus core, faster and classic preset | 3.10.2 | MIT |
| React and React DOM | 19.2.8 | MIT |
| MDX React | 3.1.1 | MIT |
| clsx | 2.1.1 | MIT |
| prism-react-renderer | 2.4.1 | MIT |
| TypeScript | 6.0.3 | Apache 2.0 |
| Wrangler | 4.125.0 | MIT or Apache 2.0 |
Docusaurus has transitive dependencies that are also locked in package-lock.json. A formal release should generate a complete software bill of materials or licence report from that lock file rather than copying only this shorter direct-dependency table.
CI actions
The Gitea Actions workflow downloads and runs:
actions/checkout@v4;actions/setup-python@v5;actions/setup-node@v4;- Coverage.py 7.10.7; and
- the official Godot 4.7.1 Linux build from
godotengine/godot-builds.
Major-version action tags are convenient, but a high-assurance pipeline should pin actions to reviewed commit hashes. The workflow also downloads Godot during the job, so a runner needs network access and the run can fail if the upstream release service is unavailable.
Hosted services
| Service | Project use | Data or operational concern |
|---|---|---|
| Supabase | Authentication, Postgres database and Row Level Security | Stores accounts, projects, experiments and replays. The publishable key is safe for a browser only when RLS and grants are correct. |
| Vercel | Hosts the researcher website and Godot web export | Deployment environment stores the Supabase URL and publishable key. |
| Cloudflare Pages | Hosts this Docusaurus website | Contains public documentation only. |
| Gitea | Source control, pull requests and Actions | Shared runners may queue jobs when capacity is unavailable. |
| jsDelivr | Delivers Supabase JavaScript to the browser | Runtime availability and the unpinned minor version are external dependencies. |
| Open-Meteo | Supplies optional environmental data | Data availability and accuracy are not guaranteed; accepted values are stored with an experiment for reproducibility. |
Scientific references are not copied code
The MCSF-inspired layout is informed by the client-provided Conduct Science and Uppsala University resources and the referenced behavioural-neuroscience paper. These sources motivate arena concepts and terminology. They are not third-party source code copied into RODENT, and the project must not describe its simplified preset as a validated reproduction of the published apparatus without dimensional and scientific verification.
Attribution and release checklist
Before a release, the team should:
- Keep the Inter
OFL.txtfile beside the distributed font. - Include or link the Godot copyright and MIT licence notice.
- Credit Open-Meteo when displaying or redistributing imported data and state when RODENT modifies it into a suggestion.
- Keep
package-lock.jsonand the pinned Godot version with the release. - Replace major-only CDN and CI references with exact reviewed versions where practical.
- Record the source and licence of any future model, texture, sound, mesh, animation or dataset.
- Do not upload third-party research models until their licence, data provenance and execution safety have been reviewed.
Not currently included
PyTorch is discussed as a possible future model-training tool but is not a current runtime dependency. The labelled model drop zones do not install or execute any third-party model. No third-party biological model should be listed as integrated until the adapter, licence, provenance and validation evidence are present.
AI Attribution: This inventory was prepared with OpenAI Codex assistance from the repository, lock file and official project licence pages. The team should repeat the licence review before a formal release.