Track historical provenance cleanup for retired ShaderToy presets #362

The integration release removes the legacy RaymarchingPrimitives.glsl, StarNest.glsl and StarNest.wgsl presets, their UI entries and dedicated tests from the current tree in #360.

On 2026-10-10, the repository owner explicitly authorized preserving published Git history and tracking historical cleanup separately for these presets. This is a narrow exception to agents.md's branch-history removal requirement for this release. It does not authorize copying other foreign implementations or rewriting published history.

• Inventory the historical commits and published refs containing these three retired preset files, preserving the existing provenance audit evidence.
• Document their original provenance and any remaining distribution or notice obligations using authoritative sources.
• Propose any necessary historical remediation separately, including its impact on published tags, releases and consumers. Obtain explicit owner authorization before a history rewrite.
• Verify the current release tree and public packages exclude the retired presets and UI references; retain the shipping inventory controls for later releases.

Release coordination: #361. Current-tree removal belongs to #360; this historical follow-up is tracked separately under the owner's approved exception.

Read-only inventory completed on 13 October 2026: 191 published branch refs and 68 tag refs, with all referenced commits available for inspection. No refs, tags, history or releases were changed. 238 ref tips contain the extracted shader files; 9 earlier ref tips contain the original inline author headers instead. Tags preview.1–preview.65 contain a preset file or original Playground preset reference. The current main, release/preview69 and tags preview.66–preview.68 exclude all three extracted files and their Playground references.

The preserved history records:

• 9fdbfbb2462fb3ea772e8fd95bd3afd31c9a8aac: original inline presets introduced.
• 7a81180fcfe4a9ecde774ad88805055f1c37e966: extracted into the three named shader files.
• 940da4f99fe4b302619c19b52d8a3657a596ff26: presets, UI choices and dedicated tests removed.

The original Raymarching header credits Inigo Quilez, links Shadertoy Xds3zN and states CC BY-NC-SA 3.0; Star Nest credits Kali. These are recorded historical source claims, not a completed license/distribution assessment. Earlier release/package contents and authoritative provenance remain separate follow-up work. Current source scan at 8bfe5b885ae9a8dcceccdccb19bb9ebeacd487fb has no retired identifiers or original author headers in src/tests/samples/eng.

The complete ref-to-commit/blob inventory is preserved locally in preset-history-362/published-ref-inventory.json, SHA256 52c031c361ea8ae1030d47af81f270079467ead0dc622e604293865ed2c9357c, beside the raw published-ref listing and the original 10 October provenance audit. The owner's preserve-history exception remains in effect.

Authoritative provenance and distribution inventory — 14 October 2026

Both original pages currently make explicit MIT declarations: Star Nest credits Pablo Roman Andrioli (Kali), and Raymarching - Primitives credits Inigo Quilez (iq), with a 2013 copyright notice. Shadertoy's terms distinguish an author's explicit license from its default CC BY-NC-SA 3.0 license.

The historical ProGPU Raymarching header instead declares CC BY-NC-SA 3.0. This audit does not infer that today's upstream MIT declaration retroactively relicenses every historical revision. The MIT license requires preservation of its copyright and permission notices. The historically declared CC terms separately cover attribution, license notices, changes to adaptations, sharing and noncommercial use; a supplemental notice alone is not claimed to cure past distribution issues.

The inventory covers 65 GitHub release objects and 4,513 named assets. No asset is named as a sample, demo, playground or Shadertoy bundle; names alone do not establish package contents. Across all 68 published tag sources, ProGPU.Samples is absent from every shipping package-project array and has no explicit packability override; all tags default to non-packable projects. The later 44 tags explicitly classify this project as nonshipping. This is source-policy evidence, not a complete historical binary-content audit. GitHub-generated source archives for preview.1–preview.65 still expose the historical sample source.

History-preserving remediation

1. Keep the retired presets excluded. The candidate aef75180bcdc3b937d004b6b949e0e91724c7981 source scan is clean; verify actual preview.69 public payloads after publication.
2. Add a supplemental historical-provenance notice identifying the original authors, URLs, affected paths and distinct observed declarations. Preserve historical headers; do not relabel whole releases as MIT.
3. Link that notice from affected release notes, preserving tags, commit identities and package bytes.
4. Resolve historical payload disposition using actual archive/member evidence where sample content could have shipped. Record immutable hashes and precise members before any scoped remediation.
5. Any proposed history rewrite, asset withdrawal or replacement requires a concrete affected-consumer list and separate owner authorization. No such action is proposed here.

Supplemental documentation and release-note links preserve existing consumer locks. They disclose provenance and do not reinstate these foreign presets under the repository's clean-room policy.

Remaining execution:

• Publish this supplemental provenance record in affected release-note links: all 63 affected published release notes now link here; release identities, tags, dates and every asset ID/name/size/digest were verified unchanged.
• Complete the historical GitHub release-asset content audit; source archives remain separately identified.
• Verify preview.69 public package exclusion.

Local receipts: preset-history-362/authoritative-provenance-20261014.json, historical-pack-policy.json, release-asset-inventory.json and history-preserving-remediation-proposal.txt. Published refs, tags and assets remain unchanged.

Completed release-asset content audit

All 4,513 assets / 3,299,456,650 bytes from the 65 listed GitHub releases were downloaded, matched against their published SHA-256 digests and sizes, and inspected. The scan checked 36,609 archive members, with ZIP CRC verification and member hashes, for the full historical shader blobs (LF and CRLF), preset identifiers/titles, original source IDs and the sample assembly name in UTF-8/UTF-16.

No preset source/name match and no sample assembly archive member was found. The 2,272 matches are README table references to ProGPU.Samples.dll, not the assembly or shader code. One transient HTTP 500 was retained in the first-pass receipt; completing that download filled the single missing asset. No package bytes were changed, and all temporary audit downloads were deleted.

This scope covers the listed GitHub release assets. It does not scan arbitrary nested compression or independently distributed NuGet bytes. GitHub-generated source archives at the affected tags retain the known historical sample sources and are not described as clean. This issue serves as the supplemental public provenance record for those historical sources, including the authors, source URLs and differing license declarations above; it does not retroactively relicense them or claim to cure any past distribution issue.

Audit receipt SHA-256: 944971702fa78435825764a2aff6372894e6cc5f0c08568ccced777d1b493651. The per-asset/member inventory, original failed download receipt and final reviewed findings are retained in preset-history-362/published-asset-content-*.json*. The current candidate source is clean; preview.69 public-package verification remains pending publication.

Public preview.69 exclusion verified

ProGPU preview.69 completed all 20 release jobs at aef75180bcdc3b937d004b6b949e0e91724c7981. All 44 package/version pairs were downloaded from public NuGet and every original archive member matched the qualified release byte-for-byte; only NuGet's added signature is permitted. All 85 GitHub package/symbol assets also matched the release artifact digests and sizes.

The public payload scan found no retired presets, historical shader blobs (LF/CRLF), sample assembly members, or removed project-family names, checking UTF-8 and both UTF-16 byte orders. The independent NuGet nuspec endpoint differs only by omitting the leading UTF-8 BOM; package contents themselves remain byte-identical. The first reader failure and corrected verification are retained separately.

This completes the scoped history-preserving follow-up under the owner's explicit exception. Existing published history and source archives remain preserved and disclosed above. No historical rewrite, asset replacement or retrospective relicensing is claimed.

Evidence: preview69-public-consumers/release269-ProGPU-public-package-metadata.json; original source and package exclusion remain part of the retained shipping inventory.