Assets.
The engine ships no art. Every mesh is a function composing cached unit primitives and every texture is drawn on a 2D canvas from seeded noise, so no PNG, no glTF, no font and no audio file is tracked anywhere in the repository. That is a claim about a repository, and a claim about a repository is worth exactly what checks it — so the substance of this page is the CI job that fails a build the moment one arrives.
A CI job, not a policy
scripts/check-no-binaries.mjs runs as no-binary-art, one of three independent jobs on every push and every pull request, with no install step and no dependencies so it stays runnable by hand in a fresh clone. It enforces three things. 16 denied extensions — .glb .gltf .png .jpg .jpeg .webp .hdr .exr .ttf .otf .woff .woff2 .mp3 .wav .fbx .obj — compared lowercased, so a .PNG off a Windows checkout is caught too. Strict scope over src/, because that is where the licensing argument lives. And 4 hard-exempt prefixes: public/props/, public/kits/, public/offices/, docs/.
Enumeration is git ls-files, never a filesystem walk. A self-hoster is told to drop their own legally-clean art into public/props/ and friends, and a walk would find it and fail their build over files this repository does not distribute. Tracked files are the only files a licence claim can be made about, so tracked files are the only files enumerated. If git is not present the check exits non-zero rather than falling back to a walk.
Apache-2.0 code, CC0-1.0 art
The repository is not uniformly Apache-2.0 and NOTICE says so. The code is Apache-2.0. In addition the copyright holders of src/assets/ dedicate the artistic output of that material — the meshes, geometry, textures, materials and palettes it produces, and any file exported from them — to the public domain under CC0-1.0. The dedication names the output rather than a set of paths, because procedural art has no existence as a committed file. The inbound grant is standing rather than per-contribution: Apache 2.0 section 5 supplies a default inbound-equals-outbound grant and there is no equivalent default for CC0, so one merged pull request from an author who never said the words would make the dedication false permanently and unfixably. CONTRIBUTING.md states the grant once and treats submission as acceptance.
What the gate does not do
It matches file extensions, not content: a .glb renamed to .ts would pass it, and nothing inspects what a tracked file contains. It is scoped to src/, so a binary at the repository root or under server/ is outside what it examines. Until 5 August 2026 this page was a licence table generated from the 2D runtime's manifest — 73 image files with an author, a licence and a SHA-256 each, 70 of them CC0-1.0 — and the figures here are transcribed from the gate's own output rather than generated. Run node scripts/check-no-binaries.mjs in a clone and it prints the same four lines, or the names of the files that make them false.