feat(01-01): add the VRM tutor character and record its license facts

- avatar/assets/tutor.vrm: VRM1_Constraint_Twist_Sample by pixiv Inc.,
VRM 1.0, 10,776,032 bytes, committed through Git LFS
- License flags read from the file's own VRMC_vrm.meta, not from a README:
allowRedistribution=true, avatarPermission=everyone,
modification=allowModificationRedistribution, creditNotation=unnecessary
- All five visemes (aa/ih/ou/ee/oh) and blink confirmed present among the
18 preset expressions, so AVTR-01 and AVTR-02 are both satisfiable
- Marked a temporary dev asset; plan 01-10 must re-raise the sourcing gate
- Records that AvatarSample_A/B/C are NOT CC0

avatar/assets/tutor.vrm

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:12c2b97e95e700783a6a550dc0eee2d7880aeedccef9ae67bc4c5a2f0f2631a2
+size 10776032

docs/ASSETS.md

@@ -0,0 +1,140 @@
+# Shipped Assets — provenance and license facts
+
+> Source of truth for LICENSES.md (written in plan 01-10). Every row must be
+> traceable to a document that was actually read, not inferred.
+
+## VRM character — avatar/assets/tutor.vrm
+
+> **STATUS: TEMPORARY DEV ASSET.** This is a properly-licensed placeholder chosen to unblock the
+> avatar pipeline (plans 01-03, 01-06, 01-08, 01-09). The decision to author a bespoke character was
+> deferred, **not cancelled**. **Plan 01-10 MUST re-raise the VRM sourcing checkpoint before the
+> phase-exit licensing audit.** See "Open item for plan 01-10" below.
+
+| Field | Value |
+|---|---|
+| Character name | VRM1_Constraint_Twist_Sample (embedded `meta.name`), model version `v1.0.1` |
+| Author | pixiv Inc. (embedded `meta.authors` = `['pixiv Inc.']`) |
+| Copyright | (c) 2022 pixiv Inc. (embedded `meta.copyrightInformation`) |
+| Source | Official VRM specification sample repository, `vrm-c/vrm-specification`, path `samples/VRM1_Constraint_Twist_Sample/vrm/VRM1_Constraint_Twist_Sample.vrm` — https://github.com/vrm-c/vrm-specification/tree/master/samples/VRM1_Constraint_Twist_Sample (HTTP 200, verified 2026-08-27) |
+| Download URL used | https://raw.githubusercontent.com/vrm-c/vrm-specification/master/samples/VRM1_Constraint_Twist_Sample/vrm/VRM1_Constraint_Twist_Sample.vrm (HTTP 200, verified 2026-08-27) |
+| Terms URL | https://vrm.dev/licenses/1.0/ — VRM Public License 1.0 (HTTP 200, verified 2026-08-27) |
+| VRM spec version | **VRM 1.0** (`extensions.VRMC_vrm.specVersion` = `1.0`), glTF binary container version 2 |
+| Embedded meta (read from the file) | name=VRM1_Constraint_Twist_Sample authors=['pixiv Inc.'] licenseUrl=https://vrm.dev/licenses/1.0/ commercialUsage=corporation creditNotation=unnecessary avatarPermission=everyone allowRedistribution=true modification=allowModificationRedistribution copyrightInformation=(c) 2022 pixiv Inc. |
+| Permissions relied on | `allowRedistribution: true` (this repo redistributes the file), `avatarPermission: everyone` (used as an avatar by any visitor), `modification: allowModificationRedistribution` (headroom to retarget or adjust and still redistribute), `commercialUsage: corporation` (the broadest tier — covers a public portfolio Space unambiguously) |
+| Required credit string | **none required** — `creditNotation: unnecessary`. Credited voluntarily anyway as: `VRM1_Constraint_Twist_Sample (c) 2022 pixiv Inc. — VRM Public License 1.0` |
+| File size | 10,776,032 bytes (10.28 MiB) |
+| SHA-256 | `12c2b97e95e700783a6a550dc0eee2d7880aeedccef9ae67bc4c5a2f0f2631a2` |
+| Git LFS | yes — `git check-attr filter` reports `filter: lfs`, and the LFS pointer's `oid sha256` equals the hash above |
+
+### Why the embedded flags are the license answer, and the README is not
+
+VRM Public License 1.0 is a **template, not a fixed grant.** It confers "Model Utilization" rights
+unconditionally, but redistribution, avatar use, modification and commercial use are **per-file
+flags set by the licensor inside the model's own `VRMC_vrm.meta` block.** Two files can both cite
+`https://vrm.dev/licenses/1.0/` and grant materially different rights.
+
+So the facts above were extracted by parsing this specific file's glTF JSON chunk, not read off a
+repository README. Every flag this project relies on is explicit and permissive in the file itself.
+
+The complete embedded `meta`, verbatim, for the record:
+
+```
+allowAntisocialOrHateUsage    : False
+allowExcessivelySexualUsage   : True
+allowExcessivelyViolentUsage  : True
+allowPoliticalOrReligiousUsage: True
+allowRedistribution           : True
+authors                       : ['pixiv Inc.']
+avatarPermission              : everyone
+commercialUsage               : corporation
+copyrightInformation          : (c) 2022 pixiv Inc.
+creditNotation                : unnecessary
+licenseUrl                    : https://vrm.dev/licenses/1.0/
+modification                  : allowModificationRedistribution
+name                          : VRM1_Constraint_Twist_Sample
+thumbnailImage                : 18
+version                       : v1.0.1
+```
+
+`allowAntisocialOrHateUsage: False` is the one restriction. It is not a constraint this project can
+plausibly violate — a Japanese-language tutor has no such use path — but plan 01-10's `LICENSES.md`
+should carry it so the restriction is stated rather than silently dropped.
+
+### Capability check — this asset can actually satisfy AVTR-01 and AVTR-02
+
+Verified by parsing `extensions.VRMC_vrm.expressions`: **18 preset expressions, 0 custom.**
+
+```
+aa, angry, blink, blinkLeft, blinkRight, ee, happy, ih, lookDown, lookLeft,
+lookRight, lookUp, neutral, oh, ou, relaxed, sad, surprised
+```
+
+| Requirement | Needs | Present |
+|---|---|---|
+| AVTR-02 lip-sync | `aa`, `ih`, `ou`, `ee`, `oh` | **all five present** |
+| AVTR-01 idle life | `blink` (plus `blinkLeft` / `blinkRight`) | **present** |
+| Expression range (later phases) | `happy`, `angry`, `sad`, `relaxed`, `surprised`, `neutral` | present |
+| Gaze (later phases) | `lookUp` / `lookDown` / `lookLeft` / `lookRight` | present |
+
+This was measured, not assumed. Both avatar requirements in Phase 1 are satisfiable with this file.
+
+Also present, and relevant to plan 01-03's renderer wiring:
+
+- `extensionsUsed`: `VRMC_springBone`, `VRMC_vrm`, `KHR_materials_unlit`, `VRMC_materials_mtoon`,
+  `VRMC_node_constraint`
+- **54 humanoid bones** defined, including `hips`, `head`, `leftEye`, `rightEye`. There is **no
+  `jaw` bone** — which is fine and expected: VRM lip-sync is driven by the `aa`/`ih`/`ou`/`ee`/`oh`
+  blendshape expressions listed above, never by a jaw bone.
+- This sample exists specifically to exercise **twist constraints** (`VRMC_node_constraint`) and
+  spring bones. That makes it a slightly heavier load path than a plain character, which is useful:
+  if plan 01-03's transport seam holds for this file, it holds for simpler ones.
+
+## Not used, and why
+
+**`AvatarSample_A`, `AvatarSample_B` and `AvatarSample_C` are NOT CC0.** Copyright is retained and
+VRoid Hub conditions apply; VRoid's own FAQ prohibits redistributing them under a CC0 designation.
+This is a widespread misconception, repeated confidently in many tutorials and blog posts. It is
+recorded here so it is not reintroduced later in this repository.
+
+Two further traps worth stating once, since they are the reason sourcing a VRM is a human decision
+rather than a download:
+
+- CC0 **cannot be set** on VRoid Hub, so any "CC0 on VRoid Hub" claim is false by construction.
+- Enabling "Allow third-party usage" on VRoid Hub **overwrites** a model's embedded license with
+  VRoid Hub's own conditions — so the embedded flags on a Hub-sourced model may not say what the
+  original author intended.
+
+## Open item for plan 01-10
+
+`avatar/assets/tutor.vrm` is a **temporary dev asset.** Plan 01-10 must re-raise the VRM sourcing
+checkpoint before the phase-exit licensing audit and decide one of:
+
+1. **Keep this file.** Legally clean as recorded above and requires no further action beyond the
+   `LICENSES.md` entry. Costs the project its own character identity — it ships a spec sample named
+   `VRM1_Constraint_Twist_Sample`, which is a visible tell on a flagship portfolio piece.
+2. **Author a bespoke character in VRoid Studio** (the original RESEARCH recommendation, estimated
+   2-4 hours). Converts DPLY-04 from "read someone else's terms and hope" into "state your own
+   terms", and gives the tutor a real identity. The embedded `vrm.meta` must be set deliberately at
+   export time, because plan 01-09 has an automated test asserting `vrm.meta` matches `LICENSES.md`.
+
+Whichever is chosen, `LICENSES.md` must carry the VRM entry and
+`tests/e2e/test_avatar_loop.py::test_vrm_meta_matches_licenses` must assert against the file that
+actually ships.
+
+**Fallback already vetted, if this file ever fails verification:** `Seed-san.vrm` by VirtualCast,
+Inc., in the sibling samples path of the same repository — same permission flags and the same 18
+presets, except `creditNotation: required`, which would make a visible credit string mandatory.
+
+## Voice — VOICEVOX / ずんだもん
+
+**Already recorded in full by plan 01-04. See `docs/VOICEVOX-SETUP.md`**, which carries all three
+licence layers, the exact `VOICEVOX:ずんだもん` credit string, the placement standard, the flow-down
+obligation, the Nemo pre-cleared swap, and the Open JTalk dictionary's BSD-3-Clause notice with its
+dual Nara/Nagoya attribution. Not duplicated here; `LICENSES.md` (plan 01-10) should read that file
+directly.
+
+## Runtime libraries — to be filled by plan 01-10
+
+three.js, `@pixiv/three-vrm`, transformers.js, and the Open JTalk dictionary. Note that this VRM
+additionally exercises `VRMC_springBone`, `VRMC_node_constraint` and `VRMC_materials_mtoon`, all of
+which are handled by `@pixiv/three-vrm` itself and add no separate licence entry.