# Provenance ledger
Every file under `third_party/`, and every file elsewhere carrying a
`Salvaged-from:` header, has a row here (RFC 0003 §8). The arch test
enforces both directions: unledgered salvage fails CI, and rows pointing
at missing files fail CI.
Columns: the file's repo-relative path, the source repository, the exact
upstream commit, the license, and a note. A GPL-lineage row must say
`accepted` in its note — that is the explicit "we took copyleft knowingly"
marker review looks for; without it the build fails.
| Path | Source | Commit | License | Note |
|---|---|---|---|---|
| third_party/sanitizer-corpus/gitea.json | github.com/go-gitea/gitea modules/markup/sanitizer_default_test.go | main@2026-08-15 | MIT | Test inputs only, as conformance vectors; no policy code crossed (RFC 0003 §8). |
| third_party/sanitizer-corpus/forgejo.json | codeberg.org/forgejo/forgejo modules/markup/sanitizer_test.go | forgejo@2026-08-15 | GPL-3.0-or-later | accepted knowingly: test inputs are data, taken with attribution as conformance vectors; no policy code crossed (RFC 0003 §8). |
| internal/web/web.go | fossil src/default.css + skins/default | 2.29 checkout@2026-08-15 | BSD-2-Clause | Card/detail/time layout values and comment-flow behavior adapted; no code copied verbatim. |
| internal/pikchr/pikchr.wasm | fossil extsrc/pikchr.c (drh) | fossil 2.29 checkout@2026-08-16 | BSD-2-Clause | Pikchr diagram compiler, built from source to standalone WASI wasm: `emcc -O2 -DPIKCHR_SHELL -sSTANDALONE_WASM -o pikchr.wasm pikchr.c`. Run under wazero so the CGO-free constraint holds; its CLI reads `-` (stdin) and writes SVG, so the host ABI is a pipe. Output is re-sanitized by a narrow SVG policy (internal/markup/pikchr.go). |
| internal/web/assets/datastar.js | github.com/starfederation/datastar bundles/datastar.js | v1.0.0-RC.7 | MIT | Vendored verbatim: the one allowed frontend framework (0001 Principle 2); served self-contained, no CDN. |
| internal/cronexpr/cronexpr.go | github.com/danmestas/dagnats internal/cronexpr/cronexpr.go | e1ca6a3 | Apache-2.0 | Copied by its own author for quarry-owned CI schedules (one cron parser for both). Diverges: an empty comma item and an over-long line return an error instead of panicking (quarry's fix, reported upstream as danmestas/dagnats#740; FuzzParseCron guards it). |
| internal/cronexpr/cronexpr_test.go | github.com/danmestas/dagnats internal/cronexpr/cronexpr_test.go | e1ca6a3 | Apache-2.0 | Copied verbatim but for this header, by its own author, for quarry-owned CI schedules (one cron parser for both). |
| internal/cronexpr/cronexpr_next_test.go | github.com/danmestas/dagnats internal/cronexpr/cronexpr_next_test.go | e1ca6a3 | Apache-2.0 | Copied verbatim but for this header, by its own author, for quarry-owned CI schedules (one cron parser for both). |
| internal/cronexpr/cronexpr_posix_day_test.go | github.com/danmestas/dagnats internal/cronexpr/cronexpr_posix_day_test.go | e1ca6a3 | Apache-2.0 | Copied verbatim but for this header, by its own author, for quarry-owned CI schedules (one cron parser for both). |
The sanitizer policy itself (`internal/markup`) is a cleanroom
implementation — neither lineage's policy code was copied.
| internal/web/web.go | github.com/primer/octicons icons/{git-commit,people,sync,clock,file-directory-fill,file}-16.svg | main@2026-08-18 | MIT | Six 16px glyphs, path data only, inlined as an SVG sprite. Octicons is designed for exactly these forge concepts (a commit, a sync, a directory), which is why these rather than a general icon set. No library, no build step, no CSS mask — the data: URI form they replaced is invalid under iOS Safari's stricter parsing and rendered as solid blocks. |