Artifact 826bc75e3e5122cead3edc870a5862714778d4d2fde65806a0088b6181770833:
- File
third_party/PROVENANCE.md
— part of check-in
[263cff2b6b]
at
2026-08-15 18:33:21
on branch trunk
— phase 3: live timeline via Datastar SSE (Principle 3 enhancement)
events.Watch coalesces per-repo change ticks; composition root hands web a Notifier interface (planes stay sealed); timeline.sse re-renders the tl-body fragment through the op path and morphs #tl; vendored datastar v1.0.0-RC.7 (MIT, ledger row) is the page's only script; the no-JS page is unchanged. data-init, not the removed data-on-load. (user: dmestas, size: 1639) [annotate] [blame] [check-ins using]
# Provenance ledger Every file under `third_party/`, and every file elsewhere carrying a `Salvaged-from:` header, has a row here (0002 §4 item 1). The arch test enforces both directions: unledgered salvage fails CI, and rows pointing at missing files fail CI. Columns: the file's repo-relative path, the source repository, the exact upstream commit, the license, and a note. A GPL-lineage row must say `accepted` in its note — that is the explicit "we took copyleft knowingly" marker review looks for; without it the build fails. | Path | Source | Commit | License | Note | |---|---|---|---|---| | third_party/sanitizer-corpus/gitea.json | github.com/go-gitea/gitea modules/markup/sanitizer_default_test.go | main@2026-08-15 | MIT | Test inputs only, as conformance vectors; no policy code crossed (0002 §2). | | third_party/sanitizer-corpus/forgejo.json | codeberg.org/forgejo/forgejo modules/markup/sanitizer_test.go | forgejo@2026-08-15 | GPL-3.0-or-later | accepted knowingly: test inputs are data, taken with attribution as conformance vectors; no policy code crossed (0002 §2). | | internal/web/web.go | fossil src/default.css + skins/default | 2.29 checkout@2026-08-15 | BSD-2-Clause | Card/detail/time layout values and comment-flow behavior adapted; no code copied verbatim. | | internal/web/assets/datastar.js | github.com/starfederation/datastar bundles/datastar.js | v1.0.0-RC.7 | MIT | Vendored verbatim: the one allowed frontend framework (0001 Principle 2); served self-contained, no CDN. | The sanitizer policy itself (`internal/markup`) is a cleanroom implementation — neither lineage's policy code was copied.