Skip to content

Record vendored licenses and split future syncs in two #424

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TheGreatAxios merged 2 commits into from
Aug 9, 2026
Merged

Record vendored licenses and split future syncs in two #424

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
757f35a
Record vendored licenses and split future syncs in two
TheGreatAxios Aug 8, 2026
a403983
Describe the last sync's commit shape accurately
TheGreatAxios Aug 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 24 additions & 6 deletions docs/VENDORING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,18 @@ points straight at `./src/*.ts` files rather than a `dist/` build.

## What's vendored

| Package | Vendor path | Synced from upstream commit | Local patches |
|---|---|---|---|
| `@intx/inference` | `vendor/intx-inference/` | `cd7c5a37747dc39713d1efd24296ea861e6ac82a` | Yes — see `vendor/intx-inference/PATCHES.md` |
| `@intx/types` | `vendor/intx-types/` | `cd7c5a37747dc39713d1efd24296ea861e6ac82a` | None — verbatim |
| `@intx/storage-isogit` | `vendor/intx-storage-isogit/` | `cd7c5a37747dc39713d1efd24296ea861e6ac82a` | None — verbatim |
| Package | Vendor path | License | Synced from upstream commit | Retrieved | Local patches |
|---|---|---|---|---|---|
| `@intx/inference` | `vendor/intx-inference/` | LGPL-2.1-only | `cd7c5a37747dc39713d1efd24296ea861e6ac82a` | 2026-08-08 | Yes — see `vendor/intx-inference/PATCHES.md` |
| `@intx/types` | `vendor/intx-types/` | LGPL-2.1-only | `cd7c5a37747dc39713d1efd24296ea861e6ac82a` | 2026-08-08 | None — verbatim |
| `@intx/storage-isogit` | `vendor/intx-storage-isogit/` | LGPL-2.1-only | `cd7c5a37747dc39713d1efd24296ea861e6ac82a` | 2026-08-08 | None — verbatim |

The license column records what each package declares in its own
`package.json`; the corresponding `LICENSE` file travels with every vendored
tree and is never edited during a sync. Corbits Code is distributed under
GPLv2, which LGPL-2.1 permits. Retrieval dates are when the copy landed here,
not when the upstream commit was authored — an audit needs both, and the
upstream commit hash supplies the other half.

All three were synced together in one pass because they are not
independently upgradable: the reactor's approval-suspend primitive (upstream
Expand Down Expand Up @@ -116,4 +123,15 @@ same commit should show ONLY those marked lines changed.
should move all three together, even if only one had code changes worth
vendoring — otherwise the trio drifts out of the single-commit coherence
this document assumes.
5. Update this document's table with the new commit hash.
5. Update this document's table with the new commit hash and retrieval date.
6. Land the sync as **two commits, in this order**: first the pristine
upstream copy with no local changes, then the re-applied patches. The
point is that the unmodified upstream state becomes a checkout rather
than a reconstruction — an auditor diffs one commit against the upstream
clone and is done, instead of subtracting a prose ledger from a merged
tree. It also makes the next upgrade cheaper, because the patch commit is
exactly the thing to replay. The 2026-08-08 sync landed as two
commits split by package rather than by pristine-then-patched, so neither
isolates an unmodified upstream tree; `PATCHES.md` is what makes that state
reconstructible, which is why that ledger is load-bearing rather than
merely descriptive.
Loading