mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-10-24 06:23:06 +08:00
Martin Vogel
032ebf5327
The vendored LICENSE carried tree-sitter-typescript's MIT text plus an appended derivative notice. That is not what MIT asks of a derivative -- it asks that upstream's notice travel with the code -- and the appended text meant the provenance audit could not byte-verify the file against upstream, so arkts landed as NO-MANIFEST-ENTRY and failed license-gate. The vendored LICENSE is now byte-identical to upstream's, and arkts is registered in the audit's FORKS map, which is defined for exactly this case: a self-maintained fork whose vendored LICENSE must match its upstream. That is a routing entry, not an exemption -- check_upstream still byte-verifies against the real upstream repository, so the fact is checked rather than asserted. Audit now reports arkts as IDENTICAL. Our copyright for the ArkTS additions is not lost, it moves to where our SOURCE is: the grammar.js header (which now states all three copyrights explicitly) and THIRD_PARTY.md, which ships inside the release archives. The edit to scripts/audit-license-provenance.py is a maintainer-only enforcement-surface change, made deliberately and stated here rather than slipped in; a contribution may never supply its own audit entry. No generated parser or source changes -- comments, licence text, manifest prose and one routing entry only. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>