fix(supply-chain): separate MIT and bundled-font licenses by seonghobae · Pull Request #270 · ContextualWisdomLab/inkspan

seonghobae · 2026-08-12T10:59:23Z

Closes #269.

Product boundary

This Draft separates the root Inkspan software license from bundled-font license evidence without changing either license. Root LICENSE is canonical MIT text for Inkspan software. Noto Sans attribution and complete OFL-1.1 terms remain in src/fonts/NOTICE and src/fonts/OFL.txt. The npm manifest remains license: MIT and packages both root LICENSE and src/fonts.

Current authority and exact source identity

Protected shipped truth is independently resolved main@a40b9489665bed7d95af619a6079b9c51cab299a. Current exact Draft head is 210284bb30661294a86f413581c26731c25d4b8a on fix/license-detection-269.

The branch remains based on the protected tip without a competing writer. The effective product delta against protected main is still exactly two paths: modified root LICENSE and added src/licenseBoundary.test.ts. No force-push or destructive rebase was used.

Test-first / evidence lineage

Test-only head 961597fe6431452a8ba89d513b6ae236abcc2e9f required exact canonical root MIT text while separately requiring Noto/OFL evidence.
CI 31589849372 failed at the intended root-license assertion because the then-protected root file contained canonical MIT text plus an appended bundled-font section; the font attribution/OFL assertions passed.
c3ce70a527e19c06e41b7d82d369ee8fd5fa402d removed only the appended bundled-font section from root LICENSE.
b2c6b6eb7b9638051688939b722a1094c97da013 strengthened source/package evidence to require manifest license: MIT plus LICENSE and src/fonts in the npm files contract.
79c0ca643c012b6666dcbc37cefe16dc3d5575bf added a packlist assertion, but later verification found that this used npm pack --dry-run; that proves npm's proposed packlist, not the bytes/entries of an emitted tarball.
63b9e626ac9efac0610f9d6b555b9b465bb88147, 765c194b7a8fa3a1c7f48ff7aa7b7a27bee4e95b, and 0a3cf2f3ec3dc0113e1bd891769a2b3bce350b60 synchronized the two-file lane with successive protected-main truth.
7b6688971a4846201dbf97f21acee99d49dd2564 closed the artifact-evidence contradiction: the test emits a real tarball with npm pack --json --ignore-scripts --pack-destination <isolated temp dir>, lists that archive with tar -tzf, requires package/LICENSE, package/src/fonts/NOTICE, and package/src/fonts/OFL.txt, and removes the temporary artifact in finally.
Current head 210284bb30661294a86f413581c26731c25d4b8a removes duplicated Office support-contract edits and leaves PR test(office): align Python support contract with PR matrix #405 as their single writer; the effective license delta remains two paths.

Exact-current-head evidence

For exact head 210284bb30661294a86f413581c26731c25d4b8a against protected main@a40b9489665b at the latest refetch:

CI 33921412404, SAST Semgrep 33921412519, Security Scan 33921412385, and CodeQL PR 33921412398 had ended cancelled before substantive exact-head evidence was produced;
all four runs were retriggered without source churn and are now queued on this unchanged head;
formal submitted reviews: 0;
unresolved inline review threads: 0;
Draft: yes.

Pending, queued, in-progress, skipped, cancelled, absent, neutral, failed, stale/predecessor, status-only, synthetic-source, wrong-checkout, or model-only evidence is non-passing. Refetch all owner paths and then-live governance before any lifecycle action; do not grandfather the prior false-green or predecessor runs.

Invariants preserved

MIT grant, disclaimer, copyright and year;
Noto Sans attribution and complete OFL-1.1 text;
package runtime behavior, versions, dependencies, exports and host authority;
npm inclusion of root software license and bundled-font artifacts, with the current contract inspecting the emitted tarball rather than dry-run metadata;
no claim that an active PR proves protected-main GitHub license detection.

This is machine-readable supply-chain evidence and license-file separation, not a license change or legal advice.

Integration boundary

Keep Draft and unmerged while #118 owns protected v0.6.0 publication/provenance/digest operational acceptance and current live governance remains unsatisfied. Before any Ready/merge transition, refetch the then-live protected tip, unchanged exact head, ancestry/mergeability, organization ruleset, central required workflows, formal reviews and threads; require qualifying independent approval and all applicable exact-head gates. After protected integration, operational acceptance must verify GitHub identifies the repository software license as MIT and that the packed/published npm artifact retains both MIT and OFL evidence.

coderabbitai · 2026-08-12T11:05:52Z

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-12T11:28:05Z

Exact-current-head read-only review request for b2c6b6eb7b9638051688939b722a1094c97da013 against frozen protected base main@a430b1c153702de3b6439def801732d7453b4940.

Direct exact-head gates are complete: CI 31590591645, Security Scan 31590591555, and SAST Semgrep 31590591516 all succeeded; current unresolved inline threads and formal reviews are zero. Review the narrow license-evidence separation only: exact canonical MIT root text, retained Noto/OFL attribution and complete terms, npm license: MIT, package inclusion of LICENSE and src/fonts, and absence of unintended runtime/version/dependency/export changes.

@coderabbitai review
@opencode-agent review
@cwl-noema-review review
@strix review

Review only. Do not mutate the branch, dispatch repair writers, reuse predecessor/stale/synthetic evidence, or synthesize author approval. Bind findings and verdicts to this exact unchanged head.

coderabbitai · 2026-08-12T11:29:37Z

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='b2c6b6eb7b9638051688939b722a1094c97da013'
base='a430b1c153702de3b6439def801732d7453b4940'

echo '== Revision identities =='
git rev-parse HEAD
git cat-file -t "$head"
git cat-file -t "$base"
git merge-base --is-ancestor "$base" "$head" && echo 'base-is-ancestor=yes' || echo 'base-is-ancestor=no'

echo '== Changed paths and diff summary =='
git diff --name-status "$base" "$head"
git diff --stat "$base" "$head"
git diff --check "$base" "$head"
git diff -- "$base" "$head" -- LICENSE package.json src/fonts/NOTICE src/fonts/OFL.txt 2>/dev/null || true

echo '== Root LICENSE canonical MIT comparison =='
expected="$(mktemp)"
cat > "$expected" <<'EOF'
MIT License

Copyright (c) 2026 Inkspan Contributors

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
EOF
if diff -u "$expected" LICENSE; then
  echo 'root-license-canonical-mit=yes'
else
  echo 'root-license-canonical-mit=no'
fi
rm -f "$expected"

echo '== Font-license evidence =='
printf 'NOTICE Noto occurrences: '
rg -n -i 'Noto(\s+Sans)?' src/fonts/NOTICE || true
printf 'OFL reserved-font-name occurrences: '
rg -n 'Reserved Font Name|Noto Sans' src/fonts/OFL.txt || true
printf 'OFL version markers: '
rg -n 'SIL OPEN FONT LICENSE|Version 1\.1|PREAMBLE|TERMS AND CONDITIONS' src/fonts/OFL.txt || true
wc -l src/fonts/NOTICE src/fonts/OFL.txt

echo '== npm manifest evidence =='
jq '{license, files, version, dependencies, devDependencies, exports, main, module, types}' package.json
echo '== Package-related changed manifest fields =='
git diff -U0 "$base" "$head" -- package.json

echo '== Non-scope changes excluding license evidence =='
git diff --name-only "$base" "$head" -- . ':!LICENSE' ':!package.json' ':!src/fonts/NOTICE' ':!src/fonts/OFL.txt'

Length of output: 8196

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head='b2c6b6eb7b9638051688939b722a1094c97da013'
base='a430b1c153702de3b6439def801732d7453b4940'

echo '== Test structure =='
ast-grep outline src/licenseBoundary.test.ts --items all

echo '== Added test content =='
cat -n src/licenseBoundary.test.ts

echo '== License content at base and head =='
echo '-- base LICENSE --'
git show "${base}:LICENSE" | cat -n
echo '-- head LICENSE --'
git show "${head}:LICENSE" | cat -n

echo '== Corrected canonical MIT comparison =='
expected="$(mktemp)"
cat > "$expected" <<'EOF'
MIT License

Copyright (c) 2026 ContextualWisdomLab

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
EOF
diff -u "$expected" LICENSE && echo 'root-license-canonical-mit=yes'
rm -f "$expected"

echo '== Exact package contract comparison =='
for key in version license dependencies devDependencies peerDependencies optionalDependencies exports main module types files; do
  before="$(git show "${base}:package.json" | jq -c --arg key "$key" '.[$key]')"
  after="$(git show "${head}:package.json" | jq -c --arg key "$key" '.[$key]')"
  if [ "$before" = "$after" ]; then
    printf '%s=unchanged\n' "$key"
  else
    printf '%s=CHANGED\n' "$key"
  fi
done

echo '== Test references to requested evidence =='
rg -n -C 2 'LICENSE|MIT|NOTICE|OFL|Noto|package\.json|license|files|src/fonts' src/licenseBoundary.test.ts

Length of output: 10800

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo='ContextualWisdomLab/inkspan'
head='b2c6b6eb7b9638051688939b722a1094c97da013'

echo '== Exact-head GitHub Actions runs =='
for run_id in 31590591645 31590591555 31590591516; do
  gh api "repos/${repo}/actions/runs/${run_id}" \
    --jq '[.id, .name, .head_sha, .status, .conclusion] | `@tsv`'
done

echo '== Retained OFL text has no changes from the protected base =='
git diff --quiet a430b1c153702de3b6439def801732d7453b4940 "$head" -- src/fonts/OFL.txt \
  && echo 'ofl-unchanged-from-base=yes' \
  || echo 'ofl-unchanged-from-base=no'

Length of output: 1082

🤖 web_search executed:

Official SIL Open Font License Version 1.1 full text plain text

Length of output: 10588

🏁 Script executed:

#!/bin/bash
set -euo pipefail

reference="$(mktemp)"
repository_terms="$(mktemp)"
reference_terms="$(mktemp)"
trap 'rm -f "$reference" "$repository_terms" "$reference_terms"' EXIT

curl --fail --silent --show-error --location \
  'https://openfontlicense.org/open-font-license-official-text/OFL.txt' \
  -o "$reference"

echo '== Official reference identity =='
sed -n '1,20p' "$reference"

echo '== Compare standard OFL-1.1 terms =='
sed -n '/^SIL OPEN FONT LICENSE Version 1\.1 - 26 February 2007$/,$p' \
  src/fonts/OFL.txt > "$repository_terms"
sed -n '/^SIL OPEN FONT LICENSE Version 1\.1 - 26 February 2007$/,$p' \
  "$reference" > "$reference_terms"

if diff -u "$reference_terms" "$repository_terms"; then
  echo 'ofl-standard-terms-exact=yes'
else
  echo 'ofl-standard-terms-exact=no'
fi

Length of output: 1154

🏁 Script executed:

#!/bin/bash
set -euo pipefail

page="$(mktemp)"
trap 'rm -f "$page"' EXIT

curl --fail --silent --show-error --location \
  --user-agent 'Mozilla/5.0 (compatible; CodeRabbit review)' \
  'https://openfontlicense.org/open-font-license-official-text/' \
  -o "$page"

echo '== Official OFL page title and text-download candidates =='
rg -n -i -C 1 '<title>|OFL\.txt|plaintext|plain text|download' "$page" | head -n 120

Length of output: 6977

🏁 Script executed:

#!/bin/bash
set -euo pipefail

reference="$(mktemp)"
repository_terms="$(mktemp)"
reference_terms="$(mktemp)"
trap 'rm -f "$reference" "$repository_terms" "$reference_terms"' EXIT

curl --fail --silent --show-error --location \
  --user-agent 'Mozilla/5.0 (compatible; CodeRabbit review)' \
  'https://openfontlicense.org/documents/OFL.txt' \
  -o "$reference"

sed -n '/^SIL OPEN FONT LICENSE Version 1\.1 - 26 February 2007$/,$p' \
  src/fonts/OFL.txt > "$repository_terms"
sed -n '/^SIL OPEN FONT LICENSE Version 1\.1 - 26 February 2007$/,$p' \
  "$reference" > "$reference_terms"

echo '== Official reference header =='
sed -n '1,16p' "$reference"
echo '== Exact standard-terms comparison =='
if diff -u "$reference_terms" "$repository_terms"; then
  echo 'ofl-standard-terms-exact=yes'
else
  echo 'ofl-standard-terms-exact=no'
fi

Length of output: 2344

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== Trailing whitespace in bundled OFL text =='
rg -n '[ \t]+$' src/fonts/OFL.txt || true

Length of output: 379

@seonghobae No findings from this exact-head review.

I reviewed b2c6b6eb7b9638051688939b722a1094c97da013 against main@a430b1c153702de3b6439def801732d7453b4940.

LICENSE is exact canonical MIT text with the existing ContextualWisdomLab copyright.
Noto attribution remains in src/fonts/NOTICE.
The complete OFL-1.1 terms remain in src/fonts/OFL.txt. The file is unchanged from the base. It has one pre-existing trailing space on Line 25, but the terms are complete.
package.json remains license: "MIT". Its files contract includes both LICENSE and src/fonts.
Versions, dependencies, exports, and package entry points are unchanged.
Only the root license and the license-boundary test changed.
CI 31590591645, Security Scan 31590591555, and SAST Semgrep 31590591516 each completed successfully on this exact head.

I kept this review distinct from protected-main verification and approval authority, as required by the repository guidance.

🧠 Learnings used

Learnt from: CR
Repo: ContextualWisdomLab/inkspan PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-08-12T02:30:49.287Z
Learning: Formal review, automated review, repository checks, host authorization, and release evidence remain distinct authorities.

Learnt from: CR
Repo: ContextualWisdomLab/inkspan PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-08-12T02:31:03.922Z
Learning: Do not infer shipped behavior from conversation history, PR bodies, model output, or predecessor-head evidence. Keep Proposed/Active-PR behavior distinct from implementation on Protected `main`, preserve fail-closed security and deterministic conversion boundaries, and update the smallest affected canonical documents plus tests when a durable contract changes.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Signed-off-by: Seongho Bae <me@seonghobae.me>

seonghobae · 2026-09-04T19:16:25Z

Restacked onto current protected main and retained the two-file license evidence boundary.

Validation at 60f98e3fe9cb8166597aade5658a8f6d48f432d4:

focused license artifact and exact-head tests: 14 passed
typecheck passed
full root suite: 157 files / 885 tests, 100% coverage
production build and packed-package verification passed

The real emitted npm tarball contains canonical root MIT text plus separate bundled-font NOTICE and OFL evidence; no license terms or runtime behavior changed. @codex review

chatgpt-codex-connector · 2026-09-04T19:16:37Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

Remove the duplicated Python support contract changes from this license branch. PR #405 remains the single writer while this branch keeps its repository license correction. Signed-off-by: Seongho Bae <seonghobae@users.noreply.github.com> Commit-Message-Assisted-by: Claude (via Claude Code)

seonghobae added 2 commits August 12, 2026 19:58

test(supply-chain): define machine-readable license boundary

961597f

fix(supply-chain): separate bundled-font licensing

c3ce70a

test(supply-chain): bind npm license evidence

b2c6b6e

seonghobae added 2 commits August 14, 2026 20:28

test(supply-chain): verify packed license evidence

79c0ca6

chore: synchronize license boundary with protected main

63b9e62

seonghobae mentioned this pull request Aug 19, 2026

fix(supply-chain): separate root MIT license from bundled font notices #269

Open

opencode-agent Bot added priority: medium Normal-priority or P2 work status: draft Draft pull request type: bug Defect or incorrect behavior labels Aug 22, 2026

seonghobae added 6 commits August 25, 2026 05:35

chore(sync): integrate protected security baseline

765c194

chore(sync): integrate current protected main

0a3cf2f

test(supply-chain): verify license evidence from actual tarball

7b66889

Merge remote-tracking branch 'origin/main' into codex/pr270-restack

b2b2672

test(ci): cover event-specific Python matrix

530f5e1

Signed-off-by: Seongho Bae <me@seonghobae.me>

test(ci): bind Python matrix to event

60f98e3

Signed-off-by: Seongho Bae <me@seonghobae.me>

seonghobae added the bug Something isn't working label Sep 7, 2026 — with ChatGPT Codex Connector

Navigation Menu

Uh oh!

fix(supply-chain): separate MIT and bundled-font licenses - #270

fix(supply-chain): separate MIT and bundled-font licenses#270
seonghobae wants to merge 12 commits into
mainfrom
fix/license-detection-269

seonghobae commented Aug 12, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading

Draft PR not reviewed

Uh oh!

seonghobae commented Aug 12, 2026

Uh oh!

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading

Uh oh!

seonghobae commented Sep 4, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

seonghobae commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Product boundary

Current authority and exact source identity

Test-first / evidence lineage

Exact-current-head evidence

Invariants preserved

Integration boundary

Uh oh!

coderabbitai Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Draft PR not reviewed

Uh oh!

seonghobae commented Aug 12, 2026

Uh oh!

coderabbitai Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Sep 4, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Aug 12, 2026 •

edited

Loading

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading