From 51452a1686972b15844d7c2c2d62a70e7ec5ec9e Mon Sep 17 00:00:00 2001 From: gamer147 Date: Mon, 3 Aug 2026 11:45:08 -0400 Subject: [PATCH] Document repository policy audit --- docs/remake-architecture-and-roadmap.md | 50 ++++++++++++++++++++++--- 1 file changed, 45 insertions(+), 5 deletions(-) diff --git a/docs/remake-architecture-and-roadmap.md b/docs/remake-architecture-and-roadmap.md index 19c178c..4dc2ab4 100644 --- a/docs/remake-architecture-and-roadmap.md +++ b/docs/remake-architecture-and-roadmap.md @@ -862,6 +862,47 @@ do not mix mechanical moves with semantic changes. only after active work is committed. Configure an off-machine remote or equivalent backup before relying on local history as the sole recovery path. + **Read-only audit (2026-08-03):** + + - **License/provenance:** the repository has no project `LICENSE`, `NOTICE`, third-party notice, or artifact + manifest. The three committed binaries are unsigned and have no dedicated artifact records; audit hashes are + `BinExtractALF.exe` 0.8 + (`46167cdf3da1f02733ce1e7f0da99d155e934ede0987ca79c8927f48feb25fe2`), metadata-free `LzssCpp.dll` + (`596b9ddb07ca5c29cee609e846f1512654edec56310a90d6c2a6951be1e39fe1`), and PE-sieve 0.4.1.1 + (`ee684b34b37af24d1c1e9ca80ceeee6878cc80bb24c0c3793840c9acf905bd59`). PE-sieve's upstream is + [BSD-2-Clause](https://github.com/hasherezade/pe-sieve/blob/master/LICENSE), but that license is not carried + here; the extractor/DLL provenance and redistribution terms remain unverified. The two committed Kelebek + source snapshots and transcribed opcode data come from the + [upstream repository](https://github.com/Kelebek1/Eushully-Decompiler), where no license file was found, so + their redistribution status also remains unresolved. FFmpeg is the good model: Windows/Linux manifests pin + provider, release, URL, version, variant, and SHA-256, while build/export scripts stage its LGPL license. + NuGet/Godot dependencies are versioned in project files but have no consolidated notice inventory. + - **Editor/build/CI policy:** there is no `.editorconfig`, `global.json`, `Directory.Build.*`, package lock, + Python environment manifest, or CI configuration. `.gitattributes` only fixes LF for shell scripts and + whitespace exceptions for generated references. Projects target `net8.0`; the Godot SDK is pinned to 4.7.0 + and NuGet versions are explicit. The locally validated tools are .NET SDK 8.0.408 and Python 3.11.4, but only + the Python 3.11 invocation is documented. `tools/validate.py --level core` is already the asset-independent + CI entry point; workspace/runtime/full levels deliberately require the private game corpus and/or Godot. + - **Repository/storage:** `age-reimpl/` is the sole real worktree. The workspace parent contains an empty + `.git` directory, and the repository has an empty `.godot/logs` nest plus an accidental ignored + `godot/godot/build` nest (3.7 MB). All inspected ignored outputs total 6.43 GiB across 12,190 files: 4.38 GB + under `build/`, 1.29 GB under `godot/.godot`, 1.12 GB under historical `godot/build`, and the remainder in + .NET/tool caches. The real `.git` holds 6,100 loose objects (71 MiB), no packs and no reported garbage; defer + compaction until backup and cleanup decisions are complete. + - **Recovery:** `main` is the only ref and has no remote, upstream, additional worktree, or repository/parent + bundle. An unrelated off-machine backup cannot be disproved from repository state, but none is configured or + evidenced here. Do not publish, delete ignored data, remove the empty parent `.git`, or run Git compaction + until the user chooses the corresponding legal, retention, and backup policy. + + **Bounded execution order:** (1) add tracked SDK/editor/line-ending policy without reformatting existing files; + (2) add an asset-independent CI workflow that invokes the existing core validation driver; (3) obtain the + user's project-license choice and resolve, replace, or exclude every unverified third-party artifact before + adding the project license/notice/manifest set; (4) configure a user-selected private/off-machine backup or + remote; (5) after explicit retention approval, remove only the verified empty/obsolete ignored nests and any + selected regenerable caches; (6) compact the real repository only after a clean committed state and verified + backup. Public distribution remains blocked on item 3; destructive cleanup and compaction remain blocked on + item 4 plus explicit target approval. + **Not cleanup targets:** generated `build/` output, the two intentional solution files, historical `docs/superpowers/` plans/specifications, and fidelity-specific complexity that is directly covered by the native ABI. Reorganization is successful when ownership and reproduction become clearer, not when the raw @@ -1208,10 +1249,9 @@ layer's rendering diverges from ADV; save layout. --- ## 8. Immediate next step -Begin step 5 of the **codebase consolidation** maintenance slice with a non-destructive repository-policy and -storage audit. Inventory current license/notice state, committed third-party binaries and provenance, editor/build -policy, SDK pinning, CI entry points, repository roots/ignored output nests, and remote/backup configuration. -Report exact gaps and a bounded implementation order before choosing a license, changing external state, deleting -or compacting repositories, or removing any ignored output. +Continue step 5 of the **codebase consolidation** maintenance slice with the first non-destructive policy change: +add a repository `global.json`, `.editorconfig`, and complete text/line-ending attributes based on the validated +.NET 8/Python 3.11 toolchain. Do not mechanically reformat existing files or change warning/runtime behavior; +verify both solutions and the core validation driver under the tracked policy. Concrete playthrough blockers may still preempt this bounded maintenance work; the consolidation effort does not replace Phase B gameplay validation or the open cross-platform gates.