inscriboor/SOURCES.md

# Sources and provenance

## Verification on 2026-10-04

`origin` is `https://teahub.xyz/matcha/inscriboor.git`. Live `git ls-remote origin refs/heads/main` returned `7298f2f9c569961c318ffc74f88ce0ecc8eaa4e4`, matching the starting worktree HEAD. Changes here are local; nothing was pushed or deployed and no issues were created.

## Imported sources

Credit: **Supertestnet and each repository's contributors**. Each source below is an unsquashed subtree under `upstream/<name>`, including its original README, LICENSE, assets, and full reachable history. Original commit authorship is preserved; integration commits use the Codex identity. These are source imports, not functioning extension integrations. Tree-object equality and upstream-tip ancestry were verified for all four imports.

| Source | Original upstream tip | Local import commit | License at tip |
| --- | --- | --- | --- |
| [vanilla-js-browser-wallet](https://github.com/supertestnet/vanilla-js-browser-wallet) | `19ae5097f4645bf5b1103a39abc04155a8b072fc` | `4f5f7dfcacc4646be48fcc0d78807ed800fbbf8e` | CC0 1.0; original `LICENSE` retained |
| [inscriptions-online](https://github.com/supertestnet/inscriptions-online) | `470b8bdf29ead319cff9dc119a005cbf58ee598c` | `70419cffc2ccf33c75a91403f7acc1eedfc27235` | CC0 1.0; original `LICENSE` retained |
| [testnet_generator](https://github.com/supertestnet/testnet_generator) | `498be4cc775ef18e7ff17357d007918518f47b98` | `60d02f9669d6b6b55bf75dfb7b1bb12ff30f10f9` | CC0 1.0; original `LICENSE` retained |
| [nwcjs](https://github.com/supertestnet/nwcjs) | `ab2ba5d780c1f753016da3ed64a9eca00a5afcca` | `8f169789ef5ae8e0af80ecf03f707b8a85b06e12` | CC0 1.0; original `LICENSE` retained |

Repository-level CC0 files do not replace bundled third-party notices. In particular, inscriptions-online includes libraries, fonts, images, and template assets that still require an asset/dependency license audit before packaging. Nothing under `upstream/` is packaged in the extension shell.

## References not imported

- [supertestnet/vanilla-js-nostr](https://github.com/supertestnet/vanilla-js-nostr): pinned candidate `8107d822beb5d74bf8bc85878f40ace2f279f3ec`. Its complete Git history was fetched to a temporary bare checkout for inspection, but **no source or history was imported into this repository**. The tip has no LICENSE file; its README invites code reuse without a formal license declaration. Clarify permission/license before importing or adapting it. Intended role: Nostr feed and event adapter.
- [coinos/coinosv3](https://github.com/coinos/coinosv3): **Coinos and contributors**, browser-wallet design reference only. No source/history imported, no commit pinned, and no license claim made. Any future reuse requires pinning and license review.

Intended roles of imported sources: vanilla-js-browser-wallet → Wallet/BTC adapter; inscriptions-online → Inscribe preparation; testnet_generator → Chain experiments; nwcjs → optional Nostr Wallet Connect adapter. These roles are inscriboor's proposed integration boundaries, not upstream endorsements.

## Repeatable history-preserving imports

Use unsquashed `git subtree` imports into separate prefixes. This keeps original commits reachable from ordinary clones and avoids extra submodule checkout steps. Never use archive downloads, copy/paste, shallow history, or `--squash` as a substitute. Keep imported trees unchanged initially; implement reviewed extension adapters separately under `packages/`. Temporary clone paths used during this task are not runtime dependencies.

For a new import, start from a clean committed worktree with Git author/committer identity configured. The following is the exact deferred Nostr import sequence **after license clarification**; if permission requires a later licensed commit, replace the pinned SHA with that reviewed commit and update this ledger:

```sh
git remote add supertestnet-nostr https://github.com/supertestnet/vanilla-js-nostr.git
git fetch supertestnet-nostr
nostr_tip=8107d822beb5d74bf8bc85878f40ace2f279f3ec
git cat-file -e "$nostr_tip^{commit}"
git subtree add --prefix=upstream/vanilla-js-nostr "$nostr_tip" \
  -m "Import supertestnet/vanilla-js-nostr with full upstream history"
git merge-base --is-ancestor "$nostr_tip" HEAD
test "$(git rev-parse HEAD:upstream/vanilla-js-nostr)" = "$(git rev-parse "$nostr_tip^{tree}")"
```

If a named remote already exists, inspect its URL rather than replacing it blindly. Fetching without a depth limit preserves full reachable history. Preserve licensing clarification alongside the import.

To update an existing subtree (example: nwcjs):

```sh
git remote add supertestnet-nwcjs https://github.com/supertestnet/nwcjs.git
git fetch supertestnet-nwcjs
# Inspect upstream changes and licenses; set reviewed_tip to the full reviewed SHA.
: "${reviewed_tip:?Set the reviewed upstream commit SHA}"
git cat-file -e "$reviewed_tip^{commit}"
git subtree merge --prefix=upstream/nwcjs "$reviewed_tip" \
  -m "Update supertestnet/nwcjs preserving history"
git merge-base --is-ancestor "$reviewed_tip" HEAD
```

Record the new tip/import commit, license changes, and validation here. For untouched subtrees, compare tree IDs as above. For future local upstream patches, review diffs explicitly and preserve attribution. Do not flatten demo code into the extension to bypass these boundaries.

## Remaining work

Resolve vanilla-js-nostr licensing/import; audit bundled dependencies/assets; specify derivation paths and recovery format; implement and test shared vault/signing/storage and feature adapters; implement bounded site/agent capabilities; validate browser loading and security behavior. The shell contains no crypto and has not been exercised in a real extension browser session.