5.6 KiB
Sources and provenance
Verification on 2026-10-04
origin is https://teahub.xyz/matcha/inscriboor.git. Live git ls-remote origin refs/heads/main returned 7298f2f9c569961c318ffc74f88ce0ecc8eaa4e4, matching the starting worktree HEAD. Changes here are local; nothing was pushed or deployed and no issues were created.
Imported sources
Credit: Supertestnet and each repository's contributors. Each source below is an unsquashed subtree under upstream/<name>, including its original README, LICENSE, assets, and full reachable history. Original commit authorship is preserved; integration commits use the Codex identity. These are source imports, not functioning extension integrations. Tree-object equality and upstream-tip ancestry were verified for all four imports.
| Source | Original upstream tip | Local import commit | License at tip |
|---|---|---|---|
| vanilla-js-browser-wallet | 19ae5097f4645bf5b1103a39abc04155a8b072fc |
4f5f7dfcacc4646be48fcc0d78807ed800fbbf8e |
CC0 1.0; original LICENSE retained |
| inscriptions-online | 470b8bdf29ead319cff9dc119a005cbf58ee598c |
70419cffc2ccf33c75a91403f7acc1eedfc27235 |
CC0 1.0; original LICENSE retained |
| testnet_generator | 498be4cc775ef18e7ff17357d007918518f47b98 |
60d02f9669d6b6b55bf75dfb7b1bb12ff30f10f9 |
CC0 1.0; original LICENSE retained |
| nwcjs | ab2ba5d780c1f753016da3ed64a9eca00a5afcca |
8f169789ef5ae8e0af80ecf03f707b8a85b06e12 |
CC0 1.0; original LICENSE retained |
Repository-level CC0 files do not replace bundled third-party notices. In particular, inscriptions-online includes libraries, fonts, images, and template assets that still require an asset/dependency license audit before packaging. Nothing under upstream/ is packaged in the extension shell.
References not imported
- supertestnet/vanilla-js-nostr: pinned candidate
8107d822beb5d74bf8bc85878f40ace2f279f3ec. Its complete Git history was fetched to a temporary bare checkout for inspection, but no source or history was imported into this repository. The tip has no LICENSE file; its README invites code reuse without a formal license declaration. Clarify permission/license before importing or adapting it. Intended role: Nostr feed and event adapter. - coinos/coinosv3: Coinos and contributors, browser-wallet design reference only. No source/history imported, no commit pinned, and no license claim made. Any future reuse requires pinning and license review.
Intended roles of imported sources: vanilla-js-browser-wallet → Wallet/BTC adapter; inscriptions-online → Inscribe preparation; testnet_generator → Chain experiments; nwcjs → optional Nostr Wallet Connect adapter. These roles are inscriboor's proposed integration boundaries, not upstream endorsements.
Repeatable history-preserving imports
Use unsquashed git subtree imports into separate prefixes. This keeps original commits reachable from ordinary clones and avoids extra submodule checkout steps. Never use archive downloads, copy/paste, shallow history, or --squash as a substitute. Keep imported trees unchanged initially; implement reviewed extension adapters separately under packages/. Temporary clone paths used during this task are not runtime dependencies.
For a new import, start from a clean committed worktree with Git author/committer identity configured. The following is the exact deferred Nostr import sequence after license clarification; if permission requires a later licensed commit, replace the pinned SHA with that reviewed commit and update this ledger:
git remote add supertestnet-nostr https://github.com/supertestnet/vanilla-js-nostr.git
git fetch supertestnet-nostr
nostr_tip=8107d822beb5d74bf8bc85878f40ace2f279f3ec
git cat-file -e "$nostr_tip^{commit}"
git subtree add --prefix=upstream/vanilla-js-nostr "$nostr_tip" \
-m "Import supertestnet/vanilla-js-nostr with full upstream history"
git merge-base --is-ancestor "$nostr_tip" HEAD
test "$(git rev-parse HEAD:upstream/vanilla-js-nostr)" = "$(git rev-parse "$nostr_tip^{tree}")"
If a named remote already exists, inspect its URL rather than replacing it blindly. Fetching without a depth limit preserves full reachable history. Preserve licensing clarification alongside the import.
To update an existing subtree (example: nwcjs):
git remote add supertestnet-nwcjs https://github.com/supertestnet/nwcjs.git
git fetch supertestnet-nwcjs
# Inspect upstream changes and licenses; set reviewed_tip to the full reviewed SHA.
: "${reviewed_tip:?Set the reviewed upstream commit SHA}"
git cat-file -e "$reviewed_tip^{commit}"
git subtree merge --prefix=upstream/nwcjs "$reviewed_tip" \
-m "Update supertestnet/nwcjs preserving history"
git merge-base --is-ancestor "$reviewed_tip" HEAD
Record the new tip/import commit, license changes, and validation here. For untouched subtrees, compare tree IDs as above. For future local upstream patches, review diffs explicitly and preserve attribution. Do not flatten demo code into the extension to bypass these boundaries.
Remaining work
Resolve vanilla-js-nostr licensing/import; audit bundled dependencies/assets; specify derivation paths and recovery format; implement and test shared vault/signing/storage and feature adapters; implement bounded site/agent capabilities; validate browser loading and security behavior. The shell contains no crypto and has not been exercised in a real extension browser session.