sorokin.oleg.edu
9fd76aef3a
Preserve raw include diagnostic provenance and derive bands from the existing shaped editor. Retain deferred tooltip paragraphs through rendering. Include source, regression, failure and native-trial evidence; corrected native acceptance remains pending.
3.6 KiB
Vendored Iced Windows notices implementation handoff
Bounded implementation by diagnostic_input, 2026-09-13. Only scripts/windows-notices.ps1 and scripts/test-windows-notices.ps1 changed. No Cargo/source annotation/App/package artifact layout/release edits. Parent owns execution and source gates; #27 owns release. PowerShell AST parsing completed successfully for both scripts; collector and synthetic tests have NOT been executed. No actual Cargo metadata, compiler, package or notice generation was run.
Production changes:
- Derive workspace ownership from
metadata.workspace_members, not source=null. Only real members receive workspace-LICENSE. - For local source manifests, require normalized repository containment before access; reject reparse points along manifest-to-repository ancestry. Record repository-relative
local_path(null for registry packages). Existing actual recursive source hashing remains authoritative; source=null and registry_checksum=null stay explicit for patched source. - Apply existing name/version/checksum-bound registry supplements only when an actual registry checksum exists. Real registry archive/checksum and unsupported-source checks remain unchanged. The existing iced_widget registry supplement is preserved in its manifest and does not apply to the path patch.
- Excluded local packages must have their own recognized license text or a valid declared license_file. The actual upstream LICENSE is collected; ARCADIA-PATCH.md is explicitly collected as a notice AND remains source-hashed. Patch prose alone cannot satisfy the own-license requirement.
Synthetic Windows metadata additions:
- Reachable iced_widget path node excluded from workspace membership.
- Assert exactly vendor LICENSE and ARCADIA-PATCH.md notice entries; neither workspace license nor registry supplement attribution.
- Compare actual Cargo.toml, src/lib.rs, LICENSE and patch hashes, notice source paths/hashes, explicit local path and null registry checksum.
- Change only vendor Rust bytes and observe source hash changes without changing unrelated registry source inventory.
- Ensure vendor does not leak into CLI-only graph.
- Move the synthetic own license temporarily outside the crate and require refusal even though patch prose remains; restore it afterward.
- Use a same-prefix sibling manifest path outside the repository and require containment refusal before any file access (no external fixture writes).
- With vendor present, retain valid real-registry supplement collection and original wrong-checksum/archive-tamper refusals.
Existing fixture output/other cases were retained. The added cases use mocked Cargo/rustc functions; parent can execute the existing test script once after review. These tests do not establish real metadata path resolution, shipped package bytes or native acceptance. Parent should subsequently run actual Windows notice preflight with the adopted lock/vendor tree, verify vendor LICENSE+patch notice and source hashes in dependency-notices.json against the identified source capture, and leave package/release claims to #27.
This patch checks local manifest ancestry and retains the existing per-file reparse-point refusal in recursive collection. It is not a generic filesystem snapshot/isolation redesign. The ordinary adopted vendor source tree must remain fixed throughout notice/build/package evidence collection as required by existing gates.
Ready source SHA-256 (before any parent edits):
scripts/windows-notices.ps1(16904 bytes):739757267292441f4a6d6bd4405dd00c15fb36a6810d8357248b0ee1e6958fd0scripts/test-windows-notices.ps1(16901 bytes):a698d690f22d8f624cb6e8609881cf2f3df101b0bb860abcc55733259d5ef284