Source & license review

Research depth is visible

The launch index contains 345 canonical crypto repositories across 28 categories. The initial snapshot records source revisions for all entries and README inspections for 100. Metadata review and README review are different levels of evidence; neither is a complete source audit.

Each entry records its evidence URL and observation date. Repository status, stars, dependencies and licenses can change after that observation. A reviewer should revisit the upstream project before accepting a new build request.

What intake checks automatically

Intake accepts an HTTPS github.com owner/repository URL with no branch, file or extra path. It checks that the repository is public and not archived, reads its default branch revision and records the detected language and license.

Crypto relevance is checked using recognized source signals. For repositories not identified by Solidity, Vyper or Move as their primary language, the intake may inspect Cargo.toml and package.json at the pinned revision. This filter does not establish source safety, functionality or legal permission.

Review the exact revision

Keep the full 40-character commit SHA with the specification, review notes and generated patch. A branch name is mutable and is insufficient to reproduce the source that was inspected.

The catalogue sourceCommit is the research pin. A newly saved request has its own commit field from fresh intake. The runner receives that request revision and checks it out directly. Differences between those two pins should be reviewed before execution.

What the build gate permits

The current automated gate recognizes Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense and CC0-1.0. A detected identifier on this list is only one build prerequisite; it is not a conclusion about every file, dependency or asset.

Other or unresolved licenses block automatic build dispatch. The current interface has no general-purpose override for that gate. Resolve the licensing question and implement a reviewed approval process before extending the permitted set.

Keep attribution attached to the source

• Inspect the license and notice files at the same commit that will be used by the job.
• Record dependency, vendored code, generated file and asset licenses separately.
• Preserve required copyright and attribution notices in modified and redistributed source.
• Review project names and brand assets independently from the source-code license.
• Keep unresolved permissions visible as blockers; do not represent a proposed fork as an upstream release.

Produce a review that can guide implementation

The saved source-review action prepares a structured migration plan. Its output identifies the source, target chain, runtime assumptions, test expectations, token-launch boundary and proposed funding route. This action does not run a model or generate a completed port.

Extend that plan with concrete file paths, interfaces, reference vectors and unresolved dependencies before funding a substantial protocol migration.