PORT-0: Chrome port registry (docs/ports.json), its test, and generated THIRD_PARTY_NOTICES.md

[thejackshelton]

PORT-0 (T118): the Chrome port registry, per docs/decisions.md "Porting Chrome's algorithms" and the T118J LGPL ruling.

What changed

• docs/ports.json is a registry of every Chrome source file Dragon cites. Each entry has:

  • the path at tag 145.0.7632.6;
  • the licence kind and copyright;
  • the file and header sha256;
  • the line ranges;
  • the Dragon file and declaration;
  • whether it is a port or reference use.

  docs/ports.md describes the registry.

• packages/parity/test/chrome-ports.test.ts checks the registry on every pnpm test. It fails when:

  • a source file cites an unregistered .cc, .cpp or .h file;
  • an LGPL entry has no ruling;
  • an LGPL entry is used as a port without being on the T123 clean-room list (step_range.cc/.h, text_break_iterator.cc);
  • a proof test is missing;
  • a Dragon file or declaration has gone;
  • a required notice is missing from the porting file;
  • THIRD_PARTY_NOTICES.md is stale.

• THIRD_PARTY_NOTICES.md is generated by pnpm notices:gen, is listed in .macroscope/ignore.md, and ships in the dragon package. The generator refuses a registry that is missing its tag, skiaRevision or v8Revision, and a test covers that.

• Re-cites: the T118J class A citations are reworded, comments only, to cite the spec or a Chrome observation.

• Two citations added since the branch was cut:

  • computed_style_constants.h (the 10000px font-size cap in units.ts). It is LGPL, class A, reference use only, like CSS_LENGTH_MAX. There is no Chrome golden yet.
  • v8/src/base/ieee754.cc (the rt harness sin and cos). This is fdlibm code under Sun's notice. The registry pins the V8 revision 4e031e4b6bfa from Chrome's DEPS file, adds the v8/ root and the fdlibm-sun licence kind, and keeps the notice in harness.ts.

What passed

• pnpm typecheck.
• pnpm test: 3037/3039. The two failures were 120000 ms timeouts under load (lanes.test.ts iosLayoutProjection, native-compare.test.ts reference proof), and both pass on rerun (41/41).
• pnpm run parity:devices: every lane status equals origin/master's. device-pixels fails with 135 iOS and 182 Android failures, as on master. out/device-failures-{ios,android}.json are byte-identical to origin/master's.

Changed tests and checks, and why

• chrome-ports.test.ts pins 19 LGPL entries, up from 18, because of the new class A entry computed_style_constants.h.
• The rapidhash notice test also covers the fdlibm notice.
• New checks reject a wrong v8Revision, and a registry missing its tag, skiaRevision or v8Revision.
• dist.test.ts expects THIRD_PARTY_NOTICES.md in the packed tarball.

No tolerance is loosened and no check is removed.

🤖 Generated with Claude Code

Note

Add Chrome port registry (docs/ports.json), parity test, and generated THIRD_PARTY_NOTICES.md

• Adds the Chrome-port registry at ports.json, recording upstream source locations, revisions, licences, hashes, and the Dragon files that cite each source entry. Documents the schema and workflow in ports.md.
• Adds a large offline Vitest suite in chrome-ports.test.ts that validates registry coverage, licence rulings, proof references, citation scanning, and generated notices against repository state.
• Adds gen-third-party-notices.ts, runnable via npm run notices:gen, which builds THIRD_PARTY_NOTICES.md from the registry plus vendor/harfbuzz/COPYING. The dragon package prepack copies the notices into the published tarball, and dist.test.ts enforces this.
• Updates ported-source JSDoc across fonts, units, and images modules to cite Chrome/Blink upstream behavior, and adds the rapidhash BSD-2-Clause and fdlibm/Sun licence notices.
• Risk: parity tests now fail on missing citations, unclassified files, invalid proof references, or a stale THIRD_PARTY_NOTICES.md; noticeTextOf throws when a non-LGPL registry entry lacks a licence-text identifier.

^{Macroscope summarized 56f438e.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR mostly adds an offline Chrome-port registry, license-notice generation, tests, and package distribution metadata, with no substantive production algorithm changes. It also changes .macroscope/ignore.md, which controls review behavior and requires human review.

^{You can add or adjust custom eligibility rules. Learn more.}