UPSTREAMS.lock.json

{
  "$schema": "https://install.doctor/schemas/upstreams.lock.v1.json",
  "schemaVersion": 1,
  "generatedAt": "2026-10-26",
  "sourceCommit": "5ef3f031",
  "note": "CANDIDATE REGISTRY ONLY — not a reuse manifest yet. No upstream has been evaluated, pinned, license-reviewed, or reused. Every entry is disposition 'pending-evaluation' with null for pinnedCommit/license/filesReused until a fire actually inspects it (master-prompt §3). GitHub stars are discovery metadata, never priority or security evidence. When a reuse lands, fill pinnedCommit+hashes+license+filesReused+modifications+maintainer+tests and set disposition to embed|adapt|integrate|design-reference|reject-with-reason. Pair with THIRD_PARTY_NOTICES (not yet created).",
  "upstreams": [
    { "id": "U01", "repo": "microsoft/PowerToys", "intendedContribution": "Command discovery, env-var UX, Windows conveniences", "boundary": "keep native utilities platform-specific", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U02", "repo": "louislam/uptime-kuma", "intendedContribution": "Health-check + incident UX, notification adapters", "boundary": "coordinate with existing monitoring, do not duplicate", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U03", "repo": "ansible/ansible", "intendedContribution": "Inventory/task semantics, optional playbook execution", "boundary": "review copyleft (GPL) obligations", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U04", "repo": "coollabsio/coolify", "intendedContribution": "Service templates, discovery, deployments, bindings", "boundary": "retain upstream Coolify where already running", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U05", "repo": "restic/restic", "intendedContribution": "Maintained backup/restore engine", "boundary": "build verified recovery workflows around it", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U06", "repo": "gitleaks/gitleaks", "intendedContribution": "Secret-scanning rules + tooling", "boundary": "scanning != safe-disclosure guarantee", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U07", "repo": "kestra-io/kestra", "intendedContribution": "Workflow observability, triggers, dependency viz", "boundary": "no mandatory additional orchestrator", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U08", "repo": "Devolutions/UniGetUI", "intendedContribution": "Package-manager abstraction, bundles, operation queues", "boundary": "install-options + restart feedback", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U09", "repo": "microsoft/winget-cli", "intendedContribution": "Native Windows package adapter + config interfaces", "boundary": "Windows-native only", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U10", "repo": "activepieces/activepieces", "intendedContribution": "Connector/auth/action/trigger contracts + workflow semantics", "boundary": "shared CF-native adaptation; AVOID packages/ee/ + server/api ee paths (enterprise license)", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U11", "repo": "osquery/osquery", "intendedContribution": "Evidence-backed inventory + constrained query packs", "boundary": "no arbitrary expensive/invasive fleet queries", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U12", "repo": "xtermjs/xterm.js", "intendedContribution": "Browser terminal renderer + supported extensions", "boundary": "use upstream, avoid a fork", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U13", "repo": "rrweb-io/rrweb", "intendedContribution": "Optional masked dashboard troubleshooting replay", "boundary": "exclude terminal/credential/sensitive views", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U14", "repo": "ActivityWatch/activitywatch", "intendedContribution": "Optional local activity summaries + recommendation signals", "boundary": "review MPL/file obligations", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U15", "repo": "asciinema/asciinema", "intendedContribution": "Recording behavior + asciicast format reference", "boundary": "recorder license reviewed separately from player", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U16", "repo": "ansible/awx", "intendedContribution": "Inventory, jobs, templates, execution-result UX patterns", "boundary": "patterns, not architecture import", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U17", "repo": "tsl0922/ttyd", "intendedContribution": "Terminal bridge reference/fallback", "boundary": "never an unauthenticated parallel management endpoint", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U18", "repo": "open-policy-agent/opa", "intendedContribution": "Deterministic action-policy option", "boundary": "optional; do not create a second policy authority", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U19", "repo": "ekzhang/sshx", "intendedContribution": "Reconnect/collaboration/presence/latency UX + relay design ref", "boundary": "no unreviewed crypto copying", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U20", "repo": "Ylianst/MeshCentral", "intendedContribution": "Enrollment, device groups, remote terminal/file/desktop workflows", "boundary": "one unified device-control architecture", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U21", "repo": "fleetdm/fleet", "intendedContribution": "Inventory, policy/query packs, software state, host lifecycle", "boundary": "distinguish docs/enterprise/client-JS; recheck pinned license + file provenance", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U22", "repo": "StackStorm/st2", "intendedContribution": "Events→rules→actions, remediation packs, failure handling", "boundary": "event normalization patterns", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U23", "repo": "rundeck/rundeck", "intendedContribution": "Safe self-service runbooks, scoped ops, delegation, evidence", "boundary": "scoped operations only", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U24", "repo": "pyinfra-dev/pyinfra", "intendedContribution": "Observed-state inspection, idempotent ops, previews, dry runs", "boundary": "no duplicate state authority", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U25", "repo": "asciinema/asciinema-player", "intendedContribution": "Embedded History recording playback (maintained player)", "boundary": "use upstream player", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U26", "repo": "microsoft/node-pty", "intendedContribution": "Native PTY adapter candidate", "boundary": "validate Node/Bun compat + platform lifecycle", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U27", "repo": "aquaproj/aqua", "intendedContribution": "Registry, version, integrity, lazy-install conventions", "boundary": "do not compete with mise ownership", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U28", "repo": "apache/guacamole-client", "intendedContribution": "Optional graphical remote-access client patterns", "boundary": "coordinate with DeskLink", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U29", "repo": "PowerShell/DSC", "intendedContribution": "Declarative resource/config interfaces + native platform adapters", "boundary": "Windows-native where applicable", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] },
    { "id": "U30", "repo": "theupdateframework/tuf-js", "intendedContribution": "Secure-update verification for compatible JS components", "boundary": "native counterparts elsewhere", "disposition": "pending-evaluation", "pinnedCommit": null, "license": null, "filesReused": [] }
  ]
}