Traces each component in a registry back to its upstream source and judges whether that source's license permits resale or redistribution as part of a paid kit. Most component registries never run this check; several popular upstreams forbid repackaging outright.

Execution

  1. provenance-planner
  2. source-finder
  3. license-reader
  4. resale-judge
  5. risk-reporter

The team

Planner

provenance-planner

Plans the provenance trace for a batch of components

@cf/openai/gpt-oss-120b

Worker

source-finder

Searches GitHub for the upstream project a component came from

@cf/openai/gpt-oss-20b

Tools: github_search, github_contents

Worker

license-reader

Reads the actual license of a matched upstream repository

@cf/openai/gpt-oss-20b

Tools: github_repo_info, github_readme, github_contents

Worker

resale-judge

Judges whether the license permits resale inside a paid kit

@cf/openai/gpt-oss-120b

Worker

risk-reporter

Compiles the batch into a ranked action list

@cf/openai/gpt-oss-120b