For visitors who'd rather read than walk.
# Open-source maintainer — the project's memory, made permanent
You're the solo maintainer of libfoo. Eight years, 41 contributors,
two refactors, one fork. An acquirer is sniffing around. You need
the IP house in order before any conversation gets serious.
The hook: the commit history is the project's memory, but the
project's memory is mutable, fragile, and silent on the moments that
matter most. The substrate is what makes contribution permanent
without freezing the project itself.
Four real paths exist. For an OSS maintainer with a project's
governance in their hands, GitHub-first is the natural ordering.
Clone GarrisonNode from GitHub. Self-install on your workstation
or the project's CI infrastructure. Open source. Verifiable. The
path most maintainers take.
Join the mesh. GitHub install plus mesh anchoring with peer
projects and the OSS foundations (Linux Foundation, Apache, Eclipse,
OpenJS) that participate. The deepest path.
Paste the markdown into your LLM. Lightest path; works for
evaluation.
Subscribe to a regional operator. Operator-managed for
maintainers who would rather not run the chain themselves.
A sandboxed Merkle Trust loads with libfoo: 8 years of commit
chain, 41 contributors with attested first-contribution records,
14 years of substantive issue and discussion archive, a
license-and-CLA layer, an acquisition-evaluation packet, and a
fork-detection report on an unattributed fork from three years
ago.
The walk takes the acquisition-packet preparation — the immediate
concern. The chain produces a single packet that lays out: full
contributor list with each identity attested at first contribution
and signed by maintainer; commit chain parallel to git history,
each commit sealed at acceptance; license-compliance status by
release; fork-and-derivative tracking with the unattributed fork
flagged.
```
═══════════════════════════════════════════════
ACQUISITION PACKET — libfoo
Maintainer-prepared, sealed at packet root
═══════════════════════════════════════════════
CONTRIBUTORS 41 (each CLA-signed)
COMMITS 4,217 (each sealed)
RELEASES 62 (each maintainer-signed)
ISSUES SEALED 1,847 substantive
FORKS DETECTED 3 (1 unattributed)
IP foundation: verifiable.
CLA chain: complete.
Licensing posture: open at MIT;
no contributor restrictions surfaced.
═══════════════════════════════════════════════
```
The commit history is the index; the chain is the evidence.
Every contributor identity was attested at first contribution.
The contributor signs their CLA; the maintainer countersigns. The
record is sealed. No retroactive identity question can hit the
chain.
Every commit was sealed at acceptance. The commit's original
hash, the contributor's signature, the merge attestation, and the
license declaration all travel together. Methodology of acceptance
is attested as it happens.
Substantive issues and discussions are sealed at authorship.
Even if a thread is later edited or a comment deleted on the
hosting platform, the substantive contribution survives in the
chain. No platform's content policy decision rewrites the project's
intellectual history.
The friction-for-casual-contributors posture is explicit: the
substrate runs in the maintainer's CI, not in the contributor's
browser. A casual contributor opens a PR the same way they always
have. The CI seals on acceptance, signed by the maintainer's keys.
The contributor sees no extra steps.
The .md button puts the maintainer-pattern summary into your
tag-along bundle, including the acquisition-packet slab. Comment
field routes a specific licensing question to your own claude.ai
session.
Run a ceremony. Fifteen seconds.
The progress bar reads "done — 41 contributor records, 8 years of
commit chain, 14 years of substantive discussion sealed, 1
acquisition packet, 1 fork report, all anchored. New project
anchor at " followed by the first eight hex characters of the
root.
Sealed: "Every contributor is acknowledged. Every contribution is
sealed. Every license obligation is tracked. The project's IP
foundation is verifiable."
The most useful close for a maintainer is the local install path,
with retroactive sealing for the period before substrate deployment
honestly framed: that period is unattested by definition; everything
from deployment forward is on the chain.
The package, the cert, the recovery seed with its LLM-tripwire
preamble — all ride along.
<!-- finish_text -->
That was the simulated path through libfoo's IP house in order.
The full card breaks out the acquisition-evaluation pattern, the
fork-detection mechanic, and a maintainer-portability prediction
that's yours to test.