Record the OnCo baseline pin and reuse audit.

Pin b594d743, typecheck the checkout, and keep the corpus and assets out of this repo. Leave screenshots and the production build open.

Assistant: grok
Assistant-Session: 01a130f1-abfb-7d71-9cd6-a8b75ec7f95a

.custodian-brief.md

@@ -12,7 +12,7 @@ Infotech already has several topics. This repo is registered by slug and classif
 
 | ID | Status | File |
 |---|---|---|
-| CONTENT-WP-0000 | ready | `workplans/CONTENT-WP-0000-upstream-baseline.md` |
+| CONTENT-WP-0000 | active | `workplans/CONTENT-WP-0000-upstream-baseline.md` |
 | CONTENT-WP-0001 | ready | `workplans/CONTENT-WP-0001-canonical-contracts.md` |
 | CONTENT-WP-0002 | proposed | `workplans/CONTENT-WP-0002-ui-extraction.md` |
 | CONTENT-WP-0003 | proposed | `workplans/CONTENT-WP-0003-ingestion-publishing.md` |

research/baseline/2026-10-12-upstream-baseline.md

@@ -0,0 +1,103 @@
+# Upstream baseline — 2026-10-12
+
+Pin: `b594d7433bf4e408b44215e25e5304696d6f840e` on `https://github.com/judegomila/OnCo.git`.
+Subject: `chore: render this week's issue to public/newsletter/ (#254)` (2026-10-12 08:17:45 +0000).
+Local checkout: `upstream-onco/`, gitignored. This report does not vendor upstream source or corpus text.
+Re-count with `python3 scripts/audit_upstream.py`.
+
+## Reproduce
+
+Node v24.11.1, npm 11.6.2.
+
+| Command | Result |
+|---|---|
+| `npm ci --ignore-scripts` | Exit 0. 473 packages added, 474 audited. npm reported 13 vulnerabilities (2 moderate, 9 high, 2 critical). Lifecycle scripts were skipped. |
+| `NODE_OPTIONS=--max-old-space-size=6144 npx tsc --noEmit` | Exit 0, no diagnostics. |
+| `npx tsc --noEmit` at the default heap | Exit 134. V8 mark-compact failed near a 2 GB heap. |
+| `npx vitest run src/lib/dag.test.ts src/components/CollapsibleSection.test.ts src/lib/graph-layout.test.ts` | Exit 0. 3 files, 23 tests. |
+| `npx eslint src/lib/kinds.ts src/lib/dag.ts src/components/filters/ResultsTable.tsx src/components/ui.tsx` | Exit 0, no findings. |
+| `npm run build` / `npm test` / full `npm run lint` | Not run. |
+
+`npm run build` starts with `build:api`, which runs network fetchers and corpus compilers (`github-stars`, embeddings, ask, similar, triples, context, freshness, newsletter) before `next build`. That is a publication pipeline, not a check that the UI typechecks. The full Vitest run loads the corpus (`src/lib/graph.test.ts` is named `corpus`). Both stay out of this pass. R2 is partly open: the toolchain reproduces; the static site build does not.
+
+## License matrix
+
+There is no `NOTICE` file. `LICENSE` is MIT, copyright line `Copyright (c) 2026 OnCo`. `package.json` declares `"license": "MIT"`. That grant covers the software, not the corpus.
+
+| Material | Path | Terms | Decision |
+|---|---|---|---|
+| Application source | `src/` except `src/data/`, `scripts/`, `packages/`, `mcp/` | MIT | May adapt later. Keep the copyright and permission notice with any copied portion. |
+| Corpus | `src/data/` (583 files) | CC BY-NC 4.0, copyright OnCo and contributors | Do not copy. Commercial and internal-pipeline use needs permission. |
+| Logos | `public/logos/` | Owner trademarks; some Wikimedia files with per-file terms in `index.json` | Do not copy. |
+| Portraits | `public/portraits/` | Per-file free licences, not the MIT grant | Do not copy. |
+| Favicons | fetched via a third-party favicon service | Organisations' own icons | Do not copy. |
+| Direct npm dependencies | see below | MIT, ISC, or Apache-2.0 | Usable. No copyleft in the direct set. |
+
+Direct dependencies at the locked versions: `@modelcontextprotocol/sdk` 1.30.0 MIT, `d3-geo` 3.1.1 ISC, `minisearch` 7.2.0 MIT, `next` 16.3.4 MIT, `react` 19.2.8 MIT, `react-dom` 19.2.8 MIT, `topojson-client` 3.1.0 ISC, `zod` 4.5.4 MIT. Dev: Tailwind 4.3.3 MIT, TypeScript 5.9.3 Apache-2.0, ESLint 9.39.5 MIT, Vitest 5.0.0 MIT, `tsx` 4.23.13 MIT, `esbuild` 0.28.2 MIT, and the `@types/*` packages MIT.
+
+`public/` holds 13,458 files and almost no code. Treat it as assets, not as MIT source.
+
+## Size
+
+| Tree | Files | Code files (`.ts`, `.tsx`, `.js`, `.mjs`) |
+|---|---:|---:|
+| `src/` | 1,439 | 1,408 |
+| `src/data/` | 583 | 559 |
+| `src/components/` | 298 | 298 |
+| `src/lib/` | 324 | 323 |
+| `src/app/` | 233 | 227 |
+| `scripts/` | 177 | 170 |
+
+`src/lib/kinds.ts` is the zod-free half of the model so client components do not import `schema.ts`. It lists 20 kinds: cancer, section, technology, target, drug, company, institution, pathway, term, trial, pairing, roadmap, idea, collection, person, bottleneck, paper, journal, biomarker, year. Every kind label and blurb is oncology vocabulary.
+
+Shared relation fields: `related`, `cancers`, `sections`, `technologies`, `targets`, `drugs`, `companies`, `institutions`, `pathways`, `terms`, `trials`, `people`, `bottlenecks`, `keyPapers`, `journals`, `dependsOn`. `related` and `dependsOn` are the generic ones.
+
+A filename search for cancer, drug, target, trial, and similar tokens hits 61 code files under `src/components`, `src/lib`, and `src/app`. The token `adc` also matches `Breadcrumbs.tsx`, so the count is an upper bound, not a reuse list.
+
+## Import trace
+
+| File | Local imports | What is coupled |
+|---|---:|---|
+| `src/components/EntityBrowser.tsx` (34,991 bytes) | 32 | `CancerIcon`, `TargetThumb`, `TechThumb`, `MoleculeSlot`, `ApprovalChip`, plus generic `filters/ResultsTable`, `browser-sort`, URL table state |
+| `src/components/EntityDetail.tsx` | 111 | Cancer record tabs, molecule viewer, trial finder, dosing, coverage, investor panels. Also generic header, TL;DR, citations, neighbours, sources, tabs |
+| `src/lib/graph.ts` | 2 | `EntitySchema` and `ALL_INPUTS` from `@/data`. `forCancer` is a dedicated traversal. Extra edges for pairing, roadmap, cancer, pathway, biomarker, company |
+| `src/app/[kind]/page.tsx` | 22 | Index shell plus branches for `cancer`, `drug`, and `target` |
+| `src/lib/nav.ts` | — | Absent at this pin. Navigation is not a single module. |
+| `src/lib/schema.ts` | — | Domain subtypes over a shared base. Server code re-exports `kinds.ts`. |
+
+## Reuse decision
+
+| Piece | Decision |
+|---|---|
+| `filters/ResultsTable.tsx`, `FacetSelect`, `browser-sort`, URL query state | Extract later. These are the generic table. |
+| `EntityBrowser.tsx` as a whole | Do not copy. Split the row visual registry from the table first. |
+| `ui.tsx` header, TL;DR, citation chip, neighbours, source list, tabs | Extract later as the detail shell. |
+| `EntityDetail.tsx` as a whole | Do not copy. It is the oncology page. |
+| `graph.ts` duplicate and dangling checks, forward and reverse links | Reimplement the behaviour against the canonical snapshot. Do not import `ALL_INPUTS` or `forCancer`. |
+| `kinds.ts` / `KIND_META` | Do not copy the enum. Copy the idea of a zod-free manifest the client can import. |
+| `[kind]/page.tsx` | Copy the static index pattern only. Drop the cancer, drug, and target branches. |
+| `src/data`, `public/logos`, `public/portraits` | Out of scope. |
+| `scripts/build-api.ts` and the fetchers | Copy the idea of a build-time snapshot. Do not copy cancer API clients. |
+| `packages/`, `mcp/` | Later. Same read contract, not part of the first UI extract. |
+
+## Live reference examples
+
+No screenshots were stored. The pages are copyrighted presentation, and a bitmap is not part of the MIT grant. Keyboard walkthrough is still open (`CONTENT-WP-0000-T04`).
+
+| Role | URL | Observed title |
+|---|---|---|
+| Home / search entry | https://onco.cc/ | OnCo: the open, cited map of cancer: treatments, targets, trials, and what is coming |
+| Browse | https://onco.cc/cancers/ | Cancers · OnCo |
+| Browse, second kind | https://onco.cc/drugs/ | Treatments & tests · OnCo |
+| Detail | https://onco.cc/cancers/head-and-neck/ | Head and neck squamous cell carcinoma · Cancer · OnCo |
+| Search / structured query | https://onco.cc/query/ | Query builder: structured questions over the corpus · OnCo |
+| Relations | https://onco.cc/graph/ | Graph explorer · OnCo |
+
+The detail page's first sections are Overview, State of the art, Anatomy and lymph node drainage, Types and stages, Subtypes, Symptoms and diagnosis, Biomarkers clinicians test, Treatment, Standard of care, Trials and papers, Biology and targets, Countries and centres. That is the oncology detail shape. The generic shell we want is title, summary, evidence, and neighbours, not those sections.
+
+## Deviations
+
+- R2: default-heap `tsc` ran out of memory. The same command passed with a 6 GB heap.
+- R2: production `next build` and the full test and lint runs were not executed.
+- R1: `NOTICE` is absent. Preservation of the MIT notice applies when a file is copied, which this pass does not do.
+- T04 screenshots and the keyboard walkthrough are not done.

research/baseline/ONCO_PIN

@@ -0,0 +1,10 @@
+sha: b594d7433bf4e408b44215e25e5304696d6f840e
+committed: "2026-10-12T08:17:45Z"
+remote: https://github.com/judegomila/OnCo.git
+subject: "chore: render this week's issue to public/newsletter/ (#254)"
+local_checkout: upstream-onco
+local_checkout_gitignored: true
+notice_file: absent
+license_files:
+  - LICENSE
+  - LICENSE-DATA

scripts/audit_upstream.py

@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""Read-only inventory of a local OnCo checkout. Writes nothing into the checkout.
+
+The checkout stays gitignored. This script counts files and import edges so the
+baseline report can be committed without copying upstream source or corpus text.
+"""
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+from collections import Counter
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+UPSTREAM = Path(sys.argv[1] if len(sys.argv) > 1 else ROOT / "upstream-onco")
+
+CODE_DIRS = ("src/components", "src/lib", "src/app", "scripts", "packages", "mcp")
+NAME_TOKENS = re.compile(
+    r"cancer|oncolog|drug|target|trial|biomarker|tumou?r|adc|payload",
+    re.I,
+)
+IMPORT_RE = re.compile(
+    r"""^import\s+(?:type\s+)?(?:[\w*\s{},]+\s+from\s+)?["']([^"']+)["']""",
+    re.M,
+)
+KIND_LITERAL = re.compile(r"""kind\s*===?\s*["']([a-z0-9-]+)["']""")
+
+
+def git(*args: str) -> str:
+    proc = subprocess.run(
+        ["git", "-C", str(UPSTREAM), *args],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    return proc.stdout.strip() if proc.returncode == 0 else ""
+
+
+def rel_files(folder: str) -> list[Path]:
+    base = UPSTREAM / folder
+    if not base.is_dir():
+        return []
+    return [p for p in base.rglob("*") if p.is_file()]
+
+
+def imports_of(path: Path) -> list[str]:
+    try:
+        text = path.read_text(encoding="utf-8", errors="replace")
+    except OSError:
+        return []
+    return IMPORT_RE.findall(text)
+
+
+def main() -> int:
+    if not (UPSTREAM / ".git").is_dir():
+        print(f"missing checkout: {UPSTREAM}", file=sys.stderr)
+        return 1
+    sha = git("rev-parse", "HEAD")
+    subject = git("log", "-1", "--format=%ci %s")
+    print(f"pin {sha}")
+    print(f"commit {subject}")
+    print(f"license_exists { (UPSTREAM / 'LICENSE').is_file() }")
+    print(f"license_data_exists { (UPSTREAM / 'LICENSE-DATA').is_file() }")
+    print(f"notice_exists { (UPSTREAM / 'NOTICE').is_file() }")
+
+    for folder in ("src", "src/data", "src/components", "src/lib", "src/app", "public", "scripts"):
+        files = rel_files(folder) if folder != "src" else [
+            p for p in (UPSTREAM / "src").rglob("*") if p.is_file()
+        ]
+        code = [p for p in files if p.suffix in {".ts", ".tsx", ".js", ".mjs"}]
+        print(f"count {folder} files={len(files)} code={len(code)}")
+
+    named = []
+    for folder in ("src/components", "src/lib", "src/app"):
+        for path in rel_files(folder):
+            if path.suffix not in {".ts", ".tsx"}:
+                continue
+            if NAME_TOKENS.search(path.name):
+                named.append(str(path.relative_to(UPSTREAM)))
+    print(f"oncology_named_code {len(named)}")
+    for item in sorted(named)[:40]:
+        print(f"  named {item}")
+    if len(named) > 40:
+        print(f"  named … {len(named) - 40} more")
+
+    focus = [
+        "src/components/EntityBrowser.tsx",
+        "src/components/EntityDetail.tsx",
+        "src/lib/graph.ts",
+        "src/lib/schema.ts",
+        "src/lib/kinds.ts",
+        "src/app/[kind]/page.tsx",
+        "src/lib/nav.ts",
+        "src/lib/tables/kinds.ts",
+    ]
+    for rel in focus:
+        path = UPSTREAM / rel
+        print(f"focus {rel} exists={path.is_file()} bytes={path.stat().st_size if path.is_file() else 0}")
+        if not path.is_file():
+            continue
+        imps = imports_of(path)
+        local = [i for i in imps if i.startswith(".") or i.startswith("@/")]
+        print(f"  imports {len(imps)} local={len(local)}")
+        for item in local:
+            print(f"    {item}")
+        text = path.read_text(encoding="utf-8", errors="replace")
+        kinds = Counter(KIND_LITERAL.findall(text))
+        if kinds:
+            print("  kind_branches " + ", ".join(f"{k}:{v}" for k, v in kinds.most_common(12)))
+
+    # Kind enum from schema if present.
+    schema = UPSTREAM / "src/lib/schema.ts"
+    if schema.is_file():
+        text = schema.read_text(encoding="utf-8", errors="replace")
+        kinds_block = re.search(r"KINDS\s*=\s*\[(.*?)\]\s*as\s+const", text, re.S)
+        if kinds_block:
+            kinds = re.findall(r"""["']([a-z0-9-]+)["']""", kinds_block.group(1))
+            print(f"kinds {len(kinds)} " + " ".join(kinds))
+        rels = re.search(r"REL_FIELDS\s*=\s*\[(.*?)\]\s*as\s+const", text, re.S)
+        if rels:
+            fields = re.findall(r"""["']([A-Za-z0-9_]+)["']""", rels.group(1))
+            print(f"rel_fields {len(fields)} " + " ".join(fields[:40]))
+
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

scripts/bootstrap-upstream.sh

@@ -2,6 +2,7 @@
 set -euo pipefail
 # This is a research/bootstrap helper, not bundled upstream code.
 # Pin commit after manual licensing inspection. Never merge upstream corpus into this repo by default.
+# Reviewed pin: research/baseline/ONCO_PIN (b594d7433bf4e408b44215e25e5304696d6f840e as of 2026-10-12).
 : "${ONCO_COMMIT:?Set ONCO_COMMIT to a reviewed full Git SHA}"
 git clone https://github.com/judegomila/OnCo.git upstream-onco
 git -C upstream-onco checkout --detach "$ONCO_COMMIT"

workplans/CONTENT-WP-0000-upstream-baseline.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Upstream baseline and IP audit"
 domain: infotech
 repo: content-explorer
-status: ready
+status: active
 flavor: planning
 depends_on: []
 created: "2026-10-12"
@@ -22,7 +22,7 @@ Reproduce the OnCo baseline and establish the legal, behavioral, and visual refe
 
 ```task
 id: CONTENT-WP-0000-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "1b9bf018-feae-589e-8374-45f9745fd988"
 ```
@@ -31,7 +31,7 @@ state_hub_task_id: "1b9bf018-feae-589e-8374-45f9745fd988"
 
 ```task
 id: CONTENT-WP-0000-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "bb091b6e-5211-5f2a-a74d-897e28d87b6f"
 ```
@@ -40,7 +40,7 @@ state_hub_task_id: "bb091b6e-5211-5f2a-a74d-897e28d87b6f"
 
 ```task
 id: CONTENT-WP-0000-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "548a55f3-599b-559a-8829-6cd168834821"
 ```
@@ -58,7 +58,7 @@ state_hub_task_id: "755f3c0a-80d9-5584-8011-dcad63418c1d"
 
 ```task
 id: CONTENT-WP-0000-T05
-status: todo
+status: done
 priority: high
 state_hub_task_id: "69d6caf9-bd0c-503b-9fe9-7373904c1e76"
 ```
@@ -67,7 +67,7 @@ state_hub_task_id: "69d6caf9-bd0c-503b-9fe9-7373904c1e76"
 
 ```task
 id: CONTENT-WP-0000-T06
-status: todo
+status: done
 priority: high
 state_hub_task_id: "c3f8d552-a06d-560f-8ef7-af1077d23845"
 ```
@@ -78,7 +78,7 @@ state_hub_task_id: "c3f8d552-a06d-560f-8ef7-af1077d23845"
 
 ```task
 id: CONTENT-WP-0000-T07
-status: todo
+status: done
 priority: high
 state_hub_task_id: "88088935-48a4-5661-9ced-1f559e60b745"
 ```
@@ -87,7 +87,7 @@ state_hub_task_id: "88088935-48a4-5661-9ced-1f559e60b745"
 
 ```task
 id: CONTENT-WP-0000-T08
-status: todo
+status: done
 priority: high
 state_hub_task_id: "37271490-6445-50e8-8a40-fad85df77286"
 ```
@@ -96,7 +96,7 @@ state_hub_task_id: "37271490-6445-50e8-8a40-fad85df77286"
 
 ```task
 id: CONTENT-WP-0000-T09
-status: todo
+status: done
 priority: high
 state_hub_task_id: "5eeaca43-1e59-5180-a599-7c9d6ab99d0c"
 ```
@@ -107,4 +107,4 @@ R1: license/source boundary. R2: unable to reproduce the baseline. Log evidence
 
 ## Evidence
 
-Pull requests, test logs, pinned artifacts, screenshots, or a comparison report where applicable. Add `ImplementationNotes.md` and `Review.md` on completion. Do not mark a gate passed without a verifiable link.
+Evidence: [research/baseline/2026-10-12-upstream-baseline.md](../research/baseline/2026-10-12-upstream-baseline.md) and [research/baseline/ONCO_PIN](../research/baseline/ONCO_PIN). T04 (screenshots and keyboard walkthrough) is still open. The production build and full test/lint runs were not executed.