# WP-00 — Upstream baseline & IP audit

**Purpose:** Reproduce OnCo baseline and establish legal, behavioral and visual reference.

**Dependencies:** see `INDEX.md`. **Status:** planned. **Owner:** to assign. **Estimate:** to refine after WP-00.

## Work packages

- [ ] Pin immutable upstream git SHA and preserve original MIT license/NOTICE.
- [ ] Install exactly locked dependencies; run build/test/lint/typecheck and record results.
- [ ] Trace dependencies of browser, detail, graph, navigation and data.
- [ ] Capture responsive screenshots and keyboard interaction walkthrough.
- [ ] Inventory data, code, logos, artwork, fonts, external dependency licenses.
- [ ] Quantify oncology-specific references and decide component-by-component reuse.

## Acceptance gates

- [ ] Pinned SHA, baseline report and component inventory committed.
- [ ] License matrix separates MIT software from NC dataset/assets.
- [ ] One reference example each for browse/detail/search/relations captured.

## Key risk / mitigation focus

R1: license/source boundary; R2: unable to reproduce baseline. Log evidence and deviations in the workplan review before marking complete.

## Evidence artifacts

Pull requests, test logs, pinned artifacts, screenshots or comparison report where applicable. Add explicit `ImplementationNotes.md` and `Review.md` on completion; do not mark a gate passed without a verifiable link.