The off-stack weekend ended with an unexpected problem: even a static blog has third-party licensing obligations. Once people can download releases, the required notices have to travel with what ships. I spent two days making that mechanical across the fleet. I don’t mind spending time automating something if it keeps me from forgetting later.
I started from an embarrassing place. The license lists were hand-maintained and had already drifted: packages missing, versions stale. I hadn’t noticed because nothing was checking. I replaced them with third-party license documents generated from the installed dependency graph, and CI now fails when the generated output and the lockfile disagree.
What took me longer to get right was where the checks look. I made the release checks inspect the files that actually ship. At the time, aidd verified its runtime closure against the built release archives and included an LGPL relink offer for the Bun runtime embedded in its standalone executable. Spernakit verifies its container contents and it’s deterministic now. I also verify that required notices survive all the way into browser assets.
One core, four repos
By Tuesday, I had similar license-resolution logic in four repositories. That meant four chances for a fix to land in one but miss three. I extracted the license parser, lockfile resolver, installed-package walker, and manifest reader into a shared license-core. It includes a fail-closed self-test. Then, I sent identical copies to aidd, the astro blog, and Podex.
Podex picked up the shared core and shipped it in 0.4.0. Its test wrapper also needed the Pester discovery-failure correction I describe in the later account.
The blog has machine-readable licensing and the same dependency checks now. I checked the negative case too: removing a required notice has to stop the build.
Later update, July 17, 2026: I added guards so the sync tool refuses to run outside Spernakit or overwrite a sibling’s uncommitted work. Those restrictions came from problems I’d had in earlier shared-code experiments.
Later update: In August, aidd v3 moved to source-only releases. That retired the compiled executables, container images, checksum bundles, and the LGPL relink offer for the bundled Bun runtime. The generated license document still inventories the runtime dependency closure, with repository-vendored material tracked separately. The release itself carries source; users install the dependencies.