Covers July 13 - 14, 2026.
Update, August 31, 2026: This post records aidd’s packaged v2 release. aidd v3 ships source only. It no longer distributes compiled executables, container images, checksum bundles, or Bun itself, so the LGPL relink offer described below was retired. Its generated license document now inventories the runtime dependency closure and separately tracks material vendored in the repository; it does not claim that npm dependencies travel with the source release.
The off-stack weekend ended with an unexpected problem: even a static blog has third-party licensing obligations. Once people can download releases, the required notices have to travel with what ships. I spent two days making that mechanical across the fleet. I don’t mind spending time automating something if it keeps me from forgetting later.
I started from an embarrassing place. The license lists were hand-maintained and had already drifted: packages missing, versions stale. I hadn’t noticed because nothing was checking. I replaced them with third-party license documents generated from the installed dependency graph, and CI now fails when the generated output and the lockfile disagree.
What took me longer to get right was where the checks look. I made the release checks inspect the files that actually ship. At the time, aidd verified its runtime closure against the built release archives and included an LGPL relink offer for the Bun runtime embedded in its standalone executable. Spernakit verifies its container contents and it’s deterministic now. I also verify that required notices survive all the way into browser assets.
One core, four repos
By Tuesday, I had similar license-resolution logic in four repositories. That meant four chances for a fix to land in one but miss three. I extracted the license parser, lockfile resolver, installed-package walker, and manifest reader into a shared license-core. It includes a fail-closed self-test. Then, I sent identical copies to aidd, the astro blog, and Podex. The sync tool won’t run outside Spernakit. It also won’t overwrite a sibling’s uncommitted work. Those restrictions came from problems I’d had in earlier shared-code experiments.
Podex 0.4.0 picked up the shared core and, while I was in there, fixed a quieter bug in its own gates: the test wrapper had been reporting success when Pester failed during discovery but before a single test ran. It checks Pester’s overall result now.
The blog has machine-readable licensing and the same dependency checks now. I checked the negative case too: removing a required notice has to stop the build.