Files
insights/.vendormark-allow
zeekay 44ff9389d2 vendormark: the harness logo registry is other people's marks, not ours
The cicd gate fails on one tracked path,
products/mcp_analytics/frontend/harness-logos/lovable.png, because `lovable` is
on the site-generator vendor list.

The rule is right and the case is its inverse. That directory is a registry of
OTHER products' marks — claude, cursor, vscode, notion, replit, windsurf, grok,
linear and eleven more — which the MCP dashboard draws beside a row to say which
client made the call. harnessRegistry.ts imports each by filename and the backend
maps the reported client name onto it, so the mark is DATA, the way a browser
icon is data in a web-analytics table. Fifteen of those files say nothing to this
gate and one does, purely because its name collides with a vendor on the list.

The gate's own remedy does not fit: it says to replace the asset with the real
brand mark, and for a row about Lovable the real brand mark IS Lovable's. Ours
there would mislabel the data.

So this uses the escape hatch vendormark already ships rather than renaming a
file to slip past a name check. Scoped to the logo directory, so a genuine vendor
asset anywhere else in mcp_analytics is still caught.

Verified by running bin/vendormark from hanzoai/ci against this tree: exits 0,
"no site-generator branding in paths, tracked content, messages or identities".
2026-08-07 15:07:07 -07:00

25 lines
1.3 KiB
Plaintext

# Paths vendormark may skip. One glob per line.
#
# The rule it enforces is right: a site-generator vendor's name in a tracked path
# is a URL the browser requests, so shipping one puts that vendor's branding in
# our page. Almost every hit is exactly that, and this file should stay almost
# empty.
#
# products/mcp_analytics/frontend/harness-logos/ is the exception, and it is the
# inverse case. That directory is a REGISTRY OF OTHER PEOPLE'S MARKS — claude,
# cursor, vscode, notion, replit, windsurf, grok, linear and eleven more — which
# the MCP dashboard draws beside a row to say which client made the call.
# harnessRegistry.ts imports each one by filename and the backend maps the
# reported client name to it, so the mark is DATA, the way a browser icon is data
# in a web-analytics table. Fifteen of those files are unremarkable to this gate
# and one is not, purely because `lovable` happens to sit on the vendor list —
# the name is the same, the meaning is opposite.
#
# The gate's own remedy does not fit here either: it says to replace the asset
# with the real brand mark, and the real brand mark for a row about Lovable IS
# Lovable's. Putting ours there would mislabel the data.
#
# Scoped to the logo directory, so a genuine vendor asset anywhere else in
# mcp_analytics is still caught.
products/mcp_analytics/frontend/harness-logos/*