The Code Cartographer
How an indie dev turned her repo into court-ready proof… instead of a free buffet for copycats.
This story sits inside our mission to make digital provenance effortless, universal, and trustworthy for the people and systems who depend on it. See Mission & Vision
Problem … When open-source turns into open season
Lina maintains a small but widely used open-source library. She also sells a premium plugin on top of it. Within months, a dev shop forks her repo, strips attribution, and publishes a "new" paid package. Marketplaces don't know who to believe.
- No clear proof of "first authorship" beyond Git history
- No neutral, third-party timestamping
- No easy way to show non-lawyers why the fork violates license terms
Solution … Mirror turns her repo into a provenance spine
She connects her GitHub repo to Mirror (one-time setup). Every tagged release is hashed, timestamped, anchored via OpenTimestamps / IPFS, and given a human-readable manifest. The manifest includes authorship, license, AI-use restrictions, and sovereign zone (jurisdiction).
Mirror doesn't change her workflow… it decorates it with proofs.
Flow … What happens when someone ships a copycat package
Step 1: Discovery
Lina sees a suspicious package and pulls the code.
Step 2: Comparison
Mirror produces a lineage + similarity report showing her original artifact timestamps vs the copycat's publication date, and license terms embedded in her manifests.
Step 3: Action
Lina sends a provenance bundle to the marketplace: one-click export of proof-of-origin manifests, timestamps, license snapshot, and hash comparisons.
Step 4: Resolution
Marketplace trust & legal teams review her dossier, see the stamped provenance, and de-list the infringing package.
Outcomes … From paranoia to posture
- Faster takedown or enforcement actions because evidence is structured and legible
- Stronger negotiating position with platforms and infringers
- Marketing angle: "Our SDKs are provenance-backed" on her own site
"Instead of arguing opinions on a forum thread, I send one provenance link. That's it."
Product connection … Why this is a Mirror use case
Git-friendly workflow, release-level manifests and anchors, open ecosystem… she can use proofs anywhere (marketplaces, emails, legal letters). Cross-link to Mirror product page.
Turn your repo into proof… not prey.
If your code is your livelihood, Mirror makes "I published first" a mathematical fact.
Why this matters now
Cases like this are emerging because AI, synthetic media, and global information flows have made provenance a necessity rather than a luxury. When it's no longer obvious who made what, when, or why, stories like this become the norm.
The Genesis Moment explains the broader context for this kind of provenance work. Read Genesis.
Work like this, when implemented on the SOVEREIGN\PROVENANCE platform, is governed by The Covenant of Restraint, our ethical framework for how we build and deploy provenance systems.
Governed by The Covenant of Restraint, aligned with our Mission & Vision, and grounded in the Genesis Moment.