fold/third_party/README.md

Fold third-party analysis libraries

This directory contains two classes of third-party content:

1. Active vendored code — code already wired into the build, e.g. ghidra-decompiler/.
2. Optional vendor manifests — VENDOR.md files for libraries we are evaluating before importing or linking. Their source trees are fetched under third_party/<name>/src/ by scripts/vendor/fetch_analysis_libs.sh and are ignored until we make a deliberate import decision.

Current optional manifests:

Directory	Role
souffle/	Datalog fact engine for MidIR-derived facts
lief/	Binary metadata parser for ELF/PE/Mach-O structure

Deferred candidates such as RetDec, Remill/McSema, PhASAR, and Crab/Clam remain research topics in docs/research/, but no longer occupy active vendor slots.

Fetch optional sources with:

scripts/vendor/fetch_analysis_libs.sh

Do not wire an optional library into fold-core until its VENDOR.md open checks are resolved and the architecture map in docs/research/ identifies its lane.

Reference docs:

• docs/research/vendor-architecture-map-2026-05-31.md — Fold-specific lane ownership.
• docs/research/vendor-library-study-2026-05-31.md — external reading list and deferred-lane policy.