Mark vendored and byte-gated trees; document the ops/ taxonomy (#78 phase 0)

[qywu]

Phase 0 of #78 — mark, don't move. Zero import churn; no Python file is modified.

• Hook protection: the pre-commit global exclude (already covering quack/) now also covers linear_attention/flashqla/ and bi_families_v2.py. The latter was only excluded from ruff-format before — but the ruff hook runs --fix-only (a rewriter), so a rule upgrade could have silently edited the sha256-gated bytes.
• Direct-invocation protection: the same excludes land in [tool.ruff] with force-exclude = true, so ruff skips these paths even when they're passed explicitly (this is exactly how a tree-wide ruff --fix recently rewrote 45 vendored quack files).
• codespell skips the vendored trees.
• ops/quack/VENDORED.md: provenance (Dao-AILab QuACK, snapshotted at 0.4.1 as a partial fork that still imports helpers from the quack-kernels==0.5.0 PyPI pin) and the local-patch ledger (cute_dsl_elf_fix, cute_dsl_mlir_threading), generalizing the existing flashqla pattern.
• ops/README.md: the edit-policy table (vendored / byte-contract-gated / first-party), a map of every subtree, and where each is headed under Reorganize src/xorl/ops: quarantine vendored code, separate kernels / layers / objectives, one home for the exact-contract family #78.

Verified: pre-commit run --all-files (the lint CI command) passes; ruff check on the excluded paths now reports no files.

Next: phase 1 (physically quarantine quack/ + flashqla/ under ops/_vendored/ with re-export stubs) after #77 lands.

[broly-code-security-scanner]

Broly Security Scan

Note

✅ Clean scan
No vulnerabilities detected in this PR.

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.2) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Exploit Chains · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.