@Jessica i once designed a system where you would basically put these little markers in the source code files, and a tool would scan the text between the markers and output a receipt of hashes for named regions.
the idea was you could put these markers around strategic parts of a program and then if you wrote say an article or a plugin you'd say that you were consuming one of those hashes. then if something changes upstream they just publish a new receipt file and you can check if your shit might be broken or not.
federated breakage audits, basically. not people fighting over getting upstreamed.