fix: close source release legal provenance gaps

.github/workflows/ci.yml

@@ -96,10 +96,6 @@ jobs:
           node-version: '24'
           cache: npm
 
-      - name: Verify ASF source release mechanics
-        if: steps.plan.outputs.asf_source == 'true'
-        run: npm run check:asf-source
-
       - name: Select the release npm toolchain
         if: steps.plan.outputs.cli_package == 'true'
         run: npm install --global --no-audit --no-fund "$(node -p 'require("./package.json").packageManager')"
@@ -129,9 +125,16 @@ jobs:
           fi
 
       - name: Install dependencies
-        if: steps.plan.outputs.code == 'true' || steps.plan.outputs.cli_package == 'true' || steps.plan.outputs.release_contract == 'true'
+        if: steps.plan.outputs.code == 'true' || steps.plan.outputs.asf_source == 'true' || steps.plan.outputs.cli_package == 'true' || steps.plan.outputs.release_contract == 'true'
         run: npm ci
 
+      # The header audit above remains install-free. The complete source gate
+      # also exercises generation and therefore runs after its pinned formatter
+      # dependency is installed, matching the source-candidate workflow.
+      - name: Verify ASF source release mechanics
+        if: steps.plan.outputs.asf_source == 'true'
+        run: npm run check:asf-source
+
       - name: Lint
         if: steps.plan.outputs.code == 'true'
         run: npm run lint

DISCLAIMER-WIP

@@ -11,7 +11,6 @@ policy. For example, releases may have incomplete or un-reviewed licensing
 conditions. What follows is a list of issues the project is currently aware of
 (this list is likely to be incomplete):
 
- * NOTICE has not yet been reworked into ASF form.
  * The software grant and committer ICLAs are not yet complete.
 
 If you are planning to incorporate this work into your product/project, please

LICENSE

@@ -207,9 +207,11 @@ Vercel AI SDK
 
 Source: https://www.npmjs.com/package/@ai-sdk/provider-utils/v/5.0.11
         https://www.npmjs.com/package/@ai-sdk/provider/v/4.0.3
+Patched package: https://www.npmjs.com/package/@ai-sdk/provider-utils/v/5.0.27
 Repository: https://github.com/vercel/ai/tree/main/packages/provider-utils
             https://github.com/vercel/ai/tree/main/packages/provider
-Version: @ai-sdk/provider-utils 5.0.11, @ai-sdk/provider 4.0.3
+Adapted declarations: @ai-sdk/provider-utils 5.0.11, @ai-sdk/provider 4.0.3
+Dependency patch: patches/@ai-sdk+provider-utils+5.0.27.patch
 Copyright 2023 Vercel, Inc.
 License: Apache-2.0
 
@@ -220,7 +222,9 @@ License, Version 2.0 above applies to the adapted material.
 
 The pinned versions are the ones present when the adaptation was made. The
 adapted declarations are unchanged through @ai-sdk/provider-utils 5.0.25 and
-@ai-sdk/provider 4.0.7, the versions recorded by the code origin audit.
+@ai-sdk/provider 4.0.7, the versions recorded by the code origin audit. Maka
+also redistributes a patch against @ai-sdk/provider-utils 5.0.27; that patch
+modifies Apache-2.0 source and is covered by the license reproduced above.
 
 Astryx
 
@@ -231,8 +235,9 @@ Copyright (c) 2026 Meta Platforms, Inc.
 License: MIT
 
 Maka includes an ejected adaptation of Astryx ChatReasoning v0.1.9 and generated
-theme artifacts based on Astryx theme-neutral v0.4.0. The following MIT License
-applies to that material:
+theme artifacts based on Astryx theme-neutral v0.4.0. Maka also redistributes
+`patches/@astryxdesign+core+0.4.0.patch`, which modifies the MIT-licensed Astryx
+core package. The following MIT License applies to that material:
 
 MIT License
 
@@ -256,6 +261,77 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+node-pty dependency patch
+
+Source: https://www.npmjs.com/package/node-pty/v/1.2.0-beta.15
+Repository: https://github.com/microsoft/node-pty
+Version: 1.2.0-beta.15
+Dependency patch: patches/node-pty+1.2.0-beta.15.patch
+License: MIT
+
+Maka redistributes a source patch for node-pty's Unix PTY write lifecycle. The
+following license notices are reproduced from node-pty 1.2.0-beta.15:
+
+Copyright (c) 2012-2015, Christopher Jeffrey (https://github.com/chjj/)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+Copyright (c) 2016, Daniel Imms (http://www.growingwiththeweb.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Copyright (c) 2018 - present Microsoft Corporation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 trycua/cua cursor-overlay
 
 Source: https://github.com/trycua/cua
@@ -365,22 +441,27 @@ file. The modifications Maka made are stated in the header of edit-replace.ts,
 as Apache-2.0 section 4(b) requires.
 
 
-sst/models.dev (generated model catalog snapshot)
+anomalyco/models.dev (generated model catalog snapshot)
 
 Source: https://models.dev/api.json
-Repository: https://github.com/sst/models.dev
+Repository: https://github.com/anomalyco/models.dev
 Copyright (c) 2025 models.dev
 License: MIT
 
 packages/core/src/model-metadata.generated.ts and
 packages/runtime/src/telemetry/model-pricing.generated.ts are generated from the
 models.dev catalog by scripts/sync-model-metadata.mjs and are redistributed with
-Maka. They copy and transform selected model and provider metadata from that
-catalog, including upstream display names and descriptive text, lifecycle status
-values, reasoning effort options, context and output limits, modalities, and
-prices. Which providers are kept, which fields are kept, and the order they
-appear in are decided by the generator. The following MIT License applies to
-the material taken from upstream:
+Maka. The exact selected input projection is stored at
+scripts/model-metadata/models-dev-api.snapshot.json. Its origin record either
+binds a refresh to the downloaded response digest or identifies the exact Maka
+commit whose generated outputs seeded the migration snapshot. The snapshot
+also carries a digest of its normalized projection; the generated-file headers
+bind each output to that digest. They copy and transform selected model and
+provider metadata from that catalog, including upstream display names and
+descriptive text, lifecycle status values, reasoning effort options, context
+and output limits, modalities, and prices. Which providers are kept, which
+fields are kept, and the order they appear in are decided by the generator. The
+following MIT License applies to the material taken from upstream:
 
 MIT License
 
@@ -405,107 +486,49 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 
-Geist and Geist Mono (bundled webfonts)
-
-Source: https://github.com/vercel/geist-font
-Emitted by: @fontsource-variable/geist 5.3.0, @fontsource-variable/geist-mono 5.3.0
-Copyright 2024 The Geist Project Authors
-License: SIL Open Font License, Version 1.1
-
-Maka's desktop renderer bundle embeds Geist Variable and Geist Mono Variable
-webfont files. The packages that carry them are build-time dependencies, but
-the `.woff2` files themselves are emitted into the renderer bundle and are
-therefore redistributed in binary artifacts. The upstream license text for
-that material follows verbatim:
-
-This Font Software is licensed under the SIL Open Font License, Version 1.1.
-This license is copied below, and is also available with a FAQ at:
-http://scripts.sil.org/OFL
-
-
------------------------------------------------------------
-SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
------------------------------------------------------------
-
-PREAMBLE
-The goals of the Open Font License (OFL) are to stimulate worldwide
-development of collaborative font projects, to support the font creation
-efforts of academic and linguistic communities, and to provide a free and
-open framework in which fonts may be shared and improved in partnership
-with others.
-
-The OFL allows the licensed fonts to be used, studied, modified and
-redistributed freely as long as they are not sold by themselves. The
-fonts, including any derivative works, can be bundled, embedded,
-redistributed and/or sold with any software provided that any reserved
-names are not used by derivative works. The fonts and derivatives,
-however, cannot be released under any other type of license. The
-requirement for fonts to remain under this license does not apply
-to any document created using the fonts or their derivatives.
-
-DEFINITIONS
-"Font Software" refers to the set of files released by the Copyright
-Holder(s) under this license and clearly marked as such. This may
-include source files, build scripts and documentation.
-
-"Reserved Font Name" refers to any names specified as such after the
-copyright statement(s).
-
-"Original Version" refers to the collection of Font Software components as
-distributed by the Copyright Holder(s).
-
-"Modified Version" refers to any derivative made by adding to, deleting,
-or substituting -- in part or in whole -- any of the components of the
-Original Version, by changing formats or by porting the Font Software to a
-new environment.
-
-"Author" refers to any designer, engineer, programmer, technical
-writer or other person who contributed to the Font Software.
-
-PERMISSION & CONDITIONS
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of the Font Software, to use, study, copy, merge, embed, modify,
-redistribute, and sell modified and unmodified copies of the Font
-Software, subject to the following conditions:
-
-1) Neither the Font Software nor any of its individual components,
-in Original or Modified Versions, may be sold by itself.
-
-2) Original or Modified Versions of the Font Software may be bundled,
-redistributed and/or sold with any software, provided that each copy
-contains the above copyright notice and this license. These can be
-included either as stand-alone text files, human-readable headers or
-in the appropriate machine-readable metadata fields within text or
-binary files as long as those fields can be easily viewed by the user.
-
-3) No Modified Version of the Font Software may use the Reserved Font
-Name(s) unless explicit written permission is granted by the corresponding
-Copyright Holder. This restriction only applies to the primary font name as
-presented to the users.
-
-4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
-Software shall not be used to promote, endorse or advertise any
-Modified Version, except to acknowledge the contribution(s) of the
-Copyright Holder(s) and the Author(s) or with their explicit written
-permission.
-
-5) The Font Software, modified or unmodified, in part or in whole,
-must be distributed entirely under this license, and must not be
-distributed under any other license. The requirement for fonts to
-remain under this license does not apply to any document created
-using the Font Software.
-
-TERMINATION
-This license becomes null and void if any of the above conditions are
-not met.
-
-DISCLAIMER
-THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
-OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
-COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
-DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
-OTHER DEALINGS IN THE FONT SOFTWARE.
+DeepSeek Harness (adapted source)
+
+Source: https://github.com/deepseek-ai/deepseek-harness
+Revision: 47f943859bef60e4160492346772ded9b24f765a
+Path: examples/jsonrpc-agent/minimal.cordis.yml
+Copyright (c) 2026 DeepSeek
+License: MIT
+
+`packages/eval/harbor/deepseek-harness-profile/cordis.patch.yml` adapts the
+upstream plugin composition, persistent-bash description, and persona. The
+file identifies Maka's modifications and scopes this MIT notice to the derived
+material; the surrounding modifications are Apache-2.0.
+
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Desktop renderer vendored source assets
+
+The source archive includes third-party SVG paths and source assets used by the
+desktop renderer. Their file-by-file inventory, immutable upstream revisions,
+copyright notices, and license texts are in:
+
+  apps/desktop/src/renderer/public/THIRD_PARTY_LICENSES.txt
+
+Additional verbatim license texts referenced by that inventory are in:
+
+  apps/desktop/resources/licenses/renderer/

NOTICE

@@ -1,8 +1,5 @@
-Maka
-Copyright 2026 The Maka Authors
+Apache Maka (incubating)
+Copyright 2026 The Apache Software Foundation
 
-This product includes software developed by the Maka project.
-
-Third-party components remain subject to their respective licenses and
-attribution notices. Those notices are distributed with the applicable
-components and application artifacts.
+This product includes software developed at
+The Apache Software Foundation (https://www.apache.org/).

README.md

@@ -244,10 +244,10 @@ npm --workspace @maka/eval test
 npm --workspace @maka/desktop test
 ```
 
-Use the following commands to update `packages/core/src/model-metadata.generated.ts` from models.dev and run the focused tests. Keep access-path-specific overrides in `model-metadata.ts`; do not edit the generated file by hand.
+Use `refresh:model-metadata` to fetch the current catalog from models.dev, update the committed snapshot, and regenerate the derived TypeScript files. A refresh fails closed when any committed model, capability, provider override, or pricing field disappears; after reviewing an intentional upstream removal, acknowledge it with `npm run refresh:model-metadata -- --accept-upstream-removals`. `sync:model-metadata` is intentionally offline: it only regenerates those files from the committed snapshot. Keep access-path-specific overrides in `model-metadata.ts`; do not edit the generated files by hand.
 
 ```sh
-npm run sync:model-metadata
+npm run refresh:model-metadata
 npm --workspace @maka/core test
 ```
 

README.zh-CN.md

@@ -241,10 +241,10 @@ npm --workspace @maka/eval test
 npm --workspace @maka/desktop test
 ```
 
-用以下命令从 models.dev 更新 `packages/core/src/model-metadata.generated.ts`，并运行相关测试。访问路径特有的 override 写在 `model-metadata.ts`，不要手动修改生成文件。
+用 `refresh:model-metadata` 从 models.dev 获取当前目录、更新仓库内快照，并重新生成派生的 TypeScript 文件。已提交的模型、能力、provider override 或 pricing 字段消失时，refresh 会 fail closed；审查确认上游确实有意删除后，用 `npm run refresh:model-metadata -- --accept-upstream-removals` 显式确认。`sync:model-metadata` 刻意保持离线，只会从已提交快照重新生成这些文件。访问路径特有的 override 写在 `model-metadata.ts`，不要手动修改生成文件。
 
 ```sh
-npm run sync:model-metadata
+npm run refresh:model-metadata
 npm --workspace @maka/core test
 ```