docs(provenance): record Computer Use and bundled Skill origins

[hqhq1025]

Summary

At a high level, Maka's Computer Use implementation was informed by the MIT-licensed trycua/cua and iFurySt/open-codex-computer-use projects and by comparison with Codex Desktop's implementation and externally visible behavior. Maka integrated and adjusted those inputs through its own testing, safety boundaries, and product requirements.

This PR:

• adds a bundled-Skill provenance manifest without changing any SKILL.md body or installed content hash
• records the contributor-confirmed origin of computer-use: independently authored by Haoqing Wang with OpenAI Codex assistance from Maka source, the maka.cu/2 schema, and Maka tests, with no third-party Skill body used
• tracks the 29 Skills introduced by feat(skills): built-in skill catalog with install-on-demand #842 as awaiting a contributor declaration, with rot guards requiring every bundled Skill to have exactly one provenance disposition
• documents the Computer Use cursor's mixed provenance without collapsing binary-derived facts into either MIT source lineage or Maka-authored work
• adds the fixed trycua/cua revision, Cua AI copyright notice, and full MIT text to the top-level LICENSE, which the desktop packager already ships as licenses/maka/LICENSE

Cursor provenance findings

The source record is mixed:

• the first Maka renderer was a TypeScript adaptation of MIT-licensed trycua/cua
• Maka used the fixed signed Codex Desktop binary as both a compatibility reference and a static-analysis input, reading Mach-O data constants, Swift type and field metadata, and disassembled control flow
• feat(desktop): replicate Codex computer-use cursor #1255 accurately recorded that the normalized glyph, center hotspot, and 30 MotionConfiguration.live values came from static inspection of the signed 2026-07-16 SkyComputerUseService artifact
• fix(cu): make the agent cursor land where it is aimed, and stop it curling #1883 accurately recorded that the core 24-step measurement and scorer coefficients were recovered from the binary at 0x1000972ec; the core weights retained today are 320, 140, 180, 18, and 45
• the phrase "term-for-term reproduction" was too broad for the whole current scorer, which also includes a Maka-authored raw-length cost and backwards-arrival penalty
• the current single-segment candidate family, odd grid, departure fan, viewport behavior, frame clock, presentation fences, target-window ordering, palette, and host integration are Maka-authored or Maka-adjusted
• the retained 0.995 / 3.157 close-enough thresholds and binary addresses are scoped only to the inspected build and must not be generalized to later Codex Desktop builds

docs/computer-use-cursor-provenance.md gives the artifact hash, inspection method, reproducibility limit, canonical wording, component-by-component matrix, and the applicable-terms gate. The historical artifact is no longer present at the recorded path; that path now contains a different 2026-08-05 signed build. No OpenAI source code or executable is redistributed, and the project must either independently replace the retained binary-derived components or obtain a human legal/ASF determination before code transfer.

Scope

This PR resolves the contributor declaration for the computer-use Skill and creates the reviewable tracking surface for the remaining catalog. It does not establish the origin of the 29 Skills from #842, and it does not close #2669. Those entries still require a declaration from the introducing contributor, documented third-party sources and licenses, or clean rewrite/removal.

The computer-use record remains pending-independent-review; this PR is the review surface for that sign-off.

Runtime impact

None. No cursor logic, constants, bundled Skill body, generated Skill body, or installation content hash changes.

Validation

• node --test scripts/computer-use-provenance.test.mjs scripts/bundled-skill-catalog.test.mjs — 9 passed
• node --test scripts/electron-builder-config.test.mjs — 2 passed
• Biome check over the changed source, tests, and manifest — passed
• git diff --check — passed

Refs #2669

[hqhq1025]

I re-audited the original commits and the preserved cursor reconstruction evidence. The first revision of this PR was wrong to reclassify all retained cursor data as compatibility observations or local choices.

The corrected boundary is now explicit in ff39ebd32:

1. feat(desktop): replicate Codex computer-use cursor #1255's binary-recovery description was accurate for the normalized glyph, center hotspot, and the 30 MotionConfiguration.live values from the signed 2026-07-16 artifact.
2. fix(cu): make the agent cursor land where it is aimed, and stop it curling #1883's address 0x1000972ec identified the inlined scorer, and its core 24-step measurement plus weights 320/140/180/18/45 were binary-derived. The 0.995/3.157 close-enough values were also read from that fixed build.
3. "Term-for-term" was too broad for the complete current Maka implementation: scoreCursorPath adds raw path length and a local backwards-arrival term, while planCursorPath uses a Maka-authored single-segment candidate family rather than the binary's candidate generator. The frame clock, viewport handling, presentation fences, target integration, rendering, and host lifecycle are also Maka work.

The PR now preserves the artifact hash and build-specific addresses, lists every retained binary-derived component, lists the Maka-authored divergences separately, and states that this evidence does not itself provide a license grant. No runtime value or algorithm changed in this correction.

[hqhq1025]

9bc4c4e6b adds the canonical wording and method record requested for this provenance review:

Maka used a specific signed Codex Desktop binary both as a compatibility reference and as a static-analysis input. The inspection read Mach-O data constants, Swift type and field metadata, and disassembled control flow. Maka then wrote TypeScript using the listed binary-derived facts and added the separately listed Maka behavior.

Self-check against the release-review requirements:

• fixed third-party input identified by build date and SHA-256
• inspection method stated
• exact retained binary-derived facts listed separately from MIT source and Maka-authored work
• no claim that inspection supplies a license
• no OpenAI source or executable redistribution claimed
• AI assistance recorded in commit trailers
• independent human licensing/release conclusion remains explicitly pending

The rot guard now requires these distinctions to remain in the repository record.

[hqhq1025]

c0dd56c28 adds the requested high-level summary: the Computer Use implementation was informed by trycua/cua, open-codex-computer-use, Codex Desktop's implementation and visible behavior, and Maka's own testing and product constraints.

That summary is now the entry point in both the PR and repository record. The detailed sections remain because the three reference sources were used differently: MIT source adaptation, public design/behavior reference, and exact facts recovered from a fixed signed binary.

[Astro-Han]

Thanks for re-auditing this. The latest head now gives a much clearer and more accurate account of the mixed cursor provenance. In particular, it preserves the binary-derived facts instead of reclassifying them as product observations or local implementation choices.

I have three follow-up suggestions. I do not think they need to block this provenance record from landing, provided they remain tracked and are resolved before code transfer.

1. Please account for the trycua/cua MIT material in LICENSE.

The PR records the renderer as a TypeScript adaptation of trycua/cua, and palette.ts still identifies itself as a faithful 1:1 port with the same palette data. The fixed upstream commit is MIT-licensed:

https://github.com/trycua/cua/blob/8c921b2b3bf13494724ead4f0a814d80c56a7e8b/LICENSE.md

The top-level LICENSE does not currently mention trycua/cua or Cua AI, Inc. Please add the component, fixed upstream revision, copyright notice, and MIT license text or an in-distribution pointer, either here or in a focused follow-up before code transfer.

The upstream revision has no NOTICE, so an addition to Maka's NOTICE does not appear necessary. This matches ASF guidance for bundled MIT material:

https://infra.apache.org/licensing-howto.html#bundling-permissively-licensed-dependencies

2. Please keep the applicable-terms question open for the binary-derived components.

The updated record confirms that the signed SkyComputerUseService binary was used to inspect Mach-O constants, Swift metadata, and disassembled control flow. It also identifies the retained geometry, motion values, thresholds, path measurement, and scorer coefficients.

OpenAI's individual Terms of Use and Services Agreement restrict reverse engineering, decompilation, and attempts to discover underlying components, subject to applicable-law exceptions:

https://openai.com/policies/row-terms-of-use/
https://openai.com/policies/services-agreement/

We have not established which agreement governed the inspection or whether an applicable-law exception applies. The current wording correctly avoids claiming that inspection provides a license. Before code transfer, the project should either independently replace the retained binary-derived components or obtain an appropriate human legal or ASF determination based on the actual terms and jurisdiction.

3. Please clarify the reproducibility limit for the inspected artifact.

The document lists the historical path and SHA-256 of the July 16 build. The same local path now contains a newer build with a different hash. It would help future reviewers to state that the inspected artifact is no longer available at that path and that the hash is contemporaneous contributor evidence, unless another verifiable copy exists. Sanitized analysis records can be retained without redistributing the proprietary binary.

The computer-use Skill declaration, the unresolved group for the other 29 Skills, and the catalog guards look consistent. The focused tests pass, 7/7, and the current CI checks are green.

AI assistance: Codex inspected the diff, repository history, focused tests, and linked policies. I reviewed the cited evidence and own these comments. The final licensing decision still requires independent human judgment.

中文对照

感谢重新核查。最新 head 对 cursor 混合来源的记录已经清楚、准确了很多，特别是保留了 binary-derived 的事实，没有再将它们统一描述为产品观察或本地实现选择。

我还有三项后续建议。只要这些事项继续被追踪，并在代码转移前解决，我认为它们不需要阻塞这份 provenance 记录本身合入。

1. 请在 LICENSE 中记录 trycua/cua 的 MIT 材料。

PR 已记录 renderer 是 trycua/cua 的 TypeScript 改编，palette.ts 也仍注明自己是 faithful 1:1 port，并保留了相同的 palette 数据。固定上游提交采用 MIT 许可证：

https://github.com/trycua/cua/blob/8c921b2b3bf13494724ead4f0a814d80c56a7e8b/LICENSE.md

当前顶层 LICENSE 没有提及 trycua/cua 或 Cua AI, Inc.。请补充组件、固定上游版本、版权声明，以及 MIT 许可证全文或指向发行包内许可证副本的链接。可以在这个 PR 中处理，也可以通过一个聚焦的后续 PR 在代码转移前完成。

该上游版本没有 NOTICE，因此目前看不需要修改 Maka 的 NOTICE。这与 ASF 对 bundled MIT 材料的指引一致：

https://infra.apache.org/licensing-howto.html#bundling-permissively-licensed-dependencies

2. 请继续追踪 binary-derived 部分所适用的条款问题。

更新后的记录确认检查了签名的 SkyComputerUseService binary，包括 Mach-O 常量、Swift 元数据和反汇编控制流，并列出了仍然保留的几何、motion 参数、thresholds、path measurement 和 scorer coefficients。

OpenAI 面向个人的使用条款和服务协议均限制 reverse engineering、decompilation 和发现底层组件，但适用法律例外除外：

https://openai.com/policies/row-terms-of-use/
https://openai.com/policies/services-agreement/

目前尚未确认当时适用哪份协议，也未确认是否存在适用法律例外。当前文档没有声称 binary inspection 提供许可证，这一点是准确的。代码转移前，项目应当独立替换仍保留的 binary-derived 部分，或者根据实际条款和适用法域取得合适的人类法律 reviewer 或 ASF 判断。

3. 请说明被检查 artifact 的复现限制。

文档记录了 7 月 16 日版本的历史路径和 SHA-256，但同一路径现在已经是更新版本，hash 也不同。建议明确说明原 artifact 已不在该路径，记录的 hash 属于当时的贡献者证据，除非另有可验证副本。可以保留脱敏分析记录，不需要重新分发 proprietary binary。

computer-use Skill 的声明、其余 29 个 Skills 的 unresolved group，以及 catalog guards 目前保持一致。聚焦测试共 7 项，全部通过，当前 CI 也全部通过。

AI 辅助说明：Codex 协助检查了 diff、仓库历史、聚焦测试和相关政策链接。我审阅了引用的证据，并对这些意见负责。最终许可证判断仍须由独立人类作出。

[hqhq1025]

@Astro-Han addressed the three follow-ups in 39aa521d0:

1. LICENSE now identifies trycua/cua, pins revision 8c921b2b3bf13494724ead4f0a814d80c56a7e8b, preserves Copyright (c) 2025 Cua AI, Inc., and includes the full MIT text. The existing desktop packaging config carries this top-level file as licenses/maka/LICENSE; NOTICE is unchanged because the fixed upstream revision has no NOTICE.
2. The applicable-terms question remains explicitly open. The provenance record now makes it a pre-code-transfer gate: independently replace the retained binary-derived components or obtain an appropriate human legal/ASF determination based on the governing terms and jurisdiction.
3. The artifact section now states that the July 16 binary is no longer at the historical path. On 2026-08-11 that path held the newer 2026-08-05 signed build with SHA-256 d51dc8dd4c5a1ff19c13e206a8e5022db8bf5cb1c7aff0d67d6c7f4bb55dc031; the historical hash is contemporaneous contributor evidence and the old inspection is not reproducible from this repository alone.

Validation: provenance/catalog tests 9/9, Electron release config 2/2, Biome and git diff --check pass. Re-review when convenient.

[Astro-Han]

Approved. The earlier follow-ups are addressed: LICENSE now covers the MIT-licensed trycua/cua material, the provenance document records the historical artifact limitation, and the applicable-terms question remains a gate before any binary-derived code is transferred.

One non-blocking P2 remains in docs/computer-use-cursor-provenance.md. “Maka palette” is listed under “Maka-authored or Maka-adjusted behavior,” but palette.ts and LICENSE identify the base palette data and selection logic as adapted from trycua/cua.

Please narrow it to:

Maka brand palette, click pulse, shadow, and host integration.

Alternatively, separate the MIT-derived base palettes and selection logic from Maka’s makaBrandPalette and its integration. This does not block merging the provenance record and may be fixed here or in a follow-up.

This approval covers the accuracy of the provenance record. It is not a final legal or ASF release determination for the binary-derived components.

AI assistance: Codex inspected the updated diff, source history, focused tests, packaging configuration, and CI results. I reviewed the evidence and own this approval.

中文对照

批准。之前提出的建议都已处理：LICENSE 现在覆盖了采用 MIT 许可证的 trycua/cua 材料，provenance 文档记录了历史 artifact 的限制，适用条款问题也仍然是转移 binary-derived 代码前必须处理的 gate。

还有一个不阻塞合并的 P2。docs/computer-use-cursor-provenance.md 将 “Maka palette” 列在 “Maka-authored or Maka-adjusted behavior” 下，但 palette.ts 和 LICENSE 已注明基础 palette 数据和选择逻辑改编自 trycua/cua。

建议收窄为：

Maka brand palette, click pulse, shadow, and host integration.

也可以明确区分采用 MIT 许可证的基础 palette 和选择逻辑，以及 Maka 编写的 makaBrandPalette 和相关集成。这个问题不阻塞 provenance 记录合并，可以在当前 PR 或后续 PR 中修正。

本次批准确认的是 provenance 记录的准确性，并不代表对 binary-derived 部分作出了最终的法律或 ASF 发版判断。

AI 辅助说明：Codex 协助检查了更新后的 diff、源码历史、聚焦测试、打包配置和 CI 结果。我审阅了相关证据，并对本次批准负责。

[Astro-Han]

Approved at 3c7683b97. The branch now includes #2695, removes the deleted Skills from the unresolved provenance list, and distinguishes Maka’s brand palette from the MIT-derived base palettes and selection logic.

The catalog generator and provenance manifest checks pass, and all GitHub CI checks are green. The documented gate for binary-derived components remains unchanged.

AI assistance: Codex checked the final diff, resolved the merge conflicts, ran the focused local checks, and monitored CI. I reviewed the result and take responsibility for this approval.

中文对照

批准，审核提交为 3c7683b97。当前分支已包含 #2695，从 unresolved provenance 清单中移除了已删除的 Skills，并明确区分了 Maka 品牌 palette 与采用 MIT 许可证的基础 palettes 和选择逻辑。

catalog 生成器和 provenance manifest 检查均通过，GitHub CI 已全部通过。文档中针对 binary-derived 部分的 gate 保持不变。

AI 辅助说明：Codex 协助检查了最终 diff、解决合并冲突、运行聚焦本地检查并监控 CI。我审阅了最终结果，并对本次批准负责。