legal: audit LICENSE and NOTICE for the first release artifacts

[M4n5ter]

English

Part of #2974 — G3: source-release legal files.

Outcome

Make the legal files match the exact contents of the extracted ASF source
candidate, apache-maka-<version>-incubating-src.tar.gz.

G3 owns only the artifact voted on by the podling and IPMC. The npm and
macOS/Windows convenience artifacts have different byte inventories and are
reviewed independently under G8 and G9; they do not expand this source-release
gate.

Exit criteria

• Build the source candidate with the release workflow and inventory the
  bytes in the extracted archive, rather than treating the repository or a
  dependency graph as the artifact.
• Confirm the candidate's root LICENSE, NOTICE, and DISCLAIMER-WIP are
  accurate for those bytes: Apache License 2.0 is present, third-party terms and
  attributions are complete, NOTICE contains only legally required notices,
  and the disclaimer's disclosures remain current.
• Identify every vendored, adapted, or generated source/data input in the
  candidate and record its origin, pinned revision or reproducible snapshot,
  license, and any required attribution. Merged PR fix: attribute the adapted opencode sources and the models.dev snapshot #3325 covers the known
  opencode adaptations and models.dev snapshot; the candidate inventory must
  still establish completeness.
• Confirm the source candidate contains no Category X material and no
  compiled third-party binaries; handle any permitted source-form third-party
  material according to ASF third-party license policy.
• Re-run the release checks against the extracted candidate and obtain the
  required human and mentor/PPMC review of this source-artifact closure, with ASF
  Legal Affairs input where applicable.

Existing work

• Merged PR fix: attribute the adapted opencode sources and the models.dev snapshot #3325 adds the known opencode/models.dev attribution and pins the
  models.dev snapshot digest. Its notice generator still walks npm dependency
  trees, so it is evidence for known inputs, not proof that the source inventory
  is complete.
• scripts/asf-source-release.mjs already creates the isolated git archive,
  rejects node_modules, and requires root legal files.
• docs: declare the bundled Geist webfonts in LICENSE #3140, fix(licenses): regenerate the notices after the bundled-font declaration #3155, and docs: add DISCLAIMER-WIP for podling releases #3141 are useful history for fonts, generated notices, and
  DISCLAIMER-WIP; only material that actually enters the source candidate is
  in G3 scope.

Boundary rationale

Apache OpenDAL's incubating releases provide a useful practice reference: its
ASF dist directories contain one source archive plus signature/checksum, while
npm publishing is a separate post-tag workflow. Maka follows the same artifact
boundary here. This is evidence for scoping the work, not a substitute for
Maka's mentor/PPMC or ASF Legal review.

Out of scope

• npm package contents and npm-specific legal files (G8).
• macOS/Windows package contents and platform-specific legal files (G9).
• ASF source headers and the RAT-equivalent audit (G4).
• Implementing packaging behavior outside the source legal-file boundary.

References

• ASF release policy
• ASF third-party license policy
• Incubator distribution guidelines
• OpenDAL 0.36.0 incubating dist
• OpenDAL 0.44.0 incubating dist
• OpenDAL 0.44.0 source release script
• OpenDAL 0.44.0 release guide
• OpenDAL 0.44.0 npm workflow

Ownership

Leave this issue unassigned until someone explicitly claims the source-candidate
legal review. Prior work in this area does not imply ownership.

简体中文

#2974 的一部分——G3：源码 release 法律文件。

目标结果

使法律文件与解压后的 ASF 源码候选
apache-maka-<version>-incubating-src.tar.gz 的实际内容完全匹配。

G3 只负责 podling 与 IPMC 投票的 artifact。npm 与 macOS/Windows convenience
artifacts 的字节清单不同，分别在 G8、G9 中独立审查；它们不扩大源码 release gate。

完成条件

• 用正式 release workflow 构建源码候选，并盘点解压后归档中的实际字节；不能拿仓库或
  dependency graph 代替 artifact 本身。
• 确认候选根目录的 LICENSE、NOTICE、DISCLAIMER-WIP 对这些字节准确：包含
  Apache License 2.0 全文，第三方条款与署名完整，NOTICE 仅保留依法必须的 notice，
  disclaimer 的披露仍然成立。
• 识别候选中的全部 vendored、adapted、generated 源码/数据输入，并记录其来源、固定
  revision 或可复现 snapshot、许可证和必要署名。已合并 PR fix: attribute the adapted opencode sources and the models.dev snapshot #3325 处理了目前已知的
  opencode 改编与 models.dev snapshot；仍须通过候选清单证明完整性。
• 确认源码候选不含 Category X 材料和编译后的第三方二进制；任何获准进入的源码形态
  第三方材料均按 ASF 第三方许可证政策处理。
• 对解压后的候选重新运行 release checks，并取得该 source-artifact 闭环所需的人工及
  mentor/PPMC 审查；适用时取得 ASF Legal Affairs 意见。

已有工作

• 已合并 PR fix: attribute the adapted opencode sources and the models.dev snapshot #3325 补充了已知的 opencode/models.dev 署名，并固定 models.dev snapshot
  digest。其 notice generator 仍遍历 npm dependency tree，因此它能证明已知输入已处理，
  不能证明源码清单完整。
• scripts/asf-source-release.mjs 已用隔离的 git archive 生成候选，拒绝
  node_modules，并要求根法律文件存在。
• docs: declare the bundled Geist webfonts in LICENSE #3140、fix(licenses): regenerate the notices after the bundled-font declaration #3155、docs: add DISCLAIMER-WIP for podling releases #3141 是字体、生成 notices 与 DISCLAIMER-WIP 的有用历史；G3
  只处理真正进入源码候选的材料。

边界依据

Apache OpenDAL 的孵化期发版可作为实际实践参考：其 ASF dist 目录只包含一个源码归档及
签名/校验和，npm 则由独立的正式 tag 后置 workflow 发布。Maka 在这里采用同样的 artifact
边界。该实践用于界定工作范围，不能替代 Maka mentors/PPMC 或 ASF Legal 的判断。

不在范围内

• npm 包内容及 npm 专属法律文件（G8）。
• macOS/Windows 包内容及平台专属法律文件（G9）。
• ASF 源码 headers 与 RAT 等价审计（G4）。
• 源码法律文件边界之外的打包实现。

参考资料

• ASF 发版政策
• ASF 第三方许可证政策
• Incubator 分发指南
• OpenDAL 0.36.0 孵化期 dist
• OpenDAL 0.44.0 孵化期 dist
• OpenDAL 0.44.0 源码 release 脚本
• OpenDAL 0.44.0 release 指南
• OpenDAL 0.44.0 npm workflow

负责人边界

在有人明确认领 source-candidate 法律审查前保持 unassigned。此前参与过该区域的工作不代表
自动承担本 issue。

[Astro-Han]

English

Two pieces of incoming third-party material are missing attribution. Recording them here because they advance the first exit criterion (inventory third-party material) without closing this gate. Full evidence is in the code origin audit report on #2907.

One shared cause

scripts/generate-third-party-notices.mjs derives its inventory by walking npm production dependency trees. Vendored source, adapted source, and generated data are therefore invisible to it by construction — not missed by accident — and npm run check:third-party-notices cannot guard what the generator never enumerates. Both gaps below follow from that, and so will the next one.

1. Adapted opencode source

packages/runtime/src/tool-output.ts and packages/runtime/src/edit-replace.ts both state in a header comment that they are adapted from opencode. The statements are accurate and the adaptation is substantial: the truncation helper follows upstream line for line down to its local names and its asymmetric newline accounting, and the escape-normalizing regular expression is identical character for character with its nine branches in upstream order. Maka's additions are real, but the material is a derivative work.

Upstream is MIT, Copyright (c) 2025 opencode, compared at commit fc80874 (the repository now resolves to anomalyco/opencode). "opencode" appears in none of LICENSE, NOTICE, packages/cli/THIRD_PARTY_NOTICES.txt, or the desktop notices, while both files ship in @maka/runtime.

2. models.dev data snapshot

packages/core/src/model-metadata.generated.ts and packages/runtime/src/telemetry/model-pricing.generated.ts are checked-in, shipped derivations of https://models.dev/api.json, together about 27,800 lines. Upstream sst/models.dev is MIT, Copyright (c) 2025 models.dev.

The individual entries are facts and are not themselves copyrightable; what comes from upstream is the selection and arrangement. The generated headers record no snapshot date or revision, so the fixed source cannot currently be identified.

Proposed work

1. Add an attribution block to each adapted file — upstream source, pinned revision, license, copyright — keeping the existing "what changed" prose. These files are mixed-origin, so mark the adapted portion rather than applying a whole-file SPDX identifier; packages/ui/src/astryx-chat-reasoning.tsx is the in-repo precedent.
2. Add LICENSE entries for opencode and models.dev, following the existing trycua/cua format.
3. Have scripts/sync-model-metadata.mjs write the snapshot revision and date into the generated headers.
4. Give the notice generator a checked manual inventory for non-npm sources.

Items 1–3 are mechanical once the wording is agreed. Item 4 is the one that stops this recurring, and it changes a checked artifact's contract, so it deserves its own review.

简体中文

有两处引入的第三方材料缺少署名。记录在此是因为它们推进了第一条完成条件（盘点第三方材料），但并不关闭这个 gate。完整证据在 #2907 的代码来源审计报告中。

共同根因

scripts/generate-third-party-notices.mjs 通过遍历 npm production 依赖树来生成清单。因此 vendored 源码、改编源码和生成数据在结构上就不可能被它发现——不是偶然遗漏——而 npm run check:third-party-notices 也无法守护生成器从未枚举过的东西。下面两处都源于此，以后新增的也会一样。

1. 改编自 opencode 的源码

packages/runtime/src/tool-output.ts 和 packages/runtime/src/edit-replace.ts 的文件头注释都写明改编自 opencode。这两处陈述准确，且改编程度很深：截断函数与上游逐行对应，连局部变量名和非对称的换行计数都一致；转义归一化的正则逐字符相同，九个分支的顺序也与上游一致。Maka 确有自己的增强，但这些材料构成 derivative work。

上游为 MIT，Copyright (c) 2025 opencode，比对基于 commit fc80874（该仓库现已指向 anomalyco/opencode）。而 LICENSE、NOTICE、packages/cli/THIRD_PARTY_NOTICES.txt 和 desktop notices 中都没有出现 "opencode"，这两个文件却随 @maka/runtime 一起分发。

2. models.dev 数据快照

packages/core/src/model-metadata.generated.ts 和 packages/runtime/src/telemetry/model-pricing.generated.ts 是 https://models.dev/api.json 的派生结果，已入库并随产品分发，合计约 27,800 行。上游 sst/models.dev 为 MIT，Copyright (c) 2025 models.dev。

其中单条记录属于事实，本身不受版权保护；来自上游的是选择与编排。生成文件头也没有记录快照日期或上游修订，因此目前无法确定固定来源。

建议的工作

1. 为每个改编文件添加署名块——上游来源、固定修订、许可证、版权——并保留现有的"改动了什么"说明。这些文件来源混合，因此应标注被改编的部分，而不是给整个文件打 SPDX 标识；packages/ui/src/astryx-chat-reasoning.tsx 是仓库内已有的先例。
2. 在 LICENSE 中添加 opencode 和 models.dev 条目，格式参照现有的 trycua/cua。
3. 让 scripts/sync-model-metadata.mjs 把快照修订和日期写入生成文件头。
4. 为 notice 生成器提供一份受检的非 npm 来源手工清单。

第 1–3 项在措辞确定后属于机械工作。第 4 项才是阻止此类问题重演的那一项，且它改变了受检 artifact 的契约，应当单独评审。

[Astro-Han]

Guarding the attribution is not in #3325.

#3325 lands the attribution itself — LICENSE entries and in-file notices for the adapted opencode sources and the models.dev snapshot. It does not add anything that fails when an attribution is dropped.

The generator is structurally blind here: it walks npm production dependency trees, and none of this material is an npm package. Two designs were tried and both were rejected in review — restating the inventory in code creates a second authority that drifts from LICENSE, and parsing LICENSE imposes an undocumented grammar on a legal file that a human edits.

What a working guard needs is a per-artifact declaration. The CLI package and the desktop app carry different material — the fonts and the cursor overlay are desktop-only — and today no single place says which artifact carries what; that knowledge is split across electron-builder.config.mjs, release-cli-package.mjs, and the npm closure. Until that exists, any check either over-claims in the CLI notice or has to be hand-maintained.

Filing this as the remaining half of the G3 exit criterion rather than stretching #3325 to cover it.