fix(release): close final G3 source inventory gaps

apps/desktop/src/renderer/public/THIRD_PARTY_LICENSES.txt

@@ -194,7 +194,8 @@ SOFTWARE.
 - Source: `dingtalk-fill`
 - License: Apache-2.0
 - Covered source asset: `packages/ui/src/bot-brand-logo.tsx` `DingTalkLogo`
-- Full license text: packaged as `licenses/renderer/MINGCUTE_APACHE_LICENSE.txt`.
+- Full license text: the repository-root `LICENSE`; desktop packages copy that file to
+  `licenses/renderer/MINGCUTE_APACHE_LICENSE.txt`.
 - Trademark boundary: DingTalk and its logo remain trademarks of their owner.
 
 ## Allogo Feishu mark

docs/code-origin-audit.md

@@ -148,7 +148,7 @@ No `NOTICE` addition is warranted. The fixed Astryx and `trycua/cua` revisions h
 
 ## Other provenance evidence
 
-The SCANOSS table above covers only what its winnowing scanner fingerprints, which is source code in supported formats. Two further categories of incoming material were found outside it and are recorded here. Both are attribution gaps rather than license conflicts, and both are tracked for the release legal-files gate in #3270; neither is resolved by this report.
+The SCANOSS table above covers only what its winnowing scanner fingerprints, which is source code in supported formats. Additional incoming-material and same-author transfer records that sit outside that scan are recorded here. The records distinguish third-party attribution obligations from contributor-confirmed ASF contributions rather than treating every cross-repository lineage as third-party code.
 
 ### Adapted opencode source
 
@@ -163,6 +163,43 @@ Upstream is MIT, Copyright (c) 2025 opencode. The repository now resolves to `an
 
 `packages/core/src/model-metadata.generated.ts` and `packages/runtime/src/telemetry/model-pricing.generated.ts` are checked-in, shipped derivations of `https://models.dev/api.json`, together about 27,800 lines. Upstream `sst/models.dev` is MIT, Copyright (c) 2025 models.dev. The individual entries are facts and are not themselves copyrightable, but the selection and arrangement — which providers and fields are carried, and upstream's normalized structures such as `lifecycle` and `thinkingOptions.efforts` — come from that database. The same generator boundary applies: models.dev is not an npm dependency, and it appears in none of the four attribution surfaces. The generated headers also record no snapshot date or upstream revision, so the fixed source cannot currently be identified.
 
+### PawWork browser port
+
+The embedded-browser work introduced by Maka commit `fab537af179232cc88dc39314038000f70d15d05` was ported from two fixed source batches in [`Astro-Han/pawwork`](https://github.com/Astro-Han/pawwork):
+
+- CDP bridge and browser options: `aff7ce202f5ccb9a7166a95172aa754b0d4de7db`;
+- `BrowserSession`, generic observe→act tools, and their desktop integration: `e3595b705c687c369828736ecd154127ed44f545`.
+
+Both PawWork snapshots are Apache-2.0. On 2026-08-23, their author AstroHan confirmed that these are the only two source batches, that all code carried into Maka was his own work, and that he submitted it directly as an ASF contribution. PawWork's repository-level `NOTICE` also describes unrelated OpenCode material, but that notice does not pertain to this contributor-confirmed slice. No PawWork or OpenCode bytes outside the two stated batches are part of this port.
+
+The exact Maka introduction boundary is the following 23-file change. This list records the transfer boundary, not an assertion that every byte in each integration file came from PawWork:
+
+- `apps/desktop/src/global.d.ts`
+- `apps/desktop/src/main/__tests__/automation-host.test.ts`
+- `apps/desktop/src/main/__tests__/browser-logic.test.ts`
+- `apps/desktop/src/main/__tests__/browser-session.test.ts`
+- `apps/desktop/src/main/__tests__/browser-tools.test.ts`
+- `apps/desktop/src/main/__tests__/browser-view-manager.test.ts`
+- `apps/desktop/src/main/__tests__/cdp-bridge.test.ts`
+- `apps/desktop/src/main/browser/automation-host.ts`
+- `apps/desktop/src/main/browser/browser-host.ts`
+- `apps/desktop/src/main/browser/browser-tools.ts`
+- `apps/desktop/src/main/browser/cdp-bridge.ts`
+- `apps/desktop/src/main/browser/controller.ts`
+- `apps/desktop/src/main/browser/logic.ts`
+- `apps/desktop/src/main/browser/options.ts`
+- `apps/desktop/src/main/browser/session.ts`
+- `apps/desktop/src/main/browser/view-manager.ts`
+- `apps/desktop/src/main/main.ts`
+- `apps/desktop/src/preload/preload.ts`
+- `apps/desktop/src/renderer/browser-panel.tsx`
+- `apps/desktop/src/renderer/main.tsx`
+- `apps/desktop/src/renderer/styles.css`
+- `packages/core/src/browser.ts`
+- `packages/core/src/index.ts`
+
+Subsequent refactors moved `apps/desktop/src/renderer/browser-panel.tsx` to `apps/desktop/src/renderer/features/workbar/tools/browser/browser-panel.tsx` and deleted the old `packages/core/src/index.ts` barrel. Those changes do not add another source batch; the introduction commit and fixed upstream revisions remain the provenance anchors.
+
 ### Bundled Skills
 
 Pull request #2695 removed the 29 bundled Skills whose individual origins could not be confirmed. The retained `computer-use` Skill has a contributor-confirmed, independently reviewed origin record in `packages/runtime/resources/bundled-skills/provenance.json`. The final human approval on pull request #2676 reviewed commit `3c7683b9793e97cba7d8536f6864da0e38f24c30`. That review covers the Skill origin record; it does not make a legal or ASF release determination about implementation inputs.

scripts/source-legal-inventory.test.mjs

@@ -52,6 +52,63 @@ test('mixed-origin DeepSeek profile carries both scopes without a whole-file ASF
   assert.doesNotMatch(profile, /Licensed to the Apache Software Foundation \(ASF\)/);
 });
 
+test('PawWork browser provenance is pinned to the confirmed transfer boundary', async () => {
+  const audit = await readFile(join(root, 'docs/code-origin-audit.md'), 'utf8');
+  const section = audit
+    .split('### PawWork browser port\n', 2)[1]
+    ?.split('\n### Bundled Skills\n', 1)[0];
+  assert.ok(section, 'PawWork browser provenance section is missing');
+  assert.match(section, /fab537af179232cc88dc39314038000f70d15d05/);
+  assert.match(section, /aff7ce202f5ccb9a7166a95172aa754b0d4de7db/);
+  assert.match(section, /e3595b705c687c369828736ecd154127ed44f545/);
+  assert.match(section, /only two source batches/);
+  assert.match(section, /submitted it directly as an ASF contribution/);
+
+  const inventoriedPaths = [...section.matchAll(/^- `([^`]+)`$/gm)].map((match) => match[1]);
+  assert.deepEqual(inventoriedPaths, [
+    'apps/desktop/src/global.d.ts',
+    'apps/desktop/src/main/__tests__/automation-host.test.ts',
+    'apps/desktop/src/main/__tests__/browser-logic.test.ts',
+    'apps/desktop/src/main/__tests__/browser-session.test.ts',
+    'apps/desktop/src/main/__tests__/browser-tools.test.ts',
+    'apps/desktop/src/main/__tests__/browser-view-manager.test.ts',
+    'apps/desktop/src/main/__tests__/cdp-bridge.test.ts',
+    'apps/desktop/src/main/browser/automation-host.ts',
+    'apps/desktop/src/main/browser/browser-host.ts',
+    'apps/desktop/src/main/browser/browser-tools.ts',
+    'apps/desktop/src/main/browser/cdp-bridge.ts',
+    'apps/desktop/src/main/browser/controller.ts',
+    'apps/desktop/src/main/browser/logic.ts',
+    'apps/desktop/src/main/browser/options.ts',
+    'apps/desktop/src/main/browser/session.ts',
+    'apps/desktop/src/main/browser/view-manager.ts',
+    'apps/desktop/src/main/main.ts',
+    'apps/desktop/src/preload/preload.ts',
+    'apps/desktop/src/renderer/browser-panel.tsx',
+    'apps/desktop/src/renderer/main.tsx',
+    'apps/desktop/src/renderer/styles.css',
+    'packages/core/src/browser.ts',
+    'packages/core/src/index.ts',
+  ]);
+});
+
+test('MingCute license pointer resolves in both source and packaged layouts', async () => {
+  const [license, inventory, builderConfig] = await Promise.all([
+    readFile(join(root, 'LICENSE'), 'utf8'),
+    readFile(join(root, 'apps/desktop/src/renderer/public/THIRD_PARTY_LICENSES.txt'), 'utf8'),
+    readFile(join(root, 'apps/desktop/electron-builder.config.mjs'), 'utf8'),
+  ]);
+  const entry = inventory.split('## MingCute DingTalk mark\n', 2)[1]?.split('\n## ', 1)[0];
+  assert.ok(entry, 'MingCute inventory entry is missing');
+  assert.match(entry, /repository-root `LICENSE`/);
+  assert.match(entry, /`licenses\/renderer\/MINGCUTE_APACHE_LICENSE\.txt`/);
+  assert.match(license, /Apache License\n\s+Version 2\.0, January 2004/);
+  assert.match(
+    builderConfig,
+    /from: '\.\.\/\.\.\/LICENSE',\n\s+to: 'licenses\/renderer\/MINGCUTE_APACHE_LICENSE\.txt'/,
+  );
+});
+
 test('every vendored provider mark is bound to its reviewed inventory and digest', async () => {
   const assetDirectory = join(root, 'apps/desktop/src/renderer/assets/provider-brands');
   const inventory = await readFile(