fix(release): ship the standard disclaimer in Rust distributions

.github/workflows/website.yml

@@ -24,21 +24,15 @@ name: Website
 on:
   pull_request:
     paths:
-      [
-        "website/**",
-        "assets/logo.png",
-        "README*",
-        "DISCLAIMER-WIP",
-        ".github/workflows/website.yml",
-      ]
+      ["website/**", "assets/logo.png", "README*", "DISCLAIMER", ".github/workflows/website.yml"]
   push:
     branches: [main]
     tags: ["v*"]
     paths:
       - "website/**"
       - "assets/logo.png"
       - "README*"
-      - "DISCLAIMER-WIP"
+      - "DISCLAIMER"
       - "LICENSE"
       - "NOTICE"
       - ".asf.yaml"

DISCLAIMER

@@ -0,0 +1,7 @@
+Apache Maka is an effort undergoing incubation at The Apache Software Foundation
+(ASF), sponsored by the Apache Incubator PMC. Incubation is required of all
+newly accepted projects until a further review indicates that the
+infrastructure, communications, and decision-making process have stabilized in a
+manner consistent with other successful ASF projects. While incubation status is
+not necessarily a reflection of the completeness or stability of the code, it
+does indicate that the project has yet to be fully endorsed by the ASF.

LICENSE

@@ -203,6 +203,33 @@
 
 THIRD-PARTY COMPONENTS
 
+Playwright browser injected script and keyboard data (Apache License 2.0)
+
+third-party/playwright contains the injected script and US keyboard data from
+playwright-core 1.58.2, revision ce480a952553175eae75342aad2c5e86cdf2cbba.
+Source: https://github.com/microsoft/playwright
+Copyright (c) Microsoft Corporation
+Original LICENSE, NOTICE and ThirdPartyNotices.txt are preserved beside the
+source. The published archive, extraction method and file hashes are recorded
+in third-party/playwright/upstream.json.
+
+reqwest HTTP client source (adapted, Apache License 2.0 OR MIT)
+
+third-party/reqwest contains reqwest 0.13.5 from
+https://github.com/seanmonstar/reqwest at revision
+de55373434f07f42926599dbb5a88550d8e55112.
+Copyright (c) 2016-2026 Sean McArthur
+Original license texts, source hashes and local changes are recorded in
+third-party/reqwest/{LICENSE-APACHE,LICENSE-MIT,upstream.json,SOURCE.md}.
+
+image-webp decoder source (adapted, Apache License 2.0 OR MIT)
+
+third-party/image-webp contains image-webp 0.2.4 from
+https://github.com/image-rs/image-webp at revision
+08b57d473c90148dd4b37a075df365afc3dfcc2b.
+Original license texts, source hashes and local changes are recorded in
+third-party/image-webp/{LICENSE-APACHE,LICENSE-MIT,upstream.json,SOURCE.md}.
+
 Zod dependency patch
 
 Source: https://www.npmjs.com/package/zod/v/4.6.7

NOTICE

@@ -9,3 +9,9 @@ Copyright 2025 OpenAI
 
 This product includes portions of GPUI Fast / GPUI.
 Copyright 2022 - 2025 Zed Industries, Inc.
+
+Playwright
+Copyright (c) Microsoft Corporation
+
+This software contains code derived from the Puppeteer project (https://github.com/puppeteer/puppeteer),
+available under the Apache 2.0 license (https://github.com/puppeteer/puppeteer/blob/master/LICENSE).

README.md

@@ -61,4 +61,4 @@ Use `just --list` for development commands. See [Contributing](CONTRIBUTING.md),
 
 The npm launcher selects a matching native package; it contains no agent runtime. Native preview artifacts are built and verified from one source archive. Packaging and publication are documented in [packages/cli](packages/cli/README.md).
 
-Apache Maka is undergoing incubation at the Apache Software Foundation. See [DISCLAIMER-WIP](DISCLAIMER-WIP), [LICENSE](LICENSE) and [NOTICE](NOTICE).
+Apache Maka is undergoing incubation at the Apache Software Foundation. See [DISCLAIMER](DISCLAIMER), [LICENSE](LICENSE) and [NOTICE](NOTICE).

README.zh-CN.md

@@ -61,4 +61,4 @@ just run
 
 npm 启动器选择匹配的原生平台包，自身不包含 Agent 运行时。原生预览包从同一份源码归档构建并验证，流程见 [packages/cli](packages/cli/README.zh-CN.md)。
 
-Apache Maka 正在 Apache 软件基金会孵化。参见 [DISCLAIMER-WIP](DISCLAIMER-WIP)、[LICENSE](LICENSE) 和 [NOTICE](NOTICE)。
+Apache Maka 正在 Apache 软件基金会孵化。参见 [DISCLAIMER](DISCLAIMER)、[LICENSE](LICENSE) 和 [NOTICE](NOTICE)。

docs/code-origin-audit.md

@@ -21,13 +21,22 @@
 
 Third-party source and dependency patch attribution is recorded in [LICENSE](../LICENSE). Apply-patch adaptations have a detailed record in [plugins/workspace/workspace-files/patch/SOURCE.md](../plugins/workspace/workspace-files/patch/SOURCE.md); native Computer Use notices live in [platform/computer-use/THIRD_PARTY_NOTICES](../platform/computer-use/THIRD_PARTY_NOTICES).
 
+### Release licensing scope
+
+The historical incoming-code review used the individual-contributor ICLA route submitted in the [0.2.0 RC2 vote](https://lists.apache.org/thread/743v94gvldqs4pbwwg59l22pojb44v4k). The questioned contributor ICLAs were [publicly confirmed](https://lists.apache.org/thread/47jpk47vykyqr4gxy85szpq25zw0qh9f), after which Justin [withdrew his binding -1](https://lists.apache.org/thread/yno6g7kzfc9dgntt0n572zk4vnj4jr2x). The standard [DISCLAIMER](../DISCLAIMER) retains the required incubation notice without repeating the resolved ICLA concern.
+
+This branch's source archive contains first-party Rust and TypeScript source, adapted source, pinned vendored source and the assets listed below. Vendored components preserve their own licenses and source records; a language rewrite does not remove those obligations. `scripts/asf-source-release.mjs` verifies the actual archive contents, including headers, manifest licenses and the finite non-text inventory.
+
+Native npm packages include the root legal documents and the reviewed Rust, embedded JavaScript, V8 and Rust standard-library notices. The launcher carries the same disclaimer, and packaged macOS application resources also include the legal documents and native notices. Dependency and notice inventories are checked by `scripts/rust/dependencies.mjs` and `scripts/rust/notices.mjs`. MPL dependencies permitted for binary distribution remain external dependencies of the source archive and have license texts and exact source references in the native notices.
+
 ### Native model protocol validation
 
 `plugins/agent/provider-protocol` implements Responses, Chat Completions compatible and Anthropic Messages with protocol-owned Rust input types, wire decoders and stream state. Chat Completions and Anthropic behavior was checked against the relevant unchanged Vercel AI SDK tests at revision `e623e8c88b55066dde769614a16ae51d424974aa` (openai-compatible 3.0.77 and anthropic 4.0.87). The upstream tests and temporary validation bindings are external validation tools and are not distributed with Maka. The product uses the same Rust protocol core through Host-scoped transport in `plugins/agent/model/src/adapters`.
 
 ### Source archive non-text inventory
 
 - `assets/logo.png`: Product artwork reproduced by `scripts/generate-logo.py` from its vector geometry; Apache-2.0.
+- `products/maka/desktop-shell/maka.ico`: Windows multi-resolution icon derived from `assets/logo.png` in [#6446](https://github.com/apache/maka/pull/6446); seven PNG images at 16–256 pixels, embedded by `windows.rc`; Apache-2.0.
 - `products/maka/workbench/app/assets/maka.png`: Byte-identical copy of `assets/logo.png`, bundled with the workbench application's composer; Apache-2.0.
 - `website/src/assets/incubator.png`: Unmodified Apache Incubator trademark artwork from https://www.apache.org/logos/res/incubator/default.png.
 - `website/src/assets/social.en.png`: English website preview rendered by `website/scripts/social-preview.mjs`; includes the product mark and self-hosted OFL-1.1 fonts.

packages/cli/package.json

@@ -13,6 +13,7 @@
   },
   "files": [
     "bin",
+    "DISCLAIMER",
     "LICENSE",
     "NOTICE",
     "README.md",

products/maka/cli/src/distribution.rs

@@ -537,6 +537,7 @@ mod tests {
         };
         append("package.json", &serde_json::to_vec(&manifest).unwrap());
         for name in [
+            "DISCLAIMER",
             "LICENSE",
             "NOTICE",
             "THIRD_PARTY_NOTICES.txt",
@@ -590,6 +591,12 @@ mod tests {
                 b"<plist version=\"1.0\"/>\n",
             );
             append("bin/Maka.app/Contents/Resources/Maka.icns", b"icns");
+            for name in ["DISCLAIMER", "LICENSE", "NOTICE", "THIRD_PARTY_NOTICES.txt"] {
+                append(
+                    &format!("bin/Maka.app/Contents/Resources/{name}"),
+                    b"test license",
+                );
+            }
         }
         if let Some(name) = extra {
             append(
@@ -877,6 +884,7 @@ mod tests {
             (linux, None, true, None),
             (linux, Some("bin/maka"), false, None),
             (linux, Some("bin/extra"), false, None),
+            (linux, None, false, Some("DISCLAIMER")),
             (linux, None, false, Some("bin/maka-python-worker")),
             (
                 Target::Win32X64,
@@ -891,6 +899,12 @@ mod tests {
                 false,
                 Some("bin/Maka.app/Contents/Resources/Maka.icns"),
             ),
+            (
+                macos,
+                None,
+                false,
+                Some("bin/Maka.app/Contents/Resources/DISCLAIMER"),
+            ),
             // A package has no optional files.
             (
                 macos,

products/maka/cli/src/distribution/archive.rs

@@ -64,6 +64,7 @@ fn allowed(target: Target, name: &str) -> bool {
 fn required(target: Target) -> impl Iterator<Item = &'static str> {
     [
         "package.json",
+        "DISCLAIMER",
         "LICENSE",
         "NOTICE",
         "THIRD_PARTY_NOTICES.txt",

products/maka/cli/src/distribution/target.rs

@@ -110,6 +110,10 @@ impl Target {
             Self::DarwinArm64 | Self::DarwinX64 => &[
                 "bin/Maka.app/Contents/Info.plist",
                 "bin/Maka.app/Contents/Resources/Maka.icns",
+                "bin/Maka.app/Contents/Resources/DISCLAIMER",
+                "bin/Maka.app/Contents/Resources/LICENSE",
+                "bin/Maka.app/Contents/Resources/NOTICE",
+                "bin/Maka.app/Contents/Resources/THIRD_PARTY_NOTICES.txt",
             ],
             _ => &[],
         }

scripts/asf-license-headers.mjs

@@ -214,7 +214,7 @@ export const exclusionRules = [
     id: 'asf-release-documents',
     justification:
       'These files are the license, notice, and incubation disclosure themselves. ASF policy fixes their contents, so a header inside them would be circular.',
-    matches: isOneOf('DISCLAIMER-WIP', 'LICENSE', 'NOTICE'),
+    matches: isOneOf('DISCLAIMER', 'LICENSE', 'NOTICE'),
   },
   {
     id: 'third-party-license-texts',

scripts/asf-source-release.mjs

@@ -42,7 +42,7 @@ import { fileURLToPath } from 'node:url';
 const defaultRepoRoot = resolve(import.meta.dirname, '..');
 const archivePattern = /^apache-maka-(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)-incubating-src\.tar\.gz$/;
 const versionPattern = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
-const requiredReleaseDocuments = ['DISCLAIMER-WIP', 'LICENSE', 'NOTICE'];
+const requiredReleaseDocuments = ['DISCLAIMER', 'LICENSE', 'NOTICE'];
 const requiredRootFiles = [...requiredReleaseDocuments, 'package.json', 'package-lock.json'];
 const forbiddenSegments = new Set(['.agents', '.claude', '.git', '.maka-shots', 'node_modules']);
 const knownNonCategoryXLicenses = new Set([
@@ -127,7 +127,7 @@ const textSourceBasenames = new Set([
   '.mailmap',
   'Cargo.toml.orig',
   'CNAME',
-  'DISCLAIMER-WIP',
+  'DISCLAIMER',
   'Dockerfile',
   'LICENSE',
   'LICENSE-APACHE',
@@ -571,10 +571,10 @@ function validateArchiveContents(archivePath, identity, entries) {
       const contents = readFileSync(join(candidateRoot, requiredFile), 'utf8');
       if (!contents.trim()) throw new Error(`${requiredFile} is empty`);
       if (
-        requiredFile === 'DISCLAIMER-WIP' &&
+        requiredFile === 'DISCLAIMER' &&
         (!contents.includes('Apache Maka') || !contents.includes('incubation'))
       ) {
-        throw new Error('DISCLAIMER-WIP does not identify Apache Maka as an incubating project');
+        throw new Error('DISCLAIMER does not identify Apache Maka as an incubating project');
       }
     }
 

scripts/asf-source-release.test.mjs

@@ -373,7 +373,7 @@ describe('ASF source release verification', () => {
         'add',
         'package.json',
         'package-lock.json',
-        'DISCLAIMER-WIP',
+        'DISCLAIMER',
         'LICENSE',
         'NOTICE',
         '.gitignore',
@@ -641,7 +641,7 @@ function writeReleaseContents(root, { includeAttributes = false } = {}) {
     `${JSON.stringify({ lockfileVersion: 3, name: 'maka', packages: { '': { name: 'maka', version: '0.1.12' } }, version: '0.1.12' }, null, 2)}\n`,
   );
   writeFileSync(
-    join(root, 'DISCLAIMER-WIP'),
+    join(root, 'DISCLAIMER'),
     'Apache Maka is undergoing incubation at The Apache Software Foundation.\n',
   );
   writeFileSync(join(root, 'LICENSE'), 'Apache License, Version 2.0\n');

scripts/rust/pack-cli.mjs

@@ -20,7 +20,17 @@
 import { execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { constants, createReadStream } from 'node:fs';
-import { chmod, copyFile, lstat, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import {
+  appendFile,
+  chmod,
+  copyFile,
+  lstat,
+  mkdir,
+  mkdtemp,
+  readFile,
+  rm,
+  writeFile,
+} from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -94,15 +104,17 @@ export async function packNativeCli({
       );
       await chmod(join(directory, 'bin', 'maka-service.exe'), 0o755);
     }
-    for (const name of ['LICENSE', 'NOTICE']) {
+    for (const name of ['DISCLAIMER', 'LICENSE', 'NOTICE']) {
       await copyRegular(join(repositoryRoot, name), join(directory, name), 16 * 1024 * 1024);
     }
+    const disclaimer = await readFile(join(directory, 'DISCLAIMER'), 'utf8');
     for (const name of ['README.md', 'README.zh-CN.md']) {
       await copyRegular(
         join(repositoryRoot, 'packages/cli', name),
         join(directory, name),
         1024 * 1024,
       );
+      await appendFile(join(directory, name), '\n\n' + disclaimer);
     }
     // Release owners supply the reviewed Rust/V8/embedded-JS notice closure.
     // The old Node CLI notice file alone is not sufficient for this binary.
@@ -111,6 +123,15 @@ export async function packNativeCli({
       join(directory, 'THIRD_PARTY_NOTICES.txt'),
       16 * 1024 * 1024,
     );
+    if (platform.os === 'darwin') {
+      for (const name of ['DISCLAIMER', 'LICENSE', 'NOTICE', 'THIRD_PARTY_NOTICES.txt']) {
+        await copyRegular(
+          join(directory, name),
+          join(directory, 'bin', 'Maka.app', 'Contents', 'Resources', name),
+          16 * 1024 * 1024,
+        );
+      }
+    }
     const name = `@maka-agent/cli-${target}`;
     await writeFile(
       join(directory, 'package.json'),
@@ -128,6 +149,7 @@ export async function packNativeCli({
           bin: { maka: `bin/${executable}` },
           files: [
             'bin',
+            'DISCLAIMER',
             'LICENSE',
             'NOTICE',
             'THIRD_PARTY_NOTICES.txt',

scripts/rust/pack-cli.test.mjs

@@ -38,7 +38,7 @@ test('native archives carry the CLI and desktop shell without a terminal sidecar
     await mkdir(join(root, 'assets'));
     await writeFile(join(root, 'assets/logo.png'), png);
     await mkdir(join(root, 'packages/cli'), { recursive: true });
-    for (const name of ['LICENSE', 'NOTICE', 'THIRD_PARTY_NOTICES.txt'])
+    for (const name of ['DISCLAIMER', 'LICENSE', 'NOTICE', 'THIRD_PARTY_NOTICES.txt'])
       await writeFile(join(root, name), 'reviewed ' + name);
     for (const name of ['README.md', 'README.zh-CN.md'])
       await writeFile(join(root, 'packages/cli', name), 'package documentation');
@@ -86,7 +86,11 @@ test('native archives carry the CLI and desktop shell without a terminal sidecar
         assert.match(plist, /<key>CFBundleShortVersionString<\/key>\n  <string>0.2.0<\/string>/);
         assert.equal(execFileSync('tar', ['-xOf', archive, bundle + 'Resources/Maka.icns']).subarray(0, 4).toString(), 'icns');
       }
-      assert.equal(execFileSync('tar', ['-xOf', archive, 'package/THIRD_PARTY_NOTICES.txt'], {encoding:'utf8'}), 'reviewed THIRD_PARTY_NOTICES.txt');
+      for (const name of ['DISCLAIMER', 'LICENSE', 'NOTICE', 'THIRD_PARTY_NOTICES.txt']) {
+        assert.equal(execFileSync('tar', ['-xOf', archive, 'package/' + name], {encoding:'utf8'}), 'reviewed ' + name);
+        if (macos) assert.equal(execFileSync('tar', ['-xOf', archive, bundle + 'Resources/' + name], {encoding:'utf8'}), 'reviewed ' + name);
+      }
+      for (const name of ['README.md', 'README.zh-CN.md']) assert.ok(execFileSync('tar', ['-xOf', archive, 'package/' + name], {encoding:'utf8'}).includes('reviewed DISCLAIMER'));
     `,
     );
     process.chdir(root);

scripts/rust/pack-launcher.mjs

@@ -18,7 +18,7 @@
  */
 
 import { execFile } from 'node:child_process';
-import { copyFile, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { appendFile, copyFile, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
@@ -48,6 +48,7 @@ export async function packLauncher(directory) {
         '-C',
         stage,
         `${candidate.rootDirectory}/packages/cli`,
+        `${candidate.rootDirectory}/DISCLAIMER`,
         `${candidate.rootDirectory}/LICENSE`,
         `${candidate.rootDirectory}/NOTICE`,
       ],
@@ -80,8 +81,11 @@ export async function packLauncher(directory) {
       join(packageDirectory, 'package.json'),
       JSON.stringify(manifest, null, 2) + '\n',
     );
-    for (const name of ['LICENSE', 'NOTICE'])
+    for (const name of ['DISCLAIMER', 'LICENSE', 'NOTICE'])
       await copyFile(join(root, name), join(packageDirectory, name));
+    const disclaimer = await readFile(join(root, 'DISCLAIMER'), 'utf8');
+    for (const name of ['README.md', 'README.zh-CN.md'])
+      await appendFile(join(packageDirectory, name), '\n\n' + disclaimer);
     const { stdout } = await run(
       'npm',
       ['pack', '--json', '--ignore-scripts', '--offline'],