(maka) 01/01: docs(release): align source-only release records

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

Astro-Han pushed a commit to branch docs/2974-source-release-docs
in repository https://gitbox.apache.org/repos/asf/maka.git

commit 2e7a6c01aa3fba61c531bf793dcf58ddd9897ea0
Author: AstroHan <le...@outlook.com>
AuthorDate: Fri Aug 28 15:51:12 2026 +0800

    docs(release): align source-only release records
    
    Generated-by: Codex
---
 .github/ASF_SOURCE_RELEASE.md | 11 +++--------
 docs/code-origin-audit.md     |  7 +++----
 2 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/.github/ASF_SOURCE_RELEASE.md b/.github/ASF_SOURCE_RELEASE.md
index d936e1463..82d815a1f 100644
--- a/.github/ASF_SOURCE_RELEASE.md
+++ b/.github/ASF_SOURCE_RELEASE.md
@@ -19,14 +19,9 @@
 
 # Apache Maka source release runbook
 
-This runbook prepares the official Apache Incubator source-release component.
-The first Maka release also requires npm and Desktop convenience artifacts, but
-those artifacts have separate build, licensing, signing, and acceptance gates.
-They must be built from the exact IPMC-approved source release produced here.
-
-The workflow implements release mechanics; it does not establish that a commit
-is legally ready to release. Before starting a vote, the PPMC and mentors must
-confirm the candidate's provenance and release documents.
+This runbook prepares the official Apache Incubator source release. npm, Desktop, and other convenience artifacts use separate build, licensing, signing, and acceptance processes; they are not part of this source candidate or its release vote. Stable convenience artifacts, when provided, are built from the approved source release and tag.
+
+The workflow implements release mechanics; it does not replace the human review of candidate provenance and release documents performed through the project's release vote.
 
 ## Candidate contract
 
diff --git a/docs/code-origin-audit.md b/docs/code-origin-audit.md
index 66cd18d22..e4f2074d8 100644
--- a/docs/code-origin-audit.md
+++ b/docs/code-origin-audit.md
@@ -157,11 +157,11 @@ The SCANOSS table above covers only what its winnowing scanner fingerprints, whi
 - `truncateToolOutput` follows `truncate.output()` line for line, sharing the `2000`-line and `50 KiB` budgets, the `direction?: 'head' | 'tail'` option, the local names `out`, `bytes`, `hitBytes`, `size`, `preview`, `removed`, and `unit`, and the asymmetric newline accounting that uses `(i > 0 ? 1 : 0)` when keeping the head and `(out.length > 0 ? 1 : 0)` when keeping the tail. Maka added byte-safe single-line slicing, trailing-newline handling, and the recovery hint, and dropped the up [...]
 - `edit-replace.ts` reuses the escape-normalizing replacer verbatim at the level of expression: the regular expression `/\\(n|t|r|'|"|`|\\|\n|\$)/g` is character-for-character identical and its nine branches appear in the same order, rewritten from a `switch` into an `if` chain. The line-trimmed and whitespace-normalized matchers follow the same upstream structure.
 
-Upstream is MIT, Copyright (c) 2025 opencode. The repository now resolves to `anomalyco/opencode`; the comparison used commit `fc80874`. Because opencode is not an npm dependency, `scripts/generate-third-party-notices.mjs` cannot reach it: that generator walks the npm production dependency trees of `@maka/desktop` and `maka-agent` only. "opencode" therefore appears in neither `LICENSE`, `NOTICE`, `packages/cli/THIRD_PARTY_NOTICES.txt`, nor the desktop notices, while both files ship in `@ [...]
+Upstream is MIT, Copyright (c) 2025 opencode. The repository now resolves to `anomalyco/opencode`; the comparison used commit `fc80874`. Because opencode is not an npm dependency, `scripts/generate-third-party-notices.mjs` cannot discover it: that generator walks the npm production dependency trees of `@maka/desktop` and `maka-agent` only. The root `LICENSE` therefore records the fixed source revision, adapted files, upstream lineage, copyright, and MIT permission notice explicitly. No ` [...]
 
 ### models.dev data snapshot
 
-`packages/core/src/model-metadata.generated.ts` and `packages/runtime/src/telemetry/model-pricing.generated.ts` are checked-in, shipped derivations of `https://models.dev/api.json`, together about 27,800 lines. Upstream `sst/models.dev` is MIT, Copyright (c) 2025 models.dev. The individual entries are facts and are not themselves copyrightable, but the selection and arrangement — which providers and fields are carried, and upstream's normalized structures such as `lifecycle` and `thinkin [...]
+`packages/core/src/model-metadata.generated.ts` and `packages/runtime/src/telemetry/model-pricing.generated.ts` are checked-in, shipped derivations of `https://models.dev/api.json`, together about 27,800 lines. Upstream `anomalyco/models.dev` is MIT, Copyright (c) 2025 models.dev. The individual entries are facts and are not themselves copyrightable, but the selection and arrangement — which providers and fields are carried, and upstream's normalized structures such as `lifecycle` and `t [...]
 
 ### PawWork browser port
 
@@ -267,11 +267,10 @@ Before code transfer or release review:
 1. obtain and record the bootstrap contributor confirmation;
 2. obtain an appropriate human legal/ASF determination about retaining the specifically documented facts recovered through static inspection, or replace those facts and dependent code independently;
 3. have the human contributor of record review this report, the 25 classifications, and the final `LICENSE`/`NOTICE` decision;
-4. attribute the adapted opencode sources and the models.dev snapshot, and close the generator gap that hides them, under #3270.
 
 No additional source-removal issue is indicated by the recovered scan. A recurring cloud snippet scan is not recommended until the project chooses a service, data policy, stable thresholds, and an owner for false-positive review. The local dependency-notice check remains the narrower, deterministic CI control for shipped npm dependencies.
 
-That check has a structural blind spot worth stating plainly, because it produced both gaps in [Other provenance evidence](#other-provenance-evidence). `scripts/generate-third-party-notices.mjs` derives its inventory from npm production dependency trees, so material that enters the repository as vendored or adapted source, or as generated data, is invisible to it by construction — not missed by accident. Every such source must be registered by hand today, which means the next one will be [...]
+That check has a structural blind spot worth stating plainly. `scripts/generate-third-party-notices.mjs` derives its inventory from npm production dependency trees, so material that enters the repository as vendored or adapted source, or as generated data, is invisible to it by construction — not missed by accident. The opencode adaptations and models.dev snapshot are now registered explicitly in the root `LICENSE`; every future source of this kind must likewise be registered by hand unl [...]
 
 The scanner has a comparable blind spot. Entry 17 was matched at 14% against an unrelated package, and what actually identified its origin was structural: near-verbatim doc comments, preserved declaration forms, and a reproduced upstream inconsistency. A follow-up sweep for the same pattern across the repository — comparing locally declared types against installed dependency declarations by name overlap and ordered property sequences — found no second instance. That sweep is still blind  [...]
 


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org