release: prepare unified signed runtime activation

.github/workflows/release.yml

@@ -76,7 +76,7 @@ jobs:
   verify-runtime-macos:
     needs: [verify-release-ref, classify-release]
     if: needs.classify-release.outputs.mode == 'activation'
-    runs-on: macos-14
+    runs-on: macos-15
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
@@ -138,18 +138,14 @@ jobs:
           TAG="${GITHUB_REF#refs/tags/}"
           # Supported forms are v-agent-collab-X.Y.Z and vX.Y.Z. Both resolve
           # to the only releaseable package.
-          if [[ "$TAG" =~ ^v-([a-z0-9-]+)-([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
-            PLUGIN="${BASH_REMATCH[1]}"
-            VER="${BASH_REMATCH[2]}"
+          if [[ "$TAG" =~ ^v-agent-collab-([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
+            PLUGIN="agent-collab"
+            VER="${BASH_REMATCH[1]}"
           elif [[ "$TAG" =~ ^v([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
             VER="${BASH_REMATCH[1]}"
             PLUGIN="agent-collab"
           else
-            echo "ERROR: tag format must be v-<plugin>-<X.Y.Z> or v<X.Y.Z>"
-            exit 1
-          fi
-          if [ "$PLUGIN" != "agent-collab" ]; then
-            echo "ERROR: agent-collab is the only releaseable package"
+            echo "ERROR: tag format must be v-agent-collab-X.Y.Z or vX.Y.Z"
             exit 1
           fi
           {

README.md

@@ -81,6 +81,12 @@ approval. See [NOTICE](NOTICE) and
 [COMMERCIAL-LICENSING.md](COMMERCIAL-LICENSING.md) for the exact ownership and
 approval boundary.
 
+An activation archive also redistributes CPython 3.13.14, Nuitka 4.1.3 runtime
+material, and their incorporated components under their own terms. The exact,
+digest-pinned inventory is shipped as `THIRD-PARTY-NOTICES.txt` and
+`third-party-licenses/` inside the plugin package. Those files are excluded from
+policy-only archives because no native runtime is present.
+
 ## System architecture
 
 ```mermaid
@@ -138,17 +144,22 @@ until the signed runtime exposes the complete matrix, including Composer.
    runtime, notarizes it, and records size/hash/team metadata.
 4. A policy-only plugin release omits the runtime and keeps every native route
    typed unavailable. An activation release imports only the final binary and
-   manifest metadata; no source implementation crosses the boundary.
+   manifest metadata plus the exact third-party notice/license tree; no private
+   source implementation crosses the boundary.
 5. Plugin CI validates both Claude and Codex manifests/marketplaces, schemas,
    skills, migration behavior, runtime fixtures, the dependency-free secret
    scan, CodeQL security analysis, release consistency, and public-export
    safety.
 6. A policy-only signed-tag release proves the runtime manifest is empty and
    the archive contains no runtime. For activation, a macOS verification job
    binds codesign, notarization, manifest, artifact digest, and commit SHA into
-   release evidence before the publish job may include the binary.
+   release evidence before the publish job may include the binary. SPDX 2.3
+   evidence distinguishes project-owned PolyForm material from the embedded
+   CPython, Nuitka, and incorporated third-party components.
 7. Hosts update one package, run the migration doctor, restart, and verify the
-   resolved profile plus eligible routes.
+   resolved profile plus eligible routes. Activation hosts then run the
+   co-packaged `runtime_setup.py status` and `prepare` commands; managed Grok
+   device login is exposed only as `runtime_setup.py login-grok`.
 
 Rollback uses policy-only safe mode. Set `AGENT_COLLAB_SAFE_MODE=1` in the
 active host runtime environment and restart that host; all model-execution
@@ -186,6 +197,24 @@ package through their compatible plugin manager; if that host has no native
 plugin surface, it cannot install this package directly and must remain
 temporarily unsupported rather than recreating a provider-specific shim.
 
+An activation release adds a closed signed-runtime management surface beside
+the coordinator. Resolve the installed plugin root and run only:
+
+```text
+python3 "<plugin-root>/runtime_setup.py" status
+python3 "<plugin-root>/runtime_setup.py" prepare
+python3 "<plugin-root>/runtime_setup.py" login-grok
+```
+
+These operations accept no provider, model, path, environment, binary, tool,
+or raw-argument overrides. The public client keeps the process environment
+scrubbed and sends only `generic` or `codex_desktop` as a closed host-context
+observation; the signed runtime derives and validates its own state roots from
+the OS login identity. Exact supported Codex, OpenCode, and Grok CLIs remain
+external prerequisites and must be installed and authenticated through their
+vendor-supported interfaces. No workspace checkout or provider-specific plugin
+is required. Policy-only releases report the management surface unavailable.
+
 Remove every old package reported by the doctor, then run the doctor again.
 The doctor reads filesystem/registry state and Codex
 `[plugins."name@marketplace"]` entries from `~/.codex/config.toml`, distinguishes
@@ -339,6 +368,11 @@ package or an activation package. For an activation candidate, also run
 on Darwin arm64; that verifier intentionally remains activation-only and fails
 closed against an empty manifest.
 
+Activation packaging also requires the exact digest-pinned
+`THIRD-PARTY-NOTICES.txt` and `third-party-licenses/` tree. Missing, extra,
+linked, hardlinked, unsafe, or modified legal members fail before archive or
+SBOM publication. Policy-only archives intentionally omit that tree.
+
 `CHANGELOG.md` remains generated at release time from `changelog.d/` fragments.
 Historical changelog entries may name retired packages only as clearly
 historical records; they are not active install or rollback instructions.

changelog.d/2026-07-12-activation-licensing.md

@@ -0,0 +1,11 @@
+### Added
+
+- Add a digest-pinned activation-only third-party notice/license tree for CPython 3.13.14, Nuitka 4.1.3, Expat, HACL*, libb2, mpdecimal, mimalloc, and Hedley.
+- Extend SPDX 2.3 release evidence with component packages, embedded-component relationships, and license conclusions that no longer mislabel the native runtime as wholly PolyForm-licensed.
+- Add a closed co-packaged runtime setup client for read-only status, idempotent managed-state preparation, and bounded Grok device login without exposing provider recipes or caller-selected paths.
+
+### Changed
+
+- Reject noncanonical package-qualified release tags, move the arm64 activation verifier to `macos-15`, and fail activation archives on missing, extra, linked, hardlinked, unsafe, or content-drifted third-party legal members.
+- Keep the native child environment scrubbed while passing only a closed generic/Codex-Desktop host-context observation; the signed runtime derives and validates provider state from the OS login identity.
+- Fail closed with typed `platform_unsupported` when POSIX user identity APIs are unavailable, before manifest or artifact ownership checks can raise on non-POSIX hosts.

changelog.d/2026-07-12-merge-resolve-rename.md

@@ -0,0 +1,3 @@
+### Breaking
+
+- Rename the public `ai-merge-resolve` skill to `merge-resolve`, including its generated command and auto-apply policy filename. Existing installations must invoke `/agent-collab:merge-resolve` and rename `.claude/ai-merge-policy.yaml` to `.claude/merge-resolve-policy.yaml` when that opt-in file is used.

docs/migration-from-legacy-packages.md

@@ -18,7 +18,7 @@ For every row below, all listed old namespaces map to the single new command.
 |---|---|
 | `/claude-collab:agent-readiness`, `/codex-collab:agent-readiness`, `/antigravity-collab:agent-readiness` | `/agent-collab:agent-readiness` |
 | `/claude-collab:agent-runtime-status`, `/codex-collab:agent-runtime-status`, `/antigravity-collab:agent-runtime-status` | `/agent-collab:agent-runtime-status` |
-| `/claude-collab:ai-merge-resolve`, `/codex-collab:ai-merge-resolve`, `/antigravity-collab:ai-merge-resolve` | `/agent-collab:ai-merge-resolve` |
+| `/agent-collab:ai-merge-resolve`, `/claude-collab:ai-merge-resolve`, `/codex-collab:ai-merge-resolve`, `/antigravity-collab:ai-merge-resolve` | `/agent-collab:merge-resolve` |
 | `/claude-collab:autonomy-readiness`, `/codex-collab:autonomy-readiness`, `/antigravity-collab:autonomy-readiness` | `/agent-collab:autonomy-readiness` |
 | `/claude-collab:brainstorm`, `/codex-collab:brainstorm`, `/antigravity-collab:brainstorm` | `/agent-collab:brainstorm` |
 | `/claude-collab:chain`, `/codex-collab:chain`, `/antigravity-collab:chain` | `/agent-collab:chain` |
@@ -87,6 +87,12 @@ route stays typed unavailable. An activation release requires the complete
 contracts plus commit-bound macOS signing/notarization evidence. No raw launcher
 is a migration fallback.
 
+Activation also requires the exact digest-pinned third-party notice/license
+tree and component-aware SPDX evidence for CPython, Nuitka, and incorporated
+runtime components. Missing, unexpected, linked, or modified legal members
+block archive publication. Policy-only archives omit those files because they
+contain none of the corresponding native components.
+
 The runtime manifest does not control signer trust. The operator-owned Apple
 Team ID must be pinned independently in `plugins/agent-collab/signing_policy.py`;
 activation verification rejects an empty anchor, a manifest mismatch, or a

plugins/agent-collab/README.md

@@ -30,6 +30,12 @@ commercial rights. See [NOTICE](NOTICE) and
 [COMMERCIAL-LICENSING.md](COMMERCIAL-LICENSING.md) for the exact ownership and
 approval boundary.
 
+When the signed native runtime is activated, the archive also includes
+`THIRD-PARTY-NOTICES.txt` and `third-party-licenses/` for CPython 3.13.14,
+Nuitka 4.1.3 runtime material, and incorporated dependencies. Those exact files
+are digest-pinned by the archive builder and remain outside policy-only
+archives, which contain none of the corresponding runtime components.
+
 ## Runtime and safe mode
 
 The package may contain a privately built signed native runtime only at the
@@ -53,6 +59,8 @@ only rather than a send primitive.
 This package may still be distributed as a policy-only release: its manifest
 has no artifact rows, its archive has no runtime executable, and invocation
 continues to return typed unavailable until an activation release is verified.
+An activation archive must add the complete digest-pinned third-party legal
+tree and component-aware SPDX evidence alongside the signed runtime.
 Reinstalling a retired plugin is never a rollback.
 
 To enter rollback mode, set `AGENT_COLLAB_SAFE_MODE=1` in the active host
@@ -135,7 +143,7 @@ time; a listed skill does not imply that its native route is currently active.
 | Delegation and implementation | `delegate`, `dev-delegate`, `worker` |
 | Large-context and knowledge work | `knowledge-compile`, `long-context` |
 | Reproducible workflows | `chain`, `chain-configurator`, `orchestrate` |
-| Integration and conflict handling | `ai-merge-resolve` |
+| Integration and conflict handling | `merge-resolve` |
 | Visual guidance | `ui-to-code`, `visual-review` |
 
 `visual-review` and `ui-to-code` currently provide primary-only guidance because
@@ -153,6 +161,27 @@ runtime manifest; blocks routing while any retired package remains installed or
 active; and prints exact manager-specific install, verify, and uninstall
 actions.
 
+## Signed runtime setup
+
+After installing an activation release, resolve this installed plugin root and
+use the closed management client only:
+
+```text
+python3 "<plugin-root>/runtime_setup.py" status
+python3 "<plugin-root>/runtime_setup.py" prepare
+python3 "<plugin-root>/runtime_setup.py" login-grok
+```
+
+`status` is read-only, `prepare` creates only signed-runtime-managed state, and
+`login-grok` starts the bounded interactive device flow. The client accepts no
+provider, model, path, environment, binary, tool, or arbitrary argument
+options. It verifies the same co-packaged signed artifact as normal routing,
+keeps the child environment scrubbed, reports only a closed host-context enum,
+and never exposes private provider recipes. Codex and OpenCode still require
+their exact supported external CLIs and standard authenticated host state;
+install and authenticate those through their vendor-supported interfaces.
+Policy-only releases return typed `unavailable` for all three commands.
+
 ## Standalone invocation and local threat limit
 
 Every routed skill resolves this installed plugin root from its own `SKILL.md`

plugins/agent-collab/THIRD-PARTY-NOTICES.txt

@@ -0,0 +1,36 @@
+Agent Collab native runtime third-party notices
+===============================================
+
+The PolyForm Strict License in LICENSE applies only to John Osumi-authored
+portions of the agent-collab package. The activation runtime also contains the
+third-party components below under their own terms. The policy-only package
+does not contain the native runtime and does not redistribute these components.
+
+Component inventory
+-------------------
+
+- CPython 3.13.14 (Python-2.0 / PSF terms). The exact license and incorporated
+  software notices are in third-party-licenses/CPython-3.13.14-LICENSE.txt and
+  third-party-licenses/CPython-3.13.14-NOTICES.txt.
+- Expat 2.8.1 (MIT), incorporated by CPython. The exact notice is in
+  third-party-licenses/Expat-COPYING.txt.
+- HACL* commit bb3d0dc8d9d15a5cd51094d5b69e70aa09005ff0 (MIT and
+  Apache-2.0), incorporated by CPython hash modules. Notices are in
+  third-party-licenses/HACL-LICENSE.txt; the complete Apache-2.0 text is also
+  reproduced in CPython-3.13.14-NOTICES.txt.
+- libb2 0.98.1 (CC0-1.0), incorporated by CPython's BLAKE2 module. The source
+  dedication is in third-party-licenses/libb2-CC0-1.0.txt.
+- mpdecimal 2.5.1 (BSD-2-Clause), incorporated by CPython's decimal module.
+  Its notice is in third-party-licenses/mpdecimal-NOTICE.txt.
+- mimalloc 2.1.2 (MIT), incorporated by CPython. Its notice is in
+  third-party-licenses/mimalloc-LICENSE.txt.
+- Nuitka 4.1.3 runtime/onefile bootstrap. Nuitka's AGPL text, runtime exception,
+  and attribution notice are in the three Nuitka-4.1.3 files under
+  third-party-licenses/. The runtime exception permits the compiled program to
+  remain under its chosen license; it is preserved verbatim.
+- Hedley v14 (CC0-1.0), incorporated by the Nuitka runtime headers. The source
+  dedication is in third-party-licenses/Hedley-CC0-1.0.txt.
+
+Apple system libraries referenced from /usr/lib and /System/Library are not
+copied into the package. Build-only tools are recorded by private build
+provenance and are not redistributed as runtime components.