legal: independently replace the cursor values recovered from a proprietary binary

[Astro-Han]

English

Part of #3268 — G1: incoming IP and provenance.

Outcome

The Computer Use cursor no longer carries values transcribed from a proprietary binary, and the values it does carry have a recorded, independently verifiable origin. This closes the G1 item by replacement rather than by determination.

#3268 allows either an ASF/legal determination that the retained facts may stay or independent replacement of those facts and the code that depends on them. This issue takes the second path because it can proceed without a determination and removes the question instead of answering it.

Exit criteria

• A contributor who has not seen the current values derives a replacement set from Maka's own requirements.
• The derivation is recorded publicly, so each new value has a verifiable origin of its own.
• Every item in the replacement scope below is replaced.
• The presentation deadline is re-derived from the new values and the presentation fence is at or above it.
• apps/desktop/src/main/__tests__/cursor-engine.test.ts passes without changes to its assertions.
• docs/computer-use-cursor-provenance.md is updated from retained facts to independent replacement.

Replacement scope

All symbols are in apps/desktop/src/renderer/computer-use-overlay/engine/cursor-engine.ts.

Item	Symbol
Glyph geometry	CODEX_CURSOR_GLYPH: size, shadowBlur, normalized path coordinates
Motion configuration	CODEX_CURSOR_MOTION: 30 fields
Close-enough gate	CURSOR_CLOSE_ENOUGH: progress, distance
Path measurement	SCORE_SAMPLES and the measures derived from it in measureCursorPath
Core scorer	SCORE_DETOUR_WEIGHT, SCORE_ANGLE_ENERGY_WEIGHT, SCORE_MAX_ANGLE_WEIGHT, SCORE_TOTAL_TURN_WEIGHT, SCORE_OUT_OF_BOUNDS_PENALTY
Terminal heading blend	terminalTangentBlendStart and the click-angle handling in cursorHeadingAt
Hotspot convention	Centre of the hosting view as the action hotspot

CURSOR_CLOSE_ENOUGH is not independently choosable. The presentation-ready deadline is derived from it together with the spring response and damping fraction, and a fence shorter than that deadline reintroduces the mid-flight click dispatch the gate exists to prevent.

Method

The replacement must be clean-room to be worth doing:

1. The contributor who performed the original binary inspection does not carry out this work.
2. New values are derived from Maka's product requirements — the glyph is legible at 1x over an arbitrary application, the cursor lands before the click is released, long moves do not sweep the desktop, and arrival does not visibly overshoot — and are tuned against the product rather than against the existing constants.
3. The derivation is written down before the file is edited.

The existing tests are behavioural rather than value-pinned; they assert landing, ordering, cancellation, and tick bounds. A test that needs a new constant written into it was pinning the old one, and that should be raised on the pull request rather than edited silently.

Existing work

• feat(desktop): replicate Codex computer-use cursor #1255 and fix(cu): make the agent cursor land where it is aimed, and stop it curling #1883 introduced the recovered values.
• docs(provenance): record Computer Use and bundled Skill origins #2676 established the current provenance record.
• The code origin audit on docs: close code origin audit #2907 restates the boundary and the open gate.

Out of scope

• The Maka-authored constants and behavior recorded in docs/computer-use-cursor-provenance.md, including MAX_DESIRED_ARC, DEPARTURE_FAN, the backwards-arrival and rotation terms, the candidate family, viewport behavior, the frame clock, presentation fences, and the brand palette. Replacing these adds risk without advancing the gate.
• The MIT trycua/cua lineage, which remains recorded as it is.
• The published git history, which still contains the original values. Whether that requires any further record is a question for the mentors and is tracked on legal: close incoming IP provenance for the first Apache release #3268, not here.

Ownership

Unassigned. The clean-room requirement above constrains who can take it: the contributor who performed the original inspection cannot, and neither can anyone who has read the current constants. This is a process requirement, not a judgement about any contributor.

简体中文

#3268 的一部分——G1：代码来源与知识产权输入。

目标结果

Computer Use 光标不再包含从专有二进制转录的数值，其所用数值具备可记录、可独立验证的来源。本 issue 以替换而非判断的方式关闭该 G1 事项。

#3268 允许两种出口：由 ASF/法务判断保留的事实可以留下，或者独立替换这些事实及依赖它们的代码。本 issue 选择后者，因为它无需等待判断即可推进，并且是让问题消失而不是回答问题。

完成条件

• 由未见过现有数值的贡献者，依据 Maka 自身需求推导出一套替换数值。
• 公开记录推导过程，使每个新数值具备自身可验证的来源。
• 完成下述替换范围内的全部项目。
• 依据新数值重新推导 presentation deadline，并确保 presentation fence 不低于该值。
• apps/desktop/src/main/__tests__/cursor-engine.test.ts 在断言未经修改的情况下通过。
• docs/computer-use-cursor-provenance.md 从「保留的事实」更新为「已独立替换」。

替换范围

全部符号位于 apps/desktop/src/renderer/computer-use-overlay/engine/cursor-engine.ts。

项目	符号
字形几何	CODEX_CURSOR_GLYPH：size、shadowBlur、归一化路径坐标
运动配置	CODEX_CURSOR_MOTION：30 个字段
Close-enough 门限	CURSOR_CLOSE_ENOUGH：progress、distance
路径度量	SCORE_SAMPLES 及 measureCursorPath 中由其派生的度量
核心评分	SCORE_DETOUR_WEIGHT、SCORE_ANGLE_ENERGY_WEIGHT、SCORE_MAX_ANGLE_WEIGHT、SCORE_TOTAL_TURN_WEIGHT、SCORE_OUT_OF_BOUNDS_PENALTY
终点转向混合	terminalTangentBlendStart 及 cursorHeadingAt 中的点击角度处理
热点约定	以宿主视图中心作为动作热点

CURSOR_CLOSE_ENOUGH 不可独立选取。presentation-ready deadline 由它连同弹簧响应与阻尼系数共同推导，而短于该 deadline 的 fence 会重新引入该门限本要防止的飞行中点击派发。

方法

替换必须采用 clean room 方式才有意义：

1. 执行原始二进制检查的贡献者不承担这项工作。
2. 新数值依据 Maka 的产品需求推导——字形在 1x 下能在任意应用之上清晰可辨、光标在点击释放前落位、长距离移动不会横扫桌面、落位不出现可见过冲——并针对产品调校，而非针对现有常量。
3. 推导过程在编辑该文件之前写下。

现有测试是行为导向而非数值锁定的：它们断言落位、顺序、取消和 tick 范围。若某个测试需要把新常量写进去，说明它原本锁定了旧值，这一点应在 pull request 上提出，而不是悄悄修改。

已有工作

• feat(desktop): replicate Codex computer-use cursor #1255 和 fix(cu): make the agent cursor land where it is aimed, and stop it curling #1883 引入了这些恢复出的数值。
• docs(provenance): record Computer Use and bundled Skill origins #2676 建立了当前的来源记录。
• docs: close code origin audit #2907 的代码来源审计重述了边界和这一未关闭的 gate。

不在范围内

• docs/computer-use-cursor-provenance.md 中记录的 Maka 自有常量与行为，包括 MAX_DESIRED_ARC、DEPARTURE_FAN、backwards-arrival 与 rotation 相关项、candidate family、视口行为、帧时钟、presentation fences 和品牌配色。替换它们只增加风险，不推进 gate。
• MIT 的 trycua/cua 血缘，按现有记录保持不变。
• 已发布的 git 历史，其中仍包含原始数值。是否需要进一步记录属于 mentors 的问题，在 legal: close incoming IP provenance for the first Apache release #3268 跟踪，不在此处。

负责人边界

未指派。上述 clean room 要求限制了可承担者：执行原始检查的贡献者不能承担，读过现有常量的人同样不能。这是流程要求，不是对任何贡献者的评价。

[Sun-GLiang]

I'd like to take this issue. I confirm that I have not inspected the current cursor constants or the proprietary binary referenced here. I’ll independently derive and publicly document the replacement values from Maka’s product requirements before editing the implementation, in accordance with the clean-room process.

[Astro-Han]

Assigned. Your declaration is exactly what the issue asks for, and I checked the public record against it: you have no commits to cursor-engine.ts or docs/computer-use-cursor-provenance.md, and you are not an author or commenter on #1255, #1883, or #2676. Recording that here so the clean room is verifiable from the repository rather than from the declaration alone.

One practical note on ordering. The replacement scope lives in a file that still contains the values being replaced, so "the derivation is written down before the file is edited" is the part that carries the weight. Please post the derivation as a comment on this issue before you open cursor-engine.ts — the timestamps are what make it independent. Seeing the old values afterwards, while applying the diff, does not taint a derivation that is already on the record.

CURSOR_CLOSE_ENOUGH is the one item that is not free to choose. Re-derive the presentation deadline from your new values and check the presentation fence against it in the same change, otherwise the mid-flight click dispatch the gate exists to prevent comes back.

If something in cursor-engine.test.ts fails on your values, raise it on the pull request rather than adjusting the assertion — that would mean the test was pinning the old constant, which is worth recording on its own.

简体中文

已指派。你的声明正是本 issue 所要求的，我也对照公开记录做了核对：cursor-engine.ts 和 docs/computer-use-cursor-provenance.md 都没有你的 commit，#1255、#1883、#2676 的作者和评论者中也没有你。在此记录下来，是为了让这个 clean room 可以从仓库本身验证，而不是只依赖声明。

关于顺序有一点实务提醒。替换范围所在的文件仍然包含着待替换的数值，因此「推导过程在编辑该文件之前写下」才是真正承担效力的一步。请在打开 cursor-engine.ts 之前，先把推导过程作为评论发在本 issue 上——正是时间戳让它具备独立性。之后在应用改动时看到旧数值，并不会污染一份已经在案的推导。

CURSOR_CLOSE_ENOUGH 是唯一不可自由选取的一项。请依据你的新数值重新推导 presentation deadline，并在同一次改动中据此检查 presentation fence，否则该门限本要防止的飞行中点击派发会重新出现。

如果 cursor-engine.test.ts 中有断言在你的新数值下失败，请在 pull request 上提出，而不要调整断言——那意味着该测试原本锁定了旧常量，这件事本身就值得记录。

[Sun-GLiang]

Clean-room derivation record

This derivation is being recorded before I open cursor-engine.ts, the current cursor-provenance document, the historical implementation PRs, or the proprietary binary referenced by this issue.

The only inputs used were Maka's public product requirements, behavior-level tests, and a value-redacted list of the configuration field names and data shapes. No current numeric cursor values were inspected.

Product criteria

The replacement is derived to satisfy four requirements:

1. The agent cursor remains legible at 1× over arbitrary application content.
2. The action hotspot reaches the target before native click dispatch is released.
3. Long moves prefer the straightest valid route instead of sweeping across the desktop.
4. Position and heading settle without visible overshoot.

Glyph geometry

I chose a rounded hotspot dart. Its tip is the action hotspot; the host view places that tip at its centre/action coordinate.

• size = 20 CSS px: large enough for a visible filled body and outline at 1×.
• shadowBlur = 3 CSS px: 15% of the glyph size, providing separation without materially enlarging it.
• Maximum tip-to-painted-edge allowance: 20 + 3 = 23 CSS px.

The new unit-square path is:

• start = (0.00, 0.00)
• curve1 = (0.03, 0.23), (0.11, 0.51), (0.20, 0.83)
• line1 = (0.43, 0.63)
• curve2 = (0.49, 0.57), (0.57, 0.60), (0.63, 0.69)
• line2 = (0.80, 1.00)
• line3 = (1.00, 0.89)
• curve3 = (0.86, 0.63), (0.69, 0.40), (0.00, 0.00)

These coordinates were drawn from scratch around the (0,0) hotspot and fit inside one normalized square.

Motion configuration

The new 30-field motion configuration is:

Field	Replacement	Derivation
clickAngle	-π/4	Canonical diagonal resting direction
candidateCount	9	Odd symmetric grid with a guaranteed zero-arc candidate
boundsMargin	23	Glyph size plus shadow extent
startHandle	1/3	Canonical cubic handle for a straight, uniform chord
endpointHandle	1/3	Same construction at arrival
arcSize	0.30	Provides avoidance candidates while scoring still prefers straight travel
arcFlow	0.50	Symmetric distribution of perpendicular displacement
straightPathDistanceThreshold	60	Three glyph widths
springResponseScaler	1/2400 s/px	Distance-scaled response
springResponseMin	0.18 s	Lower bound for moves up to 432 px
springResponseMax	0.72 s	Upper bound reached at 1728 px
springDampingFraction	1.0	Critical damping; no positional overshoot
scootDistanceThreshold	60 px	Three glyph widths
scootPositionResponse	0.16 s	Visual deformation follows the main motion
scootPositionDampingFraction	1.0	No deformation bounce
scootPositionSettleVelocity	2 px/s	One tenth of the glyph size per second
scootAxisResponse	0.12 s	Axis responds faster than position
scootAxisDampingFraction	1.0	No axis overshoot
scootBaseRotationResponse	0.18 s	Matches the shortest main response
scootBaseRotationDampingFraction	1.0	No base-rotation bounce
scootStretchResponse	0.14 s	Subtle shape response
scootStretchDampingFraction	1.0	No stretch bounce
scootStretchMin	0.92	1 - 0.08, matching the maximum Y squash
scootStretchPivotX	0.25	Keeps the leading quarter close to the hotspot
scootStretchXAmount	0.16	Maximum 16% longitudinal stretch
scootSquashYAmount	0.08	Half the X deformation
scootRotationResponse	0.16 s	Tracks the deformation response
scootRotationDampingFraction	1.0	No rotational overshoot
scootRotationMax	π/8	22.5°, half the resting diagonal
terminalTangentBlendStart	0.80	Last fifth of the route blends into the resting/click heading

Terminal heading uses smoothstep interpolation over [0.80, 1.00] and the shortest angular difference to clickAngle. A fresh move still departs toward its target rather than along the parked heading.

Path measurement and scoring

SCORE_SAMPLES = 33: two endpoints plus 31 interior points, producing 32 equal intervals.

The measures are dimensionless:

• detour = max(0, measuredLength / directDistance - 1)
• angleEnergy = mean(deltaHeading²)
• maxAngle = max(abs(deltaHeading)) / π
• totalTurn = sum(abs(deltaHeading)) / π
• outOfBounds = 0 or 1

The new score is:

8 × detour
+ 1.5 × angleEnergy
+ 2 × maxAngle
+ 0.5 × totalTurn
+ 1,000,000 × outOfBounds

All non-boundary terms are positive, so a valid straight route wins when available. The out-of-bounds term is intentionally lexicographic rather than a cosmetic preference.

Close-enough gate and presentation deadline

The new gate is:

progress = 0.99999
distance = 2 CSS px

Five-nines progress leaves at most 1 CSS px on a 100,000 CSS-px route, while the independent 2 px distance gate handles ordinary and short moves directly.

For the slowest permitted spring:

response = 0.72 s
damping fraction = 1.0
integration step = 1 / 240 s
progress threshold = 0.99999

Semi-implicit integration reaches the progress gate after 1725 ms. At the slowest tested presentation cadence of 1 fps, that becomes observable at 2000 ms. Adding 100 ms of renderer/IPC scheduling allowance gives a derived presentation-ready deadline of:

2100 ms

The presentation fence must therefore be at least 2100 ms and remain below the existing 5000 ms dead-renderer backstop.

This complete replacement set was derived independently and recorded before inspecting the values it will replace.

[Astro-Han]

Thank you — this is a complete derivation, and it is on the record before the file was opened, which is the part that carries the weight.

Two things I checked it against:

• The replacement scope is fully covered, CURSOR_CLOSE_ENOUGH included. The presentation deadline is re-derived from your own values (1725 ms to the progress gate, 2000 ms at the slowest 1 fps cadence, 100 ms scheduling allowance → 2100 ms) rather than carried across, which is exactly what that item needed.
• The score is reconstructed rather than restated, and keeping the out-of-bounds term lexicographic preserves the boundary as a hard constraint instead of a preference.

Please go ahead and open the pull request. The timestamps are what make the derivation independent, so reading the current values now, while applying the diff, does not affect it.

Three things to carry into the PR:

1. Leave the assertions in apps/desktop/src/main/__tests__/cursor-engine.test.ts unchanged. If one fails, raise it on the PR instead of adjusting it — we need to tell "the new value is wrong" apart from "the assertion encodes the old value", and only the first is yours to fix.
2. Set the presentation fence at or above 2100 ms and below the existing 5000 ms dead-renderer backstop, in the same change.
3. Update docs/computer-use-cursor-provenance.md from retained facts to independent replacement. That is an exit criterion here, not a follow-up.

Link the PR to this issue and say which exit criteria it satisfies. Please don't use Closes until the provenance document is updated as well.