feat(core): add verified runtime assets

CORRESPONDING_SOURCE.md

@@ -0,0 +1,21 @@
+# Corresponding source
+
+Every OpenCode-GraphAgent binary release that contains AGPL-covered code is
+paired with a source archive generated from the same Git commit by:
+
+```sh
+bun run ./script/corresponding-source.ts --version <release-version> --output <directory>
+```
+
+The archive contains all tracked source and build inputs, including
+`package.json`, `bun.lock`, build scripts, `LICENSE`, `NOTICE`, and
+`LICENSE-SCOPE.json`. The adjacent JSON manifest records the exact commit,
+commit timestamp, required build inputs, archive filename, and SHA-256 digest.
+
+Install the Bun version declared by the root `packageManager` field, restore
+dependencies from `bun.lock`, and run the package-specific build documented in
+the repository. External signing keys, certificates, credentials, and ordinary
+system tools are not part of the source archive.
+
+For an internal deployment, publish the archive, JSON manifest, and checksum
+next to the binaries or at the source URL configured for that deployment.

LICENSE-SCOPE.json

@@ -0,0 +1,44 @@
+{
+  "$schema": "./LICENSE-SCOPE.schema.json",
+  "schemaVersion": 1,
+  "defaultLicense": {
+    "spdx": "MIT",
+    "licenseFile": "LICENSE",
+    "copyright": "Copyright (c) 2025 opencode"
+  },
+  "scopes": [
+    {
+      "id": "dag-workflow-engine",
+      "name": "DAG workflow engine",
+      "status": "active",
+      "spdx": "AGPL-3.0-or-later",
+      "copyright": "Copyright (c) 2026 LeXwDeX",
+      "licenseFiles": ["packages/core/src/dag/LICENSE", "packages/opencode/src/dag/LICENSE"],
+      "paths": [
+        "packages/core/src/dag/",
+        "packages/opencode/src/dag/",
+        "packages/opencode/src/tool/workflow.ts",
+        "packages/schema/src/dag-event.ts",
+        "packages/tui/src/feature-plugins/system/dag-inspector.tsx",
+        "packages/tui/src/feature-plugins/system/dag-inspector-utils.ts",
+        "packages/tui/src/feature-plugins/sidebar/dag-panel.tsx",
+        "packages/opencode/src/server/routes/instance/httpapi/groups/dag.ts",
+        "packages/opencode/src/server/routes/instance/httpapi/handlers/dag.ts"
+      ]
+    },
+    {
+      "id": "portable-runtime",
+      "name": "Portable desktop runtime",
+      "status": "active",
+      "spdx": "AGPL-3.0-or-later",
+      "copyright": "Copyright (c) 2026 LeXwDeX",
+      "licenseFiles": ["packages/core/src/runtime-asset/LICENSE"],
+      "paths": [
+        "packages/core/src/runtime-asset/",
+        "packages/opencode/script/prefetch-ripgrep.ts",
+        "packages/desktop/scripts/runtime-assets.ts",
+        "packages/desktop/scripts/verify-runtime-assets.ts"
+      ]
+    }
+  ]
+}

LICENSE-SCOPE.schema.json

@@ -0,0 +1,54 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/LeXwDeX/opencode-graph-agent/blob/main/LICENSE-SCOPE.schema.json",
+  "title": "OpenCode-GraphAgent license scope manifest",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "defaultLicense", "scopes"],
+  "properties": {
+    "$schema": { "type": "string" },
+    "schemaVersion": { "const": 1 },
+    "defaultLicense": { "$ref": "#/$defs/license" },
+    "scopes": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/scope" },
+      "minItems": 1
+    }
+  },
+  "$defs": {
+    "license": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["spdx", "licenseFile", "copyright"],
+      "properties": {
+        "spdx": { "type": "string", "minLength": 1 },
+        "licenseFile": { "type": "string", "minLength": 1 },
+        "copyright": { "type": "string", "minLength": 1 }
+      }
+    },
+    "scope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "name", "status", "spdx", "copyright", "licenseFiles", "paths"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$" },
+        "name": { "type": "string", "minLength": 1 },
+        "status": { "enum": ["active", "planned"] },
+        "spdx": { "const": "AGPL-3.0-or-later" },
+        "copyright": { "type": "string", "minLength": 1 },
+        "licenseFiles": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "minItems": 1,
+          "uniqueItems": true
+        },
+        "paths": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "minItems": 1,
+          "uniqueItems": true
+        }
+      }
+    }
+  }
+}

NOTICE

@@ -7,6 +7,10 @@ an AI coding agent. It is not affiliated with or endorsed by the OpenCode team.
 License boundaries
 ------------------
 
+The machine-readable source of truth for these boundaries is
+`./LICENSE-SCOPE.json`. The human-readable paths below use the same values and
+are checked for consistency in CI.
+
 1. Upstream opencode code (the vast majority of this repository)
 
    License:  MIT
@@ -17,14 +21,15 @@ License boundaries
    are minor patches to upstream files (bug fixes, localization fixes, hook
    system, tool improvements), remains under the upstream MIT license.
 
-2. DAG workflow engine (self-developed by the fork author)
+2. Self-developed AGPL modules
 
    License:  GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later)
    Text:     ./packages/core/src/dag/LICENSE
              ./packages/opencode/src/dag/LICENSE
+             ./packages/core/src/runtime-asset/LICENSE
    Copyright (c) 2026 LeXwDeX
 
-   Covered directories and files:
+   2.1 DAG workflow engine (active)
 
    - packages/core/src/dag/                  DAG core: state machine, dependency
                                              graph, scheduling, event projection,
@@ -42,11 +47,23 @@ License boundaries
    - packages/opencode/src/server/routes/instance/httpapi/groups/dag.ts
    - packages/opencode/src/server/routes/instance/httpapi/handlers/dag.ts
                                              DAG HTTP API routes
-   - .opencode/dag-prompts/                  DAG node prompt templates
+   2.2 Portable desktop runtime (active)
+
+   - packages/core/src/runtime-asset/        Runtime asset discovery, bundled
+                                             assets, verified cache, internal
+                                             mirrors, and public fallback
+   - packages/opencode/script/prefetch-ripgrep.ts
+                                             Verified ripgrep release prefetch
+                                             for distributable artifacts
+   - packages/desktop/scripts/runtime-assets.ts
+   - packages/desktop/scripts/verify-runtime-assets.ts
+                                             Required desktop runtime asset
+                                             preparation and package gate
 
-   The AGPL applies to these files and to derivative works of them, including
-   network-server deployments. Using the rest of the repository without the
-   DAG engine is governed by the MIT license alone.
+   The AGPL applies to these paths and to derivative works of them, including
+   network-server deployments. Files outside the scopes recorded in
+   `LICENSE-SCOPE.json` remain under their existing licenses unless they carry
+   an explicit license notice that says otherwise.
 
 When a file under an AGPL-covered directory imports MIT-licensed upstream
 modules, the upstream modules remain MIT; only the AGPL-covered files and

packages/core/package.json

@@ -18,6 +18,8 @@
   "exports": {
     "./session/runner": "./src/session/runner/index.ts",
     "./system-context": "./src/system-context/index.ts",
+    "./runtime-asset": "./src/runtime-asset/index.ts",
+    "./runtime-asset/catalog/*": "./src/runtime-asset/catalog/*.ts",
     "./dag/core/*": "./src/dag/core/*.ts",
     "./dag/*": "./src/dag/*.ts",
     "./*": "./src/*.ts"

packages/core/src/dag/core/graph.ts

@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2026 LeXwDeX
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
 /**
  * DAG scheduling core — dependency graph.
  *

packages/core/src/dag/core/replan.ts

@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2026 LeXwDeX
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
 /**
  * DAG scheduling core — replan merge planning (D11, simplified model).
  *

packages/core/src/dag/core/required-validator.ts

@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2026 LeXwDeX
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
 /**
  * DAG scheduling core — required-node validation.
  *

packages/core/src/dag/core/scheduling.ts

@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2026 LeXwDeX
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
 import { DependencyGraph } from "./graph"
 
 export type SchedulingNodeStatus = "pending" | "running" | "satisfied" | "unsatisfied" | "skipped"

packages/core/src/dag/core/transitions.ts

@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2026 LeXwDeX
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
 /**
  * DAG scheduling core — transition-to-event mappings + status aggregation.
  *

packages/core/src/dag/core/types.ts

@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2026 LeXwDeX
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
 /**
  * DAG scheduling core — status enums, transition tables, and error types.
  *

packages/core/src/dag/projector.ts

@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2026 LeXwDeX
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
 export * as DagProjector from "./projector"
 
 import { and, eq, inArray, sql } from "drizzle-orm"

packages/core/src/dag/sql.ts

@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2026 LeXwDeX
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
 import { sqliteTable, text, integer, index, primaryKey, uniqueIndex } from "drizzle-orm/sqlite-core"
 import { ProjectTable } from "../project/sql"
 import { SessionTable } from "../session/sql"

packages/core/src/dag/store.ts

@@ -1,3 +1,6 @@
+// SPDX-FileCopyrightText: 2026 LeXwDeX
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
 export * as DagStore from "./store"
 
 import { and, asc, count, desc, eq, gt, inArray, or } from "drizzle-orm"