Scrub draft, provenance, brands, personal data

Original work item (epic Task 10454, verbatim): - Remove Draft state from anywhere of the jaah-ce, agent-sdk, agent-connectors. It needs to be removed at the source and then propagated using standard mechanism - remove any references on the source of documents (especially do not mention any brands) - agent-sdk. must borrow and share the process from jaah-ce, as well as terms. We want them mirrors from the main repo. Only main branch for now - do we want the same with agent-connector? make sure it is up to date with agent-sdk - Look for any sensitive or internal information or any brands - scrub all old versions from all three repos Full settled inputs: the epic's `prd` and `architecture` artifacts (Task 10454; read with `task_read`/`artifact_read`). Decisions quoted below are verbatim from them. Child D — Draft, provenance, brands, personal and infra sweep at source (architecture §1.7, §1.4 brand sweep). Uses Child B's check and baseline; covers Child C's `packages/agent-connectors`. This is the only child in its phase that adds a migration. Requirements (PRD verbatim): R1 "No file in any of the three published trees, and no file in the monorepo that ships to them, says the license is a draft, pending approval, or not in force. Fixed at the monorepo source; reaches jaah-ce by a normal publish run." R2 "No published tree or mirror commit names the source of a document: no "adapted from …", no n8n, no `jaah-ai/jaah` link or sha, no `SOURCE_COMMIT` file (or any file whose purpose is to point at the private source), no "Jaah Local". Commit messages of every mirror are neutral (e.g. "Jaah Agent SDK <version>")." R7 categories personal, infra and brands. D1 (verbatim): "Draft" = the LICENSE draft banner and every "draft until approved" wording about the license. The license is treated as approved and in force. The SDK's product term "draft task" (task_create files a draft) is not touched. S1 (verbatim): "Third-party names functionally required" = names the product must say to work or be understood: provider/CLI names the node runs and the user picks (e.g. Claude Code, Codex, Gemini), protocol/dependency names (ACP, Postgres, Docker, GitHub as a forge), and license texts' own required notices of bundled dependencies. Everything else (inspirations, comparisons, "adapted from X", vendor names in examples where a neutral word works) is removed. Do: - `infra/community-edition/LICENSE`: line 1 becomes the title line; line 4 drops the "adapted from …" clause, keeping "Version 1.0". Terms otherwise untouched. `tools/community_edition/README.md:111` drops "draft until the operator approves it". Remove the license item from `infra/community-edition/RELEASE-CHECKLIST.md`. - `packages/agent-sdk/README.md:139-144` "Status": no monorepo or mirror wording; the `jaah-ai/jaah` comment at `packages/agent-sdk/examples/*/jaah-agent.toml:3`. - "Jaah Local" in the user-visible `RAISE` text of `apps/api/migrations/versions/202610252247_accounts_local_cap.py:35` and `202610262000_accounts_ce_cap.py:67`: edit the literals and add ONE new migration that reinstalls the function with "Jaah Community Edition" (revision ids untouched). - Personal and infra hits in shipped files: ~10 files with names (web test fixtures with a person's name, `ruzhukov` paths), ~46 with `ts.net`/headscale hosts, the `dev.<domain>` hosts → neutral fixtures (`Ada Lovelace`, `example.com`) and neutral hosts. `headscale` stays as a dependency name; its hostnames do not. - Brand sweep (architecture verbatim): "Over each built tree: 1. Extract the candidate brands: every capitalised proper noun or CamelCase product token that is not in the English dictionary or the code's own identifiers, and every third-party domain (`*.com`, `*.io`, …). 2. Rank them by frequency and review the whole list against S1. 3. Each candidate lands in either the denylist (then it is scrubbed at source) or the scoped allowlist with a one-line reason. The reviewed candidate list is part of D's PR body and its acceptance, so a sweep that finds only `n8n` cannot pass." Fill `tools/mirror/brands.toml`; `n8n` credential type stays (A7). Vendored third-party code (`apps/jaahd/vendor/native/...`) keeps its attribution notices. - Delete the `sensitive_baseline.toml` rows this child clears (personal, infra except `skynet`, brands). Credentials & reach: - AC3/AC5/AC7 read oracles (branches, commits, tags, releases, file contents) | the runner's `jaah-forge` (task forge auth), GitHub API | **verified**: `jaah-forge api get repos/jaah-ai/agent-connectors/git/trees/develop` and `repos/jaah-ai/jaah/environments` answered - `./dc check full`, unit and gate oracles | nothing beyond the worktree | n/a Out of scope: - Do NOT touch tracking refs (`Task N`, `ADR-N`, `WU-…`) — Children E1–E3. Do NOT touch `skynet` (K-waves). Do NOT change the license's terms beyond the banner and origin clause. Do NOT remove the `n8n` credential type. - Do NOT rename or change the product's `draft` task state or the SDK spec's "draft task" wording (D1). - Do NOT change any repo's visibility (D8); do NOT publish packages to PyPI/npm. - Do NOT relicense agent-sdk or agent-connectors (Apache-2.0 stays); do NOT change the CE license's terms beyond removing the draft banner and origin line. - Do NOT remove functionally required third-party names (S1) — provider CLIs, protocols, dependencies, forge names. - Do NOT edit monorepo files that ship to no mirror for §5 hygiene (S2) (the `skynet` rename alone is exempt, A2); do NOT rewrite the monorepo's own history. - Do NOT change jaah-ce's `ce-staging` environment or the edition seam / API cut. - Do NOT edit the mirrors directly except the one-time history reset and branch/tag/release/package deletion in R5; every content change lands in the monorepo and reaches the mirror by its publish workflow. - Do NOT change the SDK v2 API or the `jaah.ai` extension spec semantics. - Do NOT write to any mirror repo before the final publish child (A5). Done means: - AC1 (PRD verbatim, monorepo part): `grep -rniE "pending the licensor|not yet in force|draft until" infra/community-edition tools/community_edition packages/agent-sdk packages/agent-connectors` → zero. LICENSE line 1 is the license title. (Product-term "draft task" lines in the SDK spec are excluded by D1.) — run and cite. - AC2 at source (PRD verbatim, amended by A7): `grep -rniE "n8n|adapted from|jaah-ai/jaah([^-]|$)|Jaah Local|SOURCE_COMMIT"` over each built tree (build via `tools/mirror/build.py` for CE, SDK, connectors) → zero, excluding `apps/api/app/credentials/registry.py` and its console and test fixtures. Quality: "LICENSE still reads as a complete, coherent license (title, version, all sections) — a reviewer reading it top to bottom finds no dangling reference." - The extraction is a committed, re-runnable command (e.g. `tools/mirror/brand_candidates.py <tree>`); its full output for each built tree is in the PR body and EVERY candidate it prints has a decision (denylist → scrubbed, or allowlist with a one-line S1 reason); re-running it shows no undecided candidate. - The new migration reinstalls the cap function; `./dc psql` shows the function's RAISE text says "Jaah Community Edition" after upgrade (or a migration test asserts it). - Personal/infra/brand rows are gone from `tools/mirror/sensitive_baseline.toml` and the gate's sensitive stage passes; fixtures read naturally (neutral names, not `xxx`). - `./dc check full` green in the merge lane.