chore: copyright headers, CI header gate, LegalCopyright, release provenance timestamps

.github/actions/build-installer/action.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2026 Max Aubert. All rights reserved.
+# Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 # The installer build shared by release.yml and alpha.yml, so a build step is changed in one place.
 #
 # Runs after actions/checkout. It reads the version from src/version.h, runs every test gate and
@@ -25,6 +27,11 @@ runs:
         . ./tools/version.ps1      # Get-WindVersion: the one src/version.h reader
         "version=$(Get-WindVersion (Get-Location).Path)" >> $env:GITHUB_OUTPUT
 
+    # Cheap provenance gate first: every first-party source file carries the copyright header.
+    - name: Copyright headers
+      shell: pwsh
+      run: pwsh -File tools/check_copyright.ps1
+
     - name: Install NSIS
       shell: pwsh
       run: choco install nsis --no-progress -y

.github/workflows/alpha.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2026 Max Aubert. All rights reserved.
+# Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 # Alpha / nightly channel: build an installer from ANY branch, on demand, without touching the
 # stable download.
 #

.github/workflows/build.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2026 Max Aubert. All rights reserved.
+# Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 name: build
 
 on:

.github/workflows/release.yml

@@ -1,3 +1,5 @@
+# Copyright (c) 2026 Max Aubert. All rights reserved.
+# Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 # Keep the published release in step with main.
 #
 # The problem this exists for: v0.1.0 shipped, a fix landed on main, and the release kept
@@ -109,6 +111,43 @@ jobs:
             if ($LASTEXITCODE -ne 0) { throw 'gh release create failed' }
           }
 
+      # Provenance: a record of this commit, its tree and the SHA-256 of its source
+      # archive and installer, stamped with OpenTimestamps (Bitcoin-anchored, cannot be backdated).
+      # The proof starts pending; docs/provenance/README.md says how to upgrade and verify it. A
+      # calendar outage must never block a release, hence continue-on-error.
+      - name: Timestamp provenance
+        continue-on-error: true
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          $ErrorActionPreference = 'Continue'
+          $PSNativeCommandUseErrorActionPreference = $false
+          $v = '${{ steps.ver.outputs.version }}'
+          $sha = '${{ github.sha }}'
+          git archive --format=tar -o src.tar $sha
+          $rec = "provenance-$v.txt"
+          @(
+            'Wind release provenance record'
+            'Owner: Max Aubert'
+            "Repository: https://github.com/${{ github.repository }}"
+            "Version: $v"
+            "Commit: $sha"
+            "Tree: $(git rev-parse "$sha^{tree}")"
+            "Source archive (git archive --format=tar $sha) SHA-256: $((Get-FileHash src.tar -Algorithm SHA256).Hash.ToLower())"
+            "Installer Wind-Setup-x64-$v.exe SHA-256: $('${{ steps.notes.outputs.sha }}'.ToLower())"
+          ) | Set-Content $rec -Encoding utf8NoBOM
+          python -m pip install --quiet opentimestamps-client
+          # python-bitcoinlib cannot find OpenSSL on Windows by name (the plain `ots` command dies
+          # at import), so point it at Python's own libcrypto and call the client's main directly.
+          $dll = Get-ChildItem (Join-Path (python -c "import sys;print(sys.base_prefix)") 'DLLs') -Filter 'libcrypto*.dll' | Select-Object -First 1
+          $shim = "import sys,ctypes.util as u;o=u.find_library;u.find_library=lambda n: r'$($dll.FullName)' if n in ('ssl','libeay32','crypto') else o(n);from otsclient.ots import main;sys.argv[0]='ots';main()"
+          python -c $shim stamp $rec
+          if (-not (Test-Path "$rec.ots")) { throw 'ots stamp failed' }
+          gh release upload "v$v" $rec "$rec.ots" --clobber
+          if ($LASTEXITCODE -ne 0) { throw 'provenance upload failed' }
+
       - name: Summary
         shell: pwsh
         run: |

CLAUDE.md

@@ -18,6 +18,7 @@ are frozen history cited from code, not kept in step with it.
 - `build.bat installer`: NSIS setup (needs `winget install NSIS.NSIS`), then `tools\installer_check.ps1`.
 - `pwsh -File tools\release.ps1`: release installer into `dist\` (what CI runs).
 - UI tests: `npx playwright test` in `ui/` (run when anything under `ui/` changes).
+- `pwsh -File tools\check_copyright.ps1`: CI gate; every new source file needs the copyright/SPDX header. See 11.
 
 ## Stack and map
 - Three binaries: `Wind.exe` (core, UIAccess when installed), `WindConfig.exe` (WebView2 settings),

build.bat

@@ -1,4 +1,6 @@
 @echo off
+rem Copyright (c) 2026 Max Aubert. All rights reserved.
+rem Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 setlocal enabledelayedexpansion
 set "ROOT=%~dp0"
 cd /d "%ROOT%"

docs/architecture/11-build-test-release.md

@@ -94,6 +94,18 @@ keys), the Playwright UI suite and `tools/release.ps1`, so an NSIS compile error
 `installer_check.ps1` breaks the PR, not main. Nothing is published from it. Run the Playwright suite
 locally too when anything under `ui/` changes.
 
+**Copyright headers.** Every tracked first-party source file opens with a two-line notice,
+`Copyright (c) 2026 Max Aubert. All rights reserved.` and `Proprietary
+source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary`, in
+the file's own comment syntax (`//`, `#`, `;`, `rem` after `@echo off`, `/* */`, `<!-- -->` after
+`<!doctype html>`). `tools/check_copyright.ps1` fails when a covered file lacks the SPDX line in its
+first 5 lines; it is the first gate in `build-installer`, and `-List` prints the files it covers.
+It skips third-party code (`third_party/`, `upscale_nis.h`, `upscale_shaders.h`, which keep their
+upstream notices), generated files (`flyout_palettes.h`, `themes.css`, `themes.js`, `over.nsh`),
+`docs/` and `tests/fixtures/`. A new source file needs the header; a new generated or vendored
+file goes in the script's exclusion lists. The binaries carry the same notice as `LegalCopyright`
+(`src/wind.rc`, `src/tray_app/wind_tray.rc`, `installer/wind.nsi`).
+
 ## Local UIAccess deploy
 
 UIAccess is needed for the input-transform publish (transform on the desktop), binds over

installer/app.nsh

@@ -1,3 +1,5 @@
+; Copyright (c) 2026 Max Aubert. All rights reserved.
+; Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 ;
 ; Wind setup, the parts that are about Wind rather than about installing.
 ;

installer/kit.nsh

@@ -1,3 +1,5 @@
+; Copyright (c) 2026 Max Aubert. All rights reserved.
+; Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 ;
 ; Wind setup, part one: the window.
 ;

installer/local-sign.ps1

@@ -1,3 +1,5 @@
+# Copyright (c) 2026 Max Aubert. All rights reserved.
+# Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 <#
     Signs the installed Wind on THIS PC so Windows grants it UIAccess.
 

installer/make-loop.mjs

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 /**
  * Builds the video loop setup plays, from a source clip.
  *

installer/make-over.mjs

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 /**
  * Renders installer/over.html into the alpha overlays the installer composites over its
  * video loop, plus the rectangles NSIS needs to know about.

installer/over.html

@@ -1,4 +1,6 @@
 <!doctype html>
+<!-- Copyright (c) 2026 Max Aubert. All rights reserved.
+     Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary -->
 <html lang="en">
 <head>
 <meta charset="utf-8" />

installer/plain.nsh

@@ -1,3 +1,5 @@
+; Copyright (c) 2026 Max Aubert. All rights reserved.
+; Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 ;
 ; Wind setup, the accessible plain pages (issue #513).
 ;

installer/screens.nsh

@@ -1,3 +1,5 @@
+; Copyright (c) 2026 Max Aubert. All rights reserved.
+; Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 ;
 ; Wind setup, the five screens.
 ;

installer/user-localappdata.ps1

@@ -1,3 +1,5 @@
+# Copyright (c) 2026 Max Aubert. All rights reserved.
+# Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 <#
     Prints the %LOCALAPPDATA% folder of the user who owns the desktop in this session (issue #274).
 

installer/video.nsh

@@ -1,3 +1,5 @@
+; Copyright (c) 2026 Max Aubert. All rights reserved.
+; Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 ;
 ; Wind setup, the picture: a video loop with the UI composited over it.
 ;

installer/wind.nsi

@@ -1,3 +1,5 @@
+; Copyright (c) 2026 Max Aubert. All rights reserved.
+; Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 ;
 ; Wind setup.
 ;
@@ -43,7 +45,7 @@ VIAddVersionKey "FileDescription" "Wind setup"
 VIAddVersionKey "FileVersion"     "${WIND_VERSION}"
 VIAddVersionKey "ProductVersion"  "${WIND_VERSION}"
 VIAddVersionKey "CompanyName"     "${PUBLISHER}"
-VIAddVersionKey "LegalCopyright"  "Copyright (c) 2026 ${PUBLISHER}"
+VIAddVersionKey "LegalCopyright"  "Copyright (c) 2026 ${PUBLISHER}. All rights reserved."
 
 !include "MUI2.nsh"
 !include "LogicLib.nsh"

src/color/color_filter.cpp

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #include "color_filter.h"
 #include "mag_host.h"
 #include "logging.h"

src/color/color_filter.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #pragma once
 // Colour filter controller (issue #288). Applies the DWM colour effect (MagSetFullscreenColorEffect)
 // on the tick thread, deduped so an unchanged filter costs one compare

src/color/color_matrix.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #pragma once
 // Colour filter matrices (issue #288). Pure; tests/test_color_matrix.cpp.
 //

src/color/cursor_tint.cpp

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #include "cursor_tint.h"
 #include "cursor_tint_pixels.h"
 #include "logging.h"

src/color/cursor_tint.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #pragma once
 // Tinted system pointers at 1x (spec 2026-09-30-cursor-tint-design.md). Windows draws the pointer on
 // a hardware plane the DWM colour effect never reaches, so while Warmth/Brightness are on Wind swaps

src/color/cursor_tint_pixels.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #pragma once
 // Pixel work for the tinted 1x pointer (spec 2026-09-30-cursor-tint-design.md). Pure; tests in
 // tests/test_cursor_tint.cpp. Pixels are 32bpp BI_RGB DIB values: 0xAARRGGBB, straight (not

src/config/config.cpp

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #include "config.h"
 #include "keybind_rules.h"   // one safety rule set for every bind (#285)
 #include "ini_edit.h"   // wheel migration (#318): pure text edits

src/config/config.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #pragma once
 #include <string>
 namespace wind {

src/config/config_path.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // Shared helper to resolve magnifier.ini's runtime path. MUST be included AFTER <windows.h>.
 //
 // Returns the exe's directory if it is writable (dev workflow, repo dir), else

src/config/ini_edit.cpp

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #include "ini_edit.h"
 #include <sstream>
 namespace wind {

src/config/ini_edit.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #pragma once
 #include <string>
 #include <map>

src/config/profile_switch.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // Profile switching and "relaunch Wind, put the model back if that fails", shared by the tray
 // (WindTray.exe) and the settings host (WindConfig.exe). Win32: MUST be included AFTER <windows.h>.
 // Each surface keeps only its own messages and logging; the steps and their order live here once.

src/config/profiles.cpp

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #include "profiles.h"
 #include "ini_edit.h"
 #include "config.h"   // DefaultIniText: the built-in default of every templated key

src/config/profiles.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // Pure profile logic (no <windows.h>): what belongs in a profile file vs the live magnifier.ini,
 // profile-name validation, and the text transforms used on every switch/mirror. I/O lives in
 // src/config/profiles_io.h (Win32) and the callers. See docs/specs/2026-08-12-profiles-design.md.

src/config/profiles_io.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // Win32 I/O for profiles (thin; paths, UTF-8, atomic read/write and listing: tests/test_profiles_io.cpp).
 // MUST be included AFTER <windows.h>. Shared by Wind.exe (tray + migration) and WindConfig.exe
 // (bridge handlers) so both always resolve the same profiles directory next to the resolved ini.

src/config_ui/bridge_json.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // The settings host's JSON, both directions of the WebView2 bridge. Pure (no <windows.h>), so it
 // compiles into the WIND_TESTS build; tests/test_bridge_json.cpp.
 //

src/config_ui/main.cpp

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #include "webview_recover.h"
 #include <windows.h>
 #include <dwmapi.h>

src/config_ui/webview_recover.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #pragma once
 // What Settings does when a WebView2 process dies (field 2026-09-29: RTSS's global hook crashes the
 // WebView2 browser process at start-up, a use-after-unload of dxgi.dll inside RTSSHooks64, and the

src/config_ui/wind_watchdog.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // Pure decision logic for "the magnifier is gone, so close the config window".
 // Deliberately free of <windows.h> so it compiles into the WIND_TESTS build.
 #pragma once

src/core/com_util.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #pragma once
 namespace wind {
 // Release a COM interface pointer and null it. Safe on null. Shared by the renderer and the

src/core/hitch_record.cpp

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // src/core/hitch_record.cpp - see hitch_record.h. Pure: compiled into the WIND_TESTS build.
 #include "hitch_record.h"
 #include <cstdio>

src/core/hitch_record.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // src/core/hitch_record.h
 // Per-tick flight recorder and hitch classifier (#361). Pure (no <windows.h>): the tick loop fills
 // TickRec with QPC spans and thread CPU time; this file decides what a long frame was and renders

src/core/idle_policy.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #pragma once
 // Event-driven idle (issue #71): may the main loop sleep until an input event or the ~100 ms
 // housekeeping timeout, instead of ticking at the monitor refresh? Pure; tests/test_idle_policy.cpp.

src/core/log_queue.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // src/core/log_queue.h
 // Bounded multi-producer / single-consumer queue for log lines (#361). Pure (no <windows.h>).
 //

src/core/logging.cpp

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // src/core/logging.cpp
 #include "logging.h"
 #include <cstdio>

src/core/logging.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // src/core/logging.h
 #pragma once
 #include <string>

src/core/main.cpp

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #include <windows.h>
 #include <dwmapi.h>
 #include <tlhelp32.h>

src/core/reload_gate.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #pragma once
 // Config hot-reload gate (pure, no <windows.h>; tests/test_reload_gate.cpp). RunTick reads the ini
 // and asks this what to do, so the retry/skip/reload rules are testable without a tick loop.

src/core/sched_priority.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // src/core/sched_priority.h - keep the tick loop on time when the rest of the PC is busy (issue #334).
 //
 // The tick thread ran at normal priority, so under heavy background CPU load (renders, builds) it

src/core/test_telemetry.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #pragma once
 // Per-tick test telemetry (issue #225): the proving-ground harness (tools/testenv) sets
 // WIND_TESTLOG=<path> and Wind appends one CSV line per tick - ground truth for centering,

src/core/tick_span.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 // src/core/tick_span.h
 // Time a part of the tick into the current TickRec (#361). The tick loop points tl_tickSpans at
 // the record it is filling; anywhere on the tick thread can then wrap a call in

src/core/tick_stats.h

@@ -1,3 +1,5 @@
+// Copyright (c) 2026 Max Aubert. All rights reserved.
+// Proprietary source-available software; see LICENSE. SPDX-License-Identifier: LicenseRef-Wind-Proprietary
 #pragma once
 // Recent tick intervals, for the tray's frame-pacing readout. PURE (no <windows.h>) so the
 // statistics are unit-testable without a desktop.