feat(droid-control): make desktop workflows self-contained

[factory-droid]

Description

What

droid-control 1.1.0 carries its desktop guidance as plugin-maintained documentation, with no separate Cua skill installation, upstream commit pin, or synchronization machinery. A static relocation test verifies that local references and anchors stay inside the plugin; a deliberately broken reference fails that test. The Cua executable remains a separate dependency, and these checks do not certify live GUI behavior.

Composition of origin/master...861d49f, computed with diff-composition.py (lines count additions plus deletions):

Share	Lines	Files	What it is	Reviewer action
98.6%	3,520	24	Workflow instructions, local Cua references/license, and CI	Read the routing and shared mechanics; inspect platform recovery and license attribution.
1.4%	49	1	Documentation relocation/link test	Read the containment and anchor checks.
0.1%	2	1	Plugin version metadata	Confirm 1.0.0 → 1.1.0.

Behavior-bearing files: skills/desktop-control/SKILL.md owns the plugin boundary; references/cua-driver/WORKFLOW.md and RUNTIME.md own shared mechanics. They are counted as documentation above. There is no production-code addition; .factory-plugin/plugin.json only advances the plugin version. Plugin paths below are relative to plugins/droid-control/.

Why

The existing plugin duplicates platform guidance and depends on a personal upstream skill installation. The plugin should carry and maintain the instructions it needs, without treating documentation edits as upstream-integrity failures.

How

Explicit cua-only/native-input requests take precedence over browser defaults. One controller owns shared desktop interaction; ordinary tasks use observe/act/verify without mandatory recording or rendering. Platform guides refer to the shared observation rules, and Cua attribution and the MIT license remain included.

Net effect for users: local desktop guidance, with executable installation and OS permissions kept as explicit setup steps.

Change Shape

 desktop-control
-  personal upstream skill + duplicate plugin platform guides
+  one plugin entrypoint
+    → plugin-maintained workflow/runtime/platform references
+    → static documentation link check in CI

Related Issue

Closes CLI-2242.

The local guidance is adapted from Cua. NOTICES.md and references/cua-driver/LICENSE.md retain attribution and licensing; the documents can be edited with the plugin.

Reviewer Guide

Diff shape: see the composition table. The instruction prose carries behavior; it is not generated material to skip.

Three passes / read order:

1. skills/desktop-control/SKILL.md and skills/droid-control/SKILL.md: method precedence, setup boundaries, and single-controller ownership.
2. references/cua-driver/WORKFLOW.md, RUNTIME.md, MACOS.md, and WINDOWS.md: missing-image recovery, exact targets, menu invocation, and authorized foreground operations. Then check capture/verify skills and the QA command for consistent evidence handoffs.
3. tests/test_desktop_control.py, references/README.md, and NOTICES.md: documentation closure, plugin ownership, and license preservation. The existing CI job runs the scoped test without a copied-skill discovery exception.

Review depth: Standard. There is no production Python helper or plugin compatibility adapter to review.

Risk & Impact

• Driver releases and host environments can differ from the guidance. The entrypoint requires live schema/capability inspection and preserves existing wrappers, services, and permission settings.
• Missing screenshots cannot ground pixel input; session labels cannot isolate desktop focus or a shared recorder. The guidance keeps these boundaries explicit rather than treating delivery or partial evidence as completion.
• Three old platform-guide paths are removed in favor of the local references. No driver binary, Remotion runtime, personal skill installation, or shared daemon is changed.

Verification

Static behavior verified @ 861d49f: the desktop entrypoint and reference directory relocate outside the checkout with their local links and anchors intact. The test copies only that documentation surface, not rendering assets or unrelated tooling.

Sentinel test: test_relocated_documentation_links_stay_inside_plugin in tests/test_desktop_control.py. Replacing a RUNTIME.md link with MISSING.md in a temporary copy produced the intended assertion failure. The link set is asserted nonempty.

Not tested: a newly installed plugin driving live macOS/Windows/Linux applications or recording video. The test covers the inline links and simple heading anchors used here, not a general Markdown parser or runtime tool selection.

Standard validators: scoped unittest and broken-link negative control; exact CI discovery script; Ruff lint/format; worktree verification; aggregate-scope/license checks; staged git diff --check.

Changes since last review

• Removed the importer, hash manifest, copied skill entrypoint, discovery exception, and integrity/wording-only tests.
• Replaced competing skill-install and platform recovery instructions with plugin-owned setup and shared mechanics.
• Kept one scoped static packaging test and removed the legacy browser mutation-enable recipe.

Implementation map

Current diff: 26 files changed, +3272 / -299.

• Guidance: reference maintenance README, nine Cua mechanics/setup documents, and the original license.
• Workflow: desktop/orchestrator/capture/verify skills, QA command, and removal of three duplicate platform guides.
• Coverage: documentation relocation/link test and its step in .github/workflows/check-skills.yml.
• Plugin surface: version, architecture, notices, plugin README, and marketplace README.