## 90-second read

- What: documents `cua-driver mcp` as a detected native driver (local background + isolated-sandbox surfaces) so `/flow-next:qa` can drive native apps on Windows/Linux and headless/CI — the four gaps the Codex/Claude Computer-Use rung can't reach.
- How: pure host-driven MCP prose in a new `references/cua.md` + a Step-4 detect/route line in the drive SKILL. The host calls CUA's MCP tools; no deterministic engine, no flowctl, no Python.
- Proof: the local Cua Driver was validated live (AX-driven loop, the Accessibility-vs-Screen-Recording permission split). The Sandbox SDK was not — every unvalidated sandbox claim is marked verify at build.
- Scope guard: agent-browser stays the only assumed driver; absent ⇒ fall to Computer Use → documented-limitation. Base install stays zero-dep.

## R-ID → evidence

R-ID | Criterion | Task | Commit
--- | --- | --- | ---
`R1` | Native rung documents CUA as a detected optional driver (local + sandbox); no new skill | .1, .2 | `cd32510` `4a520a8`
`R2` | `references/cua.md` with concrete install + multi-host MCP wiring + permission grant | .1 | `cd32510`
`R3` | Probe-based graceful detection; absent ⇒ Computer Use → documented-limitation | .1 | `cd32510`
`R4` | Explicit native-rung precedence (attended vs headless) — composes with R5 | .1 | `cd32510`
`R5` | Sandbox rung enables headless/CI driving; local lume/QEMU default, cua.ai opt-in | .2 | `4a520a8`
`R6` | Evidence tuple accepts cua-driver/cua-sandbox; fn-51↔fn-53 seam unchanged; drift section | .1 | `cd32510`
`R7` | Licensing — MIT-only default path; AGPL/CC-BY extras flagged, never auto-installed | .1 | `cd32510`
`R8` | Cross-platform parity + full doc sweep + Codex mirror (version bump deferred) | .3 | `23159cd`

8/8 covered — no uncovered acceptance criteria.

## Churn map · by review intent

File | Intent | Churn
--- | --- | ---
`skills/flow-next-drive/references/cua.md` NEW | The rung reference — read first | +488
`skills/flow-next-drive/SKILL.md` | Step 4 detect/route + degradation | +21/−10
`codex/skills/flow-next-drive/{SKILL,references/cua}.md` | Codex mirror (sync-codex.sh) | +509
`CHANGELOG.md` | `## Unreleased` entry (no version bump) | +12
`docs/skills.md`, `docs/platforms.md` | Driver-ladder one-liners name CUA | +2/−2
`.flow/*` | Task state + done summaries | +15/−17

## Where to look

- `references/cua.md` — the substance. Check the multi-host MCP wiring (Claude + Codex), the native-rung precedence (attended: cua-driver → Computer Use → limitation; headless: sandbox-only), and that command detail stays OUT of `SKILL.md`.
- Permission-split evidence mode — Accessibility unlocks driving, Screen Recording unlocks screenshots; absent Screen Recording ⇒ "AX-only evidence" surfaced, not a silent empty screenshot.
- Codex mirror — confirm `cua.md` reads coherently after sync-codex.sh (multi-host intact). Not a byte-identical claim — skill-local refs ride the rewrites.
- `docs/skills.md` / `docs/platforms.md` driver-ladder strings + the flow-next.dev drive page (separate repo, committed separately, `pnpm build` green).

## Risk register

- verify at build The Cua Sandbox SDK (lume/QEMU, cua.ai cloud) was not validated live — 9 "verify at build" markers in `cua.md` flag every unverified provisioning/teardown claim. The local driver was validated.
- licensing Default path is MIT-only; `cua-agent[omni]` (AGPL) / OmniParser (CC-BY) are flagged and never auto-installed — confirm the prose never runs `pip install` for the user.
- privacy cua.ai cloud sandbox receives the driven screen (data egress) + bills — must be explicit opt-in, never auto-selected. Local lume/QEMU is the default.
- deferred No version bump — staged under `## Unreleased` per the batched-release rule; version decided later. GF microsite / AI×SDLC guide untouched (driver rung).

Generated by /flow-next:make-pr from fn-71-flow-next-drive-cua-rung-provider against origin/main · 2026-06-26 · regenerable, the markdown PR body is the record.