Signetry · bkd-dotcom · Sep 1, 2026 · Sep 1, 2026
@@ -0,0 +1,49 @@
+name: Feature request
+description: Suggest a capability or input for the Signetry Admission action.
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This repo is the **GitHub Action** (Apache-2.0) — inputs, outputs, the
+        composite steps, SARIF upload, the PR comment, runner/sandbox setup.
+        Changes to the governance logic itself (contract, injection quarantine,
+        required checks, verifier, earned authority, receipts) belong in
+        [signetry-core](https://github.com/Signetry/core/issues).
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What can't you do today? Describe the workflow you are trying to build, not just the feature you have in mind.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you'd like the action to do
+      description: If it's a new input or output, name it and give its default. If it changes when the check fails, say so explicitly.
+    validations:
+      required: true
+  - type: textarea
+    id: workflow
+    attributes:
+      label: How it would look in a workflow
+      render: yaml
+      placeholder: |
+        - uses: Signetry/action@v1
+          with:
+            min-authority: "1"
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you considered
+      description: Including anything you can already do with existing inputs, or by wrapping the action in your own steps.
+  - type: checkboxes
+    id: scope
+    attributes:
+      label: Scope check
+      options:
+        - label: This is about the Action, not the governance logic in signetry-core.
+          required: true
+        - label: It does not require the Action to merge a PR (`auto_merge` is always false by design — Signetry governs the agent; a human merges).
+          required: true
@@ -4,7 +4,9 @@ name: CLA
 # before their pull request can be merged. Runs entirely in this repo's Actions —
 # no third-party OAuth app. Signatures are recorded in signatures/cla.json on this
 # repo, so there is a durable, auditable record that each contributor assigned
-# copyright/ownership of their contribution to the Owner.
+# copyright of their contribution to the Owner. This repository is Apache-2.0; the
+# CLA is kept because Signetry is open core and code may need to be relicensed to
+# move across that line (see CLA.md section 3).
 #
 # A contributor signs by commenting the exact statement below on their PR:
 #   I have read the CLA Document and I hereby sign the CLA
@@ -48,7 +50,7 @@ jobs:
           path-to-document: "https://github.com/Signetry/action/blob/main/CLA.md"
           branch: "cla-signatures"
           allowlist: "dependabot[bot],bkd-dotcom"
-          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/action/blob/main/CLA.md)** — Signetry is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:"
+          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/action/blob/main/CLA.md)** — this repo is **Apache-2.0**, and signing does not take away any of the rights that licence gives you. It assigns copyright of your contribution to the Owner so it can be relicensed across Signetry's open-core line (e.g. moved into the BUSL-1.1 engine) without asking every contributor again. To agree, reply with exactly:"
           custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
           custom-allsigned-prcomment: "All contributors have signed the CLA. ✅"
           lock-pullrequest-aftermerge: false
@@ -34,7 +34,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install signetry-reviewer
-        # source-available (All Rights Reserved); install from source, not PyPI.
+        # signetry-reviewer is installed from its source repo, not PyPI.
         run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.2.0"
       - name: Compute the PR diff
         env:

@@ -5,6 +5,29 @@ Pin `@v1` (moving) or an exact `@v0.1.3+` tag.
 
 ## [Unreleased]
 
+### Changed — licensing (open core)
+
+- **This Action is now open source under Apache-2.0.** A real `LICENSE` file is in
+  the repo root. The previous "All Rights Reserved" notice is withdrawn: you may
+  use, fork, modify, distribute, and commercialize this Action, including in
+  commercial and closed-source products, with no permission needed.
+- Signetry moved to an **open-core** model: the whole integration surface (this
+  Action, the editor/agent plugins, the pre-commit guard, the eval suite) is
+  Apache-2.0, while the engine
+  [`signetry-core`](https://github.com/Signetry/core) is source-available under
+  **BUSL-1.1** and converts to Apache-2.0 on **2030-08-31**. See
+  [LICENSING.md](https://github.com/Signetry/signetry/blob/main/LICENSING.md).
+- **The CLA is unchanged and still required.** Open core needs relicensing rights
+  so a contribution made here can later move into the engine; signing takes away
+  none of the rights Apache-2.0 grants you. `CLA.md`, `CONTRIBUTING.md`,
+  `CONTRIBUTORS.md`, and the docs were rewritten to say so accurately.
+- **The CLA's fallback licence grant is now non-exclusive.** It previously granted the
+  Owner an *exclusive* licence where copyright assignment is not permitted by law, which
+  would have stripped contributors of the right to use their own contribution — directly
+  contradicting the rights the LICENSE grants everyone. The CLA text is now identical
+  across all Signetry repositories (bar the engine/integration licence wording) so the
+  legal terms cannot drift per-repo again. See [CLA.md](CLA.md) §2–3.
+
 ### Changed — Signetry naming
 
 - The Marketplace listing name is **Signetry Admission** (tagline: "Seal every

@@ -1,6 +1,10 @@
 # Signetry Contributor License Agreement (CLA)
 
-**Copyright (c) 2026 Binay Dalai. All rights reserved.**
+**Copyright (c) 2026 Binay Dalai.** This repository is licensed under
+**[Apache-2.0](LICENSE)** as part of Signetry's
+[open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md). This
+Agreement governs what You grant the Owner when You contribute; it does not reduce the
+rights the Apache-2.0 licence gives You (and everyone else) in this code.
 
 Thank you for your interest in contributing to Signetry ("the Project"), owned by
 Binay Dalai ("the Owner"). This Contributor License Agreement ("Agreement")
@@ -26,21 +30,33 @@ Your Contribution. You agree that the Owner is the sole and exclusive owner of t
 Contribution once merged into the Project.
 
 To the extent any rights cannot be assigned by law, You grant the Owner a
-**perpetual, worldwide, exclusive, irrevocable, royalty-free, sublicensable, and
+**perpetual, worldwide, non-exclusive, irrevocable, royalty-free, sublicensable, and
 transferable license** to use, reproduce, modify, prepare derivative works of,
 publicly display, publicly perform, distribute, **sell, and commercialize** Your
 Contribution, in whole or in part, in any form and for any purpose.
 
-## 3. The Owner's exclusive rights
+Nothing in this section removes Your own ability to use Your Contribution: once it is
+released as part of this repository it is available to You, as to anyone, under
+[Apache-2.0](LICENSE), and You retain any rights You independently hold in the
+underlying ideas and techniques.
+
+## 3. Why the Owner needs this (open core)
 
 You acknowledge and agree that:
 
-- The Owner alone retains the right to **use, license, sell, and monetize** the
-  Project, including Your Contribution.
-- You obtain **no right** to use, copy, modify, distribute, sell, or commercialize
-  the Project or Your Contribution for Your own personal or commercial purposes,
-  except as expressly permitted in writing by the Owner.
-- The Project is **not open source** and is licensed "All Rights Reserved."
+- **You keep the licence's rights.** This repository is released under
+  [Apache-2.0](LICENSE), so You may use, copy, modify, distribute, and commercialize
+  it — including Your own Contribution — on exactly the same terms as any other user.
+  No separate written permission is required.
+- **The Owner may relicense.** The assignment above lets the Owner use, license, sell,
+  and monetize the Project, including Your Contribution, and release it under other
+  terms.
+- **Code may move across the open-core line.** Signetry's integration surface is
+  Apache-2.0 while the engine
+  ([`Signetry/core`](https://github.com/Signetry/core)) is source-available under
+  BUSL-1.1, converting to Apache-2.0 on 2030-08-31. A Contribution accepted here may
+  later be moved into the engine, or engine code moved out to an Apache-2.0 repo. The
+  CLA is what makes that possible without asking every past contributor again.
 
 ## 4. Recognition of Contributors (credit, not rights)
 
@@ -50,8 +66,8 @@ of Your work.
 
 This recognition is **attribution only**. It does **not**:
 
-- grant You any ownership, license, or right to use, copy, sell, sublicense, or
-  commercialize the Project or Your Contribution;
+- grant You ownership of the Project, or any rights beyond those the Project's
+  licence already grants everyone;
 - entitle You to represent the Project, or any part of it, as Your own work, product,
   or property, or to market or sell it under Your own name or brand; or
 - create any partnership, employment, or revenue-sharing relationship with the Owner.

@@ -1,25 +1,104 @@
-# Contribution Agreement
+# Contributing
 
-By submitting a Pull Request to this repository, you agree to assign and transfer all copyright and ownership of your contributed code to the repository owner. The owner retains the exclusive right to monetize, use, and control the entire codebase.
+Thanks for wanting to improve **Signetry Admission**. This repository is the
+GitHub Action — the integration surface — and it is
+[Apache-2.0](LICENSE): use it, fork it, ship it commercially, no strings.
 
-## Signing the CLA (required before merge)
+## What the licence lets you do
 
-This is enforced by a bot. When you open a pull request, the **CLA Assistant** check
-will ask you to sign the [Contributor License Agreement](CLA.md). Reply on the PR
-with exactly:
+Apache-2.0 gives you a patent grant and the right to use, copy, modify,
+distribute, and commercialize this Action, including in closed-source and
+commercial products. You do not need our permission and you do not owe us
+anything. Keep the `LICENSE` and the attribution notices when you redistribute,
+and note your changes — that is the whole obligation.
+
+This repo is part of Signetry's
+[open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md):
+every integration (this Action, the editor and agent plugins, the pre-commit
+guard, the eval suite) is Apache-2.0, while the engine
+([`Signetry/core`](https://github.com/Signetry/core)) is source-available under
+BUSL-1.1 and converts to Apache-2.0 on 2030-08-31.
+
+## The CLA still applies — and why
+
+A PR **cannot be merged** until you sign the
+[Contributor License Agreement](CLA.md). It is enforced by a bot: when you open a
+pull request, the **CLA Assistant** check asks you to reply on the PR with exactly:
 
 ```
 I have read the CLA Document and I hereby sign the CLA
 ```
 
-Your acceptance is recorded in `signatures/cla.json`. A PR **cannot be merged** until
-the CLA is signed. Signetry is **not open source** (All Rights Reserved) — by signing
-you assign copyright/ownership of your contribution to the Owner and gain no right to
-use, sell, or commercialize it yourself.
+Your acceptance is recorded in `signatures/cla.json`.
+
+The CLA is not about withholding rights from you — Apache-2.0 already grants you
+everything above, and signing does not take it away. It exists because code moves
+across the open-core line. A well-built adapter that starts here as Apache-2.0
+may later belong in the BUSL-1.1 engine, and Signetry needs the relicensing
+rights to move it without tracking down every past contributor for permission.
+It also lets us dual-license and defend the project if that is ever necessary.
+
+## Getting started
+
+There is no build step and no compiled artifact. The Action is a **composite
+action defined entirely in [`action.yml`](action.yml)** — a series of `shell: bash`
+steps that install `signetry-core` from its source repo and run
+`signetry admit` / `signetry scan` / `signetry comment`. Editing this repo means
+editing that YAML (or the workflows in `.github/workflows/`) and the docs.
+
+To exercise a change, point a workflow in a scratch repository at your branch:
+
+```yaml
+      - uses: Signetry/action@my-branch    # or your-fork/action@my-branch
+        with:
+          min-authority: "1"
+```
+
+…then open a PR in that scratch repo and read the run log, the verdict comment,
+and the uploaded receipt artifact.
+
+Two workflows run on every PR here:
+
+- **CLA** (`.github/workflows/cla.yml`) — the signature gate described above.
+- **Reviewer** (`.github/workflows/reviewer.yml` + `reviewer-comment.yml`) — an
+  advisory `signetry-reviewer` pass that posts one recommendation comment. It is
+  advisory only: it never merges and never fails the PR.
+
+### Where a change belongs
+
+- **This repo** — action inputs and outputs, the composite steps, SARIF upload,
+  the PR comment plumbing, runner/sandbox setup, docs.
+- **[`Signetry/core`](https://github.com/Signetry/core)** — the governance logic
+  itself: the contract, injection quarantine, required checks, the independent
+  verifier, earned authority, and receipt signing. If the verdict is wrong, the
+  bug is almost certainly there, not here.
+
+### Things to keep in mind
+
+`action.yml` is a security-critical surface, and `.github/CODEOWNERS` routes it
+for review accordingly:
+
+- Never interpolate `${{ inputs.* }}` or `${{ github.event.* }}` directly into a
+  `run:` body — pass it through `env:` and read the variable, as the existing
+  steps do. That was a real script-injection vulnerability in `v0.1.0`–`v0.1.2`
+  (see [SECURITY.md](SECURITY.md)).
+- Do not add `pull_request_target` with a checkout of PR head, and do not give a
+  job that executes PR code a writable token. The split between `reviewer.yml`
+  (untrusted code, read-only) and `reviewer-comment.yml` (trusted, writable, never
+  checks out PR code) is deliberate — the header comments in both files explain it.
+- Fail closed, not open. A step that cannot verify something should refuse, not
+  wave the change through.
+- Update [`CHANGELOG.md`](CHANGELOG.md) under `## [Unreleased]` for anything a
+  user would notice.
+
+Found a vulnerability? Do not open a public issue — use
+[private reporting](https://github.com/Signetry/action/security/advisories/new).
+See [SECURITY.md](SECURITY.md).
+
+By participating you agree to the [Code of Conduct](CODE_OF_CONDUCT.md).
 
 ## Credit
 
 Contributors are **acknowledged** in [CONTRIBUTORS.md](CONTRIBUTORS.md), the Git
-history, and release notes. This is attribution only — you may truthfully say you
-contributed, but it grants no ownership and no right to use, sell, or rebrand the
-project as your own. See the "Recognition of Contributors" clause in [CLA.md](CLA.md).
+history, and release notes. See the "Recognition of Contributors" clause in
+[CLA.md](CLA.md).
@@ -1,14 +1,16 @@
 # Contributors
 
-Signetry is **owned by Binay Dalai** and is **All Rights Reserved** (not open source).
+This repository is **[Apache-2.0](LICENSE)** and maintained by Binay Dalai as part of
+Signetry's [open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md).
 The people below are gratefully acknowledged for contributions accepted under the
 [Contributor License Agreement](CLA.md).
 
-**Credit, not ownership.** Being listed here recognizes a person's contribution. It
-does **not** grant any right to use, copy, sell, sublicense, or commercialize the
-project, and does **not** entitle anyone to present the project (in whole or in part)
-as their own work, product, or brand. All such rights remain exclusively with the
-owner.
+**Credit, not ownership.** Being listed here recognizes a person's contribution.
+Everyone — contributors included — already has the right to use, modify, and
+commercialize this code under Apache-2.0. Listing here does **not** additionally grant
+ownership of the project, and does **not** entitle anyone to present the project (in
+whole or in part) as their own work, product, or brand, or to use the Signetry name to
+endorse their own products.
 
 ## Owner / maintainer