chore: relicense to Apache-2.0 (Signetry goes open core)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,71 @@
+name: Bug report
+description: Something in the Codex integration behaves incorrectly
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. This repository is the **Codex integration surface**
+        (MCP server wiring, the `signetry guard` lifecycle hook, `config.toml`).
+        Governance logic — contract evaluation, guard decisions, the verifier, receipts —
+        lives in [signetry-core](https://github.com/Signetry/core); please file those
+        there.
+
+        For a **security vulnerability**, do not open an issue: use
+        [private vulnerability reporting](https://github.com/Signetry/codex/security/advisories/new)
+        instead. See [SECURITY.md](https://github.com/Signetry/codex/blob/main/SECURITY.md).
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What you saw, and what you expected instead.
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: The smallest sequence that shows the problem.
+      placeholder: |
+        1. Wired the MCP server into ~/.codex/config.toml as documented
+        2. Asked Codex to ...
+        3. Observed ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: config
+    attributes:
+      label: Relevant config
+      description: >
+        Your `~/.codex/config.toml` Signetry block and/or `.signetry/admission.yaml`.
+        Redact anything private — never paste an API key.
+      render: toml
+
+  - type: textarea
+    id: output
+    attributes:
+      label: Command output
+      description: >
+        Output from the failing command (e.g. `signetry guard ...`), or the Codex
+        transcript around the failure.
+      render: shell
+
+  - type: input
+    id: core-version
+    attributes:
+      label: signetry-core version
+      description: The pin you installed (e.g. `v0.7.0`), or the output of `signetry --version`.
+    validations:
+      required: true
+
+  - type: input
+    id: env
+    attributes:
+      label: Environment
+      description: OS, Python version, Codex version.
+      placeholder: macOS 15.3, Python 3.12.4, Codex CLI 0.x
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,13 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Governance engine (signetry-core)
+    url: https://github.com/Signetry/core/issues
+    about: >
+      Contract evaluation, guard decisions, the verifier, receipts, and scanning live
+      in the engine. File engine behaviour there, not here.
+  - name: Signetry platform overview
+    url: https://github.com/Signetry/signetry
+    about: How the integrations, the engine, and the CI action fit together.
+  - name: Report a security vulnerability (private)
+    url: https://github.com/Signetry/codex/security/advisories/new
+    about: Signetry is a security tool. Please report privately, never in a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,43 @@
+name: Feature request
+description: Suggest an improvement to the Codex integration
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This repository is Apache-2.0 and contributions are welcome — see
+        [CONTRIBUTING.md](https://github.com/Signetry/codex/blob/main/CONTRIBUTING.md).
+
+        Scope check: this repo wires Codex to the engine. It **never reimplements
+        policy** and never auto-merges. Requests to change how contracts are
+        evaluated, how receipts are signed, or what the guard decides belong in
+        [signetry-core](https://github.com/Signetry/core).
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What are you trying to do that this integration makes hard or impossible today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed change
+      description: What should the integration do instead? Config snippets welcome.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Workarounds you tried, and why they were not enough.
+
+  - type: checkboxes
+    id: contribute
+    attributes:
+      label: Would you like to implement this?
+      options:
+        - label: I'm willing to open a pull request (I'll sign the CLA).

.github/workflows/cla.yml

@@ -6,6 +6,12 @@ name: CLA
 # repo, so there is a durable, auditable record that each contributor assigned
 # copyright/ownership of their contribution to the Owner.
 #
+# The CLA is kept even though this repo is Apache-2.0: Signetry is open core, so a
+# contribution accepted on the Apache-2.0 integration surface may later move into the
+# BUSL-1.1 engine (Signetry/core) or be released under other terms. The CLA is what
+# makes that possible without asking every past contributor again. It does not reduce
+# the contributor's own Apache-2.0 rights.
+#
 # A contributor signs by commenting the exact statement below on their PR:
 #   I have read the CLA Document and I hereby sign the CLA
 
@@ -48,7 +54,7 @@ jobs:
           path-to-document: "https://github.com/Signetry/codex/blob/main/CLA.md"
           branch: "cla-signatures"
           allowlist: "dependabot[bot],bkd-dotcom"
-          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/codex/blob/main/CLA.md)** — Signetry is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:"
+          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/codex/blob/main/CLA.md)** — this repo is **Apache-2.0**, and signing assigns copyright in your contribution to the Owner so it can move across Signetry's open-core line later. You keep the same Apache-2.0 rights to this code as everyone else. To agree, reply with exactly:"
           custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
           custom-allsigned-prcomment: "All contributors have signed the CLA. ✅"
           lock-pullrequest-aftermerge: false

.github/workflows/reviewer.yml

@@ -34,7 +34,7 @@ jobs:
         with:
           python-version: "3.12"
       - name: Install signetry-reviewer
-        # source-available (All Rights Reserved); install from source, not PyPI.
+        # Not published to PyPI; install from the pinned Git source.
         run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.2.0"
       - name: Compute the PR diff
         env:

CHANGELOG.md

@@ -6,10 +6,24 @@ Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semve
 
 ### Changed
 
+- **Licence: Apache-2.0.** This repository moves from "All Rights Reserved" to
+  [Apache-2.0](LICENSE) as part of Signetry's
+  [open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md) — the
+  integration surface is Apache-2.0, while the engine
+  ([`Signetry/core`](https://github.com/Signetry/core)) is BUSL-1.1 and converts to
+  Apache-2.0 on 2030-08-31. The [CLA](CLA.md) is retained so contributions can move
+  across the open-core line; it no longer withholds usage rights from contributors.
+
 - Naming: CLI `signetry`, env vars `SIGNETRY_*`, config `.signetry/`, import package
   `signetry_core`, and prose/docs references use **Signetry**. Install pins now use
   `signetry-core @ git+https://github.com/Signetry/core@v0.6.0` and
   `signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.2`.
+- **The CLA's fallback licence grant is now non-exclusive.** It previously granted the
+  Owner an *exclusive* licence where copyright assignment is not permitted by law, which
+  would have stripped contributors of the right to use their own contribution — directly
+  contradicting the rights the LICENSE grants everyone. The CLA text is now identical
+  across all Signetry repositories (bar the engine/integration licence wording) so the
+  legal terms cannot drift per-repo again. See [CLA.md](CLA.md) §2–3.
 
 ## [0.3.0] — 2026-07-26
 

CLA.md

@@ -1,6 +1,10 @@
 # Signetry Contributor License Agreement (CLA)
 
-**Copyright (c) 2026 Binay Dalai. All rights reserved.**
+**Copyright (c) 2026 Binay Dalai.** This repository is licensed under
+**[Apache-2.0](LICENSE)** as part of Signetry's
+[open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md). This
+Agreement governs what You grant the Owner when You contribute; it does not reduce the
+rights the Apache-2.0 licence gives You (and everyone else) in this code.
 
 Thank you for your interest in contributing to Signetry ("the Project"), owned by
 Binay Dalai ("the Owner"). This Contributor License Agreement ("Agreement")
@@ -26,21 +30,33 @@ Your Contribution. You agree that the Owner is the sole and exclusive owner of t
 Contribution once merged into the Project.
 
 To the extent any rights cannot be assigned by law, You grant the Owner a
-**perpetual, worldwide, exclusive, irrevocable, royalty-free, sublicensable, and
+**perpetual, worldwide, non-exclusive, irrevocable, royalty-free, sublicensable, and
 transferable license** to use, reproduce, modify, prepare derivative works of,
 publicly display, publicly perform, distribute, **sell, and commercialize** Your
 Contribution, in whole or in part, in any form and for any purpose.
 
-## 3. The Owner's exclusive rights
+Nothing in this section removes Your own ability to use Your Contribution: once it is
+released as part of this repository it is available to You, as to anyone, under
+[Apache-2.0](LICENSE), and You retain any rights You independently hold in the
+underlying ideas and techniques.
+
+## 3. Why the Owner needs this (open core)
 
 You acknowledge and agree that:
 
-- The Owner alone retains the right to **use, license, sell, and monetize** the
-  Project, including Your Contribution.
-- You obtain **no right** to use, copy, modify, distribute, sell, or commercialize
-  the Project or Your Contribution for Your own personal or commercial purposes,
-  except as expressly permitted in writing by the Owner.
-- The Project is **not open source** and is licensed "All Rights Reserved."
+- **You keep the licence's rights.** This repository is released under
+  [Apache-2.0](LICENSE), so You may use, copy, modify, distribute, and commercialize
+  it — including Your own Contribution — on exactly the same terms as any other user.
+  No separate written permission is required.
+- **The Owner may relicense.** The assignment above lets the Owner use, license, sell,
+  and monetize the Project, including Your Contribution, and release it under other
+  terms.
+- **Code may move across the open-core line.** Signetry's integration surface is
+  Apache-2.0 while the engine
+  ([`Signetry/core`](https://github.com/Signetry/core)) is source-available under
+  BUSL-1.1, converting to Apache-2.0 on 2030-08-31. A Contribution accepted here may
+  later be moved into the engine, or engine code moved out to an Apache-2.0 repo. The
+  CLA is what makes that possible without asking every past contributor again.
 
 ## 4. Recognition of Contributors (credit, not rights)
 
@@ -50,8 +66,8 @@ of Your work.
 
 This recognition is **attribution only**. It does **not**:
 
-- grant You any ownership, license, or right to use, copy, sell, sublicense, or
-  commercialize the Project or Your Contribution;
+- grant You ownership of the Project, or any rights beyond those the Project's
+  licence already grants everyone;
 - entitle You to represent the Project, or any part of it, as Your own work, product,
   or property, or to market or sell it under Your own name or brand; or
 - create any partnership, employment, or revenue-sharing relationship with the Owner.

CONTRIBUTING.md

@@ -1,6 +1,29 @@
-# Contribution Agreement
+# Contributing to Signetry for Codex
 
-By submitting a Pull Request to this repository, you agree to assign and transfer all copyright and ownership of your contributed code to the repository owner. The owner retains the exclusive right to monetize, use, and control the entire codebase.
+Contributions are welcome — bug reports, docs fixes, and improvements to the Codex
+integration surface (the MCP server wiring, the lifecycle-hook guard, `config.toml`).
+
+## Licensing
+
+This repository is **[Apache-2.0](LICENSE)**. You may use, copy, modify, distribute,
+and commercialize it, including in closed-source and commercial products, subject to
+the licence's attribution and notice terms. There is no separate permission to ask for.
+
+It is part of Signetry's
+[open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md): the
+integration surface (this repo and the other adapters) is Apache-2.0 so anyone can add
+an agent, an editor, or a CI adapter, while the engine
+([`Signetry/core`](https://github.com/Signetry/core)) is source-available under
+BUSL-1.1 and converts to Apache-2.0 on 2030-08-31.
+
+### The CLA still applies
+
+Contributions are accepted under the [Contributor License Agreement](CLA.md), and the
+CLA check still gates every pull request. Open core is exactly why it is kept: a
+well-built adapter here may later be moved *across* the open-core line into the
+BUSL-1.1 engine, or re-licensed as the model evolves. The CLA is what makes that
+possible without going back to every past contributor for permission. It does not take
+your Apache-2.0 rights away — you keep the same rights to this code as everyone else.
 
 ## Signing the CLA (required before merge)
 
@@ -13,13 +36,37 @@ I have read the CLA Document and I hereby sign the CLA
 ```
 
 Your acceptance is recorded in `signatures/cla.json`. A PR **cannot be merged** until
-the CLA is signed. Signetry is **not open source** (All Rights Reserved) — by signing
-you assign copyright/ownership of your contribution to the Owner and gain no right to
-use, sell, or commercialize it yourself.
+the CLA is signed.
+
+## Getting started
+
+This repo has no build step and no test suite: it is documentation plus the
+`config.toml` snippet for `~/.codex/config.toml`. The governance logic lives in
+`signetry-core`, which this integration pins and never reimplements.
+
+To exercise a change locally, install the pinned engine (same command as the README
+prerequisite):
+
+```bash
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+```
+
+Then point Codex at the MCP server / guard as described in the [README](README.md) and
+confirm the behaviour you changed.
+
+Two workflows run on your pull request:
+
+- **CLA** (`.github/workflows/cla.yml`) — the signature gate described above.
+- **Reviewer** (`.github/workflows/reviewer.yml`) — an advisory architecture/security
+  review that posts one comment. It is advisory only: it never merges and never fails
+  the PR.
+
+When you change a pinned version, keep it consistent across `README.md`,
+`config.toml`, and the workflows, and note it under `## [Unreleased]` in
+[CHANGELOG.md](CHANGELOG.md).
 
 ## Credit
 
 Contributors are **acknowledged** in [CONTRIBUTORS.md](CONTRIBUTORS.md), the Git
-history, and release notes. This is attribution only — you may truthfully say you
-contributed, but it grants no ownership and no right to use, sell, or rebrand the
-project as your own. See the "Recognition of Contributors" clause in [CLA.md](CLA.md).
+history, and release notes. See the "Recognition of Contributors" clause in
+[CLA.md](CLA.md).

CONTRIBUTORS.md

@@ -1,14 +1,16 @@
 # Contributors
 
-Signetry is **owned by Binay Dalai** and is **All Rights Reserved** (not open source).
+This repository is **[Apache-2.0](LICENSE)** and maintained by Binay Dalai as part of
+Signetry's [open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md).
 The people below are gratefully acknowledged for contributions accepted under the
 [Contributor License Agreement](CLA.md).
 
-**Credit, not ownership.** Being listed here recognizes a person's contribution. It
-does **not** grant any right to use, copy, sell, sublicense, or commercialize the
-project, and does **not** entitle anyone to present the project (in whole or in part)
-as their own work, product, or brand. All such rights remain exclusively with the
-owner.
+**Credit, not ownership.** Being listed here recognizes a person's contribution.
+Everyone — contributors included — already has the right to use, modify, and
+commercialize this code under Apache-2.0. Listing here does **not** additionally grant
+ownership of the project, and does **not** entitle anyone to present the project (in
+whole or in part) as their own work, product, or brand, or to use the Signetry name to
+endorse their own products.
 
 ## Owner / maintainer