chore: relicense to BUSL-1.1 + publish the receipt spec (Signetry goes open core)

.github/workflows/cla.yml

@@ -4,7 +4,9 @@ name: CLA
 # before their pull request can be merged. Runs entirely in this repo's Actions —
 # no third-party OAuth app. Signatures are recorded in signatures/cla.json on this
 # repo, so there is a durable, auditable record that each contributor assigned
-# copyright/ownership of their contribution to the Owner.
+# copyright in their contribution to the Owner — which is what lets code be
+# relicensed across the open-core line (BUSL-1.1 engine <-> Apache-2.0 integrations)
+# without re-asking every past contributor.
 #
 # A contributor signs by commenting the exact statement below on their PR:
 #   I have read the CLA Document and I hereby sign the CLA
@@ -48,7 +50,7 @@ jobs:
           path-to-document: "https://github.com/Signetry/core/blob/main/CLA.md"
           branch: "cla-signatures"
           allowlist: "dependabot[bot],bkd-dotcom"
-          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/core/blob/main/CLA.md)** — Signetry is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:"
+          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/core/blob/main/CLA.md)** — Signetry is **open core** (this engine is BUSL-1.1, converting to Apache-2.0 on 2030-08-31; the integrations are Apache-2.0). Signing assigns copyright in your contribution to the Owner so code can be relicensed across that open-core line later without re-asking every contributor. It does not take away the rights the LICENSE already grants you. To agree, reply with exactly:"
           custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
           custom-allsigned-prcomment: "All contributors have signed the CLA. ✅"
           lock-pullrequest-aftermerge: false

.github/workflows/release.yml

@@ -2,12 +2,12 @@ name: Release
 
 # Cuts a GitHub Release when a version tag is pushed (e.g. v0.5.3).
 #
-# signetry-core is SOURCE-AVAILABLE (All Rights Reserved) and is NOT published to
-# PyPI — it is installed from source by tag:
+# signetry-core is source-available under BUSL-1.1 (Apache-2.0 on 2030-08-31) and is
+# not published to PyPI — it is installed from source by tag:
 #   pip install "signetry-core @ git+https://github.com/Signetry/core@v0.5.3"
-# The former PyPI Trusted-Publishing job was removed on the source-available
-# lockdown (all PyPI releases were yanked). This workflow only builds/tests and
-# attaches the built artifacts to a GitHub Release for convenience.
+# The former PyPI Trusted-Publishing job was removed when distribution moved to
+# git-by-tag (all prior PyPI releases were yanked). This workflow only builds/tests
+# and attaches the built artifacts to a GitHub Release for convenience.
 #
 # Then: git tag v0.5.3 && git push origin v0.5.3
 
@@ -89,7 +89,7 @@ jobs:
             echo "Release ${GITHUB_REF_NAME}. See CHANGELOG.md." > notes.md
           fi
           echo "" >> notes.md
-          echo "Source-available (All Rights Reserved); install from source:" >> notes.md
+          echo "BUSL-1.1 (Apache-2.0 on 2030-08-31); install from source:" >> notes.md
           echo '```' >> notes.md
           echo "pip install \"signetry-core @ git+https://github.com/Signetry/core@${GITHUB_REF_NAME}\"" >> notes.md
           echo '```' >> notes.md

.github/workflows/reviewer.yml

@@ -37,7 +37,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install signetry-reviewer
-        # source-available (All Rights Reserved); install from source, not PyPI.
+        # not published to PyPI — install from its source repo by tag.
         run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.2.0"
 
       - name: Compute the PR diff

.signetry/admission.yaml

@@ -12,7 +12,9 @@ allowed_paths:
   - "docs/**"
   - ".signetry/**"
   - "*.md"
+  - "LICENSE*"
   - "pyproject.toml"
+  - "install.sh"
   - "Makefile"
   - "mkdocs.yml"
   - ".gitignore"

CHANGELOG.md

@@ -7,6 +7,68 @@ change between minor versions.
 
 ## [Unreleased]
 
+### Added — the receipt format is now a published, independently testable spec
+
+- **[`docs/RECEIPT_SPEC.md`](docs/RECEIPT_SPEC.md)** documents the
+  `signetry.remediation-receipt` v1 format in full: envelope, payload,
+  canonicalization, signing, the verification algorithm, the §4.3 invariants, and a
+  change contract. RFC 2119 language throughout. A receipt is meant to be verifiable
+  by someone who does not have this tool and is reading it years later, so the format
+  is an interface and is now written down as one.
+- **[`tests/conformance/`](tests/conformance/)** — 17 assertions over 7 committed JSON
+  vectors, with published test-key seed strings so an implementation in any language
+  can be checked against exactly the same files. Regenerate with
+  `python tests/conformance/generate_vectors.py`; the vectors are committed rather
+  than computed at test time so a change to canonicalization or signing shows up as a
+  diff.
+- **The spec and the suite are [Apache-2.0](LICENSE-Apache-2.0.txt), named as explicit
+  exclusions from the BUSL `Licensed Work`** in [`LICENSE`](LICENSE). They carry no
+  restriction and no Change Date. Writing a competing issuer or an independent
+  verifier against the spec is a supported use.
+- **`check_invariants(receipt)`** (exported from `signetry_core.pipeline`) enforces
+  RECEIPT_SPEC §4.3: `auto_merge` must be `false`, `human_review_required` must be
+  `true`, plus `kind`/`version`/`authority_level` well-formedness. `verify_receipt`
+  now returns `conforming` and `invariant_violations` alongside its cryptographic
+  result, because those are different questions — a receipt can be correctly signed
+  and still claim something the format forbids.
+- **`signetry verify` now fails on a non-conforming receipt**, not just an unverifiable
+  one, and says which of the two failed. A validly signed receipt with
+  `auto_merge: true` prints `NON-CONFORMING` and `REJECTED` and exits `1`; it never
+  prints a bare `VERIFIED`. This is what makes "Signetry never merges on its own
+  judgement" a checkable property of every receipt instead of a promise in a README.
+
+### Fixed
+
+- Two repo-root-relative links in `docs/RELEASING.md` resolved from `docs/` and were
+  therefore broken.
+
+### Changed — licence: open core (BUSL-1.1, converting to Apache-2.0)
+
+- `signetry-core` is now licensed **[BUSL-1.1](LICENSE)** and converts to
+  **Apache-2.0 on 2030-08-31**, replacing the previous "All Rights Reserved"
+  proprietary terms. You may read, run in your own CI, use in production to govern
+  repositories you or your organization control, fork, modify, and redistribute it;
+  the one carve-out is offering it to third parties as a paid, competing hosted
+  service. `pyproject.toml`'s `license` field is now `BUSL-1.1`.
+- The **integration surface is Apache-2.0**: the
+  [Action](https://github.com/Signetry/action),
+  [plugins](https://github.com/Signetry/plugins),
+  [pre-commit guard](https://github.com/Signetry/precommit), and
+  [eval suite](https://github.com/Signetry/eval).
+- The **CLA still applies** — open core means code moves across the BUSL/Apache line,
+  and the assignment is what allows that relicensing without re-asking every past
+  contributor. `CLA.md`, `CONTRIBUTING.md`, and `CONTRIBUTORS.md` were rewritten for
+  the open-source posture; README/docs/workflow comments no longer claim the project
+  is "not open source" or "All Rights Reserved".
+- No functional or API change. Distribution is unchanged: still installed from source
+  by tag, not published to PyPI.
+- **The CLA's fallback licence grant is now non-exclusive.** It previously granted the
+  Owner an *exclusive* licence where copyright assignment is not permitted by law, which
+  would have stripped contributors of the right to use their own contribution — directly
+  contradicting the rights the LICENSE grants everyone. The CLA text is now identical
+  across all Signetry repositories (bar the engine/integration licence wording) so the
+  legal terms cannot drift per-repo again. See [CLA.md](CLA.md) §2–3.
+
 ### Added — Python insecure-deserialisation coverage
 
 - `marshal.load(s)` and `shelve.open` now flagged (CWE-502) — both execute arbitrary

CLA.md

@@ -1,6 +1,11 @@
 # Signetry Contributor License Agreement (CLA)
 
-**Copyright (c) 2026 Binay Dalai. All rights reserved.**
+**Copyright (c) 2026 Binay Dalai.** This repository is the Signetry **engine**, licensed
+under **[BUSL-1.1](LICENSE)** — source-available today, converting to
+[Apache-2.0](https://www.apache.org/licenses/LICENSE-2.0) on **2030-08-31** — as part of
+Signetry's [open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md).
+This Agreement governs what You grant the Owner when You contribute; it does not reduce
+the rights the LICENSE already gives You (and everyone else) in this code.
 
 Thank you for your interest in contributing to Signetry ("the Project"), owned by
 Binay Dalai ("the Owner"). This Contributor License Agreement ("Agreement")
@@ -26,21 +31,38 @@ Your Contribution. You agree that the Owner is the sole and exclusive owner of t
 Contribution once merged into the Project.
 
 To the extent any rights cannot be assigned by law, You grant the Owner a
-**perpetual, worldwide, exclusive, irrevocable, royalty-free, sublicensable, and
+**perpetual, worldwide, non-exclusive, irrevocable, royalty-free, sublicensable, and
 transferable license** to use, reproduce, modify, prepare derivative works of,
 publicly display, publicly perform, distribute, **sell, and commercialize** Your
 Contribution, in whole or in part, in any form and for any purpose.
 
-## 3. The Owner's exclusive rights
+Nothing in this section removes Your own ability to use Your Contribution: once it is
+released as part of this repository it is available to You, as to anyone, under
+[BUSL-1.1](LICENSE) — and under Apache-2.0 from the Change Date — and You retain any
+rights You independently hold in the underlying ideas and techniques.
+
+## 3. Why the Owner needs this (open core)
 
 You acknowledge and agree that:
 
-- The Owner alone retains the right to **use, license, sell, and monetize** the
-  Project, including Your Contribution.
-- You obtain **no right** to use, copy, modify, distribute, sell, or commercialize
-  the Project or Your Contribution for Your own personal or commercial purposes,
-  except as expressly permitted in writing by the Owner.
-- The Project is **not open source** and is licensed "All Rights Reserved."
+- **You keep the licence's rights.** This repository is released under
+  [BUSL-1.1](LICENSE), so You may read it, run it in your own CI, use it in production
+  to govern repositories You or Your organization control, fork it, patch it, and
+  publish those patches — including Your own Contribution — on exactly the same terms
+  as any other user, with no separate written permission. The single carve-out applies
+  to everyone equally: You may not offer this engine to third parties as a paid,
+  competing hosted service. On **2030-08-31** the licence becomes Apache-2.0 and even
+  that carve-out lapses.
+- **The Owner may relicense.** The assignment above lets the Owner use, license, sell,
+  and monetize the Project, including Your Contribution, and release it under other
+  terms.
+- **Code may move across the open-core line.** This repository is the BUSL-1.1 engine;
+  Signetry's integration surface (the GitHub Action, the editor and agent plugins, the
+  pre-commit guard, the eval suite, and the receipt specification) is Apache-2.0. A
+  Contribution accepted here may later be moved out to an Apache-2.0 repository — the
+  receipt spec and its conformance suite are deliberately Apache-2.0 for exactly that
+  reason — or an Apache-2.0 adapter may be promoted into this engine. The CLA is what
+  makes that possible without asking every past contributor again.
 
 ## 4. Recognition of Contributors (credit, not rights)
 
@@ -50,8 +72,8 @@ of Your work.
 
 This recognition is **attribution only**. It does **not**:
 
-- grant You any ownership, license, or right to use, copy, sell, sublicense, or
-  commercialize the Project or Your Contribution;
+- grant You ownership of the Project, or any rights beyond those the Project's
+  licence already grants everyone;
 - entitle You to represent the Project, or any part of it, as Your own work, product,
   or property, or to market or sell it under Your own name or brand; or
 - create any partnership, employment, or revenue-sharing relationship with the Owner.

CONTRIBUTING.md

@@ -1,8 +1,66 @@
-# Contribution Agreement
+# Contributing to signetry-core
 
-By submitting a Pull Request to this repository, you agree to assign and transfer all copyright and ownership of your contributed code to the repository owner. The owner retains the exclusive right to monetize, use, and control the entire codebase.
+`signetry-core` is the **engine** of Signetry's [open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md).
+It is licensed [BUSL-1.1](LICENSE) and converts to Apache-2.0 on **2030-08-31**;
+the integration surface around it (the [Action](https://github.com/Signetry/action),
+the [plugins](https://github.com/Signetry/plugins), the
+[pre-commit guard](https://github.com/Signetry/precommit), the
+[eval suite](https://github.com/Signetry/eval)) is Apache-2.0 today.
 
-## Signing the CLA (required before merge)
+## What the licence lets you do
+
+Without asking anyone, at no cost: read the source, run it in your own CI, use it in
+production to govern changes to repositories you or your organization control, fork
+it, patch it, and publish those patches. The single carve-out is offering
+`signetry-core` to third parties as a paid, competing hosted service — change
+admission, agent governance, or receipt issuance and verification as a service. See
+[LICENSE](LICENSE) for the exact grant.
+
+## Getting started
+
+```bash
+uv venv
+uv pip install -e ".[dev]"      # or: make install
+uv run pytest                   # hermetic — no real agent invoked, no network
+uv run ruff check .
+```
+
+`make test`, `make lint`, and `make build` wrap the same commands. To exercise the
+prompt-injection defense end to end:
+
+```bash
+uv run python demos/injection/demo.py    # or: make verify-injection
+```
+
+Every PR runs the test suite on Python 3.11–3.13 (`uv sync --extra dev`,
+`uv run ruff check .`, `uv run pytest -q`), a `signetry scan` SARIF check, the
+injection demo, and signetry-core's own admission self-check. Match that locally and
+CI should be green.
+
+🌱 **Where to start:** the
+[good-first-issues board](https://github.com/Signetry/signetry/issues/10)
+and [Discussions](https://github.com/Signetry/signetry/discussions).
+Well-scoped areas in this repo:
+
+- **A new detection rule** — add a vuln class or language to
+  `signetry_core/pipeline/findings/` with a test in `tests/test_findings_engine.py`.
+- **An executor adapter** — wire a new coding agent behind the `Executor` protocol
+  (`signetry_core/executors/`).
+- **Docs / examples** — clarify the admission pipeline, hardening, or a recipe.
+
+Keep the core deterministic and honest: no model or network calls in the
+deterministic pipeline (agent/LLM work stays behind the `Executor` protocol or the
+optional classifier hook), `auto_merge` always false, authority earned from evidence,
+and no overstating enforcement tiers or detection scope. The
+[pull request template](.github/PULL_REQUEST_TEMPLATE.md) is the checklist.
+
+## Signing the CLA (still required before merge)
+
+Open source does **not** mean no CLA. Signetry is open **core**, so code legitimately
+moves across the line between the BUSL-1.1 engine and the Apache-2.0 integration
+surface — a well-built adapter may be promoted into the engine, and engine code may be
+released under Apache-2.0 early or at the Change Date. The CLA is what lets us do that
+relicensing without tracking down every past contributor for permission again.
 
 This is enforced by a bot. When you open a pull request, the **CLA Assistant** check
 will ask you to sign the [Contributor License Agreement](CLA.md). Reply on the PR
@@ -13,13 +71,16 @@ I have read the CLA Document and I hereby sign the CLA
 ```
 
 Your acceptance is recorded in `signatures/cla.json`. A PR **cannot be merged** until
-the CLA is signed. Signetry is **not open source** (All Rights Reserved) — by signing
-you assign copyright/ownership of your contribution to the Owner and gain no right to
-use, sell, or commercialize it yourself.
+the CLA is signed.
 
 ## Credit
 
 Contributors are **acknowledged** in [CONTRIBUTORS.md](CONTRIBUTORS.md), the Git
-history, and release notes. This is attribution only — you may truthfully say you
-contributed, but it grants no ownership and no right to use, sell, or rebrand the
-project as your own. See the "Recognition of Contributors" clause in [CLA.md](CLA.md).
+history, and release notes. See the "Recognition of Contributors" clause in
+[CLA.md](CLA.md).
+
+## Conduct and security
+
+Be decent — see [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md). Security issues go through
+[private reporting](https://github.com/Signetry/core/security/advisories/new), not a
+public issue; see [SECURITY.md](SECURITY.md).

CONTRIBUTORS.md

@@ -1,14 +1,19 @@
 # Contributors
 
-Signetry is **owned by Binay Dalai** and is **All Rights Reserved** (not open source).
+This repository is the Signetry **engine**, licensed under **[BUSL-1.1](LICENSE)**
+(source-available; it becomes Apache-2.0 on 2030-08-31) and maintained by Binay Dalai as
+part of Signetry's
+[open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md).
 The people below are gratefully acknowledged for contributions accepted under the
 [Contributor License Agreement](CLA.md).
 
-**Credit, not ownership.** Being listed here recognizes a person's contribution. It
-does **not** grant any right to use, copy, sell, sublicense, or commercialize the
-project, and does **not** entitle anyone to present the project (in whole or in part)
-as their own work, product, or brand. All such rights remain exclusively with the
-owner.
+**Credit, not ownership.** Being listed here recognizes a person's contribution.
+Everyone — contributors included — already has the right to read, run, fork, and patch
+this code under BUSL-1.1, and to use it in production to govern their own repositories.
+Listing here does **not** additionally grant
+ownership of the project, and does **not** entitle anyone to present the project (in
+whole or in part) as their own work, product, or brand, or to use the Signetry name to
+endorse their own products.
 
 ## Owner / maintainer
 
@@ -19,4 +24,4 @@ owner.
 <!-- Contributors who have signed the CLA are added here (alphabetical by GitHub
      handle). To be credited, contribute a PR and sign the CLA. -->
 
-- **Advait Varhade** ([@AdvaitVarhade](https://github.com/AdvaitVarhade)) — SSRF (CWE-918) detection rule for JavaScript/Node ([#73](https://github.com/Signetry/core/pull/73)); SSRF URL-argument resolution for keyword + positional calls, plus httpx/aiohttp coverage ([#89](https://github.com/Signetry/core/pull/89)); identified the Python insecure-deserialisation gaps — `marshal`, `shelve`, and an explicitly unsafe `yaml` Loader ([#87](https://github.com/Signetry/core/issues/87))
+_Be the first — open a PR, sign the CLA, and your name goes here._