legal: enforce CLA + credit contributors (attribution, not ownership)

.github/workflows/cla.yml

@@ -0,0 +1,42 @@
+name: CLA
+
+# Requires every contributor to sign the Contributor License Agreement (CLA.md)
+# before their pull request can be merged. Runs entirely in this repo's Actions —
+# no third-party OAuth app. Signatures are recorded in signatures/cla.json on this
+# repo, so there is a durable, auditable record that each contributor assigned
+# copyright/ownership of their contribution to the Owner.
+#
+# A contributor signs by commenting the exact statement below on their PR:
+#   I have read the CLA Document and I hereby sign the CLA
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  actions: write
+  contents: write        # write the signatures file
+  pull-requests: write   # comment + label the PR
+  statuses: write
+
+jobs:
+  cla:
+    runs-on: ubuntu-latest
+    # Skip Dependabot / the Owner's own automated PRs if desired; contributors still gate.
+    steps:
+      - name: CLA Assistant
+        if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
+        uses: contributor-assistant/github-action@v2.6.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          path-to-signatures: "signatures/cla.json"
+          path-to-document: "https://github.com/bkd-dotcom/umbra-precommit/blob/main/CLA.md"
+          branch: "main"
+          allowlist: "dependabot[bot],bkd-dotcom"
+          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/bkd-dotcom/umbra-precommit/blob/main/CLA.md)** — Umbra is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:"
+          custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
+          custom-allsigned-prcomment: "All contributors have signed the CLA. ✅"
+          lock-pullrequest-aftermerge: false

CLA.md

@@ -0,0 +1,96 @@
+# Umbra Contributor License Agreement (CLA)
+
+**Copyright (c) 2026 Binay Dalai. All rights reserved.**
+
+Thank you for your interest in contributing to Umbra ("the Project"), owned by
+Binay Dalai ("the Owner"). This Contributor License Agreement ("Agreement")
+governs any contribution you submit. You must agree to it before your contribution
+can be accepted.
+
+By signing this Agreement (for example, by commenting the acceptance statement on a
+pull request when prompted by the CLA bot), you agree to the following terms for any
+past and future Contributions you submit to the Project.
+
+## 1. Definitions
+
+- **"You"** means the individual or legal entity making a Contribution.
+- **"Contribution"** means any original work of authorship — including code,
+  documentation, configuration, or other material — that You intentionally submit to
+  the Project (via pull request, patch, or otherwise).
+
+## 2. Assignment of Copyright
+
+To the maximum extent permitted by applicable law, You hereby **assign and transfer
+to the Owner all right, title, and interest worldwide in and to the copyright** in
+Your Contribution. You agree that the Owner is the sole and exclusive owner of the
+Contribution once merged into the Project.
+
+To the extent any rights cannot be assigned by law, You grant the Owner a
+**perpetual, worldwide, exclusive, irrevocable, royalty-free, sublicensable, and
+transferable license** to use, reproduce, modify, prepare derivative works of,
+publicly display, publicly perform, distribute, **sell, and commercialize** Your
+Contribution, in whole or in part, in any form and for any purpose.
+
+## 3. The Owner's exclusive rights
+
+You acknowledge and agree that:
+
+- The Owner alone retains the right to **use, license, sell, and monetize** the
+  Project, including Your Contribution.
+- You obtain **no right** to use, copy, modify, distribute, sell, or commercialize
+  the Project or Your Contribution for Your own personal or commercial purposes,
+  except as expressly permitted in writing by the Owner.
+- The Project is **not open source** and is licensed "All Rights Reserved."
+
+## 4. Recognition of Contributors (credit, not rights)
+
+The Owner will **credit You as a contributor** — for example, in Git commit history,
+in a `CONTRIBUTORS` file, and/or in release notes — as a courtesy and acknowledgement
+of Your work.
+
+This recognition is **attribution only**. It does **not**:
+
+- grant You any ownership, license, or right to use, copy, sell, sublicense, or
+  commercialize the Project or Your Contribution;
+- entitle You to represent the Project, or any part of it, as Your own work, product,
+  or property, or to market or sell it under Your own name or brand; or
+- create any partnership, employment, or revenue-sharing relationship with the Owner.
+
+You may factually and truthfully state that You contributed to the Project (e.g. on a
+résumé or portfolio). You may **not** claim authorship or ownership of the Project as
+a whole, nor use the Project's name or the Owner's name to endorse or promote your own
+products without the Owner's written permission.
+
+## 5. Your representations
+
+You represent that:
+
+- Each Contribution is Your original creation, and You have the legal right to
+  assign it under this Agreement.
+- If Your employer has rights to intellectual property You create, You have received
+  permission to make the Contribution on behalf of that employer, or the employer
+  has waived such rights.
+- Your Contribution does not knowingly infringe any third party's rights and
+  contains no third-party code unless clearly identified and compatible with this
+  Agreement.
+
+## 6. No warranty
+
+Your Contribution is provided "as is," without warranty of any kind. You are not
+expected to provide support for Your Contribution.
+
+## 7. Miscellaneous
+
+This Agreement is the entire agreement concerning Contributions. If any provision is
+unenforceable, the remaining provisions remain in effect. This Agreement is governed
+by the laws applicable at the Owner's principal place of business.
+
+---
+
+**How to sign:** when you open a pull request, the CLA bot will ask you to confirm.
+Post the exact sentence it requests (for example:
+`I have read the CLA Document and I hereby sign the CLA`). Your GitHub username and
+the signing commit are recorded in `signatures/cla.json` as your acceptance.
+
+> This document is provided by the Owner and is **not legal advice**. The Owner is
+> responsible for its legal sufficiency in the relevant jurisdiction.

CONTRIBUTING.md

@@ -1,3 +1,25 @@
 # Contribution Agreement
 
 By submitting a Pull Request to this repository, you agree to assign and transfer all copyright and ownership of your contributed code to the repository owner. The owner retains the exclusive right to monetize, use, and control the entire codebase.
+
+## Signing the CLA (required before merge)
+
+This is enforced by a bot. When you open a pull request, the **CLA Assistant** check
+will ask you to sign the [Contributor License Agreement](CLA.md). Reply on the PR
+with exactly:
+
+```
+I have read the CLA Document and I hereby sign the CLA
+```
+
+Your acceptance is recorded in `signatures/cla.json`. A PR **cannot be merged** until
+the CLA is signed. Umbra is **not open source** (All Rights Reserved) — by signing
+you assign copyright/ownership of your contribution to the Owner and gain no right to
+use, sell, or commercialize it yourself.
+
+## Credit
+
+Contributors are **acknowledged** in [CONTRIBUTORS.md](CONTRIBUTORS.md), the Git
+history, and release notes. This is attribution only — you may truthfully say you
+contributed, but it grants no ownership and no right to use, sell, or rebrand the
+project as your own. See the "Recognition of Contributors" clause in [CLA.md](CLA.md).

CONTRIBUTORS.md

@@ -0,0 +1,22 @@
+# Contributors
+
+Umbra is **owned by Binay Dalai** and is **All Rights Reserved** (not open source).
+The people below are gratefully acknowledged for contributions accepted under the
+[Contributor License Agreement](CLA.md).
+
+**Credit, not ownership.** Being listed here recognizes a person's contribution. It
+does **not** grant any right to use, copy, sell, sublicense, or commercialize the
+project, and does **not** entitle anyone to present the project (in whole or in part)
+as their own work, product, or brand. All such rights remain exclusively with the
+owner.
+
+## Owner / maintainer
+
+- **Binay Dalai** ([@bkd-dotcom](https://github.com/bkd-dotcom)) — creator & owner
+
+## Contributors
+
+<!-- Contributors who have signed the CLA are added here (alphabetical by GitHub
+     handle). To be credited, contribute a PR and sign the CLA. -->
+
+_Be the first — open a PR, sign the CLA, and your name goes here._