diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 164bec8..765361c 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -4,7 +4,9 @@ name: CLA # before their pull request can be merged. Runs entirely in this repo's Actions — # no third-party OAuth app. Signatures are recorded in signatures/cla.json on this # repo, so there is a durable, auditable record that each contributor assigned -# copyright/ownership of their contribution to the Owner. +# copyright in their contribution to the Owner — which is what lets code be +# relicensed across the open-core line (BUSL-1.1 engine <-> Apache-2.0 integrations) +# without re-asking every past contributor. # # A contributor signs by commenting the exact statement below on their PR: # I have read the CLA Document and I hereby sign the CLA @@ -48,7 +50,7 @@ jobs: path-to-document: "https://github.com/Signetry/signetry/blob/main/CLA.md" branch: "cla-signatures" allowlist: "dependabot[bot],bkd-dotcom" - custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/signetry/blob/main/CLA.md)** — Signetry is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:" + custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/signetry/blob/main/CLA.md)** — Signetry is **open core** (this repo is Apache-2.0; the engine is BUSL-1.1, converting to Apache-2.0 on 2030-08-31). Signing assigns copyright in your contribution to the Owner so code can be relicensed across that open-core line later without re-asking every contributor. It does not take away the rights the LICENSE already grants you. To agree, reply with exactly:" custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA" custom-allsigned-prcomment: "All contributors have signed the CLA. ✅" lock-pullrequest-aftermerge: false diff --git a/CLA.md b/CLA.md index 07c0cbc..f89b32e 100644 --- a/CLA.md +++ b/CLA.md @@ -1,6 +1,10 @@ # Signetry Contributor License Agreement (CLA) -**Copyright (c) 2026 Binay Dalai. All rights reserved.** +**Copyright (c) 2026 Binay Dalai.** This repository is licensed under +**[Apache-2.0](LICENSE)** as part of Signetry's +[open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md). This +Agreement governs what You grant the Owner when You contribute; it does not reduce the +rights the Apache-2.0 licence gives You (and everyone else) in this code. Thank you for your interest in contributing to Signetry ("the Project"), owned by Binay Dalai ("the Owner"). This Contributor License Agreement ("Agreement") @@ -26,21 +30,33 @@ Your Contribution. You agree that the Owner is the sole and exclusive owner of t Contribution once merged into the Project. To the extent any rights cannot be assigned by law, You grant the Owner a -**perpetual, worldwide, exclusive, irrevocable, royalty-free, sublicensable, and +**perpetual, worldwide, non-exclusive, irrevocable, royalty-free, sublicensable, and transferable license** to use, reproduce, modify, prepare derivative works of, publicly display, publicly perform, distribute, **sell, and commercialize** Your Contribution, in whole or in part, in any form and for any purpose. -## 3. The Owner's exclusive rights +Nothing in this section removes Your own ability to use Your Contribution: once it is +released as part of this repository it is available to You, as to anyone, under +[Apache-2.0](LICENSE), and You retain any rights You independently hold in the +underlying ideas and techniques. + +## 3. Why the Owner needs this (open core) You acknowledge and agree that: -- The Owner alone retains the right to **use, license, sell, and monetize** the - Project, including Your Contribution. -- You obtain **no right** to use, copy, modify, distribute, sell, or commercialize - the Project or Your Contribution for Your own personal or commercial purposes, - except as expressly permitted in writing by the Owner. -- The Project is **not open source** and is licensed "All Rights Reserved." +- **You keep the licence's rights.** This repository is released under + [Apache-2.0](LICENSE), so You may use, copy, modify, distribute, and commercialize + it — including Your own Contribution — on exactly the same terms as any other user. + No separate written permission is required. +- **The Owner may relicense.** The assignment above lets the Owner use, license, sell, + and monetize the Project, including Your Contribution, and release it under other + terms. +- **Code may move across the open-core line.** Signetry's integration surface is + Apache-2.0 while the engine + ([`Signetry/core`](https://github.com/Signetry/core)) is source-available under + BUSL-1.1, converting to Apache-2.0 on 2030-08-31. A Contribution accepted here may + later be moved into the engine, or engine code moved out to an Apache-2.0 repo. The + CLA is what makes that possible without asking every past contributor again. ## 4. Recognition of Contributors (credit, not rights) @@ -50,8 +66,8 @@ of Your work. This recognition is **attribution only**. It does **not**: -- grant You any ownership, license, or right to use, copy, sell, sublicense, or - commercialize the Project or Your Contribution; +- grant You ownership of the Project, or any rights beyond those the Project's + licence already grants everyone; - entitle You to represent the Project, or any part of it, as Your own work, product, or property, or to market or sell it under Your own name or brand; or - create any partnership, employment, or revenue-sharing relationship with the Owner. diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md new file mode 100644 index 0000000..7bd28fb --- /dev/null +++ b/CODE_OF_CONDUCT.md @@ -0,0 +1,68 @@ +# Contributor Covenant Code of Conduct + +## Our Pledge + +We as members, contributors, and leaders pledge to make participation in our +community a harassment-free experience for everyone, regardless of age, body +size, visible or invisible disability, ethnicity, sex characteristics, gender +identity and expression, level of experience, education, socio-economic status, +nationality, personal appearance, race, religion, or sexual identity and +orientation. + +We pledge to act and interact in ways that contribute to an open, welcoming, +diverse, inclusive, and healthy community. + +## Our Standards + +Examples of behavior that contributes to a positive environment for our +community include: + +- Demonstrating empathy and kindness toward other people +- Being respectful of differing opinions, viewpoints, and experiences +- Giving and gracefully accepting constructive feedback +- Accepting responsibility and apologizing to those affected by our mistakes, + and learning from the experience +- Focusing on what is best not just for us as individuals, but for the overall + community + +Examples of unacceptable behavior include: + +- The use of sexualized language or imagery, and sexual attention or advances of + any kind +- Trolling, insulting or derogatory comments, and personal or political attacks +- Public or private harassment +- Publishing others' private information, such as a physical or email address, + without their explicit permission +- Other conduct which could reasonably be considered inappropriate in a + professional setting + +## Enforcement Responsibilities + +Community leaders are responsible for clarifying and enforcing our standards of +acceptable behavior and will take appropriate and fair corrective action in +response to any behavior that they deem inappropriate, threatening, offensive, +or harmful. + +## Scope + +This Code of Conduct applies within all community spaces, and also applies when +an individual is officially representing the community in public spaces. + +## Enforcement + +Instances of abusive, harassing, or otherwise unacceptable behavior may be +reported to the maintainers via +[GitHub private vulnerability reporting](https://github.com/Signetry/signetry/security/advisories/new) +or by opening a confidential issue. All complaints will be reviewed and +investigated promptly and fairly. + +All community leaders are obligated to respect the privacy and security of the +reporter of any incident. + +## Attribution + +This Code of Conduct is adapted from the [Contributor Covenant][homepage], +version 2.1, available at +. + +[homepage]: https://www.contributor-covenant.org diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 9f91869..6cfaeeb 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,6 +1,22 @@ -# Contribution Agreement +# Contributing to Signetry -By submitting a Pull Request to this repository, you agree to assign and transfer all copyright and ownership of your contributed code to the repository owner. The owner retains the exclusive right to monetize, use, and control the entire codebase. +This is the **umbrella** repository: the platform overview, architecture notes, the +compatibility matrix, and the licensing map. Most code contributions belong in a child +repository — the engine ([`core`](https://github.com/Signetry/core)), the benchmark +([`eval`](https://github.com/Signetry/eval)), or an adapter — but docs fixes here are +very welcome, and a good first PR is +[adding a detection test case to `eval`](https://github.com/Signetry/eval). + +## Licensing + +This repository is **[Apache-2.0](LICENSE)**. Signetry as a whole is **open core**: the +entire integration surface is Apache-2.0, while the engine is source-available under +BUSL-1.1 and converts to Apache-2.0 on **2030-08-31**. Which repository is licensed how, +and what each licence lets you do, is set out in [LICENSING.md](LICENSING.md). + +Short version: you can use Signetry at work, in production, on your own repositories, +without asking anyone. You need a separate arrangement only to resell the engine as a +competing hosted governance service. ## Signing the CLA (required before merge) @@ -13,13 +29,27 @@ I have read the CLA Document and I hereby sign the CLA ``` Your acceptance is recorded in `signatures/cla.json`. A PR **cannot be merged** until -the CLA is signed. Signetry is **not open source** (All Rights Reserved) — by signing -you assign copyright/ownership of your contribution to the Owner and gain no right to -use, sell, or commercialize it yourself. +the CLA is signed. + +**Why an Apache-2.0 project still asks for a CLA.** Signetry is open core, and the line +between the Apache-2.0 integration surface and the BUSL-1.1 engine is not permanent — an +adapter that proves itself may later belong inside +[`Signetry/core`](https://github.com/Signetry/core). The CLA gives the maintainer the +rights to move code across that line and to relicense it (including to Apache-2.0 when +the engine converts in 2030) without tracking down every past contributor. It assigns +copyright in a merged contribution to the maintainer; it does not reduce the rights the +LICENSE grants you. The details, plainly stated, are in +[LICENSING.md](LICENSING.md#contributions). ## Credit Contributors are **acknowledged** in [CONTRIBUTORS.md](CONTRIBUTORS.md), the Git -history, and release notes. This is attribution only — you may truthfully say you -contributed, but it grants no ownership and no right to use, sell, or rebrand the -project as your own. See the "Recognition of Contributors" clause in [CLA.md](CLA.md). +history, and release notes. Attribution is separate from trademark: you may freely and +truthfully say you contributed, but please don't present the project as your own work or +brand, or use the Signetry name to endorse your own products. See the "Recognition of +Contributors" clause in [CLA.md](CLA.md). + +## Conduct and security + +By participating you agree to the [Code of Conduct](CODE_OF_CONDUCT.md). Please report +vulnerabilities privately rather than in a public issue — see [SECURITY.md](SECURITY.md). diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md index 38dcd13..d14be14 100644 --- a/CONTRIBUTORS.md +++ b/CONTRIBUTORS.md @@ -1,14 +1,16 @@ # Contributors -Signetry is **owned by Binay Dalai** and is **All Rights Reserved** (not open source). +This repository is **[Apache-2.0](LICENSE)** and maintained by Binay Dalai as part of +Signetry's [open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md). The people below are gratefully acknowledged for contributions accepted under the [Contributor License Agreement](CLA.md). -**Credit, not ownership.** Being listed here recognizes a person's contribution. It -does **not** grant any right to use, copy, sell, sublicense, or commercialize the -project, and does **not** entitle anyone to present the project (in whole or in part) -as their own work, product, or brand. All such rights remain exclusively with the -owner. +**Credit, not ownership.** Being listed here recognizes a person's contribution. +Everyone — contributors included — already has the right to use, modify, and +commercialize this code under Apache-2.0. Listing here does **not** additionally grant +ownership of the project, and does **not** entitle anyone to present the project (in +whole or in part) as their own work, product, or brand, or to use the Signetry name to +endorse their own products. ## Owner / maintainer diff --git a/INSTALL.md b/INSTALL.md index 9e82d91..b76dc56 100644 --- a/INSTALL.md +++ b/INSTALL.md @@ -64,7 +64,7 @@ diff budget). Capabilities can only **restrict** — they never widen authority. ## 3. (Optional) Govern locally + verify the receipt ```bash -# source-available (All Rights Reserved); not on PyPI — install from source +# BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0" # Govern an agent's change on your machine (exits non-zero below branch-PR): diff --git a/LAUNCH.md b/LAUNCH.md index 4fd1241..5247d52 100644 --- a/LAUNCH.md +++ b/LAUNCH.md @@ -28,7 +28,7 @@ marketing that outruns the evidence. > > It also ships a deterministic, offline SAST engine (`signetry scan`, 7 languages, cross-file taint, SARIF). On a public 52-case benchmark it's 100% recall at 0 false positives. > -> Source-available (All Rights Reserved), install from source, govern PRs via a GitHub Action. Feedback welcome — especially on the threat model. +> Open core: the integrations are Apache-2.0, the engine is BUSL-1.1 (Apache-2.0 in 2030). Install from source, govern PRs via a GitHub Action. Feedback welcome — especially on the threat model. > > Site: https://signetry.github.io · Code: https://github.com/Signetry @@ -67,9 +67,13 @@ much authority a change has *earned* — and proves it. patch-writer can't bypass; and a receipt an auditor verifies offline. No scanner attempts that. -**Source-available** (All Rights Reserved — *not* open source), on the GitHub -Marketplace. Read it, evaluate it, and contribute under a CLA — the owner retains all -rights, contributors are credited. 10 tagged good-first-issues. +**Open core**, on the GitHub Marketplace: every integration — the Action, the editor +and agent plugins, the pre-commit guard, the eval suite, the receipt spec — is +**Apache-2.0**, so you can fork it and ship it commercially with no strings. The engine +is **BUSL-1.1**: read it, run it, use it in production to govern your own repos; the one +carve-out is reselling it as a competing hosted service, and it converts to Apache-2.0 +on 2030-08-31. Contributions go through a CLA and are credited. +10 tagged good-first-issues. ## Reproduce the headline claim @@ -93,9 +97,12 @@ signetry scan . # scan any repo, offline & free ## Talking to contributors -**Source-available, contribute under a CLA.** The project is All Rights Reserved; -contributors are **credited** (CONTRIBUTORS.md, release notes) but gain no ownership -or right to use/sell it. A bot asks for a one-line CLA signature on the first PR. +**Apache-2.0 integrations, BUSL-1.1 engine, contribute under a CLA.** Contributors are +**credited** (CONTRIBUTORS.md, release notes) and keep every right the licence grants +anyone — on the Apache-2.0 repos that includes commercial use of their own work. Be +upfront that the CLA assigns copyright in a merged contribution to the maintainer, and +why: code moves across the open-core line. A bot asks for a one-line signature on the +first PR. Full map: LICENSING.md. The three flagship repos accept real code: @@ -119,6 +126,9 @@ to the owner). production `SIGNETRY_SIGNING_KEY` and pin its public key. - `auto_merge` is false at every level. Signetry is the governance layer between the agent and the human — not a replacement for code review. -- **Source-available, not open source.** The code is public to read and contribute - to, but it's All Rights Reserved — don't call it "open source." Contributions are - credited and accepted under a CLA; the owner retains all rights. +- **Say "open core", and be precise about which half.** The integration surface is + Apache-2.0 — that half genuinely is open source, so don't undersell it. The engine is + BUSL-1.1, which is **source-available, not OSI open source**: don't call `core` "open + source", and don't let a headline imply the whole platform is BUSL either. If someone + asks whether they can use it at work, the answer is yes — point them at LICENSING.md + rather than hedging. diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..118c83c --- /dev/null +++ b/LICENSE @@ -0,0 +1,202 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright 2026 Binay Dalai + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + diff --git a/LICENSING.md b/LICENSING.md new file mode 100644 index 0000000..cb69c13 --- /dev/null +++ b/LICENSING.md @@ -0,0 +1,100 @@ +# Licensing + +Signetry is **open core**. The line is drawn on purpose, and it is drawn in the same +place for every release: + +> **Everything you integrate with is Apache-2.0. The engine is source-available and +> converts to Apache-2.0 on 2030-08-31.** + +Every public repository in the organization is covered by the table below. If you find +a public Signetry repository with no `LICENSE` file, that is a bug — please open an +issue. + +## What that means per repository + +| Repository | License | Why | +|---|---|---| +| [`core`](https://github.com/Signetry/core) | **BUSL-1.1** → Apache-2.0 on 2030-08-31 | The admission engine and receipt issuer. Source-available: read it, run it, fork it, patch it. The only prohibition is reselling it as a competing hosted governance service. | +| [`eval`](https://github.com/Signetry/eval) | **Apache-2.0** | The adversarial benchmark. A benchmark nobody can freely run, audit and reproduce is worthless, so this one has no strings at all. | +| [`action`](https://github.com/Signetry/action) | **Apache-2.0** | CI integration. | +| [`plugins`](https://github.com/Signetry/plugins) | **Apache-2.0** | Editor and agent plugins. | +| [`codex`](https://github.com/Signetry/codex) | **Apache-2.0** | OpenAI Codex adapter. | +| [`claude-code`](https://github.com/Signetry/claude-code) | **Apache-2.0** | Claude Code adapter. | +| [`cursor`](https://github.com/Signetry/cursor) | **Apache-2.0** | Cursor adapter. | +| [`precommit`](https://github.com/Signetry/precommit) | **Apache-2.0** | Editor-agnostic git/CI guard. | +| [`github-app`](https://github.com/Signetry/github-app) | **Apache-2.0** | GitHub App manifest and setup. | +| [`autofix-demo`](https://github.com/Signetry/autofix-demo) | **Apache-2.0** | Deliberately vulnerable demo target. | +| [`signetry`](https://github.com/Signetry/signetry) | **Apache-2.0** | This umbrella: docs, architecture, compatibility matrix. | +| [`reviewer`](https://github.com/Signetry/reviewer) | **Apache-2.0** | The advisory PR reviewer installed by the CI workflows. Advisory only — it never merges and never gates. | +| [`homebrew-signetry`](https://github.com/Signetry/homebrew-signetry) | **Apache-2.0** | Homebrew tap formulae. | +| [`signetry.github.io`](https://github.com/Signetry/signetry.github.io) | **Apache-2.0** | The documentation site. | +| [`.github`](https://github.com/Signetry/.github) | **Apache-2.0** | Org profile and shared community-health defaults. | + +## Why not Apache-2.0 everywhere? + +Because a one-person project that gives away its engine to cloud vendors does not stay +a project for long. BUSL-1.1 keeps `core` readable, runnable, forkable and patchable by +everyone who actually uses it, and stops exactly one thing: a paid competing service +built on it. + +The Change Date is not decoration. On **2030-08-31**, `core` becomes Apache-2.0 — +irrevocably, by the terms of the license already published in the repository. Every +release carries its own four-year clock, so the version you install today is +guaranteed to be Apache-2.0 four years from its publication whatever happens to this +project or its author. + +## Does BUSL block me? + +Almost certainly not. You are explicitly free to: + +- read and audit every line +- run `signetry` in your CI, on your laptop, in your build system +- use it **in production** to govern changes to repositories you or your organization control +- fork it, modify it, and publish your modifications +- build and sell a product that *uses* Signetry, as long as the product is not itself a competing governance service + +You need a separate arrangement only if you intend to offer change admission, agent +governance, or receipt issuance/verification to third parties as a paid service. If +you are unsure which side of the line you are on, open an issue and ask — a plain +answer is faster for both of us than a lawyer. + +## The receipt format is deliberately unencumbered + +The [receipt specification](https://github.com/Signetry/core/blob/main/docs/RECEIPT_SPEC.md) +and its [conformance suite](https://github.com/Signetry/core/tree/main/tests/conformance) +are **Apache-2.0**, and the format is versioned independently of the engine. This is +not a footnote: both are named as explicit exclusions from the BUSL `Licensed Work` +parameter in [`core/LICENSE`](https://github.com/Signetry/core/blob/main/LICENSE), so +they carry no restriction and no Change Date. + +A receipt is meant to outlive the tool that issued it: an auditor in 2032 must be able +to verify a receipt written in 2026 without running, trusting, or licensing anything +from us. If you want to write a competing issuer or an independent verifier against +the spec, that is a supported use, not a tolerated one — the conformance vectors are +language-agnostic JSON with published test-key seeds precisely so you can check your +implementation against ours. + +## Contributions + +Contributions to every repository are accepted under the [CLA](https://github.com/Signetry/core/blob/main/CLA.md). + +The CLA exists for one practical reason: open core means code sometimes moves across +the line — a community-built adapter that proves itself may belong in the engine. The +CLA lets that happen without tracking down every past contributor for permission. + +Be aware of what it actually does, because this is where CLAs differ: it is a +**copyright assignment**, so the maintainer — not you — ends up owning the copyright in +a merged contribution. To the extent an assignment is not permitted by law, it falls +back to a **non-exclusive** licence, deliberately non-exclusive so that you never lose +the ability to use your own work. What you keep either way is the licence's rights: +your contribution ships under that repository's LICENSE, so you may use, modify and +(on the Apache-2.0 repos) commercialize it on exactly the same terms as anyone else. +If assigning copyright is not acceptable to you, say so on the issue before you start +— a DCO-only path for small fixes is a reasonable thing to ask for, and it is easier to +agree before the code is written than after. + +## Trademark + +"Signetry" and the Signetry mark are not covered by any of the licences above. Fork +the code freely; do not ship a fork under the Signetry name in a way that suggests it +is this project. diff --git a/README.md b/README.md index 2aebd8a..5674510 100644 --- a/README.md +++ b/README.md @@ -4,14 +4,10 @@
-> **Copyright (c) 2026 Binay Dalai. All rights reserved.** -> This repository is strictly for viewing and contributing to the original project. You may not use, copy, modify, distribute, or commercialize this code for your own personal or commercial projects without explicit written permission. Only the original author retains the right to use and monetize this project. - - **The umbrella overview for the Signetry platform — a change-control plane for coding agents.** -[![Source-available](https://img.shields.io/badge/source-available-informational.svg)](README.md#contributing--source-available-prs-welcome) -[![PRs Welcome](https://img.shields.io/badge/PRs-welcome%20(CLA)-brightgreen.svg)](https://github.com/Signetry/signetry/issues/10) +[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE) +[![PRs Welcome](https://img.shields.io/badge/PRs-welcome%20(CLA)-brightgreen.svg)](CONTRIBUTING.md) [![Discussions](https://img.shields.io/badge/chat-Discussions-5865F2.svg)](https://github.com/Signetry/signetry/discussions) [signetry.github.io](https://signetry.github.io) · [Architecture](ARCHITECTURE.md) · [Integrations](INTEGRATIONS.md) · [Compatibility](COMPATIBILITY.md) · [Install](INSTALL.md) @@ -84,18 +80,21 @@ signetry-core reaches **100% recall at 0 false positives** — matching/leading scanner (Claude Opus 4.8 at 90%) while staying deterministic, offline, and free. Detection is table stakes; the governance above is what the scanners don't attempt. -## Contributing — source-available, PRs welcome +## Contributing — Apache-2.0, PRs welcome -Signetry is **source-available**: the code is public to read, run for evaluation, and -**contribute to** — but it is **not open source**. It is **All Rights Reserved -(© 2026 Binay Dalai)**, and contributions are accepted under a -**Contributor License Agreement**. In plain terms: +Signetry is **open core**. This umbrella repo and the whole integration surface are +**[Apache-2.0](LICENSE)**: read it, run it, fork it, ship it commercially — no +permission needed, no strings. The engine +([`signetry-core`](https://github.com/Signetry/core)) is source-available under +BUSL-1.1 and converts to Apache-2.0 on **2030-08-31**. Full map: +[LICENSING.md](LICENSING.md). -- ✅ **You can** contribute, and you'll be **credited** (in `CONTRIBUTORS.md`, the Git - history, and release notes). You may truthfully say you contributed. -- ❌ **You cannot** use, sell, sublicense, or commercialize the project, or present it - (in whole or part) as your own work or brand. -- The **owner alone** retains the right to use and monetize the project. +Contributions are accepted under a **[Contributor License Agreement](CLA.md)** — kept +deliberately, because code moves across the open-core line: an adapter contributed +here may later be promoted into the engine, and engine code is released outward as +its licence converts. The CLA is what lets that happen without re-asking every +contributor. You keep every right the licence gives everyone else, and you are +**credited** in `CONTRIBUTORS.md`, the Git history, and release notes. Contributing is easy and welcome: @@ -103,7 +102,8 @@ Contributing is easy and welcome: [Signetry/signetry#10](https://github.com/Signetry/signetry/issues/10) — well-scoped tasks with exact files + acceptance criteria. - 💬 **Questions / ideas:** [Discussions](https://github.com/Signetry/signetry/discussions) -- 📝 **How to contribute + sign the CLA:** each repo's `CONTRIBUTING.md` and `CLA.md` +- 📝 **How to contribute + sign the CLA:** [CONTRIBUTING.md](CONTRIBUTING.md) here, plus + each child repo's own `CONTRIBUTING.md` and `CLA.md` (e.g. [signetry-core](https://github.com/Signetry/core/blob/main/CONTRIBUTING.md)). The best first PR is **adding a detection test case** in [signetry-eval](https://github.com/Signetry/eval). @@ -120,10 +120,11 @@ The strongest contribution targets are **signetry-core** (the engine), **signetr - **How do releases flow?** → [RELEASE.md](RELEASE.md) - **Want to contribute?** → [good first issues](https://github.com/Signetry/signetry/issues/10) · [Discussions](https://github.com/Signetry/signetry/discussions) - **Announcing / sharing Signetry?** → [LAUNCH.md](LAUNCH.md) +- **What is licensed how?** → [LICENSING.md](LICENSING.md) ## Contributors -Gratefully credited for contributions accepted under the [CLA](CLA.md) — **credit, not ownership**. Each grid links to that repo's contributor graph and updates automatically. +Gratefully credited for contributions accepted under the [CLA](CLA.md), which keeps code free to move across the [open-core line](LICENSING.md). Each grid links to that repo's contributor graph and updates automatically. @@ -162,4 +163,12 @@ Gratefully credited for contributions accepted under the [CLA](CLA.md) — **cre ## License -**Copyright (c) 2026 Binay Dalai. All rights reserved.** This code is not open source. You may not use, copy, modify, distribute, or commercialize it for your own personal or commercial purposes without explicit written permission from the author, who alone retains the right to use and monetize this project. See [CONTRIBUTING.md](CONTRIBUTING.md). +[Apache-2.0](LICENSE). Use it, fork it, ship it commercially — no strings. + +This repository is part of Signetry's [open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md): +the **integration surface is Apache-2.0** so anyone can add an agent, an editor, or a +CI adapter, while the engine ([`Signetry/core`](https://github.com/Signetry/core)) is +source-available under BUSL-1.1 and converts to Apache-2.0 on 2030-08-31. + +Contributions are accepted under the [CLA](CLA.md) — it lets us move a well-built +adapter into the engine later without asking every contributor for permission again. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..dc24b8d --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,47 @@ +# Security policy + +This is the **umbrella** repository: documentation, architecture notes, and the +compatibility matrix. It contains no governance logic. Vulnerabilities in the pipeline +itself — contract evaluation, the guard, the verifier, receipt issuance and +verification — belong against [`Signetry/core`](https://github.com/Signetry/core). + +## Reporting + +Use **GitHub private vulnerability reporting** on the affected repository: + +- Engine, receipts, verifier → [report to `core`](https://github.com/Signetry/core/security/advisories/new) +- CI integration → [report to `action`](https://github.com/Signetry/action/security/advisories/new) +- Anything else, or you are unsure → [report here](https://github.com/Signetry/signetry/security/advisories/new) + +Please do **not** open a public issue for an unpatched vulnerability. If you do not get +an acknowledgement within 7 days, open a public issue saying only that you sent a +private report and got no reply — no details. + +## What is in scope + +- A change that earns authority it should not (contract bypass, path escape, a check + reported as passing when it did not run). +- A receipt that verifies when it should not: a signature forged, a payload altered + without detection, or a gate reporting `pass` on absent evidence. +- A receipt that fails to verify when it should — a spec or implementation mismatch is + also a security bug, because it destroys the audit trail. +- Privilege escalation in the GitHub Action or App beyond `branch_pr_only`. + +## What is not in scope + +- The deliberate SQL injection in + [`autofix-demo`](https://github.com/Signetry/autofix-demo) — it is the test fixture. +- The soft, in-editor guard failing open. It is defense-in-depth and says so: it may + fail open, but only with a loud `INACTIVE` signal. The hard boundary is the required + check on the pull request plus the signed receipt. +- Findings that require an attacker to already control the repository's Actions + secrets or branch protection. + +## Standing guarantees + +- `auto_merge` is always `false`, and it is a **signed field inside every receipt** — + so "Signetry never merges on its own judgement" is checkable, not promised. +- A gate never reports `pass` on missing evidence. Absent evidence is `unproven`. +- Receipts verify **offline**, against a pinned public key. Verification never requires + contacting us, and never requires trusting the tool that issued the receipt. See the + [receipt specification](https://github.com/Signetry/core/blob/main/docs/RECEIPT_SPEC.md).