chore: relicense to Apache-2.0 (Signetry goes open core)

.github/workflows/cla.yml

@@ -4,7 +4,9 @@ name: CLA
 # before their pull request can be merged. Runs entirely in this repo's Actions —
 # no third-party OAuth app. Signatures are recorded in signatures/cla.json on this
 # repo, so there is a durable, auditable record that each contributor assigned
-# copyright/ownership of their contribution to the Owner.
+# copyright in their contribution to the Owner — which is what lets code be
+# relicensed across the open-core line (BUSL-1.1 engine <-> Apache-2.0 integrations)
+# without re-asking every past contributor.
 #
 # A contributor signs by commenting the exact statement below on their PR:
 #   I have read the CLA Document and I hereby sign the CLA
@@ -48,7 +50,7 @@ jobs:
           path-to-document: "https://github.com/Signetry/signetry/blob/main/CLA.md"
           branch: "cla-signatures"
           allowlist: "dependabot[bot],bkd-dotcom"
-          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/signetry/blob/main/CLA.md)** — Signetry is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:"
+          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/signetry/blob/main/CLA.md)** — Signetry is **open core** (this repo is Apache-2.0; the engine is BUSL-1.1, converting to Apache-2.0 on 2030-08-31). Signing assigns copyright in your contribution to the Owner so code can be relicensed across that open-core line later without re-asking every contributor. It does not take away the rights the LICENSE already grants you. To agree, reply with exactly:"
           custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
           custom-allsigned-prcomment: "All contributors have signed the CLA. ✅"
           lock-pullrequest-aftermerge: false

CLA.md

@@ -1,6 +1,10 @@
 # Signetry Contributor License Agreement (CLA)
 
-**Copyright (c) 2026 Binay Dalai. All rights reserved.**
+**Copyright (c) 2026 Binay Dalai.** This repository is licensed under
+**[Apache-2.0](LICENSE)** as part of Signetry's
+[open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md). This
+Agreement governs what You grant the Owner when You contribute; it does not reduce the
+rights the Apache-2.0 licence gives You (and everyone else) in this code.
 
 Thank you for your interest in contributing to Signetry ("the Project"), owned by
 Binay Dalai ("the Owner"). This Contributor License Agreement ("Agreement")
@@ -26,21 +30,33 @@ Your Contribution. You agree that the Owner is the sole and exclusive owner of t
 Contribution once merged into the Project.
 
 To the extent any rights cannot be assigned by law, You grant the Owner a
-**perpetual, worldwide, exclusive, irrevocable, royalty-free, sublicensable, and
+**perpetual, worldwide, non-exclusive, irrevocable, royalty-free, sublicensable, and
 transferable license** to use, reproduce, modify, prepare derivative works of,
 publicly display, publicly perform, distribute, **sell, and commercialize** Your
 Contribution, in whole or in part, in any form and for any purpose.
 
-## 3. The Owner's exclusive rights
+Nothing in this section removes Your own ability to use Your Contribution: once it is
+released as part of this repository it is available to You, as to anyone, under
+[Apache-2.0](LICENSE), and You retain any rights You independently hold in the
+underlying ideas and techniques.
+
+## 3. Why the Owner needs this (open core)
 
 You acknowledge and agree that:
 
-- The Owner alone retains the right to **use, license, sell, and monetize** the
-  Project, including Your Contribution.
-- You obtain **no right** to use, copy, modify, distribute, sell, or commercialize
-  the Project or Your Contribution for Your own personal or commercial purposes,
-  except as expressly permitted in writing by the Owner.
-- The Project is **not open source** and is licensed "All Rights Reserved."
+- **You keep the licence's rights.** This repository is released under
+  [Apache-2.0](LICENSE), so You may use, copy, modify, distribute, and commercialize
+  it — including Your own Contribution — on exactly the same terms as any other user.
+  No separate written permission is required.
+- **The Owner may relicense.** The assignment above lets the Owner use, license, sell,
+  and monetize the Project, including Your Contribution, and release it under other
+  terms.
+- **Code may move across the open-core line.** Signetry's integration surface is
+  Apache-2.0 while the engine
+  ([`Signetry/core`](https://github.com/Signetry/core)) is source-available under
+  BUSL-1.1, converting to Apache-2.0 on 2030-08-31. A Contribution accepted here may
+  later be moved into the engine, or engine code moved out to an Apache-2.0 repo. The
+  CLA is what makes that possible without asking every past contributor again.
 
 ## 4. Recognition of Contributors (credit, not rights)
 
@@ -50,8 +66,8 @@ of Your work.
 
 This recognition is **attribution only**. It does **not**:
 
-- grant You any ownership, license, or right to use, copy, sell, sublicense, or
-  commercialize the Project or Your Contribution;
+- grant You ownership of the Project, or any rights beyond those the Project's
+  licence already grants everyone;
 - entitle You to represent the Project, or any part of it, as Your own work, product,
   or property, or to market or sell it under Your own name or brand; or
 - create any partnership, employment, or revenue-sharing relationship with the Owner.

CODE_OF_CONDUCT.md

@@ -0,0 +1,68 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the maintainers via
+[GitHub private vulnerability reporting](https://github.com/Signetry/signetry/security/advisories/new)
+or by opening a confidential issue. All complaints will be reviewed and
+investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+<https://www.contributor-covenant.org/version/2/1/code_of_conduct.html>.
+
+[homepage]: https://www.contributor-covenant.org

CONTRIBUTING.md

@@ -1,6 +1,22 @@
-# Contribution Agreement
+# Contributing to Signetry
 
-By submitting a Pull Request to this repository, you agree to assign and transfer all copyright and ownership of your contributed code to the repository owner. The owner retains the exclusive right to monetize, use, and control the entire codebase.
+This is the **umbrella** repository: the platform overview, architecture notes, the
+compatibility matrix, and the licensing map. Most code contributions belong in a child
+repository — the engine ([`core`](https://github.com/Signetry/core)), the benchmark
+([`eval`](https://github.com/Signetry/eval)), or an adapter — but docs fixes here are
+very welcome, and a good first PR is
+[adding a detection test case to `eval`](https://github.com/Signetry/eval).
+
+## Licensing
+
+This repository is **[Apache-2.0](LICENSE)**. Signetry as a whole is **open core**: the
+entire integration surface is Apache-2.0, while the engine is source-available under
+BUSL-1.1 and converts to Apache-2.0 on **2030-08-31**. Which repository is licensed how,
+and what each licence lets you do, is set out in [LICENSING.md](LICENSING.md).
+
+Short version: you can use Signetry at work, in production, on your own repositories,
+without asking anyone. You need a separate arrangement only to resell the engine as a
+competing hosted governance service.
 
 ## Signing the CLA (required before merge)
 
@@ -13,13 +29,27 @@ I have read the CLA Document and I hereby sign the CLA
 ```
 
 Your acceptance is recorded in `signatures/cla.json`. A PR **cannot be merged** until
-the CLA is signed. Signetry is **not open source** (All Rights Reserved) — by signing
-you assign copyright/ownership of your contribution to the Owner and gain no right to
-use, sell, or commercialize it yourself.
+the CLA is signed.
+
+**Why an Apache-2.0 project still asks for a CLA.** Signetry is open core, and the line
+between the Apache-2.0 integration surface and the BUSL-1.1 engine is not permanent — an
+adapter that proves itself may later belong inside
+[`Signetry/core`](https://github.com/Signetry/core). The CLA gives the maintainer the
+rights to move code across that line and to relicense it (including to Apache-2.0 when
+the engine converts in 2030) without tracking down every past contributor. It assigns
+copyright in a merged contribution to the maintainer; it does not reduce the rights the
+LICENSE grants you. The details, plainly stated, are in
+[LICENSING.md](LICENSING.md#contributions).
 
 ## Credit
 
 Contributors are **acknowledged** in [CONTRIBUTORS.md](CONTRIBUTORS.md), the Git
-history, and release notes. This is attribution only — you may truthfully say you
-contributed, but it grants no ownership and no right to use, sell, or rebrand the
-project as your own. See the "Recognition of Contributors" clause in [CLA.md](CLA.md).
+history, and release notes. Attribution is separate from trademark: you may freely and
+truthfully say you contributed, but please don't present the project as your own work or
+brand, or use the Signetry name to endorse your own products. See the "Recognition of
+Contributors" clause in [CLA.md](CLA.md).
+
+## Conduct and security
+
+By participating you agree to the [Code of Conduct](CODE_OF_CONDUCT.md). Please report
+vulnerabilities privately rather than in a public issue — see [SECURITY.md](SECURITY.md).

CONTRIBUTORS.md

@@ -1,14 +1,16 @@
 # Contributors
 
-Signetry is **owned by Binay Dalai** and is **All Rights Reserved** (not open source).
+This repository is **[Apache-2.0](LICENSE)** and maintained by Binay Dalai as part of
+Signetry's [open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md).
 The people below are gratefully acknowledged for contributions accepted under the
 [Contributor License Agreement](CLA.md).
 
-**Credit, not ownership.** Being listed here recognizes a person's contribution. It
-does **not** grant any right to use, copy, sell, sublicense, or commercialize the
-project, and does **not** entitle anyone to present the project (in whole or in part)
-as their own work, product, or brand. All such rights remain exclusively with the
-owner.
+**Credit, not ownership.** Being listed here recognizes a person's contribution.
+Everyone — contributors included — already has the right to use, modify, and
+commercialize this code under Apache-2.0. Listing here does **not** additionally grant
+ownership of the project, and does **not** entitle anyone to present the project (in
+whole or in part) as their own work, product, or brand, or to use the Signetry name to
+endorse their own products.
 
 ## Owner / maintainer
 

INSTALL.md

@@ -64,7 +64,7 @@ diff budget). Capabilities can only **restrict** — they never widen authority.
 ## 3. (Optional) Govern locally + verify the receipt
 
 ```bash
-# source-available (All Rights Reserved); not on PyPI — install from source
+# BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source
 pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
 
 # Govern an agent's change on your machine (exits non-zero below branch-PR):

LAUNCH.md

@@ -28,7 +28,7 @@ marketing that outruns the evidence.
 >
 > It also ships a deterministic, offline SAST engine (`signetry scan`, 7 languages, cross-file taint, SARIF). On a public 52-case benchmark it's 100% recall at 0 false positives.
 >
-> Source-available (All Rights Reserved), install from source, govern PRs via a GitHub Action. Feedback welcome — especially on the threat model.
+> Open core: the integrations are Apache-2.0, the engine is BUSL-1.1 (Apache-2.0 in 2030). Install from source, govern PRs via a GitHub Action. Feedback welcome — especially on the threat model.
 >
 > Site: https://signetry.github.io · Code: https://github.com/Signetry
 
@@ -67,9 +67,13 @@ much authority a change has *earned* — and proves it.
   patch-writer can't bypass; and a receipt an auditor verifies offline. No scanner
   attempts that.
 
-**Source-available** (All Rights Reserved — *not* open source), on the GitHub
-Marketplace. Read it, evaluate it, and contribute under a CLA — the owner retains all
-rights, contributors are credited. 10 tagged good-first-issues.
+**Open core**, on the GitHub Marketplace: every integration — the Action, the editor
+and agent plugins, the pre-commit guard, the eval suite, the receipt spec — is
+**Apache-2.0**, so you can fork it and ship it commercially with no strings. The engine
+is **BUSL-1.1**: read it, run it, use it in production to govern your own repos; the one
+carve-out is reselling it as a competing hosted service, and it converts to Apache-2.0
+on 2030-08-31. Contributions go through a CLA and are credited.
+10 tagged good-first-issues.
 
 ## Reproduce the headline claim
 
@@ -93,9 +97,12 @@ signetry scan .                    # scan any repo, offline & free
 
 ## Talking to contributors
 
-**Source-available, contribute under a CLA.** The project is All Rights Reserved;
-contributors are **credited** (CONTRIBUTORS.md, release notes) but gain no ownership
-or right to use/sell it. A bot asks for a one-line CLA signature on the first PR.
+**Apache-2.0 integrations, BUSL-1.1 engine, contribute under a CLA.** Contributors are
+**credited** (CONTRIBUTORS.md, release notes) and keep every right the licence grants
+anyone — on the Apache-2.0 repos that includes commercial use of their own work. Be
+upfront that the CLA assigns copyright in a merged contribution to the maintainer, and
+why: code moves across the open-core line. A bot asks for a one-line signature on the
+first PR. Full map: LICENSING.md.
 
 The three flagship repos accept real code:
 
@@ -119,6 +126,9 @@ to the owner).
   production `SIGNETRY_SIGNING_KEY` and pin its public key.
 - `auto_merge` is false at every level. Signetry is the governance layer between the
   agent and the human — not a replacement for code review.
-- **Source-available, not open source.** The code is public to read and contribute
-  to, but it's All Rights Reserved — don't call it "open source." Contributions are
-  credited and accepted under a CLA; the owner retains all rights.
+- **Say "open core", and be precise about which half.** The integration surface is
+  Apache-2.0 — that half genuinely is open source, so don't undersell it. The engine is
+  BUSL-1.1, which is **source-available, not OSI open source**: don't call `core` "open
+  source", and don't let a headline imply the whole platform is BUSL either. If someone
+  asks whether they can use it at work, the answer is yes — point them at LICENSING.md
+  rather than hedging.