[kinqsradio]

Summary

• Adds .github/workflows/licence-grant.yml, a reusable interim check for pull requests from outside the organisation. It stays until the contributor licence agreement in feat: agree once with /orbynAgree for every Orbyn repository #1 is approved.
• It posts one comment asking the author for the licence-grant sentence. It sets a "Licence grant" commit status: pending until the author posts the sentence, then success, with a "Thanks, licence grant recorded" reply.
• Every new comment re-checks it straight away, by updating the status on the pull request's head commit.
• Organisation members, kinqsradio and bots pass at once.
• Records each grant in orbyn-dev/cla-signatures once a CLA_SIGNATURES_TOKEN exists. Until then, the comment itself is the record.
• Adds examples/licence-grant-caller.yml for product repositories, plus a test workflow.

Security

• It never checks out or runs pull request code. Comments are read as data only.
• Permissions are only contents read and pull-requests, issues and statuses write.
• Actions are pinned by SHA: actions/github-script v9.0.0 and actions/checkout v4.3.0 (test only).

Testing

• node --test scripts/*.test.mjs: 5 passing. They cover the exact sentence, quoted or reflowed copies, changed or partial sentences, and the exempt and non-exempt authors.
• Not tested yet: a live run. That's next, once orbyn-engineering calls it.

AI usage

• Harness and version: Claude Code 2.1.318
• Models: claude-opus-5-5 (all)
• Effort: medium
• Human role: Anh asked for this check; Products Research set the spec.
• Sources: none