chore(governance): replace CLA with DCO, add NOTICE and third-party license policy

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,7 +24,7 @@
 - [ ] Plugin tests pass (`./tests/run-tests.sh` inside the affected plugin)
 - [ ] Interactive flow verified manually in **both** Claude Code and Cursor
 - [ ] `CHANGELOG.md` updated under `[Unreleased]` with plugin name prefix
-- [ ] [CLA](https://github.com/humanbound/plugins/blob/main/CLA.md) signed (the CLAAssistant bot will prompt you on first PR)
+- [ ] All commits are signed off (`git commit -s`) — see [DCO.md](https://github.com/humanbound/plugins/blob/main/DCO.md)
 
 ## Linked issue(s)
 

.github/workflows/dco.yml

@@ -0,0 +1,42 @@
+name: DCO
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  dco:
+    name: Signed-off-by check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify every commit carries a Signed-off-by trailer
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const commits = await github.paginate(github.rest.pulls.listCommits, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+            });
+            // Merge commits are bot-generated and exempt, matching the
+            // behavior of the standard probot DCO app.
+            const missing = commits
+              .filter(c => c.parents.length < 2)
+              .filter(c => !/^Signed-off-by: .+ <.+@.+>$/m.test(c.commit.message));
+            if (missing.length === 0) {
+              core.info(`All ${commits.length} commit(s) are signed off.`);
+              return;
+            }
+            const list = missing
+              .map(c => `  ${c.sha.slice(0, 7)} ${c.commit.message.split('\n')[0]}`)
+              .join('\n');
+            core.setFailed(
+              `${missing.length} commit(s) are missing a Signed-off-by trailer (see DCO.md):\n` +
+              `${list}\n\n` +
+              `Fix with "git commit --amend -s" (single commit) or ` +
+              `"git rebase --signoff origin/main" (whole branch), then force-push.`
+            );

CHANGELOG.md

@@ -18,6 +18,20 @@ and each plugin adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.
   only via `/humanbound-test:resume <id>` (the polling logic moved into a
   dedicated "Resume path" section in `dispatching-hb-tests/SKILL.md` — no
   behavior change for resume itself).
+- **Contribution policy: CLA replaced by DCO** (repo-wide). External
+  contributions no longer require signing the Humanbound Contributor
+  License Agreement. Contributions are now accepted under the Developer
+  Certificate of Origin v1.1 (see `DCO.md`) — sign commits with
+  `git commit -s`. Contributors keep their copyright; contributions are
+  licensed inbound = outbound under Apache-2.0. `CLA.md` is removed and a
+  `dco.yml` workflow now checks `Signed-off-by` trailers on every pull
+  request.
+- `CONTRIBUTING.md` gains an explicit third-party license policy: vendored
+  code must be permissively licensed (Apache-2.0/MIT/BSD/ISC); GPL, AGPL,
+  SSPL, and BSL code cannot be accepted.
+
+### Added
+- `NOTICE` file per Apache-2.0 section 4(d).
 
 ## [humanbound-test 0.1.0] — 2026-05-12
 

CONTRIBUTING.md

@@ -48,12 +48,39 @@ Bugs, feature requests, and questions all live in
 
 **Do not file security issues publicly.** See [SECURITY.md](./SECURITY.md).
 
-## Contributor License Agreement (CLA) — required
+## Developer Certificate of Origin (DCO) — required
 
-Every external contribution must be covered by the
-[Humanbound Contributor License Agreement](./CLA.md). The first time you
-open a pull request, the CLAAssistant bot will comment with a one-line
-instruction to sign.
+This project does **not** use a CLA. Contributions are accepted under the
+[Developer Certificate of Origin](./DCO.md) — the same lightweight mechanism
+used by the Linux kernel, CNCF projects, and GitLab. You keep the copyright
+to your work; it is licensed inbound = outbound under
+[Apache-2.0](./LICENSE), exactly like the rest of the codebase.
+
+There is nothing to sign — just add the `-s` flag when committing:
+
+```bash
+git commit -s -m "your message"
+```
+
+CI checks that every commit in a pull request carries the resulting
+`Signed-off-by` trailer. Forgot one? `git commit --amend -s` (or
+`git rebase --signoff main` for a whole branch) and force-push.
+
+## Third-party code and licenses
+
+To keep the repository safely redistributable under Apache-2.0:
+
+- **Code copied or vendored into this repository** (scripts, snippets,
+  assets) must be under a permissive license: Apache-2.0, MIT, BSD (2- or
+  3-clause), or ISC. Include the upstream copyright notice and license
+  text, and mention the origin in your PR description.
+- **New dependencies a plugin pulls in at runtime** must be permissively
+  licensed as above; weak-copyleft dependencies (MPL-2.0, LGPL) are
+  acceptable only unmodified and need maintainer sign-off.
+- **GPL, AGPL, SSPL, or BSL-licensed code cannot be accepted** in any form
+  (vendored, copied, or as a dependency).
+
+If you're unsure about a license, ask in the PR before writing code.
 
 ## Change workflow
 

DCO.md

@@ -0,0 +1,68 @@
+# Developer Certificate of Origin
+
+Contributions to this project are accepted under the
+[Developer Certificate of Origin v1.1](https://developercertificate.org/)
+(DCO), the same mechanism used by the Linux kernel, CNCF projects, and
+GitLab. There is nothing to sign and no account to create: you certify the
+DCO by adding a `Signed-off-by` line to each commit, which `git` does for
+you with the `-s` flag:
+
+```bash
+git commit -s -m "fix: handle empty provider list"
+```
+
+That appends a trailer with the name and email from your git config:
+
+```
+Signed-off-by: Jane Developer <jane@example.com>
+```
+
+By signing off, you certify the statements below — in short, that you wrote
+the change or otherwise have the right to submit it under the project's
+open-source license ([Apache-2.0](./LICENSE)). Contributions are licensed
+inbound = outbound: you keep the copyright to your work, and it is licensed
+to the project and everyone else under Apache-2.0, exactly like the rest of
+the codebase.
+
+If you forget to sign off, amend the commit (`git commit --amend -s`) or
+sign off a whole branch (`git rebase --signoff main`) and force-push; the
+DCO check on the pull request will re-run automatically.
+
+The full text of the Developer Certificate of Origin v1.1 follows, verbatim:
+
+```
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.
+```

NOTICE

@@ -0,0 +1,5 @@
+humanbound plugins
+Copyright 2024-2026 AI and Me Single-Member Private Company (Humanbound)
+
+This product includes software developed at Humanbound
+(https://humanbound.ai/).

README.md

@@ -94,8 +94,8 @@ Different hook models, equivalent posture.
 
 Contributions are welcome — both bug fixes for the existing plugin and
 proposals for new plugins. See [CONTRIBUTING.md](./CONTRIBUTING.md) for the
-dev loop, plugin layout conventions, and the CLA requirement (see
-[CLA.md](./CLA.md)).
+dev loop, plugin layout conventions, and the DCO sign-off requirement (see
+[DCO.md](./DCO.md)).
 
 - 🐛 [Report a bug](https://github.com/humanbound/plugins/issues/new/choose)
 - 💡 [Request a feature](https://github.com/humanbound/plugins/issues/new/choose)