diff --git a/AGENTS.md b/AGENTS.md index 043b0bc..c59dd94 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -250,6 +250,15 @@ and "why isn't X here?" questions. Consult it before adding anything. each land as separate commits when practical. Don't bundle unrelated work. - **Never commit secrets.** The `.gitignore` already covers `.env*`, `*.pem`, `*.key`. If a new secret pattern appears, extend `.gitignore` in the same commit. +- **Developer Certificate of Origin (DCO) — REQUIRED on every commit.** Every commit + MUST be signed off (`git commit -s` or `git commit --signoff`) to attest the author + has the right to contribute the code under the project's license (GPL-3.0-or-later, + ADR-0004). This preserves the copyright-holder's option to dual-license later — + without a DCO/CLA instrument, every external contribution erodes that option. See + [`DCO.md`](DCO.md) for the full text. The signoff line (`Signed-off-by: Name `) + is the canonical attestation; CI (planned) will reject unsigned commits. Agents + committing on behalf of a human MUST sign off with the human's name + email, not + their own identity. - **PR description template** (for non-trivial PRs): ``` ## What lands diff --git a/DCO.md b/DCO.md new file mode 100644 index 0000000..e91c6f9 --- /dev/null +++ b/DCO.md @@ -0,0 +1,82 @@ +# Developer Certificate of Origin (DCO) + +Version 1.1 + +Copyright (C) 2004, 2006 The Linux Foundation. All rights reserved. + +Everyone is permitted to copy and distribute verbatim copies of this +license document, but changing it is not allowed. + +By making a contribution to this project, I certify that: + +(a) The contribution was created in whole or in part by me and I + have the right to submit it under the open source license + indicated in the file; or + +(b) The contribution is based upon previous work that, to the best + of my knowledge, is covered under an appropriate open source + license and I have the right under that license to submit that + work with modifications, whether created in whole or in part + by me, under the same open source license (unless I am + permitted to submit under a different license), as indicated + in the file; or + +(c) The contribution was provided directly to me by some other + person who certified (a), (b) or (c) and I have not modified + it. + +(d) I understand and agree that this project and the contribution + are public and that a record of the contribution (including all + personal information I submit with it, including my sign-off) is + maintained indefinitely and may be redistributed consistent with + this project or the open source license(s) involved. + +--- + +## How to sign off + +Every commit MUST be signed off. Use `git commit -s` (or `git commit --signoff`) +to add the attestation line automatically: + +``` +$ git commit -s -m "feat: add barge-in reflex" + +commit 0123456789abcdef... +Author: A.D. Lee +Date: Wed Jul 2 10:00:00 2026 +0000 + + feat: add barge-in reflex + + Signed-off-by: A.D. Lee +``` + +The `Signed-off-by: Name ` line is the canonical DCO attestation. The +name and email MUST match the git author identity. + +## Why DCO (not a CLA) + +The DCO is a per-commit attestation (lightweight, no registration), not a +Contributor License Agreement (which would require a one-time grant + tracking). +The DCO preserves the copyright-holder's option to dual-license the project +later — every contributor retains their own copyright but attests they have the +right to contribute under GPL-3.0-or-later (the project's license, ADR-0004). +See [ADR-0004](docs/adr/0004-license.md) for the license decision and the +dual-license rationale. + +## For agents committing on behalf of a human + +An AI agent that commits code on behalf of a human operator MUST sign off with +the **human's** name + email, not the agent's own identity. The human is the +contributor of record; the agent is the instrument. The DCO attestation +certifies the human's right to contribute, not the agent's. + +``` +# Correct — the human (alee) is the contributor of record +Signed-off-by: A.D. Lee + +# WRONG — the agent is not a legal entity that can hold copyright +Signed-off-by: opencode-agent +``` + +CI (planned) will reject commits missing a valid `Signed-off-by` line matching +the author identity.