chore: relicense to Apache-2.0 (Signetry goes open core)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,76 @@
+name: Bug report
+description: Report a problem with the Signetry Claude Code plugin.
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For **security vulnerabilities** do NOT use this form — see
+        [SECURITY.md](https://github.com/Signetry/claude-code/security/policy).
+        Governance-logic bugs (contract evaluation, guard decisions, verifier,
+        receipts) belong in [signetry-core](https://github.com/Signetry/core/issues) —
+        this plugin never reimplements policy, it pins `signetry-core`.
+  - type: input
+    id: version
+    attributes:
+      label: Plugin version
+      description: From `signetry/.claude-plugin/plugin.json`, or the branch/commit you loaded.
+      placeholder: "0.3.0"
+    validations:
+      required: true
+  - type: input
+    id: env
+    attributes:
+      label: Environment
+      description: OS, Claude Code version, and the output of `python3 --version`.
+      placeholder: "macOS 15.3 · Claude Code 2.1.0 · Python 3.12.4"
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Which part misbehaved
+      options:
+        - PreToolUse guard (signetry-guard.sh)
+        - SessionStart hook / activation (signetry-session-start.sh)
+        - Python/venv resolution (signetry-lib.sh)
+        - MCP server (signetry-mcp.sh)
+        - /signetry:admit skill
+        - Plugin install / marketplace manifest
+        - Something else
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: |
+        Expected vs actual. If the guard allowed something it should have blocked (or
+        blocked something it should have allowed), say which file path or command, and
+        include the relevant part of your `.signetry/admission.yaml`.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Reproduction
+      description: |
+        Ideally reproduce it through the real hook without an interactive session:
+        `bash demos/try-guard.sh`, or pipe the tool-call JSON straight in —
+        `printf '%s' '{"tool_name":"Write","tool_input":{"file_path":"deploy.yml"}}' | bash signetry/hooks/signetry-guard.sh`
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: output
+    attributes:
+      label: Hook output / session transcript
+      description: The SessionStart status line and any hook output. Redact secrets and paths you would rather not share.
+      render: text
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: The SessionStart line said Signetry was **active** (not `INACTIVE`) when this happened.
+        - label: I confirmed the same behaviour is not already fixed on `main`.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability (private)
+    url: https://github.com/Signetry/claude-code/security/advisories/new
+    about: Please report vulnerabilities privately — do not open a public issue.
+  - name: Governance logic (signetry-core)
+    url: https://github.com/Signetry/core/issues
+    about: Bugs in the contract, guard decisions, verifier, receipts, or pipeline belong in signetry-core.
+  - name: Platform overview and licensing
+    url: https://github.com/Signetry/signetry
+    about: How the pieces fit together, and the open-core licensing model.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,64 @@
+name: Feature request
+description: Suggest an improvement to the Signetry Claude Code plugin.
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This repository is the **Claude Code integration surface**: the hooks, the
+        hook matchers, Python/venv resolution, the MCP launcher, the
+        `/signetry:admit` skill, and the manifests.
+
+        Changes to the governance logic itself — what a contract can express, how
+        authority is earned, the verifier, receipt signing — belong in
+        [signetry-core](https://github.com/Signetry/core/issues).
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What are you trying to do, and where does the plugin get in the way today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you would like to happen
+      description: If it affects a hook, a matcher, or a manifest field, say which.
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Which part would change
+      options:
+        - PreToolUse guard (signetry-guard.sh)
+        - SessionStart hook / activation (signetry-session-start.sh)
+        - Hook matchers or timeouts (hooks.json)
+        - Python/venv resolution (signetry-lib.sh)
+        - MCP server (signetry-mcp.sh)
+        - /signetry:admit skill
+        - Plugin install / marketplace manifest
+        - Docs
+        - Not sure
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you considered
+      description: Including whether your repo's `.signetry/admission.yaml` could already express this.
+  - type: checkboxes
+    id: invariants
+    attributes:
+      label: Invariants this preserves
+      description: The plugin holds these regardless of configuration. Confirm your proposal does not break them.
+      options:
+        - label: The decision stays deterministic — the model never approves its own change.
+        - label: Admission still fails **closed**; the soft guard may fail open only with a loud `INACTIVE`.
+        - label: "`auto_merge` stays false — a human merges."
+  - type: checkboxes
+    id: contribute
+    attributes:
+      label: Contributing
+      options:
+        - label: I would be willing to open a PR for this (see [CONTRIBUTING.md](https://github.com/Signetry/claude-code/blob/main/CONTRIBUTING.md)).

.github/workflows/cla.yml

@@ -4,7 +4,12 @@ name: CLA
 # before their pull request can be merged. Runs entirely in this repo's Actions —
 # no third-party OAuth app. Signatures are recorded in signatures/cla.json on this
 # repo, so there is a durable, auditable record that each contributor assigned
-# copyright/ownership of their contribution to the Owner.
+# copyright in their contribution to the Owner.
+#
+# This repo is Apache-2.0, and the CLA does not take those rights away from a
+# contributor. It exists because Signetry is open core: an adapter contributed
+# here may later move into the BUSL-1.1 engine (Signetry/core), and that needs
+# relicensing rights we cannot get retroactively from every past contributor.
 #
 # A contributor signs by commenting the exact statement below on their PR:
 #   I have read the CLA Document and I hereby sign the CLA
@@ -48,7 +53,7 @@ jobs:
           path-to-document: "https://github.com/Signetry/claude-code/blob/main/CLA.md"
           branch: "cla-signatures"
           allowlist: "dependabot[bot],bkd-dotcom"
-          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/claude-code/blob/main/CLA.md)** — Signetry is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:"
+          custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/claude-code/blob/main/CLA.md)**. This repo is **Apache-2.0** — signing does not take those rights away from you. The CLA assigns copyright in your contribution to the Owner so it can be relicensed if it later moves into the BUSL-1.1 engine ([open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md)). To agree, reply with exactly:"
           custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
           custom-allsigned-prcomment: "All contributors have signed the CLA. ✅"
           lock-pullrequest-aftermerge: false

CHANGELOG.md

@@ -4,6 +4,36 @@ Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semve
 
 ## [Unreleased]
 
+### Changed — the project is now open source (Apache-2.0)
+
+- Signetry moved to an **open-core** model. This repository is the integration
+  surface, so it is now **Apache-2.0**: use it, fork it, ship it commercially, no
+  strings. The engine ([`Signetry/core`](https://github.com/Signetry/core)) is
+  source-available under BUSL-1.1 and converts to Apache-2.0 on 2030-08-31. See
+  [LICENSING.md](https://github.com/Signetry/signetry/blob/main/LICENSING.md).
+- `signetry/.claude-plugin/plugin.json` now declares `"license": "Apache-2.0"`,
+  which **supersedes the `"Proprietary — All Rights Reserved"` value set by the
+  entry below** in this same unreleased range.
+- `README.md`, `CONTRIBUTING.md`, `CLA.md`, `CONTRIBUTORS.md`, and the CLA
+  workflow's PR comment no longer describe the project as "All Rights Reserved" or
+  "not open source".
+- The **CLA is kept**. Apache-2.0 already grants contributors every right the old
+  wording withheld; the CLA now exists for the relicensing rights that let a
+  well-built adapter move into the BUSL-1.1 engine later without chasing down
+  every past contributor.
+- **The CLA's fallback licence grant is now non-exclusive.** It previously granted the
+  Owner an *exclusive* licence where copyright assignment is not permitted by law, which
+  would have stripped contributors of the right to use their own contribution — directly
+  contradicting the rights the LICENSE grants everyone. The CLA text is now identical
+  across all Signetry repositories (bar the engine/integration licence wording) so the
+  legal terms cannot drift per-repo again. See [CLA.md](CLA.md) §2–3.
+
+### Added
+
+- Issue templates under `.github/ISSUE_TEMPLATE/` (bug report, feature request,
+  and a config that routes vulnerabilities to private reporting and
+  governance-logic bugs to `signetry-core`).
+
 ### Fixed — the plugin declared the wrong license
 
 - `signetry/.claude-plugin/plugin.json` declared `"license": "MIT"` while the

CLA.md

@@ -1,6 +1,10 @@
 # Signetry Contributor License Agreement (CLA)
 
-**Copyright (c) 2026 Binay Dalai. All rights reserved.**
+**Copyright (c) 2026 Binay Dalai.** This repository is licensed under
+**[Apache-2.0](LICENSE)** as part of Signetry's
+[open-core model](https://github.com/Signetry/signetry/blob/main/LICENSING.md). This
+Agreement governs what You grant the Owner when You contribute; it does not reduce the
+rights the Apache-2.0 licence gives You (and everyone else) in this code.
 
 Thank you for your interest in contributing to Signetry ("the Project"), owned by
 Binay Dalai ("the Owner"). This Contributor License Agreement ("Agreement")
@@ -26,21 +30,33 @@ Your Contribution. You agree that the Owner is the sole and exclusive owner of t
 Contribution once merged into the Project.
 
 To the extent any rights cannot be assigned by law, You grant the Owner a
-**perpetual, worldwide, exclusive, irrevocable, royalty-free, sublicensable, and
+**perpetual, worldwide, non-exclusive, irrevocable, royalty-free, sublicensable, and
 transferable license** to use, reproduce, modify, prepare derivative works of,
 publicly display, publicly perform, distribute, **sell, and commercialize** Your
 Contribution, in whole or in part, in any form and for any purpose.
 
-## 3. The Owner's exclusive rights
+Nothing in this section removes Your own ability to use Your Contribution: once it is
+released as part of this repository it is available to You, as to anyone, under
+[Apache-2.0](LICENSE), and You retain any rights You independently hold in the
+underlying ideas and techniques.
+
+## 3. Why the Owner needs this (open core)
 
 You acknowledge and agree that:
 
-- The Owner alone retains the right to **use, license, sell, and monetize** the
-  Project, including Your Contribution.
-- You obtain **no right** to use, copy, modify, distribute, sell, or commercialize
-  the Project or Your Contribution for Your own personal or commercial purposes,
-  except as expressly permitted in writing by the Owner.
-- The Project is **not open source** and is licensed "All Rights Reserved."
+- **You keep the licence's rights.** This repository is released under
+  [Apache-2.0](LICENSE), so You may use, copy, modify, distribute, and commercialize
+  it — including Your own Contribution — on exactly the same terms as any other user.
+  No separate written permission is required.
+- **The Owner may relicense.** The assignment above lets the Owner use, license, sell,
+  and monetize the Project, including Your Contribution, and release it under other
+  terms.
+- **Code may move across the open-core line.** Signetry's integration surface is
+  Apache-2.0 while the engine
+  ([`Signetry/core`](https://github.com/Signetry/core)) is source-available under
+  BUSL-1.1, converting to Apache-2.0 on 2030-08-31. A Contribution accepted here may
+  later be moved into the engine, or engine code moved out to an Apache-2.0 repo. The
+  CLA is what makes that possible without asking every past contributor again.
 
 ## 4. Recognition of Contributors (credit, not rights)
 
@@ -50,8 +66,8 @@ of Your work.
 
 This recognition is **attribution only**. It does **not**:
 
-- grant You any ownership, license, or right to use, copy, sell, sublicense, or
-  commercialize the Project or Your Contribution;
+- grant You ownership of the Project, or any rights beyond those the Project's
+  licence already grants everyone;
 - entitle You to represent the Project, or any part of it, as Your own work, product,
   or property, or to market or sell it under Your own name or brand; or
 - create any partnership, employment, or revenue-sharing relationship with the Owner.