chore: remove an unsigned contributor from CONTRIBUTORS - #99
Merged
Conversation
Signetry Reviewer — 🟡 Needs human reviewA human should decide — the required check is pending. Deterministic gates (the authority)
FindingsNo issues found by the deterministic scanners. MergeA human should review and merge.
|
@adity982 never signed the CLA. Verified against the authoritative store — signatures/cla.json on the cla-signatures branch lists exactly one signed contributor (AdvaitVarhade, from #73). The two "I have read the CLA" strings on #55 are the bot's own instruction text and a quote of it in a maintainer comment, not a signature. CONTRIBUTORS.md states that the people listed are acknowledged "for contributions accepted under the Contributor License Agreement", so an unsigned contribution does not belong in that list. NOTE — this leaves an open provenance question, not resolved here. The Aider adapter merged in #96 is a port of their #55, and aider.py still records that derivation in its module docstring. Without a signed CLA the copyright assignment never happened, so the repo now contains code derived from an unassigned contribution. That needs a decision (reimplement from the sibling adapters, or obtain a signature) — flagged rather than settled by this commit.
bkd-dotcom
force-pushed
the
chore/remove-unsigned-contributor
branch
from
August 18, 2026 20:29
0f6c46b to
e863872
Compare
bkd-dotcom
added a commit
that referenced
this pull request
Aug 18, 2026
Resolves the provenance question flagged in #99. The version merged in #96 was a port of an unsigned contribution (#55). Without a signed CLA the copyright assignment never happened, so keeping derived code — especially after removing the attribution — was the least defensible combination. This rewrites the adapter from the sibling adapters (codex.py / claude_code.py, both owner-authored) so nothing in the tree derives from an unassigned contribution, and drops the attribution from the module docstring and the v0.7.0 changelog entry. Behaviour is unchanged: all 33 executor tests written against the previous implementation pass without modification, because they assert behaviour rather than structure. Two things the rewrite adds, both from house patterns the port lacked: * --model is validated before use, like the Codex adapter's -m value, so a caller-supplied string cannot smuggle shell metacharacters or extra arguments into the command. The first character must be alphanumeric — my own test caught that a naive character class accepts "--dangerously-x", since "-" is legal inside a model name, and an argument parser may read a leading dash as a new option rather than as --model's value. * The withheld-authority flags are a named constant, so removing one shows up in review instead of disappearing into the command construction. A test asserts the set, not just individual flags. Also logs a non-zero exit like claude_code.py does, which the port did not. Co-authored-by: Binay <bkd-dotcom@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@adity982 never signed the CLA, so they should not be in
CONTRIBUTORS.md.Verified against the authoritative store
signatures/cla.jsonon thecla-signaturesbranch:{ "signedContributors": [ { "name": "AdvaitVarhade", "pullRequestNo": 73, ... } ] }One signer.
adity982is not in it, and noclacheck ever reported onfeat/aider-executor.Worth noting because it's misleading: grepping #55 for "I have read the CLA" returns two hits, but both are the bot's own instruction text and my quote of it — neither is a signature. The signature file is the thing to check.
CONTRIBUTORS.mdsays the people listed are acknowledged "for contributions accepted under the Contributor License Agreement", so an unsigned contribution doesn't belong there.Removing the credit line is the smaller half. The Aider adapter merged in #96 is a port of their #55, and
signetry_core/executors/aider.pystill records that derivation in its module docstring:Without a signed CLA the copyright assignment never happened, so the repo now holds code derived from an unassigned contribution — and removing the attribution while keeping the derivation is the least defensible combination of the two.
Two ways to resolve it, and it's a licensing call rather than a technical one:
aider.pyfrom the sibling adapters (codex.py/claude_code.py, both owner-authored). The Executor protocol dictates most of the shape, Aider's CLI dictates the flags, and the repo's security model dictates the redaction — so an independent implementation is straightforward. Then drop the docstring credit. Removes the exposure entirely.I've left #55 open pending that decision rather than closing it, since option 2 keeps it alive.
Say which and I'll do it.