diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
new file mode 100644
index 0000000..dc5de73
--- /dev/null
+++ b/.github/workflows/dco.yml
@@ -0,0 +1,20 @@
+name: DCO
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  dco:
+    runs-on: ubuntu-latest
+    steps:
+      # SAFETY: pull_request_target runs with write access to the BASE repo.
+      # This job is safe ONLY because it reads commit metadata via the API and never
+      # checks out or executes the PR's code. Do NOT add a checkout of the PR head
+      # here — doing so turns this into a remote-code-execution vector.
+      - uses: KineticCafe/actions-dco@1da04282bbf757dab7d92a5c8535dbfb8113da5c   # v3.1.0
+        # repo-token defaults to ${{ github.token }}; no explicit input needed.
+        with:
+          config: |
+            comment = true
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..7e225fc
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,60 @@
+# Contributing
+
+Thank you for contributing. This project is part of the Network Theory
+Applied Research Institute (NTARI) and is governed by a simple, deliberately
+unamendable arrangement.
+
+## Licensing: inbound = outbound, no CLA
+
+- Contributions are accepted under a **Developer Certificate of Origin (DCO)**
+  sign-off. See the `DCO` file at the repository root.
+- **Your contribution is licensed under this project's existing license**
+  (the AGPL-3.0 text in `LICENSE`). Inbound matches outbound. There is no
+  separate contributor agreement to sign.
+- **Copyright stays with you.** NTARI requires no CLA and takes no copyright
+  assignment. The copyright in this project therefore remains distributed
+  across every contributor, and no single party — including NTARI — can
+  relicense the corpus without unanimous consent. That distribution is the
+  point: it entrenches the project's anti-enclosure commitment in the
+  ownership structure itself.
+
+## How to sign off
+
+Configure your git identity to match your GitHub account, once:
+
+```sh
+git config --global user.name  "Your Name"
+git config --global user.email "you@example.org"
+```
+
+Then sign off every commit by adding `-s`:
+
+```sh
+git commit -s -m "Your message"
+```
+
+This appends a `Signed-off-by: Your Name <you@example.org>` trailer, which is
+your certification of the DCO for that commit.
+
+## If you forget the sign-off
+
+A DCO check runs on every pull request. If a commit is missing its
+`Signed-off-by` trailer the check will fail; it may also post a comment on
+your pull request explaining which commits need attention (comments are posted
+only on pull requests opened from a branch in this repository, not from forks).
+Either way, the failed check's details list exactly which commits need a
+sign-off. To fix:
+
+- **One commit:**
+  ```sh
+  git commit --amend --no-edit --signoff
+  git push --force-with-lease
+  ```
+- **Several commits** (the last N):
+  ```sh
+  git rebase --signoff HEAD~N
+  git push --force-with-lease
+  ```
+
+Open your pull request against the `main` branch; branch from
+`main` to start work.
diff --git a/DCO b/DCO
new file mode 100644
index 0000000..49b8cb0
--- /dev/null
+++ b/DCO
@@ -0,0 +1,34 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.