Exempt Claude Code's cloud-agent commit identity from the CLA gate

.github/workflows/cla.yml

@@ -40,4 +40,16 @@ jobs:
           branch: "cla-signatures"
           # Automated dependency-bump PRs (Dependabot) aren't a human agreeing
           # to anything — exempt them rather than block routine bumps.
-          allowlist: dependabot[bot]
+          #
+          # `claude` is the commit identity Claude Code's cloud/background
+          # agent uses when it pushes directly to `claude/*` branches (see
+          # CLAUDE.md's "Never credit Claude" rule — that governs interactive
+          # sessions; this is the separate cloud-agent identity). Copyright in
+          # those commits vests in whoever directed the tool — the repo
+          # maintainer, who has already signed (see signatures/version1/cla.json
+          # on the cla-signatures branch) — not in the automation account
+          # itself, so it isn't a third party asserting authorship and doesn't
+          # need its own signature. Exact username, no wildcard: a `claude*`
+          # pattern would also allowlist any future unrelated `claude-...`
+          # account on this legal gate.
+          allowlist: dependabot[bot],claude

CLA.md

@@ -139,3 +139,9 @@ timestamp, and this document's version) is recorded in
 [`signatures/version1/cla.json`](signatures/version1/cla.json). You only
 need to sign once — the bot recognizes returning contributors
 automatically on later pull requests.
+
+Commits authored by maintainer-operated automation accounts (currently
+`dependabot[bot]` and `claude`, Claude Code's cloud-agent commit identity)
+are exempt from signing: copyright in those commits vests in whoever
+directed the tool, not in the automation account, so they aren't a third
+party asserting authorship.

changelog.d/cla-allowlist-claude.changed.md

@@ -0,0 +1 @@
+- **Exempted Claude Code's cloud-agent commit identity from the CLA gate.** `.github/workflows/cla.yml`'s `CLAAssistant` check blocked PRs whose commits are authored by GitHub user `claude` (the identity Claude Code's cloud/background agent uses when it pushes directly to `claude/*` branches, e.g. PR #2248) — that account had never signed the CLA and wasn't in the `allowlist` (previously `dependabot[bot]` only). Added `claude` to the allowlist alongside `dependabot[bot]`: copyright in those commits vests in whoever directed the tool (the maintainer, who has already signed), not in the automation account, so it isn't a third party asserting authorship. `CLA.md`'s "How to sign" section now documents both exemptions.