Remove non-AGPL contributor approval machinery

[adrianwebb]

Outcome

Remove the AGPL/commercial-license contributor approval system from this Apache-2.0 Agent package while preserving assignment/capacity authority and exact-head PR evidence.

Work authority

• Work item / Issue: Replace per-PR contribution grants with a trusted GitHub username allowlist api#7
• Proposal / decision: maintainer direction to restrict contributor approval to AGPL/commercial repositories
• Assignment / checkpoint: SDK-first cutover contributor-policy correction
• Actor: agent:engineer
• Human authority: GitHub user adrianwebb
• Agent / capacity provider: agent:engineer / local TreeSeed provider
• Exact base ref: staging at 89bbeb0b28bc1ded0a534b0440e1305205dbd9b2
• Exact head ref: codex/committer-policy at 602fe2ee3f4c8ae53fd33d6ff1aeff35dbb630ab

Contributor mode (select one):

• Human-authored
• Agent-assisted under human authority
• Agent-authored under human authority

Plan

Remove the repository workflow, template grant/attestation sections, runtime attestation client, SDK contribution dependency, and definition requirements; retain ordinary Apache Section 5 guidance and provider credential boundaries.

Changes and commits

• 602fe2ee3f4c8ae53fd33d6ff1aeff35dbb630ab — removes non-AGPL approval machinery and adds a regression test.

Verification

• Focused non-AGPL policy test: 1/1 passed.

• npm ci --dry-run: passed.

• Declaration build could not use the borrowed API dependency tree because it does not contain Agent-only @openai/codex-sdk; hosted clean install is authoritative.

• git diff --check: passed.

• Eight Agent definitions no longer declare contribution_attestation.

• I ran the narrowest relevant package verification and documented any checks that could not be run.

Risk and rollback

The removed attestation client was staging-only and supported the superseded approval architecture. Assignment and capacity-provider authority are unchanged. Revert the commit to restore it, but do not re-enable contributor grants in this non-AGPL repository.

Completion summary

The Agent repository no longer requires or prepares contribution grants. The architecture correction and both exact-head Verify runs pass; exact-head review found no remaining contribution machinery or unrelated source changes.

Submission checklist

• The change is bounded to the stated work item and target repository.
• Exact base and head refs are recorded and the branch is ready for review.
• Verification and compatibility evidence are recorded above.
• No plaintext secrets, credentials, machine state, or unrelated residue are included.
• Plan, status, commits, and completion summary form a complete durable record.
• Rollback or recovery steps are documented and executable.