chore: add bounded contributor agreement

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,13 @@
+## Summary
+
+<!-- What changed, and why? Keep the pull request limited to one coherent change. -->
+
+## Verification
+
+<!-- List the checks you ran and any relevant limitations. -->
+
+## Contributor agreement
+
+Signing on behalf of a legal entity (leave blank if accepting individually):
+
+- [ ] I have read and agree to the [RememberStack Contributor License Agreement v1.0](https://github.com/writeitai/remember-stack/blob/main/CLA.md).

.github/workflows/cla.yml

@@ -0,0 +1,44 @@
+name: Contributor agreement
+
+on:
+  pull_request_target:
+    types: [opened, edited, reopened, synchronize]
+
+permissions: {}
+
+jobs:
+  cla:
+    name: CLA
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      # Security invariant: pull_request_target evaluates only event metadata. It must
+      # never check out, import, or execute code from the untrusted pull-request ref.
+      - name: Verify contributor assent
+        env:
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          python3 - <<'PY'
+          import os
+
+          author = os.environ.get("PR_AUTHOR", "")
+          if author in {"dependabot[bot]", "github-actions[bot]"}:
+              raise SystemExit(0)
+
+          expected = (
+              "- [x] I have read and agree to the "
+              "[RememberStack Contributor License Agreement v1.0]"
+              "(https://github.com/writeitai/remember-stack/blob/main/CLA.md)."
+          )
+          lines = {
+              line.strip().casefold()
+              for line in os.environ.get("PR_BODY", "").splitlines()
+          }
+          if expected.casefold() not in lines:
+              print(
+                  "::error::Read CLA.md and check the exact contributor-agreement "
+                  "box in the pull-request body."
+              )
+              raise SystemExit(1)
+          PY

CLA.md

@@ -0,0 +1,197 @@
+# RememberStack Contributor License Agreement
+
+Version 1.0 — 23 July 2026
+
+Thank you for contributing to RememberStack. This Contributor License Agreement
+("Agreement") documents the rights that You grant to WriteIt.ai s.r.o., IČO 04518136,
+with its registered office at Na Folimance 2155/15, Vinohrady, 120 00 Praha 2,
+Czech Republic ("We", "Us", or "WriteIt.ai").
+
+This is a legally binding agreement. You accept it electronically when You submit a
+RememberStack pull request containing the checked assent required by the repository's
+pull-request template. If You do not agree, do not check that box or submit the work for
+inclusion.
+
+## 1. Definitions
+
+**"You"** means the authenticated GitHub pull-request author accepting this Agreement
+as an individual. If that author identifies a legal entity in the pull request's
+"Signing on behalf of" field, "You" instead means that entity and the author represents
+that they are authorized to bind it.
+
+**"Contribution"** means a work of authorship that You Submit to Us for inclusion in
+RememberStack and in which You own, or have authority to license, the applicable
+Copyright. It excludes material conspicuously marked "Not a Contribution" and
+third-party material that You identify as such.
+
+**"Copyright"** means copyright, moral, neighboring, and similar rights protecting
+works of authorship for the full term of those rights.
+
+**"Material"** means RememberStack and any successor, renamed, split, combined, or
+derivative project controlled by Us into which Your Contribution is incorporated.
+
+**"Submit"** means intentionally sending a Contribution to a repository, issue tracker,
+or other collaboration system managed by Us for the purpose of discussing or improving
+the Material.
+
+**"Self-Host"** means to install and operate the Material, in source or object form and
+with or without modification, on infrastructure selected or controlled by the recipient
+for that recipient's own use. It includes personal, research, nonprofit, and internal
+commercial production use. It does not include offering the Material's functionality to
+third parties as a hosted or managed service.
+
+**"Qualifying License"** means a license under which every recipient has perpetual
+rights, without paying a license fee to Us or an affiliate and without being required
+to purchase support or another service, to:
+
+1. obtain the corresponding source code for the Material;
+2. reproduce and modify the Material;
+3. redistribute the Material and modifications, in source or object form, for others
+   to Self-Host; and
+4. Self-Host and operate the Material without limits based on users, seats, instances,
+   data volume, or duration.
+
+A Qualifying License may require attribution, publication of modifications, source-code
+availability, or other reciprocal conditions. It may also restrict offering the
+Material as a hosted or managed service to third parties. Charges for hosting, support,
+consulting, or other services do not by themselves prevent a license from qualifying.
+
+## 2. Grant of rights
+
+### 2.1 Copyright license
+
+You retain ownership of the Copyright in Your Contribution and remain free to use or
+license it independently.
+
+To the maximum extent permitted by law, You grant Us a perpetual, worldwide,
+non-exclusive, transferable (subject to Section 6.3), royalty-free, irrevocable
+copyright license, with the right to sublicense through multiple tiers, to reproduce,
+modify, prepare derivative works of, publicly display, publicly perform, distribute,
+and otherwise use Your Contribution as part of the Material.
+
+### 2.2 Patent license
+
+For patent claims that You own, control, or have the right to license now or in the
+future, You grant Us a perpetual, worldwide, non-exclusive, transferable (subject to
+Section 6.3), royalty-free, irrevocable patent license, with the right to sublicense
+through multiple tiers, to make, have made, use, offer to sell, sell, import, and
+otherwise transfer Your Contribution and Your Contribution in combination with the
+Material.
+
+This license applies only to claims necessarily infringed by Your Contribution alone or
+by its combination with the Material.
+
+### 2.3 Bounded outbound licensing
+
+We covenant that, when We license Your Contribution to third parties as part of the
+Material, We will do so only under one or more Qualifying Licenses. The Apache License,
+Version 2.0 used by RememberStack on the date of this Agreement is a Qualifying License.
+
+This covenant permits a future license to protect a hosted-service business, but it
+does not permit Us to remove the source-availability and free Self-Hosting rights
+defined above. Once We release a version under a Qualifying License, We will not revoke
+or narrow the rights already granted under that license. Versions already released
+under the Apache License, Version 2.0 remain available under that license.
+
+This covenant does not restrict Our use of the Contribution, including using it to
+provide hosted services without granting third parties a copyright license to the
+Material. It does not require Us to publish a Contribution that We have not incorporated
+into the Material.
+
+The grants in Sections 2.1 and 2.2 are not conditional on this covenant and do not
+terminate automatically if We breach it. A breach of this Section 2.3 is a material
+breach of this Agreement. You may seek injunctive relief, specific performance, and any
+other remedy available under applicable law to stop or remedy licensing that violates
+this covenant. A breach does not invalidate a license previously granted to a recipient
+under a Qualifying License.
+
+### 2.4 Moral rights
+
+To the maximum extent permitted by law, You waive and agree not to assert moral rights
+in the Contribution against Us, Our successors, or Our direct or indirect licensees.
+Where waiver is not permitted, You grant the broadest license or consent permitted by
+law to exercise those rights consistently with this Agreement.
+
+### 2.5 Reservation and acceptance
+
+You reserve every right not expressly granted by this Agreement. We are not required to
+accept or use any Contribution.
+
+## 3. Your representations
+
+You represent that:
+
+1. You have legal authority to enter into this Agreement and make these grants.
+2. The Contribution is Your original work, or You otherwise own or control the rights
+   needed to grant the licenses in Section 2.
+3. These grants do not violate an agreement with another party, including Your
+   employer. If another person or entity owns or controls the relevant rights, You have
+   obtained its authorization before Submitting.
+4. You have identified any third-party material included in the Contribution and
+   complied with its license. Material You do not have authority to license under this
+   Agreement must be clearly marked "Not a Contribution."
+5. The Contribution is not confidential information that You or another party expects
+   Us to keep confidential.
+6. If You are accepting for a legal entity, You are authorized to bind that entity. If
+   You are under the age required to enter this Agreement, Your parent or legal guardian
+   has accepted it for You.
+
+## 4. Disclaimer
+
+EXCEPT FOR THE EXPRESS REPRESENTATIONS IN SECTION 3, THE CONTRIBUTION IS PROVIDED
+"AS IS". TO THE MAXIMUM EXTENT PERMITTED BY LAW, YOU DISCLAIM ALL EXPRESS OR IMPLIED
+WARRANTIES, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND
+NON-INFRINGEMENT.
+
+## 5. Limitation of liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER YOU NOR WE WILL BE LIABLE TO THE OTHER
+UNDER THIS AGREEMENT FOR LOST PROFITS, LOST SAVINGS, LOSS OF DATA, OR INDIRECT,
+SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, REGARDLESS OF THE THEORY OF
+LIABILITY.
+
+## 6. Miscellaneous
+
+### 6.1 Governing law
+
+This Agreement is governed by the laws of the Czech Republic, excluding its
+conflict-of-laws rules. The United Nations Convention on Contracts for the
+International Sale of Goods does not apply.
+
+### 6.2 Entire agreement
+
+This Agreement is the entire agreement between You and Us concerning Your
+Contributions and supersedes prior understandings about those Contributions.
+
+### 6.3 Transfer
+
+We may transfer this Agreement and the rights granted under it to an affiliate or to a
+successor or acquirer of all or substantially all of the Material or the business that
+maintains it, but only if that recipient agrees in writing to assume Our obligations,
+including Section 2.3. You may transfer this Agreement only with Our written consent.
+Existing Qualifying Licenses and permitted sublicenses remain effective after a
+transfer.
+
+### 6.4 Waiver and severability
+
+A failure to enforce a provision is not a waiver of that provision. If a provision is
+unenforceable, it will be adjusted only as far as necessary to make it enforceable
+while preserving its intent; the remaining provisions stay effective.
+
+### 6.5 Revisions
+
+Each published revision of this Agreement has a version number. A revision applies only
+to Contributions for which You assent to that revision; it does not retroactively
+expand grants made under an earlier version.
+
+### 6.6 Electronic record
+
+Your authenticated GitHub account, the pull request containing Your checked assent and
+any "Signing on behalf of" entry, and GitHub's associated repository history form the
+electronic record of Your acceptance.
+
+This Agreement is adapted from the Harmony Contributor Agreement Template, Version 1.0,
+licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/). It has been
+materially modified for RememberStack, including its bounded outbound-license condition,
+electronic acceptance, and Czech governing law. Project Harmony does not endorse this
+Agreement.

CONTRIBUTING.md

@@ -0,0 +1,55 @@
+# Contributing to RememberStack
+
+Thank you for helping improve RememberStack. Keep changes focused: for substantial work,
+open an issue first so the scope and design boundary are clear before implementation.
+
+## Development
+
+The repository uses `uv` and supports Python 3.12 through 3.14.
+
+```bash
+uv sync --locked --python 3.14
+uv run ruff check src/
+uv run ruff format --check src/
+uv run pyright src/ --pythonversion 3.14
+uv run pytest src/tests -q
+```
+
+Run the smallest relevant test set while iterating, then the complete checks appropriate
+to the change before requesting review. User-facing behavior changes must update the
+corresponding documentation in the same pull request.
+
+## Contributor agreement
+
+RememberStack is currently distributed under the Apache License, Version 2.0. Before a
+human-authored pull request can merge, its author must accept the
+[RememberStack Contributor License Agreement](CLA.md).
+
+The agreement is a license, not a copyright assignment: You keep ownership of Your
+Contribution. It gives WriteIt.ai s.r.o. the rights needed to maintain and distribute
+RememberStack, including a bounded ability to change the outbound license. Any such
+license must continue to make source available and permit free self-hosting as defined
+in the agreement.
+
+The pull-request template contains the required assent checkbox. The `CLA` job fails
+until the exact box is checked; once that status is required in `main` protection, a
+failure blocks merge. A later agreement version requires fresh assent and does not
+retroactively expand an earlier grant.
+
+If Your employer or another entity owns the work, only accept on its behalf if You are
+authorized to bind it, and identify that entity in the pull-request field. The assent
+covers only work that the accepting individual or entity owns or is authorized to
+license. Split contributions into separate pull requests when copyrightable work from
+another author is not covered by that authority. Identify third-party material and its
+license in the pull request; do not represent third-party work as Your Contribution.
+
+## Pull requests
+
+- Keep each pull request limited to one coherent change.
+- Explain the behavior change and the verification performed.
+- Preserve unrelated user changes and generated artifacts.
+- Do not include secrets, private data, or material You cannot license.
+- Expect maintainers to request changes that reduce complexity or scope.
+
+Project names and logos are governed separately by the
+[RememberStack Trademark Policy](TRADEMARKS.md).

README.md

@@ -8,9 +8,9 @@ distill them into progressively more abstract, navigable knowledge — while kee
 auditable by humans. Scale is a requirement, not an aspiration: it is meant to still be useful
 at a million documents.
 
-> **Pre-release software.** Phases 0–6 and most of Phase 7 are implemented and tested. Release
-> automation exists, but the owner-side legal, governance, and registry setup gates are not
-> complete, so no public package or container release exists yet. The fresh-deployment Docker
+> **Pre-release software.** Phases 0–7 are implemented and tested. Release automation, trusted
+> publishing, and tag protection are in place; activation of the bounded contributor-agreement
+> check and the first public tag remain. The fresh-deployment Docker
 > Compose skeleton is documented under
 > [Self-host deployment](website/src/app/docs/deployment/page.mdx); it proves PostgreSQL, MinIO,
 > API ingestion, and the first two E0 worker stages, not a production rollout. The build follows

RELEASING.md

@@ -6,11 +6,13 @@ It accepts only tags exactly matching `vMAJOR.MINOR.PATCH`.
 
 ## One-time owner setup
 
-Complete these steps in order:
+The owner setup is in its final activation step:
 
-1. Finish the focused name clearance and put the bounded CLA in place. These are governance
-   gates, not release-workflow features.
-2. Confirm the GitHub repository is `writeitai/remember-stack`, then update each existing clone:
+1. D77 records explicit acceptance of the preliminary naming risk. `CLA.md`, the trademark policy,
+   pull-request template, and `CLA` workflow land together; after merge, make the emitted `CLA`
+   status a required `main` check with administrator enforcement before accepting an outside
+   contribution or creating the first release tag.
+2. The GitHub repository is `writeitai/remember-stack`. Update each existing clone if needed:
 
    ```bash
    git remote set-url origin git@github.com:writeitai/remember-stack.git
@@ -20,9 +22,9 @@ Complete these steps in order:
    RememberStack and the Python distribution/import remain `rememberstack`. GitHub redirects
    ordinary repository and Git traffic after a rename, but the final name must be in place before
    configuring PyPI because the trusted identity includes the repository name.
-3. In the GitHub repository, create an environment named `pypi`. Add yourself as a required
-   reviewer so a tag cannot publish to PyPI without an explicit approval.
-4. Create a PyPI account, enable two-factor authentication, and add a
+3. The GitHub environment `pypi` requires an owner review, so a tag cannot publish to PyPI without
+   explicit approval.
+4. The PyPI account uses two-factor authentication and has a
    [pending Trusted Publisher](https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/)
    with these exact values:
 
@@ -36,7 +38,8 @@ Complete these steps in order:
 
    A pending publisher does not reserve the PyPI name. Configure it only after the repository
    rename and publish promptly once the release gates are clear.
-5. Protect tags matching `v*` so only maintainers can create or update release tags.
+5. The active `Protect release tags` ruleset restricts creation, update, and deletion of tags
+   matching `v*` to repository administrators.
 
 No PyPI password or long-lived API token belongs in GitHub secrets. The workflow requests a
 short-lived OpenID Connect credential and grants `id-token: write` only to the PyPI job.