chore: activate contributor agreement

.github/PULL_REQUEST_TEMPLATE.md

@@ -10,4 +10,4 @@
 
 Signing on behalf of a legal entity (leave blank if accepting individually):
 
-- [ ] I have read and agree to the [RememberStack Contributor License Agreement v1.0](https://github.com/writeitai/remember-stack/blob/main/CLA.md).
+- [ ] I have read and agree to the [RememberStack Contributor License Agreement v1.0](https://github.com/writeitai/remember-stack/blob/9e403b25a6d5b0e280cb54dbdfbe900625325940/CLA.md).

.github/workflows/cla.yml

@@ -29,7 +29,8 @@ jobs:
           expected = (
               "- [x] I have read and agree to the "
               "[RememberStack Contributor License Agreement v1.0]"
-              "(https://github.com/writeitai/remember-stack/blob/main/CLA.md)."
+              "(https://github.com/writeitai/remember-stack/blob/"
+              "9e403b25a6d5b0e280cb54dbdfbe900625325940/CLA.md)."
           )
           lines = {
               line.strip().casefold()

CONTRIBUTING.md

@@ -32,7 +32,7 @@ license must continue to make source available and permit free self-hosting as d
 in the agreement.
 
 The pull-request template contains the required assent checkbox. The `CLA` job fails
-until the exact box is checked; once that status is required in `main` protection, a
+until the exact box is checked, and that status is required in `main` protection, so a
 failure blocks merge. A later agreement version requires fresh assent and does not
 retroactively expand an earlier grant.
 

README.md

@@ -9,8 +9,8 @@ auditable by humans. Scale is a requirement, not an aspiration: it is meant to s
 at a million documents.
 
 > **Pre-release software.** Phases 0–7 are implemented and tested. Release automation, trusted
-> publishing, and tag protection are in place; activation of the bounded contributor-agreement
-> check and the first public tag remain. The fresh-deployment Docker
+> publishing, tag protection, and bounded contributor-agreement enforcement are in place; the
+> first public tag remains. The fresh-deployment Docker
 > Compose skeleton is documented under
 > [Self-host deployment](website/src/app/docs/deployment/page.mdx); it proves PostgreSQL, MinIO,
 > API ingestion, and the first two E0 worker stages, not a production rollout. The build follows

RELEASING.md

@@ -6,12 +6,11 @@ It accepts only tags exactly matching `vMAJOR.MINOR.PATCH`.
 
 ## One-time owner setup
 
-The owner setup is in its final activation step:
+The one-time owner setup is complete:
 
 1. D77 records explicit acceptance of the preliminary naming risk. `CLA.md`, the trademark policy,
-   pull-request template, and `CLA` workflow land together; after merge, make the emitted `CLA`
-   status a required `main` check with administrator enforcement before accepting an outside
-   contribution or creating the first release tag.
+   pull-request template, and metadata-only `CLA` workflow are present. The emitted `CLA` status is
+   a required `main` check with administrator enforcement.
 2. The GitHub repository is `writeitai/remember-stack`. Update each existing clone if needed:
 
    ```bash

plan/plans/phase-7-scale-ops.md

@@ -18,10 +18,9 @@ HA manager, backup scheduler, or parallel source of operational truth. Extend th
 Postgres state, narrow ports, typed settings, and CLI/admin surfaces along one shared path for
 self-host and reference adapters.
 
-**Entry gates:** none. Work-package-local gates remain explicit: #24 is resolved by D74 before
-WP-7.5 implementation. WP-7.6 engineering and account-level registry setup are complete. D77
-records the owner's naming-risk acceptance and the bounded CLA; activating its required `CLA`
-status remains before the first public tag and artifact proof.
+**Entry gates:** none. Work-package-local gates remain explicit: #24 was resolved by D74 before
+WP-7.5 implementation. WP-7.6 engineering, account-level registry setup, and D77 governance
+activation are complete. The first public tag remains the artifact proof.
 **Exit criteria:** fixed synthetic scale profiles exercise the D23 shapes and portable batching;
 a fixture budget parks and later resumes work without loss; telemetry/admin surfaces expose
 pipeline and DLQ state; rebuild and forget drills pass; S55 is green across active serving stores
@@ -35,7 +34,7 @@ the operator-driven portable restore drill is green without a library transport
 | WP-7.3 | Cost metering + configurable budget enforcement | orchestration §4; schema §2 `cost_ledger` | WP-7.1 | enforcement + admin inspection | explicit fixture ceiling parks and resumes an over-budget lane; attribution is visible | done |
 | WP-7.4 | Operational correctness surfaces + drills: typed telemetry, pipeline/DLQ inspection and replay, P2/P3 rebuild, currency-ledger audit | orchestration §6–7; D7, D60–D61 | WP-7.1 | telemetry/admin surfaces + deterministic drills | failures remain visible and drills pass without a dashboard or hosted control plane | done |
 | WP-7.5 | **Hard-delete end-to-end**: purge active P1/P2/P3/K surfaces and prevent restore resurrection through the D74 portable manifest/adapter contract | hard-forget design; lifecycle §8; k_layers §10; S55 | D74 (gate #24 resolved) | forget pipeline | **S55 CI gate ON and green** across library-controlled surfaces + restore canary | done |
-| WP-7.6 | **Release engineering**: semver across PyPI + the shared GHCR image + pinned compose; migrations-before-workers upgrade drill; quickstart cold-start release gate | packaging §1, §5–6; D62, D76–D77 | WP-7.1, owner release gates | release pipeline | tagged release produces all artifacts; upgrade drill green; quickstart under target | implemented (CLA activation, then first-tag artifact proof, remain) |
+| WP-7.6 | **Release engineering**: semver across PyPI + the shared GHCR image + pinned compose; migrations-before-workers upgrade drill; quickstart cold-start release gate | packaging §1, §5–6; D62, D76–D77 | WP-7.1, owner release gates | release pipeline | tagged release produces all artifacts; upgrade drill green; quickstart under target | implemented (first-tag artifact proof remains) |
 | WP-7.7 | **Portable state + restore round-trip**: define the authoritative store set and fail-closed restore order; operators move bytes with native tools and projections rebuild normally | packaging §6; D7, D60, D74–D75 | WP-7.1, WP-7.5 | portability contract + deterministic drill | real PostgreSQL restore plus whole/independent external-store canaries → no resurrection + control green | done |
 
 ## WP-7.1 implementation
@@ -165,10 +164,9 @@ a reachable health endpoint.
 
 [`RELEASING.md`](../../RELEASING.md) records the deliberately manual owner steps and the clean
 verification commands. The repository rename, D77 risk acceptance, PyPI environment/pending
-publisher, and release-tag protection are complete. The bounded CLA lands before its emitted check
-is made required on `main`; only then does the first tag supply the artifact proof. Making the newly
-created GHCR package public remains the one post-publish owner step rather than an OSS runtime
-feature.
+publisher, release-tag protection, and bounded-CLA enforcement are complete. The first tag now
+supplies the artifact proof. Making the newly created GHCR package public remains the one
+post-publish owner step rather than an OSS runtime feature.
 
 ## WP-7.7 implementation
 

plan/plans/roadmap.md

@@ -100,7 +100,7 @@ needs to restate it:
 | 4 | Projections | P2 (spikes → views → rebuild → snapshots), P3 (tree + mounts incl. raw), communities | p2_graph, e0 §6, `p3_agent_navigation.md` | done (exit criteria met 2026-07-19; PRs #100-#104 — see the phase file) |
 | 5 | Retrieval complete | full primitives + recipe registry, envelope contract CI, MCP/CLI, batch scan, **consumption skill + S58** | retrieval | done (exit criteria met 2026-07-20; PRs #105–#111 — see the phase file) |
 | 6 | Plane K | planner/writer/driver, fact-sheet → prose bands, citations/staleness, authored + sidecars, triggers + subscriptions, K1 + K2 purpose scopes | k_layers | done (exit criteria met 2026-07-21; PRs #112–#117; former WP-6.7 removed by D73) |
-| 7 | Operational correctness + portability | backfill/reprocessing, fixed scale batteries, configurable budgets, failure inspection/drills, hard-delete, release, portable restore | orchestration, packaging, schema §12–13 | in progress (WP-7.1–7.5 and WP-7.7 done; WP-7.6 implemented, with its public tag waiting on owner release gates) |
+| 7 | Operational correctness + portability | backfill/reprocessing, fixed scale batteries, configurable budgets, failure inspection/drills, hard-delete, release, portable restore | orchestration, packaging, schema §12–13 | implemented (all code and owner gates complete; first-tag artifact proof remains) |
 | 8 | Competitive benchmarks | external benchmark harness, adapters, baselines (Mem0/Zep-class), capability benchmark, published methodology + results | D22 (internal) + `phase-8` survey | planned |
 
 Sequencing calls already argued (see the phase files for the rest): **K after retrieval**
@@ -115,7 +115,7 @@ as usual):
 | Gate | Blocks | What must be decided |
 |---|---|---|
 | stack conventions (§3; **resolved 2026-07-17**) | Phase 0 WP-0.1 | Closed by the merged scaffold in [PR #39](https://github.com/writeitai/remember-stack/pull/39) and configuration convention in [PR #41](https://github.com/writeitai/remember-stack/pull/41); §3 maps every former slot to its exact repository evidence. |
-| public-release governance (`questions.md` §11a; **decided 2026-07-23 → D77; activation pending**) | first public tag, first outside PR | Owner accepted the documented naming risk and selected the repository-native, self-hosting-bounded CLA plus narrow trademark policy; close the implementation gate by making the emitted `CLA` status required on `main`. |
+| public-release governance (`questions.md` §11a; **resolved 2026-07-23 → D77**) | first public tag, first outside PR | Closed: owner accepted the documented naming risk; the repository-native, self-hosting-bounded CLA and narrow trademark policy are present; immutable assent is enforced by the required `CLA` status on `main`. |
 | #3 embedding model + dimension (**resolved** → D63) | Phase 1 entry | closed: `qwen3-embedding-8b` port default; conventional + prefix binds (e1 §5); stored dimension remains a D22 measurement |
 | #4 LLM per stage (**extractor seat resolved** → D70) | Phase 2 (adjudicators), Phase 6 (K writers) | extraction default `gpt-5.6-luna` closed Phase 1's gate; remaining seats inherit the port-default principle, gated by their phases' measurements (D53 family split holds) |
 | #7 PageIndex hosted vs self-hosted (**resolved** → D71: neither — a port-configured LLM seat + deterministic snap) | Phase 3 (full structure route) | closed: the snap guards any seat's output; no external tool dependency |

questions.md

@@ -65,8 +65,8 @@ Keep this current: when something here is decided, move it to a decision and pru
 11. ~~**Backfill / reprocessing orchestration design**~~ **RESOLVED (D52/D67;
     `orchestration_design.md` §2–§4).** Phase 7 WP-7.1 implements the existing version-filtered
     seeder, separate lane, throttling, resumability, and rollback/replay semantics.
-11a. **OSS governance & release readiness (D60/D61) — DECIDED (D77, 2026-07-23);
-    CLA activation pending.** Conclusions (2026-07-08 comparables + 2026-07-23 owner resolution; full
+11a. **OSS governance & release readiness (D60/D61) — RESOLVED (D77, 2026-07-23);
+    CLA active.** Conclusions (2026-07-08 comparables + 2026-07-23 owner resolution; full
     detail in the cloud repo's split analysis, `04_licensing_naming_findings.md`):
     - **License: stay Apache-2.0** (already shipped). Verified comparables: Sentry FSL-1.1-Apache-2.0
       (tightened only after a decade of dominance), E2B Apache-2.0, Hermes agent (Nous Research) MIT —
@@ -75,8 +75,8 @@ Keep this current: when something here is decided, move it to a decision and pru
       meaningful scale), never a launch choice.
     - **The bounded CLA is specified by D77** rather than a plain DCO. Contributors retain
       ownership; the grant preserves a hosted-service-protective license option only when source
-      remains available and self-hosting remains free. `CLA.md` plus versioned pull-request assent
-      land first; this gate closes when the emitted `CLA` status is required on `main`.
+      remains available and self-hosting remains free. `CLA.md`, immutable versioned pull-request
+      assent, and the required `CLA` status on `main` close this gate.
       `TRADEMARKS.md` separately allows truthful reference, interoperability, unmodified releases,
       and clearly distinguished forks while reserving confusing official-product uses.
     - ~~"Ultimate Memory" is a working title — a rename gates public release~~ **NAME DECIDED
@@ -93,15 +93,15 @@ Keep this current: when something here is decided, move it to a decision and pru
       (lineage-aware ingest; connector management vs execution), delivery-only task execution
       over `processing_state` with the two shells + janitor, the enforced hexagonal layout,
       compose profiles, release/upgrade/portable-restore policy. D76 supplied the exact targets,
-      the mechanical rename is complete, and D77 decides the governance policy pending activation.
+      the mechanical rename and D77 governance activation are complete.
     - ~~Stack-convention slots (roadmap §3).~~ **RESOLVED (2026-07-17;
       `PLAN-RECONCILIATION-WP-0.1-STACK-CONVENTIONS` / WP-0.1)** —
       [PR #39](https://github.com/writeitai/remember-stack/pull/39) merged `uv`/Hatchling,
       Ruff, the single-package `src` layout and naming, and GitHub Actions CI;
       [PR #41](https://github.com/writeitai/remember-stack/pull/41) merged the typed
       pydantic-settings/secret convention and direct-environment-access lint guard. The
-      roadmap now links each choice to the exact repository evidence. The release rename is
-      complete; the D77 `CLA` required-check activation is the remaining governance step.
+      roadmap now links each choice to the exact repository evidence. The release rename and
+      D77 `CLA` required-check activation are complete.
 
 ## 2. Open objections (unresolved critique — see `objections.md`)
 

website/src/app/docs/deployment/page.mdx

@@ -16,9 +16,9 @@ This is a pre-release infrastructure proof. It processes a Markdown upload
 through conversion and deterministic structure, then leaves its chunk work
 pending. Later pipeline workers are not yet wired into this quickstart. The
 release workflow and tag-pinned Compose contract exist and trusted publishing is
-configured. The bounded contributor-agreement workflow still needs activation as
-a required `main` check before the first public tag is created, so no public PyPI
-or GHCR artifact exists yet.
+configured. The bounded contributor agreement is enforced as a required `main`
+check. No public PyPI or GHCR artifact exists yet because the first tag has not
+been created.
 The RememberStack, `rememberstack`, and `remember` names used here are final. Do
 not expose this stack to untrusted traffic.