fix: CLA signatures branch + declutter repo root#409
Conversation
- Change CLA signature storage from protected main branch to dedicated cla-signatures orphan branch (fixes contributor-assistant action failing due to branch protection rules) - Move CLA.md to .github/CLA.md (GitHub community files convention) - Move DESIGN_SPEC.md to docs/DESIGN_SPEC.md (it's a docs pointer) - Move .zizmor.yml to .github/.zizmor.yml (CI config belongs in .github) - Update all references across workflows, CLAUDE.md, README, skills, CONTRIBUTING, licensing docs, and getting_started
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
All contributors have signed the CLA. Thank you! |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (4)
📝 WalkthroughSummary by CodeRabbit
WalkthroughUpdate documentation and CI/workflow path references: move design-spec pointer from root DESIGN_SPEC.md to docs/DESIGN_SPEC.md, relocate CLA to .github/CLA.md and point CLA workflow to the cla-signatures branch, and move .zizmor.yml into .github/.zizmor.yml. Changes are documentation and workflow-path updates only. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
📝 Coding Plan
Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses a critical CLA enforcement issue by reconfiguring how CLA signatures are stored, moving them to a dedicated, unprotected branch. Concurrently, it improves repository organization by relocating several key files ( Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request effectively declutters the repository root by moving several files (CLA.md, DESIGN_SPEC.md, .zizmor.yml) to more appropriate locations within the .github and docs directories. It also correctly updates the CLA signature storage to use a dedicated cla-signatures branch, which resolves the branch protection issue. The changes are well-executed, and all references to the moved files appear to be updated correctly across the codebase. I have a few minor suggestions to improve the consistency and maintainability of the documentation links.
| ## Phase 0: Load Project Context | ||
|
|
||
| **Before doing anything else**, read `DESIGN_SPEC.md` in the project root. This is the authoritative source for the project's architecture, module design, technology choices, and risk register. You need this context loaded to produce accurate project mappings and verdicts in later phases. Read it in parallel with the Phase 1 content acquisition. | ||
| **Before doing anything else**, read `docs/DESIGN_SPEC.md` in the project root. This is the authoritative source for the project's architecture, module design, technology choices, and risk register. You need this context loaded to produce accurate project mappings and verdicts in later phases. Read it in parallel with the Phase 1 content acquisition. |
There was a problem hiding this comment.
The file path for DESIGN_SPEC.md has been updated correctly, but the accompanying text "in the project root" is now inaccurate since the file has been moved to the docs/ directory. To avoid confusion, this phrase should be removed.
| **Before doing anything else**, read `docs/DESIGN_SPEC.md` in the project root. This is the authoritative source for the project's architecture, module design, technology choices, and risk register. You need this context loaded to produce accurate project mappings and verdicts in later phases. Read it in parallel with the Phase 1 content acquisition. | |
| **Before doing anything else**, read `docs/DESIGN_SPEC.md`. This is the authoritative source for the project's architecture, module design, technology choices, and risk register. You need this context loaded to produce accurate project mappings and verdicts in later phases. Read it in parallel with the Phase 1 content acquisition. |
| | Offering SynthOrg as a hosted/managed service | Conditional | Commercial license | | ||
| | Reselling or embedding SynthOrg as your core product | Conditional | Commercial license | | ||
| | Contributing to SynthOrg | Yes | Sign the [CLA](https://github.com/Aureliolo/synthorg/blob/main/CLA.md) | | ||
| | Contributing to SynthOrg | Yes | Sign the [CLA](https://github.com/Aureliolo/synthorg/blob/main/.github/CLA.md) | |
There was a problem hiding this comment.
This link to CLA.md uses an absolute URL that includes the main branch name. This can be brittle if the default branch name ever changes. Using a relative path is more maintainable for links within the repository.
| | Contributing to SynthOrg | Yes | Sign the [CLA](https://github.com/Aureliolo/synthorg/blob/main/.github/CLA.md) | | |
| | Contributing to SynthOrg | Yes | Sign the [CLA](../.github/CLA.md) | |
| ## Contributor License Agreement (CLA) | ||
|
|
||
| We require a [Contributor License Agreement](https://github.com/Aureliolo/synthorg/blob/main/CLA.md) before merging external contributions. The CLA: | ||
| We require a [Contributor License Agreement](https://github.com/Aureliolo/synthorg/blob/main/.github/CLA.md) before merging external contributions. The CLA: |
There was a problem hiding this comment.
This link to the Contributor License Agreement uses an absolute URL that includes the main branch name. This can be brittle if the default branch name ever changes. Using a relative path is more maintainable for links within the repository.
| We require a [Contributor License Agreement](https://github.com/Aureliolo/synthorg/blob/main/.github/CLA.md) before merging external contributions. The CLA: | |
| We require a [Contributor License Agreement](../.github/CLA.md) before merging external contributions. The CLA: |
|
I have read the CLA Document and I hereby sign the CLA |
Greptile SummaryThis PR fixes a CLA enforcement failure caused by branch protection blocking signature commits on
Confidence Score: 4/5
Important Files Changed
Prompt To Fix All With AIThis is a comment left during a code review.
Path: docs/getting_started.md
Line: 127
Comment:
**Redundant entry in directory tree**
`docs/DESIGN_SPEC.md` is now a sub-item of the `docs/` directory already listed at line 122. Showing it at the same indentation level as `docs/` implies it lives at the repo root, which is the opposite of what this PR intends. It should either be removed (since `docs/` already covers it) or indented as a child entry of `docs/`:
```suggestion
docs/
DESIGN_SPEC.md # Pointer to design specification pages
...other docs/... # Developer documentation
```
Or simply remove the `docs/DESIGN_SPEC.md` line and annotate `docs/` with the note directly.
How can I resolve this? If you propose a fix, please make it concise.Last reviewed commit: a571e5b |
There was a problem hiding this comment.
Pull request overview
This PR fixes CLA enforcement by moving signature commits off main to an unprotected cla-signatures branch, and declutters the repository root by relocating community/docs/CI config files and updating references accordingly.
Changes:
- Update CLA GitHub Action to store signatures on
cla-signaturesand point to the relocated.github/CLA.md. - Move root-level docs/config files into conventional locations (
.github/,docs/) and update cross-repo references. - Add
.github/.zizmor.ymland update the zizmor workflow to use the new config path.
Reviewed changes
Copilot reviewed 12 out of 14 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
docs/licensing.md |
Updates CLA links to the new .github/CLA.md location. |
docs/getting_started.md |
Updates repo layout documentation to reflect docs/DESIGN_SPEC.md. |
docs/DESIGN_SPEC.md |
Adds a pointer page listing design/supporting documentation pages. |
README.md |
Updates the DESIGN_SPEC.md pointer link to its new location. |
CLAUDE.md |
Updates design spec link and clarifies CLA signatures live on cla-signatures. |
.github/workflows/zizmor.yml |
Updates workflow triggers and config path to .github/.zizmor.yml. |
.github/workflows/cla.yml |
Switches signature branch to cla-signatures and updates CLA document path/link. |
.github/CONTRIBUTING.md |
Updates CLA link to point to the new in-folder CLA.md. |
.github/CLA.md |
Updates wording to mention signatures are stored on cla-signatures branch. |
.github/.zizmor.yml |
Adds zizmor configuration under .github/. |
.claude/skills/worktree/SKILL.md |
Updates references to the new docs/DESIGN_SPEC.md path. |
.claude/skills/research-link/SKILL.md |
Updates DESIGN_SPEC path reference. |
.claude/skills/pre-pr-review/SKILL.md |
Updates DESIGN_SPEC path reference. |
.claude/skills/aurelio-review-pr/SKILL.md |
Updates DESIGN_SPEC path reference. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ## Phase 0: Load Project Context | ||
|
|
||
| **Before doing anything else**, read `DESIGN_SPEC.md` in the project root. This is the authoritative source for the project's architecture, module design, technology choices, and risk register. You need this context loaded to produce accurate project mappings and verdicts in later phases. Read it in parallel with the Phase 1 content acquisition. | ||
| **Before doing anything else**, read `docs/DESIGN_SPEC.md` in the project root. This is the authoritative source for the project's architecture, module design, technology choices, and risk register. You need this context loaded to produce accurate project mappings and verdicts in later phases. Read it in parallel with the Phase 1 content acquisition. |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.claude/skills/aurelio-review-pr/SKILL.md:
- Line 207: The instruction currently tells reviewers to read
`docs/DESIGN_SPEC.md`, `CLAUDE.md`, and `README.md` only; update the SKILL.md
text to also require reading the `docs/design/` folder (all pages) as part of
the docs-consistency check so reviewers don't miss required architecture, data
model, or behavior sections. Replace the phrase that treats
`docs/DESIGN_SPEC.md` as the full source of truth with wording that explicitly
lists `docs/design/` (or "all pages under docs/design/") alongside
`docs/DESIGN_SPEC.md`, `CLAUDE.md`, and `README.md`, and add a short reminder to
consult the relevant `docs/design/*` page before implementing features or
planning issues. Ensure the change is applied to the same sentence in SKILL.md
that currently references `docs/DESIGN_SPEC.md` so the scope is broadened to
include the design pages.
In @.claude/skills/pre-pr-review/SKILL.md:
- Line 309: The guidance in SKILL.md incorrectly treats docs/DESIGN_SPEC.md as
the single source of truth; update the text that references
"docs/DESIGN_SPEC.md" so it explicitly points to and requires reading the actual
design files under docs/design/*.md (or list the specific design pages), and
change the wording to: "Always read the relevant docs/design/*.md page(s) before
implementing or planning." Modify the string "docs/DESIGN_SPEC.md" in
.claude/skills/pre-pr-review/SKILL.md and make the requirement about the design
spec mandatory (e.g., "MANDATORY: read relevant docs/design/*.md") so reviewers
and contributors are directed to the real spec files.
In @.claude/skills/research-link/SKILL.md:
- Line 27: The instruction line that begins "Before doing anything else"
currently points to a single DESIGN_SPEC file; update that sentence in SKILL.md
so it mandates reading the relevant docs/design/ pages first (e.g., "Read the
docs/design/ page for the relevant feature/area before doing anything else") and
remove or de-emphasize the single DESIGN_SPEC file as authoritative, ensuring
the text says the docs/design page is MANDATORY and must be read in parallel
with Phase 1 content acquisition.
In @.claude/skills/worktree/SKILL.md:
- Line 187: The prompt step currently points to docs/DESIGN_SPEC.md; change it
to reference the canonical per-feature design pages under docs/design/ (e.g.,
replace the line "Read `docs/DESIGN_SPEC.md` sections: <list relevant §sections
from issue bodies>" with "Read the relevant design pages in
`docs/design/<feature>.md`" and ensure the instruction explicitly directs
readers to include the specific design page(s) named in the issue), updating
SKILL.md's step text so implementers always open the correct docs/design/*.md
file(s) before implementing or planning; locate and edit the exact step string
in .claude/skills/worktree/SKILL.md to perform this replacement.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9ab9bbff-cca4-4c8b-a860-94641e1b5217
📒 Files selected for processing (14)
.claude/skills/aurelio-review-pr/SKILL.md.claude/skills/pre-pr-review/SKILL.md.claude/skills/research-link/SKILL.md.claude/skills/worktree/SKILL.md.github/.zizmor.yml.github/CLA.md.github/CONTRIBUTING.md.github/workflows/cla.yml.github/workflows/zizmor.ymlCLAUDE.mdREADME.mddocs/DESIGN_SPEC.mddocs/getting_started.mddocs/licensing.md
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Agent
- GitHub Check: Greptile Review
- GitHub Check: Analyze (python)
🧰 Additional context used
📓 Path-based instructions (1)
docs/**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Docs source: Markdown in docs/, built with Zensical. Design spec: docs/design/ (7 pages: index, agents, organization, communication, engine, memory, operations).
Files:
docs/licensing.mddocs/getting_started.md
🧠 Learnings (10)
📚 Learning: 2026-03-14T18:03:28.533Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T18:03:28.533Z
Learning: Applies to docs/**/*.md : Docs source: Markdown in docs/, built with Zensical. Design spec: docs/design/ (7 pages: index, agents, organization, communication, engine, memory, operations).
Applied to files:
.claude/skills/research-link/SKILL.md.claude/skills/worktree/SKILL.md.claude/skills/pre-pr-review/SKILL.mddocs/getting_started.mdCLAUDE.md.claude/skills/aurelio-review-pr/SKILL.mdREADME.md
📚 Learning: 2026-03-14T18:03:28.533Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T18:03:28.533Z
Learning: Always read the relevant docs/design/ page before implementing any feature or planning any issue. The design spec is the starting point for architecture, data models, and behavior.
Applied to files:
.claude/skills/research-link/SKILL.md.claude/skills/worktree/SKILL.md.claude/skills/pre-pr-review/SKILL.mddocs/getting_started.mdCLAUDE.md.claude/skills/aurelio-review-pr/SKILL.mdREADME.md
📚 Learning: 2026-03-14T18:03:28.533Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T18:03:28.533Z
Learning: Design specification is MANDATORY: ALWAYS read the relevant docs/design/ page before implementing any feature or planning any issue.
Applied to files:
.claude/skills/research-link/SKILL.md.claude/skills/worktree/SKILL.md.claude/skills/pre-pr-review/SKILL.mddocs/getting_started.mdCLAUDE.md.claude/skills/aurelio-review-pr/SKILL.mdREADME.md
📚 Learning: 2026-03-14T18:03:28.533Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T18:03:28.533Z
Learning: For trivial/docs-only changes: /pre-pr-review quick skips agents but still runs automated checks.
Applied to files:
.claude/skills/pre-pr-review/SKILL.md
📚 Learning: 2026-03-14T18:03:28.533Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T18:03:28.533Z
Learning: When approved deviations occur, update the relevant docs/design/ page to reflect the new reality.
Applied to files:
.claude/skills/pre-pr-review/SKILL.md
📚 Learning: 2026-03-14T18:03:28.533Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T18:03:28.533Z
Learning: Applies to web/src/components/**/*.vue : Vue 3 components in the web dashboard: organized by feature (agents/, approvals/, budget/, common/, dashboard/, layout/, messages/, org-chart/, tasks/).
Applied to files:
docs/getting_started.md
📚 Learning: 2026-03-14T18:03:28.533Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T18:03:28.533Z
Learning: Applies to web/package.json : Web dashboard: Node.js 20+, dependencies in web/package.json (Vue 3, PrimeVue, Tailwind CSS, Pinia, VueFlow, ECharts, Axios, vue-draggable-plus, Vitest, ESLint, vue-tsc).
Applied to files:
docs/getting_started.md
📚 Learning: 2026-03-14T18:03:28.533Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T18:03:28.533Z
Learning: If implementation deviates from the design spec (better approach found, scope evolved, etc.), alert the user and explain why — user decides whether to proceed or update the spec. Do not silently diverge.
Applied to files:
CLAUDE.md
📚 Learning: 2026-03-14T18:03:28.533Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T18:03:28.533Z
Learning: Pre-commit hooks: trailing-whitespace, end-of-file-fixer, check-yaml, check-toml, check-json, check-merge-conflict, check-added-large-files, no-commit-to-branch (main), ruff check+format, gitleaks, hadolint (Dockerfile linting).
Applied to files:
CLAUDE.md
📚 Learning: 2026-03-14T18:03:28.533Z
Learnt from: CR
Repo: Aureliolo/synthorg PR: 0
File: CLAUDE.md:0-0
Timestamp: 2026-03-14T18:03:28.533Z
Learning: Signed commits: required on main via branch protection — all commits must be GPG/SSH signed.
Applied to files:
.github/workflows/cla.yml
🪛 LanguageTool
CLAUDE.md
[uncategorized] ~265-~265: The official name of this software platform is spelled with a capital “H”.
Context: ... Skips Dependabot. Signatures stored in .github/cla-signatures.json on the `cla-signat...
(GITHUB)
🔇 Additional comments (9)
docs/getting_started.md (1)
127-127: Path update is accurate and clearly labeled as a pointer.Good clarification that
docs/DESIGN_SPEC.mdpoints to the design pages rather than replacing them..github/CONTRIBUTING.md (1)
149-149: Relative CLA link fix is correct.
CLA.mdresolves correctly from.github/CONTRIBUTING.mdafter the file move..github/CLA.md (1)
103-103: CLA signature storage note is aligned with the workflow change.The branch/location wording is clear and consistent with the PR intent.
docs/licensing.md (1)
14-14: CLA links are consistently updated.Both references now point to the relocated CLA document path.
Also applies to: 114-114
.github/workflows/zizmor.yml (1)
9-9: Workflow path migration is correctly wired.Both
on.pathsfilters and the actionconfiginput now target the new.github/.zizmor.ymllocation.Also applies to: 15-15, 36-36
README.md (1)
150-150: Contributor onboarding note and paths look correct.The updated links align with the moved design pointer location and keep the design-first instruction clear.
.github/workflows/cla.yml (1)
32-35: CLA workflow branch/document updates are coherent.Using
.github/CLA.mdpluscla-signaturesaligns with the new file layout and avoids writing signatures to protectedmain.CLAUDE.md (2)
9-13: Design-spec guidance update is clear and correctly scoped.The pointer link and mandatory
docs/design/instruction are consistent with the docs move and expected implementation flow.
265-265: CLA CI documentation matches workflow behavior.The note about storing signatures on
cla-signaturesis consistent with the workflow change and improves contributor guidance accuracy.
DESIGN_SPEC.md is just a pointer/index file. The actual design spec lives in docs/design/*.md pages. Update all 4 skill files to direct readers to the relevant design pages as the authoritative source.
| .github/ # CI workflows, dependabot, actions | ||
| pyproject.toml # Project config (deps, tools, linters) | ||
| DESIGN_SPEC.md # Pointer to design specification pages | ||
| docs/DESIGN_SPEC.md # Pointer to design specification pages |
There was a problem hiding this comment.
Redundant entry in directory tree
docs/DESIGN_SPEC.md is now a sub-item of the docs/ directory already listed at line 122. Showing it at the same indentation level as docs/ implies it lives at the repo root, which is the opposite of what this PR intends. It should either be removed (since docs/ already covers it) or indented as a child entry of docs/:
| docs/DESIGN_SPEC.md # Pointer to design specification pages | |
| docs/ | |
| DESIGN_SPEC.md # Pointer to design specification pages | |
| ...other docs/... # Developer documentation |
Or simply remove the docs/DESIGN_SPEC.md line and annotate docs/ with the note directly.
Prompt To Fix With AI
This is a comment left during a code review.
Path: docs/getting_started.md
Line: 127
Comment:
**Redundant entry in directory tree**
`docs/DESIGN_SPEC.md` is now a sub-item of the `docs/` directory already listed at line 122. Showing it at the same indentation level as `docs/` implies it lives at the repo root, which is the opposite of what this PR intends. It should either be removed (since `docs/` already covers it) or indented as a child entry of `docs/`:
```suggestion
docs/
DESIGN_SPEC.md # Pointer to design specification pages
...other docs/... # Developer documentation
```
Or simply remove the `docs/DESIGN_SPEC.md` line and annotate `docs/` with the note directly.
How can I resolve this? If you propose a fix, please make it concise.🤖 I have created a release *beep* *boop* --- ## [0.2.0](v0.1.4...v0.2.0) (2026-03-15) ##First probably usable release? Most likely not no and everything will break ### Features * add /get/ installation page for CLI installer ([#413](#413)) ([6a47e4a](6a47e4a)) * add cross-platform Go CLI for container lifecycle management ([#401](#401)) ([0353d9e](0353d9e)), closes [#392](#392) * add explicit ScanOutcome signal to OutputScanResult ([#394](#394)) ([be33414](be33414)), closes [#284](#284) * add meeting scheduler, event-triggered meetings, and Go CLI lint fixes ([#407](#407)) ([5550fa1](5550fa1)) * wire MultiAgentCoordinator into runtime ([#396](#396)) ([7a9e516](7a9e516)) ### Bug Fixes * CLA signatures branch + declutter repo root ([#409](#409)) ([cabe953](cabe953)) * correct Release Please branch name in release workflow ([#410](#410)) ([515d816](515d816)) * replace slsa-github-generator with attest-build-provenance, fix DAST ([#424](#424)) ([eeaadff](eeaadff)) * resolve CodeQL path-injection alerts in Go CLI ([#412](#412)) ([f41bf16](f41bf16)) ### Refactoring * rename package from ai_company to synthorg ([#422](#422)) ([df27c6e](df27c6e)), closes [#398](#398) ### Tests * add fuzz and property-based testing across all layers ([#421](#421)) ([115a742](115a742)) ### CI/CD * add SLSA L3 provenance for CLI binaries and container images ([#423](#423)) ([d3dc75d](d3dc75d)) * bump the major group with 4 updates ([#405](#405)) ([20c7a04](20c7a04)) ### Maintenance * bump github.com/spf13/cobra from 1.9.1 to 1.10.2 in /cli in the minor-and-patch group ([#402](#402)) ([e31edbb](e31edbb)) * narrow BSL Additional Use Grant and add CLA ([#408](#408)) ([5ab15bd](5ab15bd)), closes [#406](#406) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Summary
Follow-up to #408. Fixes CLA enforcement failure (branch protection blocked signature commits) and moves 3 files out of the repo root.
branch: main→branch: cla-signatures(unprotected orphan branch, auto-created in this PR)CLA.md→.github/CLA.md(GitHub community files convention)DESIGN_SPEC.md→docs/DESIGN_SPEC.md(it's a docs pointer file).zizmor.yml→.github/.zizmor.yml(CI config belongs in .github)Test plan
cla-signaturesorphan branch created and pushed to remoteReview coverage
Pre-reviewed by 2 agents (docs-consistency, infra-reviewer). 1 finding addressed (create orphan branch before merge).