Apache-2.0, DCO sign-off, project trademark retained

Context

An infrastructure security tool needs a license enterprises can adopt without legal review friction, an express patent grant, and a contribution-provenance mechanism that doesn't gate drive-by contributors behind paperwork. Name control matters independently of code freedom: forks should be free to exist, not free to impersonate.

Decision

• The entire repository is Apache-2.0. Built artifacts that bundle third-party packages, the console's code and fonts, carry those packages under their own licenses, with the license texts beside them. (Amended 2026-10-06; see Amendments.)
• Contributions require DCO sign-off (Signed-off-by, enforced in CI) on every commit a contributor authors. A merge commit that lands a pull request is exempt and CI checks the pull request's own commits, each of which carries its sign-off. No CLA. (Amended 2026-10-06; see Amendments.)
• The Innerwall name and marks are retained by the project; the trademark is not licensed by the code license. Forks take the code, not the name.

Consequences

• Enterprise adoption and dependency-inclusion friction is minimized; the patent grant is explicit.
• Provenance is a property of every authored commit, with near-zero contributor friction. A conflict resolution made in a merge commit is reviewed in its pull request but not signed off; that is the accepted cost of the exemption. (Amended 2026-10-06; see Amendments.)
• Relicensing later would require chasing every contributor — the license choice is effectively permanent; accepted knowingly.

Amendments