# Aegis Latent Core — Contributor License Agreement **Document status:** Maintainer draft for legal review and publication **Project:** Aegis Latent Core **Current public release:** `5.0.2` **Outbound project licence:** Aegis Commercial License 1.0 (`LicenseRef-Aegis-Commercial-1.0`) from v5.0.3; the SDKs remain Apache-2.0 **Effective scope:** Contributions intentionally submitted after this Agreement is published, unless a separate written agreement expressly provides otherwise. > **Important notice.** This document is a contribution-rights instrument, not legal advice. It is designed to make inbound contribution rights explicit while preserving contributor ownership and allowing the Maintainer to license each release under its current outbound terms. A contributor acting for an employer, customer, university, government body, or other legal entity must obtain the necessary authorization before accepting this Agreement. If local law, an employment agreement, an institutional policy, or a separate signed agreement conflicts with this text, obtain advice from qualified counsel before submitting a Contribution. --- ## 1. Purpose and outbound licence Aegis Latent Core is distributed under the Aegis Commercial License 1.0 from v5.0.3; release 5.0.2 and earlier keep the terms they were published under, including Apache-2.0 for 5.0.2. The Project is an AI governance and evidence gateway; it is not a hosted service, certification, legal-admissibility determination, universal security boundary, or guarantee that an upstream model response is true. This Contributor License Agreement (the **“Agreement”** or **“CLA”**) records the rights that a contributor grants for work intentionally submitted to the Project. It is intended to: 1. preserve a clear provenance record for source code, documentation, tests, configuration, infrastructure, benchmarks, security research, and other Project materials; 2. permit the Maintainer and the community to reproduce, review, modify, combine, distribute, and maintain accepted Contributions; 3. permit the Maintainer to continue publishing the Project under Apache-2.0 and, where legally appropriate, to publish future versions or separate distributions under other terms without claiming ownership of a contributor’s copyright; 4. grant the patent rights described in Section 7 to the extent permitted by the applicable patent law and the contributor’s rights; 5. avoid implying that the Maintainer accepts every submission, owes compensation, or provides support for a Contribution; and 6. distinguish contributor authorization from the Project’s release, security, compliance, procurement, and deployment claims. This Agreement does **not** change the Apache-2.0 licence that applies to the published `5.0.2` source and distributions. It does not retroactively change the terms of any earlier release. It does not create a second commercial licence tier, an entitlement to payment, a promise of acceptance, or a promise that any Contribution will be merged. --- ## 2. Parties ### 2.1 “Maintainer” **“Maintainer”** means Juan Luna, the current maintainer and copyright holder identified by the repository, together with any successor maintainer or legal entity to which the Project and the rights granted under this Agreement are lawfully transferred. Current contact for contribution and licensing questions: - **Name:** Juan Luna - **Email:** `juan.c.luna04@gmail.com` - **Project repository:** `https://github.com/JuanLunaIA/aegis-latent-core` The contact details above are administrative contact information. They are not a warranty about jurisdiction, residency, tax status, corporate structure, trademark registration, or the absence of other rights holders. ### 2.2 “Contributor” **“Contributor,” “You,”** or **“Your”** means the individual accepting this Agreement, or the legal entity on whose behalf that individual is authorized to act. If You contribute on behalf of a legal entity, references to “You” include that entity for the rights, representations, warranties, and obligations applicable to it, and You represent that You have authority to bind it. ### 2.3 Individual and corporate acceptance An individual may accept this Agreement for the individual’s own Contribution. A legal entity may accept it through an authorized representative. A person who is not authorized to bind an entity must not accept this Agreement on that entity’s behalf. The Maintainer may request additional evidence of authority, including an entity name, title, corporate email, signed counterpart, or separate corporate CLA. The request may be made before acceptance, before a Contribution is merged, or when a material ambiguity is discovered. --- ## 3. Definitions For this Agreement: ### 3.1 “Contribution” **“Contribution”** means any original work of authorship or other protectable material that You intentionally submit to the Maintainer or the Project for possible inclusion in, integration with, documentation of, testing of, or improvement of the Project. Examples include: - source code, object code, scripts, patches, pull requests, commits, and generated build files; - documentation, diagrams, specifications, examples, tutorials, API descriptions, and translations; - tests, fixtures, fuzzing cases, security reproductions, threat-model inputs, and verification harnesses; - configuration, deployment manifests, infrastructure-as-code, container definitions, Helm charts, workflows, and release tooling; - benchmark code, benchmark data, measurement scripts, performance reports, and reproducibility metadata; - cryptographic, privacy, authorization, redaction, ledger, storage, or observability implementations; - assets, schemas, samples, fixtures, icons, fonts, media, and other files submitted for Project use; and - corrections, modifications, adaptations, or other material that You submit to the Project. A Contribution does not include material that You merely observe, quote for criticism, report as a vulnerability, or identify as excluded under Section 4, unless You intentionally submit that material for inclusion or integration. ### 3.2 “Submit” and “Submission” **“Submit”** or **“Submission”** means intentionally sending, committing, attaching, posting, or otherwise making a Contribution available to the Maintainer or the Project for possible use. A Submission may occur through a pull request, commit, issue attachment, patch, code review, security report, mailing list, discussion, chat, design review, or another channel controlled or authorized by the Maintainer. A Submission is not a Contribution if it is conspicuously marked **“Not a Contribution”** before or at the time it is sent, provided that the marking is reasonably visible and the material is not subsequently submitted without that designation. A maintainer may decline to use marked material. Merely writing “not a contribution” does not remove rights that You do not own or grant permission to use. ### 3.3 “Project” **“Project”** means Aegis Latent Core and its maintained components, including source repositories, SDKs, tools, documentation, tests, deployment materials, release artifacts, and successor versions or distributions identified by the Maintainer as part of the Project. The Project definition does not silently acquire unrelated projects, customer systems, private deployments, third-party dependencies, or a contributor’s independent work merely because the work is technically compatible with Aegis Latent Core. ### 3.4 “Accepted Contribution” **“Accepted Contribution”** means a Contribution that the Maintainer has deliberately incorporated into a Project revision, release artifact, documentation set, or other Project distribution. A pull request being opened, reviewed, tested, or discussed does not mean that the Contribution has been accepted. ### 3.5 “Necessary Patent Claims” **“Necessary Patent Claims”** means patent claims, including process and apparatus claims, that You own or control, or are authorized to license, and that are necessarily infringed by Your Contribution alone or by the combination of Your Contribution with the Project to which that Contribution was submitted. A claim is not a Necessary Patent Claim if the Contribution or the combination is optional, can be avoided by a reasonably available alternative implementation, or is not required to practice the relevant Contribution or combination. This definition follows the narrow contribution-linked scope of the Apache-2.0 patent grant. It is not a licence to every patent You own, control, or may later acquire. ### 3.6 “Applicable Law” **“Applicable Law”** means the laws, regulations, binding orders, court rules, and enforceable professional or institutional requirements that apply to You, the Maintainer, the Submission, or the relevant rights. --- ## 4. Contributions excluded from automatic acceptance The following are excluded from the automatic contribution licence unless You clearly identify them and separately provide the rights needed for the Project to use them: 1. confidential information, trade secrets, credentials, private keys, personal data, customer data, regulated data, or information subject to a non-disclosure obligation; 2. material owned by an employer, customer, client, university, government body, contracting party, or another third party where You lack authority to grant the rights in this Agreement; 3. third-party code, copied text, datasets, model weights, media, fonts, icons, trademarks, patents, or other material that You do not own or cannot sublicense under compatible terms; 4. security vulnerability details submitted through a private reporting channel when the purpose is coordinated remediation rather than inclusion in the Project; 5. material conspicuously marked “Not a Contribution” under Section 3.2; 6. personal information that is not necessary for contribution attribution, licensing records, or legal compliance; and 7. ideas, suggestions, issue reports, feature requests, and general feedback, except to the extent they contain copyrightable material intentionally submitted for Project inclusion. The Maintainer may ask You to remove excluded material, provide a licence notice, redact sensitive data, or submit a separate permission before using any part of it. A Maintainer’s review, copying for internal triage, or temporary storage does not constitute public distribution or acceptance of excluded material. --- ## 5. Copyright licence grant Subject to this Agreement, You grant to the Maintainer and to recipients of an Accepted Contribution a perpetual, worldwide, non-exclusive, royalty-free, fully paid-up, irrevocable copyright licence to reproduce, prepare derivative works of, publicly display, publicly perform, distribute, sublicense, and otherwise use the Contribution, in source or object form, alone or as part of the Project, in any medium or format now known or later developed. This grant includes the right to: 1. copy, store, index, mirror, cache, and archive the Contribution; 2. review, test, benchmark, fuzz, scan, lint, format, refactor, translate, document, and otherwise process the Contribution; 3. modify the Contribution, combine it with other code or materials, and create collective or derivative works; 4. publish the Contribution in source and compiled, packaged, containerized, embedded, cloud, air-gapped, or other distribution formats; 5. include the Contribution in releases, security updates, long-term support branches, forks maintained by the Project, SDKs, examples, documentation, and generated artifacts; 6. sublicense the Contribution as part of the Project under Apache-2.0 or other terms selected for a future version, distribution, or separate Project component, subject to Applicable Law and the rights of other contributors; and 7. permit downstream recipients and authorized distributors to exercise the rights necessary to use, modify, reproduce, and distribute the Accepted Contribution as part of the Project. The licence is granted without accounting, royalty, profit-sharing, approval, or additional-consent obligations. The Maintainer may choose not to exercise any granted right. ### 5.1 No assignment of ownership This Agreement is a licence grant, not an assignment. Except for the rights granted here, You retain Your ownership of the copyright and other rights You hold in Your Contribution. You may use, license, publish, or submit the Contribution elsewhere, subject to any third-party rights, confidentiality duties, employment obligations, patent commitments, and other Applicable Law. ### 5.2 No promise of relicensing The Maintainer may, but is not required to, publish future versions or distributions under Apache-2.0, another open-source licence, a commercial licence, or another lawful set of terms. The grant in this Agreement does not promise that the Maintainer will relicense the Project, offer proprietary licensing, sell services, accept a Contribution, or provide any particular release. A future licence decision cannot retroactively change the terms of a copy already received by a recipient under Apache-2.0 or another applicable outbound licence. This Agreement does not revoke rights already granted by the Project to downstream recipients. ### 5.3 Attribution and notices The Maintainer may preserve Your name, copyright notice, attribution, and contribution metadata where appropriate. The Maintainer may also consolidate, shorten, anonymize, or omit attribution in generated artifacts, changelogs, security reports, package metadata, or other contexts where doing so is technically necessary, legally permitted, or consistent with Project practice. You must not require the Project to display Your name, logo, employer name, biography, endorsement, or other personal or organizational information except where the requirement is expressly agreed in a separate written instrument. --- ## 6. Patent licence grant To the extent You have the legal authority to grant it, You grant to the Maintainer and to each recipient of the Project a perpetual, worldwide, non-exclusive, royalty-free, fully paid-up, irrevocable patent licence to make, have made, use, offer to sell, sell, import, and otherwise transfer the Project, but only for Necessary Patent Claims. This patent grant applies to Your Contribution and the combination of Your Contribution with the Project to which the Contribution was submitted. It does not grant: - a licence to patent claims unrelated to the Contribution; - a licence to implementations that do not practice the Contribution or the relevant combination; - a licence to claims You do not own, control, or have authority to license; - a promise that the Project is non-infringing or patent-free; or - an indemnity against patent claims, litigation, damages, or legal costs. ### 6.1 Patent litigation termination If You initiate patent litigation against the Maintainer or any recipient of the Project alleging that the Contribution, the Project, or the combination of the Contribution with the Project infringes a patent, then the patent licences granted by You under this Agreement to the party sued terminate as of the date the litigation is filed. This termination does not apply to a defensive counterclaim made in response to a patent claim first brought against You, except to the extent Applicable Law permits the termination to apply. For this Section, “patent litigation” includes a lawsuit or other formal judicial proceeding alleging patent infringement. It does not include a good-faith request for information, a non-public notice, participation in a patent pool, a declaratory statement that does not seek an infringement judgment, or a defensive position where You did not initiate the patent dispute. ### 6.2 Patent disclosures If You know of a patent, patent application, or other intellectual-property claim that may be directly relevant to Your Contribution, You should disclose it to the Maintainer promptly, subject to confidentiality and Applicable Law. Disclosure is not an admission of infringement, validity, ownership, or enforceability. --- ## 7. Contributor representations and warranties By accepting this Agreement and intentionally submitting a Contribution, You represent and warrant, to the extent of Your actual knowledge and authority, that: 1. **Authority.** You have the legal capacity and authority to accept this Agreement and grant the rights stated here. 2. **Ownership or permission.** You own the rights necessary to make the Submission, or You have obtained sufficient written permission, licence, assignment, employment authorization, institutional authorization, or other legal basis to submit it under this Agreement. 3. **Employer review.** If an employer, customer, university, government body, or other organization may own or control any part of the Contribution, You have completed the review and obtained the authorization required to grant these rights. 4. **Third-party materials.** You have identified material that is not Yours, including copied code, generated assets, datasets, model outputs, documentation excerpts, fonts, images, trademarks, and dependencies, and You have supplied the applicable licence, attribution, source, notice, or restriction information. 5. **No intentional infringement.** To the best of Your knowledge, the Contribution does not intentionally infringe, misappropriate, or violate a third party’s copyright, patent, trademark, trade-secret, privacy, publicity, moral, contractual, or other rights. 6. **No unlawful or malicious payload.** You are not intentionally submitting malware, credentials, destructive payloads, unlawful content, or material designed to compromise the Project or its users. Security research and proof-of-concept material must follow the responsible-disclosure process and must not include live secrets or unnecessary exploit capability. 7. **No undisclosed restriction.** You have not attached a condition, grant-back, field-of-use restriction, attribution demand, patent promise, confidentiality term, or other restriction that conflicts with this Agreement or the intended Apache-2.0 distribution, unless You have disclosed it in writing and the Maintainer has accepted it in writing. 8. **No conflicting obligation.** You are not knowingly bound by an agreement that prevents the rights granted here, and You have not promised the same rights exclusively to another party in a way that conflicts with this Agreement. 9. **Accuracy of metadata.** The author, copyright, licence, provenance, dependency, and security information You provide is accurate to the best of Your knowledge and is not deliberately misleading. 10. **No endorsement.** You are not submitting the Contribution in a way that falsely implies Project endorsement by You, Your employer, a customer, a government body, a regulator, a standards organization, or another third party. The representations in this Section are limited by the words **“to the extent of Your actual knowledge and authority.”** The Maintainer does not require a contributor to guarantee facts that the contributor could not reasonably know. This limitation does not excuse deliberate concealment, fraud, knowingly false statements, or submission without required authority. --- ## 8. Employer, institution, and government contributions Before submitting a Contribution created in the course of employment, under a grant, for a customer, at a university, or under a government contract, You must determine who owns or controls the relevant rights. The Maintainer may require a corporate or institutional acceptance. If an employer or other entity owns the Contribution, the authorized entity must accept this Agreement or provide a separate written agreement that grants rights at least sufficient for the Project’s intended use. An individual’s acceptance alone does not transfer or waive an entity’s rights. If a Contribution is subject to government rights, public-sector procurement rules, export controls, security restrictions, or contract-specific data-use terms, disclose those restrictions before submission. The Maintainer may reject or request replacement of the Contribution if those restrictions are incompatible with Project distribution. The Maintainer is not responsible for determining whether an individual’s employment, grant, procurement, or institutional terms permit contribution. That determination belongs to the contributor and the relevant rights holder. --- ## 9. Third-party code, dependencies, data, and generated material ### 9.1 Third-party code and assets Do not copy third-party material into the Project without identifying its origin and licence. A dependency declaration is not, by itself, permission to copy source code or redistribute non-code assets. For each material third-party component, provide enough information for the Maintainer to record: - name, version, source URL, and relevant commit or release; - copyright and attribution notices; - applicable SPDX identifier or licence text; - whether the component is distributed, dynamically linked, statically linked, generated, optional, test-only, or build-only; - patent, trademark, attribution, network-use, data, or notice obligations; and - any incompatibility or review question that could affect Apache-2.0 distribution. ### 9.2 Data and personal information Do not submit personal data, credentials, private keys, customer data, regulated records, production logs, or confidential prompts unless the Maintainer has expressly authorized the channel and the use. Prefer synthetic, minimized, redacted, or locally generated fixtures. A Contribution containing personal information may be retained in public history, package archives, issue exports, mirrors, backups, and derived artifacts. Removing it later may be impossible. You are responsible for ensuring that the data use is authorized and lawful. ### 9.3 AI-assisted or machine-generated material You may use AI-assisted tools when permitted by Your employer, customer, institution, and Applicable Law, but You remain responsible for the Submission. Before submitting AI-assisted material, You must: 1. review the output for correctness, security, licensing, privacy, provenance, and unwanted inclusion of third-party material; 2. remove secrets, personal data, confidential information, and unrequested instructions from the output; 3. verify that You have the right to submit the material under this Agreement; 4. identify material provenance or tool involvement when reasonably necessary for review; and 5. avoid representing unreviewed machine output as tested, secure, novel, original, measured, certified, or human-authored. The use of an AI tool does not automatically transfer ownership to the Maintainer, establish copyrightability, eliminate third-party rights, or prove that You have authority to submit the output. The Maintainer may request a human-authored replacement, additional provenance information, or a legal review. ### 9.4 Security research and exploit material Security reports should use the private vulnerability-reporting path where public disclosure would create avoidable risk. A report, reproduction, or exploit is not automatically an Accepted Contribution. Do not include live credentials, destructive automation, customer data, or weaponized material beyond what is reasonably necessary to reproduce and remediate the issue. --- ## 10. Submission procedure and acceptance record ### 10.1 Preferred record The preferred contribution record contains: - a pull request or patch linked to the relevant issue or security report; - a clear description of the change and its intended effect; - test, benchmark, security, or reproducibility evidence appropriate to the change; - third-party and generated-material disclosures; - a DCO `Signed-off-by` line on every commit; and - an explicit CLA acceptance record as described below. ### 10.2 CLA acceptance You accept this Agreement by completing one of the following methods accepted by the repository’s configured automation or by the Maintainer: **Method A — configured CLA service.** Follow the authenticated signing flow presented by the repository’s configured CLA service. The service may record the GitHub account, contributor identity, timestamp, repository, pull request, Agreement revision, and acceptance status. **Method B — explicit pull-request statement.** Post the following statement in the pull request, using an account that identifies You and that You are authorized to use for the Contribution: ```text I have read and agree to the Aegis Latent Core Contributor License Agreement, version 5.0.2, and I am authorized to grant the rights it describes for my Contribution. ``` **Method C — signed written counterpart.** Sign a copy of this Agreement electronically or in writing and send it to the Maintainer at `juan.c.luna04@gmail.com` or another address designated by the Maintainer. A DCO sign-off alone is not necessarily acceptance of this CLA. A CLA acceptance alone does not replace the DCO sign-off required by `CONTRIBUTING.md`. The Maintainer may require both. ### 10.3 Acceptance evidence The Maintainer may retain an acceptance record indefinitely for provenance, audit, release, attribution, legal, and operational purposes. The record may include the contributor’s name, public account identifier, email address used for signing, timestamp, Agreement version, repository, pull request, commit identifiers, and entity authorization. The Maintainer may publish or redistribute contribution attribution and acceptance information where consistent with Project practice, Applicable Law, the Apache-2.0 licence, or a legal obligation. Do not use a personal email address in a public commit if You do not want it exposed; use an address permitted by the contribution platform and Your policies. ### 10.4 Agreement revisions This Agreement may be revised for future Contributions. Unless a revision expressly states otherwise and is legally effective, a revision does not change the rights granted for Contributions already accepted under an earlier version. A material revision may require a new acceptance for future Contributions. The applicable version is the version that You accepted or, if acceptance occurred by a repository workflow, the version identified by that workflow at the time of acceptance. If no version can be established, the Maintainer may ask You to re-accept the current version before merging additional work. --- ## 11. Review, acceptance, and no obligation The Maintainer may review, modify, reject, close, revert, remove, or replace any Submission for any lawful reason, including technical quality, security, maintenance cost, compatibility, provenance uncertainty, licence incompatibility, privacy risk, project direction, or inability to verify rights. Nothing in this Agreement: - requires the Maintainer to accept, merge, release, publish, support, or maintain a Contribution; - gives You a right to participate in governance, roadmap decisions, security response, or release management; - creates an employment, agency, partnership, joint venture, fiduciary, franchise, or procurement relationship; - requires the Maintainer to provide notice, accounting, compensation, royalty, equity, reimbursement, support, warranty, or attribution beyond the rights stated here; or - prevents the Maintainer from independently developing similar or competing work without using Your confidential information. A code review, test run, public discussion, or temporary branch does not create a promise of incorporation or distribution. --- ## 12. Confidentiality, privacy, and public history This Agreement does not require You to disclose confidential information. You must not submit confidential information unless a separate written agreement authorizes the submission and the Maintainer has approved the channel and intended use. Public contributions may be copied into Git history, release archives, package indexes, mirrors, caches, security databases, documentation, generated context manifests, and backups. The Maintainer may be unable to remove all copies after publication. You should submit only information that You are authorized to make public. The Maintainer will handle personal information according to the applicable repository and platform practices, Applicable Law, and the practical limitations of public version control. This Agreement is not a privacy policy, data-processing agreement, retention schedule, or promise of deletion. --- ## 13. Disclaimer of warranties Except for a representation expressly made in Section 7 and except to the extent Applicable Law does not permit exclusion, Your Contribution is provided **“AS IS,” WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND**, express or implied, including warranties or conditions of title, non-infringement, merchantability, fitness for a particular purpose, accuracy, availability, security, performance, or quiet enjoyment. The Maintainer does not promise that a Contribution: - is correct, complete, safe, secure, performant, deterministic, or ready for a production deployment; - satisfies a regulatory, contractual, procurement, certification, or audit requirement; - is free of vulnerabilities, defects, malicious code, patent claims, or third-party restrictions; - is suitable for medical, legal, financial, safety-critical, military, or other high-impact use; or - will remain in the Project, be supported, or be distributed under any particular version. The Project’s claim matrix, release records, security policy, benchmark records, and deployment documentation define their own boundaries. This Agreement does not expand those claims. --- ## 14. Limitation of liability To the maximum extent permitted by Applicable Law, neither the Maintainer nor You will be liable to the other for indirect, incidental, special, exemplary, consequential, or punitive damages, or for loss of profits, revenue, business opportunity, goodwill, data, or use arising from this Agreement or a Contribution, even if advised of the possibility of those damages. Nothing in this Agreement excludes or limits liability that cannot lawfully be excluded or limited, including liability for fraud, intentional misconduct, or other liability protected by Applicable Law. This section is not intended to limit the rights granted to downstream recipients under Apache-2.0. --- ## 15. Indemnity and third-party claims Unless prohibited by Applicable Law or agreed in a separate written instrument, You are responsible for claims arising from Your knowing misrepresentation of authority, deliberate concealment of third-party restrictions, or intentional submission of material that You knew You could not license under this Agreement. Nothing here requires You to indemnify the Maintainer for an ordinary defect, an honest mistake made within the knowledge limits of Section 7, a Maintainer modification, an independent work, or a claim caused solely by the Project or another contributor. The Maintainer may request cooperation in investigating a claim, including provenance information and available permission records. This section is not a general commercial indemnity and does not create one where none is permitted by law. --- ## 16. Term and termination This Agreement becomes effective when You accept it or intentionally submit a Contribution after the Agreement has been published, to the extent the submission constitutes acceptance under the repository’s stated process. The copyright and patent licences granted for a Contribution are irrevocable, except for termination of patent rights under Section 6.1 or another termination required by Applicable Law. Withdrawal, account deletion, employment termination, disagreement with a later Project decision, or removal of a pull request does not automatically terminate rights already granted for an Accepted Contribution. If the Maintainer discovers that a Contribution was submitted without authority, contained undisclosed third-party material, or materially violates this Agreement, the Maintainer may reject, remove, replace, or revert the Contribution and may suspend further submissions while the issue is investigated. Removal from the repository does not determine whether a third party retained rights in copies already distributed. Sections intended by their nature to survive — including definitions, ownership, copyright and patent grants, representations, disclaimers, limitations, provenance records, and governing-law provisions — survive termination or closure of a contribution channel. --- ## 17. Governing law and dispute forum Unless a separate written agreement provides otherwise, this Agreement is governed by the laws of the State of Delaware, United States, without regard to conflict-of-law rules, to the extent that choice is permitted by Applicable Law. Subject to any mandatory jurisdiction or venue rule, the parties consent to the exclusive jurisdiction and venue of the state and federal courts located in Delaware for disputes arising from this Agreement. Nothing prevents a party from seeking provisional, injunctive, or protective relief in a court with jurisdiction where necessary to protect confidential information, intellectual property, security, or evidence. If a court finds this section or any part of it unenforceable, the remainder of the Agreement remains effective to the maximum extent permitted by law. --- ## 18. General terms ### 18.1 Entire agreement This Agreement, together with the Apache-2.0 licence applicable to the relevant outbound copy, the DCO requirements in `CONTRIBUTING.md`, and any signed supplemental agreement, is the complete contribution-rights agreement for the subject matter here. It supersedes earlier contribution-rights language only for Contributions within its effective scope. ### 18.2 Order of precedence If a signed supplemental agreement expressly addresses the same Contribution, that agreement controls to the extent of a direct conflict. Otherwise, this CLA controls inbound rights and Apache-2.0 controls the outbound rights granted by the Project to recipients. A repository README, issue comment, release note, or marketing document does not amend this Agreement unless it clearly identifies the amendment and is accepted in writing by the Maintainer and the relevant Contributor. ### 18.3 Assignment You may not assign this Agreement or the rights You grant under it in a way that conflicts with the rights already granted to the Maintainer and downstream recipients. The Maintainer may assign this Agreement and the rights received under it to a successor maintainer, successor project, or legal entity that lawfully assumes the Project’s obligations. ### 18.4 Severability If any provision is held invalid or unenforceable, it will be narrowed to the minimum extent necessary to make it enforceable where permitted, and the remaining provisions will continue in effect. ### 18.5 No waiver A failure to enforce a provision is not a waiver of the right to enforce it later. A waiver must be explicit and applies only to the specific instance stated. ### 18.6 Electronic records and counterparts Electronic acceptance, authenticated platform records, signed commits, signed pull requests, and electronic counterparts may be used as evidence of acceptance to the extent permitted by Applicable Law. ### 18.7 No third-party beneficiary status under this CLA Except for the patent rights expressly granted to Project recipients in Section 6, this Agreement does not create a third-party beneficiary right in a person who is not a party. Downstream recipients receive the outbound rights provided by the applicable Project licence, including Apache-2.0, not an independent right to enforce every provision of this CLA. ### 18.8 Language This Agreement is written in English. A translation may be provided for convenience, but the English text controls in the event of inconsistency unless the parties sign a written version that states otherwise. --- ## 19. Acceptance block Complete this block only if You are accepting as an individual or authorized representative. A pull-request bot or comment may use the abbreviated acceptance statement in Section 10.2; this block is for a signed counterpart or durable contribution record. ### Individual Contributor - Legal name: ______________________________________________ - GitHub handle or other contribution identity: ________________ - Email: ___________________________________________________ - Country or jurisdiction of residence: _________________________ - Contribution or pull request reference: _______________________ - Agreement version accepted: `5.0.2` - Signature: _________________________________________________ - Date (UTC): _______________________________________________ ### Corporate or institutional Contributor - Legal entity name: _________________________________________ - Entity type and jurisdiction: _________________________________ - Authorized representative: __________________________________ - Representative title: _______________________________________ - Representative email: ______________________________________ - Contribution or pull request reference: _______________________ - Agreement version accepted: `5.0.2` - Signature: _________________________________________________ - Date (UTC): _______________________________________________ By signing, the individual or authorized representative confirms that the signer has read this Agreement, has authority to accept it for the identified Contributor, and grants the rights described for Contributions intentionally submitted under it. --- ## 20. Maintainer review checklist This checklist is operational guidance and is not a substitute for legal review: - [ ] The current CLA version is recorded in the contribution workflow. - [ ] The contributor’s identity is sufficient to distinguish the signer from an anonymous account. - [ ] The signer is an individual contributor or has authority to bind the identified entity. - [ ] DCO sign-off is present where required by `CONTRIBUTING.md`. - [ ] Employer, customer, university, government, or grant restrictions were checked where relevant. - [ ] Third-party code, assets, data, model outputs, and generated material were disclosed. - [ ] No credentials, private keys, personal data, confidential information, or production records were submitted. - [ ] The Contribution’s licence and attribution requirements are compatible with the intended Project distribution. - [ ] Security material was routed through the appropriate private disclosure path when necessary. - [ ] Tests, documentation, benchmarks, and claim boundaries were reviewed according to the change type. - [ ] Acceptance evidence is linked to the pull request, commit range, or signed counterpart. - [ ] Any exception is recorded in a separate written agreement and approved by the Maintainer. --- ## Related documents - [`LICENSE`](LICENSE) — Apache License, Version 2.0 - [`NOTICE`](NOTICE) — Project notices and attribution - [`CONTRIBUTING.md`](CONTRIBUTING.md) — DCO, workflow, testing, and contribution process - [`SECURITY.md`](SECURITY.md) — vulnerability reporting and security boundaries - [`docs/CLAIMS_MATRIX.md`](docs/CLAIMS_MATRIX.md) — public claim control - [`docs/RELEASE_STATUS.md`](docs/RELEASE_STATUS.md) — publication and provenance readback - [`docs/legal/LICENSE_TRANSITION_5.0.2.md`](docs/legal/LICENSE_TRANSITION_5.0.2.md) — licence transition record - [Developer Certificate of Origin 1.1](https://developercertificate.org/) **Questions:** `juan.c.luna04@gmail.com`