Estimate: 30m
Type: task · Parent: Epic 1 · Executor: human (no PR-of-code; GitHub-side install + a tiny doc commit).
Why now, not at launch (Epic 8). Industry pattern (MongoDB, Elastic, GitLab, Sentry, Plane) is unambiguous: introduce the CLA on day one. Without it, every outside contributor's commit becomes a copyright fragment we cannot unilaterally relicense — even a single drive-by typo fix poisons the codebase's future optionality. The asymmetry is severe: setting it up costs ~30 minutes; retrofitting it costs months-to-years of contributor outreach (Elastic took ~2 years). The relicense option we're protecting is NOT a current plan — it's the floor under all open-core options should economics ever break (HashiCorp/Elastic/Redis/MongoDB all eventually exercised theirs, each one made possible by a CLA they had in place from earlier).
Template chosen by the planner: Apache ICLA (a LICENSE, not an assignment). Apache ICLA grants moooon B.V. a broad license to the contribution; the contributor retains their copyright. This is contributor-friendly (low friction, the de-facto industry standard for individual contributions) AND broad enough to permit a future BSL/SSPL/source-available relicense — the rights granted include sublicensing, which is what a relicense needs. Considered and REJECTED: (a) MongoDB-style copyright assignment — broader rights but creates contributor pushback that hurts the community side of the moat; only worth it if a relicense is concretely planned, which it is not; (b) DCO alone (Developer Certificate of Origin, Signed-off-by: per commit) — much lower friction, used by Linux kernel + GitLab alongside their CLA, but the DCO is an ATTESTATION not a grant, so it doesn't carry the relicensing rights we're protecting. DCO solves a different problem (provenance) and is not a CLA substitute for our purpose.
What you do. (1) Sign in to https://cla-assistant.io with GitHub. (2) Authorize CLA Assistant on moooon-B-V/motir-core (motir-ai is private and won't have outside contributors — skip it). (3) Paste the Apache ICLA text (https://www.apache.org/licenses/icla.pdf — convert to plain text), modified to name "moooon B.V." as the receiving party in §1. Save. CLA Assistant now hooks every PR on motir-core: it comments asking outside contributors to sign, and adds a required status check that turns green only once signed. (4) On a seed/cla-setup branch in motir-core, commit motir-core/CLA.md (the Apache ICLA text + a short preamble naming moooon B.V. and linking to CLA Assistant's signing flow) AND either create motir-core/CONTRIBUTING.md or amend the existing one with a short paragraph: "By opening a PR, you'll be asked to sign our CLA via CLA Assistant. This grants us the rights we need to maintain the project's open-source license and to potentially relicense the codebase in the future. You retain copyright of your contribution." Open + merge that PR (the seed/* prefix skips E2E + Vercel preview per MOTIR.md § Plan seed). (5) Open a throwaway PR from a second GitHub account (or any account without a signed CLA on file); confirm the bot comments + the status check appears red until signed. Close the throwaway PR. (6) Record the throwaway PR URL in the seed PR's body as the verification artifact (so future-me can audit that the gate is live).
moooon-B-V/motir-core (visible in the repo's installed-apps list and in CLA Assistant's dashboard).motir-core/CLA.md exists at repo root, contains Apache ICLA text adapted to name moooon B.V. as the receiving party.motir-core/CONTRIBUTING.md carries a paragraph naming the CLA requirement and pointing contributors at the signing flow.done only on user confirmation that steps 1–5 are complete (mirrors 1.6.7 — manual SaaS provisioning, no PR-of-code to gate on).MOTIR.md § Source of truth (open-core architecture paragraph) — names the GPL-3.0 / closed-source motir-ai split this CLA underwrites.notes.html mistake #17 — open-core is an architectural shift, not a license toggle; the CLA is the legal half of that architecture.seed/* PR against motir-meta. The trademark filing (~$500, ~12 months) is ALSO out of scope and tracked as a finding rather than a planned task (it has no software artifact and no dependency on the seed).