Scope

This pull request makes NomadPosting legally open source and adds the repository controls needed to accept contributions responsibly. It does not enable live posting or claim production readiness.

Decisions

• License: GNU AGPL v3 or any later version (AGPL-3.0-or-later).
• Contributions: Developer Certificate of Origin 1.1, contributor-retained copyright, no CLA.
• Governance: one active maintainer, documented bus-factor limitation, and independent qualified review required before any live security gate can close.

What changed

• Rewrites the README around the verified dry-run boundary and contributor hardening tracks.
• Adds the canonical AGPL v3 LICENSE, DCO 1.1, contribution terms, governance, maintainer, conduct, and name/provenance policies.
• Adds CODEOWNERS, issue forms, and a stronger pull-request template.
• Separates vulnerability reporting from conduct reporting and documents authorized research boundaries.
• Adds adoption-aware DCO enforcement and adversarial self-tests to both pinned workflows.
• Keeps every live mode and production-readiness claim fail closed.

Local verification

• Canonical AGPL and DCO texts verified after line-ending normalization.
• scripts/check-dco-tests.sh: signed author and co-author cases passed; unsigned author, unsigned co-author, unsigned post-adoption, and empty-range cases failed as required.
• Real range aef6a31..543d916: DCO adoption detected at aecbbe9; all three post-adoption commits passed.
• All relative Markdown links resolve across 16 repository files.
• All GitHub YAML parsed successfully after the workflow and issue-form changes.
• go mod verify, go test -count=3 ./..., and go vet ./... passed all 10 packages.
• gofmt, dependency-license policy, Linux amd64 CGO-disabled cross-builds, and high-signal literal-secret scan passed.
• govulncheck v1.6.0 found no reachable symbol- or package-level vulnerability; the existing unreachable module advisory remains documented in docs/VERIFICATION.md.

CI evidence

Current head: 543d916cf3593c5898a97cb7bc9b520b52613cb9.

• DCO signoff: passed.
• Pull-request verify: passed.
• Push verify: passed.

The prior head failed before assertions because the Windows-authored checker lacked an executable bit on Ubuntu. Commit 543d916 fixed the root cause by invoking the checker through Bash and recording both DCO scripts as executable; all replacement runs are green.

Production boundary

This remains a dry-run research preview. Live release is still blocked on the reviewed Linux namespace/WireGuard/nftables/DNS executor and teardown; packet-capture no-fallback proofs across every fault phase; broker-backed pinned transports; concrete NIP-46 identity, permission, and Schnorr verification; OS-backed secret sealing; same-exit X reconciliation and length conformance; remaining metadata-index encryption; live relay review; provisioned and validated infrastructure; full accessibility and visual regression; canary evidence; and three clean production adversarial rounds.