loci-vault 0.7.0__tar.gz

loci_vault-0.7.0/.githooks/_common.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Shared helpers for the hooks in this directory.
+
+PROTECTED_BRANCHES="main master"
+
+current_branch() {
+	git symbolic-ref --quiet --short HEAD 2>/dev/null || echo ""
+}
+
+is_protected() {
+	local branch="$1"
+	for protected in $PROTECTED_BRANCHES; do
+		[ "$branch" = "$protected" ] && return 0
+	done
+	return 1
+}
+
+# Escape hatch: LOCI_ALLOW_MAIN=1 git <cmd> ...
+override_set() {
+	[ "${LOCI_ALLOW_MAIN:-}" = "1" ]
+}
+
+deny() {
+	echo "" >&2
+	echo "  BLOCKED: $1" >&2
+	echo "" >&2
+	echo "  Work on a branch and open a PR:" >&2
+	echo "    git switch -c my-branch" >&2
+	echo "    git push -u origin my-branch" >&2
+	echo "    gh pr create" >&2
+	echo "" >&2
+	echo "  Override (rarely correct): LOCI_ALLOW_MAIN=1 <your git command>" >&2
+	echo "" >&2
+	exit 1
+}

loci_vault-0.7.0/.githooks/_install_skills.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# Reinstall the Loci skill stubs into ~/.claude/skills/ when the skills tree
+# changed.
+#
+# The stub in ~/.claude/skills/<name>/ only calls read_skill, and the MCP
+# server reads src/loci/skills/<name>/SKILL.md on every call, so editing a
+# skill is live with nothing to re-run. What the stub cannot do is create
+# itself: a skill directory added by someone else arrives with `git pull` and
+# nothing in ~/.claude/skills/ names it, so Claude Code never sees the skill
+# at all. A reworded trigger description is the same gap, since the stub
+# carries it. That is what this closes, which is why it runs on checkout and
+# merge rather than on commit — your own edits are already live.
+#
+# Never fails the git operation it is attached to. A checkout that aborts
+# because a stub could not be written would be a far worse trade than a skill
+# that is one `make skills` behind.
+#
+# Escape hatch: LOCI_SKIP_SKILL_INSTALL=1 git <cmd> ...
+#
+# Usage: _install_skills.sh <old-rev> <new-rev>
+set -uo pipefail
+
+[ "${LOCI_SKIP_SKILL_INSTALL:-}" = "1" ] && exit 0
+
+old_rev="${1:-}"
+new_rev="${2:-}"
+[ -n "$old_rev" ] && [ -n "$new_rev" ] || exit 0
+
+# Both revs have to be real. On a fresh clone, or the first commit in a repo,
+# ORIG_HEAD may not resolve — nothing to compare, nothing to do.
+git rev-parse --verify --quiet "$old_rev" >/dev/null || exit 0
+git rev-parse --verify --quiet "$new_rev" >/dev/null || exit 0
+
+# The common case by a wide margin: a branch switch that touched no skill.
+# Checking first keeps the hook off the critical path of every checkout.
+#
+# Only the SKILL.md files and the stub writer itself count. A stub is a
+# skill's frontmatter over a body template in skills_install.py, and nothing
+# else, so a change under skills/references/ (ontology, tag seeds, the
+# *-user.md overlay seeds) cannot move one — running here would print
+# "skills changed" and spawn uv for a listing that finds nothing to do. A
+# pull that rewords the template, on the other hand, leaves every installed
+# stub carrying the old text, which is exactly the gap this hook is for.
+if git diff --quiet "$old_rev" "$new_rev" -- 'src/loci/skills/*/SKILL.md' src/loci/skills_install.py 2>/dev/null; then
+	exit 0
+fi
+
+command -v uv >/dev/null 2>&1 || exit 0
+
+cd "$(git rev-parse --show-toplevel)" || exit 0
+
+# `loci skills` compares each installed stub against the one it would write
+# and only touches the ones that differ, so a procedure-only change costs a
+# listing and nothing else.
+echo "githooks: skills changed — updating stubs in ~/.claude/skills/" >&2
+if ! uv run --quiet loci skills --yes >&2; then
+	echo "githooks: stub install failed. Run \`make skills\` when convenient." >&2
+fi
+
+exit 0

loci_vault-0.7.0/.githooks/post-checkout

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Reinstall the skill stubs after a branch switch that changed them.
+#
+# git passes: <previous HEAD> <new HEAD> <branch-checkout flag>
+# The flag is 1 for a branch checkout and 0 for a file checkout
+# (`git checkout -- path`), which changes the working tree but not HEAD.
+set -uo pipefail
+
+[ "${3:-0}" = "1" ] || exit 0
+
+exec "$(dirname "$0")/_install_skills.sh" "$1" "$2"

loci_vault-0.7.0/.githooks/post-merge

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Reinstall the skill stubs after a merge — in practice, after `git pull` brings in a
+# skill someone else added or renamed.
+#
+# git passes the squash flag as $1 and nothing useful about the range, so the
+# comparison is against ORIG_HEAD, which merge sets to the pre-merge commit.
+set -uo pipefail
+
+exec "$(dirname "$0")/_install_skills.sh" ORIG_HEAD HEAD

loci_vault-0.7.0/.githooks/pre-commit

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Refuse ordinary commits made directly on a protected branch.
+set -euo pipefail
+
+. "$(dirname "$0")/_common.sh"
+
+branch="$(current_branch)"
+is_protected "$branch" || exit 0
+override_set && exit 0
+
+deny "direct commit on '$branch'."

loci_vault-0.7.0/.githooks/pre-merge-commit

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Refuse `git merge` that would create a merge commit on a protected branch.
+set -euo pipefail
+
+. "$(dirname "$0")/_common.sh"
+
+branch="$(current_branch)"
+is_protected "$branch" || exit 0
+override_set && exit 0
+
+deny "merge into '$branch' from your working copy."

loci_vault-0.7.0/.githooks/pre-push

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# Two gates before anything leaves this machine:
+#
+#   1. Refuse pushing to a protected branch.
+#      This is the hook that actually stops "merged straight into main": a
+#      fast-forward merge creates no commit, so pre-commit and
+#      pre-merge-commit never fire for it — but the push still comes here.
+#
+#   2. Run the unit suite, to keep obviously-red trees off a PR.
+#      Unit only (-m "not e2e"): ~4s, no Node or browser needed. The e2e
+#      suite is left to CI, which runs both on every push and PR.
+#      This tests the working tree, not the commits being pushed — when the
+#      two differ the hook says so instead of implying more than it checked.
+#
+# The two gates have separate escape hatches: LOCI_ALLOW_MAIN=1 waives the
+# branch guard only, LOCI_SKIP_TESTS=1 waives the suite only.
+#
+# stdin lines: <local ref> <local sha> <remote ref> <remote sha>
+set -euo pipefail
+
+. "$(dirname "$0")/_common.sh"
+
+head_sha="$(git rev-parse HEAD 2>/dev/null || echo "")"
+pushing_commits=0
+tree_matches_push=1
+
+while read -r _local_ref local_sha remote_ref _remote_sha; do
+	[ -z "$remote_ref" ] && continue
+
+	remote_branch="${remote_ref#refs/heads/}"
+	if [ "$remote_branch" != "$remote_ref" ] && is_protected "$remote_branch" && ! override_set; then
+		deny "push to '$remote_branch' on the remote."
+	fi
+
+	# All-zero local sha means "delete this remote ref" — nothing to test.
+	case "$local_sha" in
+	*[!0]*)
+		pushing_commits=1
+		[ "$local_sha" = "$head_sha" ] || tree_matches_push=0
+		;;
+	esac
+done
+
+[ "$pushing_commits" -eq 1 ] || exit 0
+[ "${LOCI_SKIP_TESTS:-}" = "1" ] && exit 0
+
+if ! command -v uv >/dev/null 2>&1; then
+	echo "" >&2
+	echo "  BLOCKED: uv not found, so the unit suite cannot run." >&2
+	echo "" >&2
+	echo "  Install it: https://docs.astral.sh/uv/" >&2
+	echo "  Pushing from a GUI client or IDE? Its PATH probably misses uv" >&2
+	echo "  (usually ~/.local/bin) — push from a terminal, or fix its PATH." >&2
+	echo "" >&2
+	echo "  Skip this check (rarely correct): LOCI_SKIP_TESTS=1 git push" >&2
+	echo "" >&2
+	exit 1
+fi
+
+cd "$(git rev-parse --show-toplevel)"
+
+# The suite covers the working tree. When that is not what is being pushed,
+# say so — passing tests here do not mean the pushed commits are green, and
+# failing ones may have nothing to do with them.
+if [ "$tree_matches_push" -eq 0 ]; then
+	echo "" >&2
+	echo "  NOTE: pushing commits that are not checked out (HEAD is elsewhere)." >&2
+	echo "        Tests below cover the working tree, not those commits." >&2
+	echo "" >&2
+elif ! git diff --quiet HEAD 2>/dev/null; then
+	echo "" >&2
+	echo "  NOTE: working tree has uncommitted changes." >&2
+	echo "        Tests below cover the tree as it stands, not the pushed commits." >&2
+	echo "" >&2
+fi
+
+echo "pre-push: running unit tests..." >&2
+
+# --extra dev because pytest lives in the dev extra; uv installs it on demand
+# and caches it, so this is only slow on a fresh clone.
+if ! uv run --extra dev pytest tests/ -q -m "not e2e"; then
+	echo "" >&2
+	echo "  BLOCKED: unit tests failed — not pushing." >&2
+	echo "" >&2
+	echo "  Fix them, or see the full output with:" >&2
+	echo "    make test-fast" >&2
+	echo "" >&2
+	echo "  Skip this check (rarely correct): LOCI_SKIP_TESTS=1 git push" >&2
+	echo "" >&2
+	exit 1
+fi

loci_vault-0.7.0/.github/workflows/cla.yml

@@ -0,0 +1,74 @@
+name: CLA
+
+# Blocks a pull request until its author has signed the Contributor Licence
+# Agreement in CLA.md.
+#
+# Why this is enforced rather than advisory: Loci is released under PolyForm
+# Noncommercial, so commercial use requires a separate licence from the owner.
+# Granting one means holding rights to the whole codebase. A contribution
+# merged without a CLA arrives under PolyForm Noncommercial itself, leaving the
+# project with only noncommercial rights to part of its own source and no way
+# to license the whole commercially. That damage is silent and permanent, so
+# the gate sits before the merge rather than in a document nobody reads.
+#
+# Signatures are recorded in signatures/cla.json on the cla-signatures branch.
+# That branch must already exist and must not be protected — the action commits
+# to it but does not create it, and fails the run with "Branch cla-signatures
+# not found" if it is missing. It is kept as an orphan branch holding signatures
+# only. Signing is once per person, not per PR.
+#
+# Note on the allowlist below: it matches GitHub logins, resolved from each
+# commit's author email. A commit whose email is not attached to a GitHub
+# account resolves to no login, so the allowlist cannot match it and even the
+# owner is asked to sign. Commit with an email your account owns.
+
+on:
+  # pull_request_target, not pull_request: the job needs write access to comment
+  # on the PR and to commit the signature file, which a fork-triggered
+  # `pull_request` run does not get. It checks out no PR code, so the elevated
+  # token is never exposed to a contributor's branch.
+  pull_request_target:
+    types: [opened, synchronize, reopened, closed]
+  issue_comment:
+    types: [created]
+
+permissions:
+  actions: write
+  contents: write
+  pull-requests: write
+  statuses: write
+
+concurrency:
+  group: cla-${{ github.event.issue.number || github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  cla:
+    runs-on: ubuntu-latest
+    # Run on PR events, and on comments only when they are on a PR and either
+    # sign or recheck. Without this every issue comment in the repo starts a job.
+    if: >
+      (github.event_name == 'pull_request_target') ||
+      (github.event.issue.pull_request != null &&
+       (contains(github.event.comment.body, 'I have read the CLA Document and I hereby sign the CLA') ||
+        github.event.comment.body == 'recheck'))
+    steps:
+      - name: Check or record CLA signature
+        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
+        env:
+          # The action's own token. No PAT is needed while the signature branch
+          # lives in this same repository.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          path-to-signatures: signatures/cla.json
+          path-to-document: https://github.com/gked/loci/blob/main/CLA.md
+          branch: cla-signatures
+          allowlist: gked,dependabot[bot]
+          custom-notsigned-prcomment: >
+            Thanks for the pull request. Before it can be merged, please read
+            the [Contributor Licence Agreement](https://github.com/gked/loci/blob/main/CLA.md)
+            and sign it by posting exactly this as a new comment:
+          custom-pr-sign-comment: >
+            I have read the CLA Document and I hereby sign the CLA
+          custom-allsigned-prcomment: >
+            All contributors have signed the CLA. Thank you.

loci_vault-0.7.0/.github/workflows/release.yml

@@ -0,0 +1,149 @@
+name: Release
+
+# Fires on the tag `make release-publish` pushes. Everything before this — the
+# version bump, its PR, the merge — has already happened on main, and both
+# suites ran there. What is left is to prove the tag is honest, build the
+# artifact, and publish it.
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # release_notes.py reads the previous tag's files out of git history,
+          # so a shallow clone would leave every release looking like the first.
+          fetch-depth: 0
+
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+
+      # The wheel carries the built frontend, so the release needs Node. An
+      # installed Loci has neither app/ nor a toolchain to build it with, and
+      # `loci` would serve an API and no UI.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: app/package-lock.json
+
+      # First, and before anything is built: a tag whose version disagrees with
+      # pyproject.toml would publish a wheel that lies about what it is. That
+      # happens when the tag is pushed before the bump PR merged.
+      - name: Verify the tag matches pyproject.toml
+        run: uv run python scripts/release.py check "${GITHUB_REF_NAME}"
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      # The unit suite only. The e2e suite already ran on the merge commit this
+      # tag points at, and re-running the browser against an unchanged tree
+      # would add minutes without adding a signal.
+      - name: Run unit tests
+        run: uv run pytest tests/ -v -m "not e2e"
+
+      # `make wheel`, not `uv build`: it compiles the frontend into
+      # src/loci/static/ first. A bare uv build produces a backend-only wheel,
+      # which is what every release before this shipped.
+      - name: Build the wheel
+        run: make wheel
+
+      # PyPI refuses a distribution whose metadata it cannot render, and a
+      # published version can never be replaced. Catch it here, before the
+      # GitHub Release exists and long before the upload. twine is pinned: this
+      # job builds what is uploaded to PyPI, so it does not run a floating tool.
+      - name: Check the distribution metadata
+        run: uvx twine@7.0.0 check --strict dist/*
+
+      # The publish job ships exactly these files, not a second build.
+      - name: Keep the built distributions for the publish job
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  # PyPI trusted publishing: no API token is stored anywhere. PyPI trusts this
+  # repository, this workflow file and this environment, and accepts the
+  # short-lived identity token GitHub mints for the job. That is also why this
+  # is its own job — `id-token: write` is held by the one job that runs no
+  # repository code, only the upload.
+  #
+  # It runs before the GitHub Release. If the pending publisher or the `pypi`
+  # environment is missing or misnamed, the upload fails here and no Release
+  # exists yet: fix the setup and "Re-run failed jobs". The reverse order left a
+  # public Release for a version that never reached PyPI.
+  publish-pypi:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/loci-vault
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+
+  # Last, and only once PyPI has the files: a Release means the version is out.
+  # If this job fails, "Re-run failed jobs" repeats only this job. PyPI refuses
+  # a second upload of the same version, so the upload must not be repeated.
+  release:
+    name: GitHub Release
+    needs: publish-pypi
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write  # creating a Release writes to the repo
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # release_notes.py reads the previous tag's files out of git history.
+          fetch-depth: 0
+
+      - uses: astral-sh/setup-uv@v4
+
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: dist
+          path: dist/
+
+      - name: Compose release notes
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="${GITHUB_REF_NAME}"
+          # "^" is the tag's parent: the newest release tag before this one.
+          # Empty before the first release, which release_notes.py handles.
+          PREVIOUS="$(git describe --tags --abbrev=0 --match 'v*' "${TAG}^" 2>/dev/null || true)"
+          echo "Previous release: ${PREVIOUS:-none}"
+
+          # The upgrade section first — it is the part that asks something of
+          # the reader — then GitHub's own list of merged PRs beneath it.
+          uv run --no-project python scripts/release_notes.py "${PREVIOUS}" "${TAG}" > notes.md
+          gh api "repos/${GITHUB_REPOSITORY}/releases/generate-notes" \
+            -f tag_name="${TAG}" \
+            ${PREVIOUS:+-f previous_tag_name="${PREVIOUS}"} \
+            --jq .body >> notes.md
+
+          cat notes.md
+
+      - name: Publish the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" dist/* \
+            --title "Loci ${GITHUB_REF_NAME}" \
+            --notes-file notes.md

loci_vault-0.7.0/.github/workflows/test.yml

@@ -0,0 +1,67 @@
+name: Tests
+
+# A bare `push:` alongside `pull_request:` ran both jobs twice for every commit
+# on a PR branch — once per event, same SHA. Limiting push to main keeps the
+# post-merge check on main and lets pull_request cover branch work exactly once.
+# Branches with no PR open no longer get CI; the pre-push hook still runs the
+# unit suite locally, and opening the PR runs both suites.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  unit:
+    name: Python unit tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: Run tests
+        run: uv run pytest tests/ -v -m "not e2e"
+
+  e2e:
+    name: Browser e2e tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: app/package-lock.json
+
+      - name: Install Python dependencies
+        run: uv sync --extra dev
+
+      - name: Install frontend dependencies
+        run: npm ci --prefix app
+
+      # --with-deps pulls the system libraries headless Chromium needs on
+      # ubuntu-latest; without it the browser fails to launch.
+      - name: Install Playwright browser
+        run: uv run playwright install --with-deps chromium
+
+      - name: Run e2e tests
+        run: uv run pytest tests/e2e/ -v --tracing=retain-on-failure
+
+      # Traces replay a CI failure locally: npx playwright show-trace <file>
+      - name: Upload traces on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-traces
+          path: test-results/
+          retention-days: 7

loci_vault-0.7.0/.gitignore

@@ -0,0 +1,29 @@
+config.yml
+config.yml.migrated
+# Scratch config and vault used by `make dev` — never the real ones.
+dev-config.yml
+dev-vault/
+dev-vault.tmp/
+vault/
+!tests/fixtures/vault/
+__pycache__/
+*.pyc
+.DS_Store
+.venv/
+.coverage
+settings.local.json
+.claude/
+app/node_modules/
+app/dist/
+# Playwright traces/screenshots from the e2e suite
+test-results/
+
+# Wheels from `uv build`. uv writes dist/.gitignore too; this is the explicit one.
+/dist/
+
+# The frontend bundle `make wheel` compiles into the package. Build output,
+# not source — pyproject's hatch `artifacts` entry is what still ships it.
+/src/loci/static/
+
+# Vite's dependency pre-bundle cache. Regenerated on every dev start.
+app/.vite/

loci_vault-0.7.0/.python-version

@@ -0,0 +1 @@
+3.13.0

loci_vault-0.7.0/CLA.md

@@ -0,0 +1,118 @@
+# Loci Contributor License Agreement
+
+Adapted from the Apache Software Foundation Individual CLA v2.0 for a
+single-owner project. Plain-language summary first; the agreement itself is
+below and is what actually binds.
+
+## Why this exists
+
+Loci is released under the [PolyForm Noncommercial 1.0.0](LICENSE) licence.
+Noncommercial use is free for everyone; commercial use needs a separate licence
+from the owner.
+
+That only works if the owner holds rights broad enough to grant one. Without
+this agreement, a contribution arrives licensed under PolyForm Noncommercial
+itself, which means the project would hold only *noncommercial* rights to part
+of its own code and could no longer license the whole of it commercially. One
+merged pull request would quietly remove that option, for good.
+
+This agreement fixes that, and keeps the licence itself changeable later. If the
+project ever moves to AGPL, MIT, or a dual licence, it can do so without
+tracking down every past contributor.
+
+## What you keep
+
+**You keep your copyright.** This is a licence, not an assignment. You may use,
+publish, sell, or relicense your own contribution anywhere else, on any terms,
+forever. Signing takes nothing away from you.
+
+---
+
+## Agreement
+
+You accept and agree to the following terms for your past, present, and future
+Contributions submitted to Loci ("the Project"). Except for the licences granted
+here to the Project's owner ("the Owner"), you reserve all right, title, and
+interest in and to your Contributions.
+
+### 1. Definitions
+
+**"You"** means the copyright owner, or the legal entity authorised by the
+copyright owner, entering into this agreement with the Owner.
+
+**"Contribution"** means any original work of authorship, including any
+modification of or addition to an existing work, intentionally submitted by you
+to the Owner for inclusion in, or documentation of, the Project. "Submitted"
+means any form of electronic, verbal, or written communication sent to the Owner
+or its representatives, including but not limited to communication on electronic
+mailing lists, source code control systems, and issue tracking systems managed
+by or on behalf of the Owner, excluding communication conspicuously marked or
+otherwise designated in writing by you as "Not a Contribution."
+
+### 2. Grant of Copyright Licence
+
+Subject to the terms of this agreement, you grant to the Owner a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright licence
+to reproduce, prepare derivative works of, publicly display, publicly perform,
+sublicence, and distribute your Contributions and such derivative works.
+
+This licence expressly includes the right to sublicence and to distribute your
+Contribution, and derivative works of it, **under any licensing terms the Owner
+chooses**, including proprietary and commercial terms, and to change those terms
+in future.
+
+### 3. Grant of Patent Licence
+
+Subject to the terms of this agreement, you grant to the Owner and to recipients
+of software distributed by the Owner a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section) patent
+licence to make, have made, use, offer to sell, sell, import, and otherwise
+transfer the Project. This licence applies only to those patent claims
+licensable by you that are necessarily infringed by your Contribution alone or
+by combination of your Contribution with the Project to which it was submitted.
+
+If any entity institutes patent litigation against you or any other entity
+alleging that your Contribution, or the Project to which it was submitted,
+constitutes direct or contributory patent infringement, then any patent licences
+granted to that entity under this agreement for that Contribution or Project
+terminate as of the date such litigation is filed.
+
+### 4. You Have the Right to Grant This
+
+You represent that you are legally entitled to grant the above licences. If your
+employer has rights to intellectual property that you create, you represent that
+you have received permission to make the Contributions on behalf of that
+employer, that your employer has waived such rights, or that your employer has
+executed a separate corporate CLA with the Owner.
+
+### 5. Your Own Work
+
+You represent that each of your Contributions is your original creation. You
+represent that your Contribution submissions include complete details of any
+third-party licence or other restriction of which you are personally aware and
+which is associated with any part of your Contributions.
+
+### 6. No Warranty
+
+You are not expected to provide support for your Contributions, except to the
+extent you desire to provide support. Unless required by applicable law or
+agreed to in writing, you provide your Contributions on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,
+including, without limitation, any warranties or conditions of TITLE,
+NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+
+### 7. Notify Us of Changes
+
+You agree to notify the Owner of any facts or circumstances of which you become
+aware that would make these representations inaccurate in any respect.
+
+---
+
+## How to sign
+
+Open a pull request. A bot will comment with the exact sentence to reply with.
+Posting that comment records your signature against your GitHub username, and
+the check on your pull request turns green.
+
+You sign once. It covers every contribution you make to this project, past and
+future.