Repository navigation
Finalize Conveyal CLA v1.0 for EBP US Inc. with individual, organization-wide coverage - #1
Merged
Merged
Conversation
|
CLA signature validation failed:
|
|
All human commit authors are covered by Conveyal CLA |
|
CLA signature validation failed:
|
trevorgerhardt
force-pushed
the
cla-v1.0
branch
from
October 27, 2026 03:31
2d8c273 to
55ce14f
Compare
trevorgerhardt
added a commit
that referenced
this pull request
Oct 27, 2026
## Summary Allow ordinary documentation and version-change PRs to edit `signatures/README.md` without being classified as signature submissions. ```diff signature paths - every file under signatures/ + every file under signatures/ except its top-level README.md ``` Both current and previous paths remain checked. Renaming a record to the README still fails, and nested README files remain subject to record validation. This applies to root and nested ledger configurations. Unblocks the documentation change in #1 once this fix is merged to main and its checks are triggered again. ## Evidence - **Before:** Both root and nested README regression cases fail validation. **After:** All 101 tests pass, including rename protection cases; `pnpm typecheck` passes. ## Merge Danger **Door:** two-way **Blast Radius:** validation Only the exact ledger documentation path is excluded. Actual signature records retain append-only validation.
ansoncfit
reviewed
Oct 29, 2026
Comment on lines
+9
to
+10
| "Covered project" means any open-source repository in the Conveyal GitHub | ||
| organization (`conveyal`), including future additions. |
Member
There was a problem hiding this comment.
Suggested change
| "Covered project" means any open-source repository in the Conveyal GitHub | |
| organization (`conveyal`), including future additions. | |
| "Covered project" means any public repository in the github.com Conveyal | |
| organization (`conveyal`), including future additions. |
Comment on lines
+6
to
+7
| are not covered. One accepted signature per CLA version covers all Conveyal | ||
| open-source repositories, including future additions. For example, R5 can |
Member
There was a problem hiding this comment.
Some of this text is repeated in GOVERNANCE.md, SETUP_PROJECT.md, signatures/README.md, README.md...
To make future changes easier, it might be worth reducing/consolidating some of the documentation, especially where things are clear in the CLA itself.
Comment on lines
+9
to
+10
| "Covered project" means any open-source repository in the Conveyal GitHub | ||
| organization (`conveyal`), including future additions. |
Member
There was a problem hiding this comment.
Suggested change
| "Covered project" means any open-source repository in the Conveyal GitHub | |
| organization (`conveyal`), including future additions. | |
| "Covered project" means any public repository in the github.com Conveyal | |
| organization (`conveyal`), including future additions. |
Comment on lines
13
to
14
| enters this Agreement, or an authorized representative signing a corporate | ||
| authorization on behalf of an organization. "Contribution" means any original |
Member
There was a problem hiding this comment.
Suggested change
| enters this Agreement, or an authorized representative signing a corporate | |
| authorization on behalf of an organization. "Contribution" means any original | |
| enters this Agreement. "Contribution" means any original |
Comment on lines
39
to
41
Member
There was a problem hiding this comment.
This seems different than the CSA example:
If any entity institutes patent litigation against You or any other entity (including a cross-claim or counterclaim in a lawsuit) alleging that Your Contribution, or the Work to which You have contributed, constitutes direct or contributory patent infringement, then any patent licenses granted to that entity under this Agreement for that Contribution or Work shall terminate as of the date such litigation is filed.
As re-written, it seems like this would allow contributors to revoke a patent license they themselves granted (by alleging infringement of any patent).
Member
Author
There was a problem hiding this comment.
Rewrote it back to the CSA example here: 8264940
Comment on lines
15
to
16
| required. A corporate representative may authorize a | ||
| set of GitHub account IDs through a corporate record. |
Member
There was a problem hiding this comment.
Suggested change
| required. A corporate representative may authorize a | |
| set of GitHub account IDs through a corporate record. | |
| required. |
Comment on lines
+68
to
+71
| Corporate authorization records additionally identify the organization, | ||
| authorized representative account, and covered contributor account IDs. A | ||
| corporate record is effective when Conveyal merges it. | ||
| corporate record is effective when authorized Conveyal maintainers merge it | ||
| on behalf of EBP. |
Member
There was a problem hiding this comment.
Are we removing the concept of corporate authorization?
Member
Author
There was a problem hiding this comment.
Yes, I forgot to do that part. Made those changes here: bb14de9
Point README, GOVERNANCE, PROJECTS, FAQ, SETUP_PROJECT, and the signature README at CLA section 7 instead of restating coverage terms.
Limit "You" to the individual contributor and drop corporate records from sections 6 and 7, following review suggestions. Remove corporate generation, coverage, and validation; validation now rejects corporate record paths. Update documentation, the PR template, and tests.
Replace "open-source repository" with "public repository in the github.com Conveyal organization", following review suggestions, and match the signature record wording.
Terminate patent licenses only for an entity that sues over the Contribution or project, matching the CSA source, and let EBP sublicense the patent license to recipients of the covered project.
trevorgerhardt
changed the title
Member
|
Thanks for the updates. Thinking through #1 (comment) more generally, a diff between our CLA and the CSA example, with an explanation of the intention behind any changes, might facilitate others' review. |
|
I think we still need to clean up section 7. It's not clear what "that organization" means in the below.
Also, I don't think we any longer expect to replace this version with a counsel-reviewed material version, right? Should we just use Massachusetts as we do for most of our other contracts? |
Records link to the agreement and state the SHA-256 hash of its exact file instead of embedding its text. Signing links stay short at any agreement length, and the hash proves which frozen text was accepted.
Restore the Submitted definition, licensed-rights limit, trademark exclusion, moral rights waiver, warranty disclaimer, offer withdrawal and decline, signer representations, and entire-agreement clause. Move the legal-advice note to the README.
Replace the note that no governing-law clause is included with CSA's governing-law and venue clause, using Massachusetts instead of Nevada, as suggested in review. Place it before the entire-agreement clause, as in CSA.
Add cla/exempt.json, read from the trusted base branch, listing GitHub account IDs that need no signature record. The check treats listed authors as covered and still fails for other uncovered or unmapped authors. A malformed list fails the check closed. Seed the list with current EBP US Inc. employees and document who maintains it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
versions/CLA-v1.0.md, synchronizeCLA.md, and remove obsolete v0.1 references and provisional labels. No signature records require migration in this ledger.sign.tsdrops--individual,--corporate,--organization, and--authorized-id; coverage ignores and validation rejectscorporate/paths. Record paths staysignatures/<version>/individual/<id>.md.shasum -a 256 versions/CLA-<version>.md. The PR comment tells contributors to read the agreement before opening their signing link.signatures/README.mdlink to CLA section 7 instead of restating scope.Evidence
After:
pnpm typecheckand all 113 tests pass, including single-signature coverage across two consumer repositories without refresh enrollment and rejection of altered signature scope.sign.ts --corporategenerated corporate snapshots that supplied coverage.After:
--corporateand--individualfail withUnknown option; a PR addingsignatures/v1.0/corporate/acme/0001.mdfails validation.After: About 660 characters, whatever the agreement's length. A generated record's hash equals
shasum -a 256 versions/CLA-v1.0.md.After: Regression tests cover failure updates, success resolution, legacy cleanup, bot ownership, no unsolicited success comments, and stale-run protection.
git diff --checkpasses;CLA.mdandversions/CLA-v1.0.mdare byte-identical.Merge Danger
Door: Two-way until signatures are accepted; one-way afterward.
This revises the unsigned pre-release agreement in place. Once v1.0 is signed, freeze its text and use a new agreement version for material changes. EBP must authorize the maintainers who accept records; GitHub merge permission alone is not EBP's authorization.
The agreement has not had counsel review. Open questions: whether a record that links to the terms, with "have read" and a hash, is enough evidence of assent, since contributors no longer see the terms in the GitHub editor as they commit; and whether §6 should say that a record identifies the agreement by hash. #4 proposes restoring further CSA protections and is still open.
Blast Radius: Organization-wide
Changes affect future Conveyal CLA signatures and contributor checks. The record format and the
sign.tsCLI changed, so consumers must use a compatible reviewed tooling release before rollout; this PR does not publish a tooling release or update external consumers. Contributors from companies sign individually and represent employer authorization under §4. Repository workflows and required-check settings still need individual deployment. The browser test has not been run on the new record format;EDITOR_PROTOTYPE.mdrequires repeating it before rollout.Coverage checks read the base branch, so this PR passes against v0.1 on
main. After merge,mainrequires v1.0 and no v1.0 records exist, so every human author's PR failsConveyal CLAuntil they sign, including maintainers. Themainruleset requires no status checks today, so those failures will not block merges there.Signature-comment maintenance takes effect after this PR merges because signature workflows execute trusted base-branch code. Comment API failures are logged and do not change the validation verdict.