Drop the DCO sign-off requirement

.github/pull_request_template.md

@@ -7,7 +7,6 @@
 - [ ] I checked `description` against requests a user would really type — see
       CONTRIBUTING.md.
 - [ ] `python3 tools/validate_skills.py` passes locally.
-- [ ] Every commit is signed off with `git commit -s` (DCO).
 
 <!--
 Everything else is checked by CI, so there is nothing to attest here.

CONTRIBUTING.md

@@ -13,7 +13,7 @@ mkdir -p skills/your-skill-name
 cp templates/SKILL.md skills/your-skill-name/SKILL.md
 # write it, then:
 python3 tools/validate_skills.py
-git commit -s -m "Add your-skill-name skill"      # -s is the DCO sign-off
+git commit -m "Add your-skill-name skill"
 ```
 
 ## `SKILL.md` frontmatter
@@ -166,80 +166,18 @@ python3 tools/run_evals.py --validate            # only if you wrote evals/evals
 
 Keyless, stdlib-only, and Python 3.11 or newer — the first and third need no network. If
 all three pass, the blocking checks left are about the repository rather than your text: the
-DCO sign-off on every commit, the workflow linters, the installer round trip, and — if you
-imported a skill from another repository — `python3 tools/sync_external.py --check`.
+workflow linters, the installer round trip, and — if you imported a skill from another
+repository — `python3 tools/sync_external.py --check`.
 
-## Licence and sign-off
+## Licence
 
-The two sections below are Intel's standard contributor text. The project name and the link
-to [LICENSE](LICENSE) are filled in; the wording and the Developer Certificate of Origin it
-quotes are unchanged, and the DCO itself may not be changed by anyone.
-
-### License
+The paragraph below is Intel's standard contributor text, with the project name and the
+link to [LICENSE](LICENSE) filled in. It is what makes a contribution inbound-licensed, and
+it is the only thing this repository asks you to agree to — there is no separate sign-off,
+no per-commit trailer, and no CLA.
 
 Intel Skills is licensed under the terms in [LICENSE](LICENSE). By contributing to the project, you agree to the license and copyright terms therein and release your contribution under these terms.
 
-### Sign your work
-
-Please use the sign-off line at the end of the patch. Your signature certifies that you wrote the patch or otherwise have the right to pass it on as an open-source patch. The rules are pretty simple: if you can certify
-the below (from [developercertificate.org](http://developercertificate.org/)):
-
-```
-Developer Certificate of Origin
-Version 1.1
-
-Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
-660 York Street, Suite 102,
-San Francisco, CA 94110 USA
-
-Everyone is permitted to copy and distribute verbatim copies of this
-license document, but changing it is not allowed.
-
-Developer's Certificate of Origin 1.1
-
-By making a contribution to this project, I certify that:
-
-(a) The contribution was created in whole or in part by me and I
-    have the right to submit it under the open source license
-    indicated in the file; or
-
-(b) The contribution is based upon previous work that, to the best
-    of my knowledge, is covered under an appropriate open source
-    license and I have the right under that license to submit that
-    work with modifications, whether created in whole or in part
-    by me, under the same open source license (unless I am
-    permitted to submit under a different license), as indicated
-    in the file; or
-
-(c) The contribution was provided directly to me by some other
-    person who certified (a), (b) or (c) and I have not modified
-    it.
-
-(d) I understand and agree that this project and the contribution
-    are public and that a record of the contribution (including all
-    personal information I submit with it, including my sign-off) is
-    maintained indefinitely and may be redistributed consistent with
-    this project or the open source license(s) involved.
-```
-
-Then you just add a line to every git commit message:
-
-    Signed-off-by: Joe Smith <joe.smith@email.com>
-
-Use your real name (sorry, no pseudonyms or anonymous contributions.)
-
-If you set your `user.name` and `user.email` git configs, you can sign your
-commit automatically with `git commit -s`.
-
-Two shortcuts for when you forget:
-
-```bash
-git commit --amend -s                # the last commit
-git rebase HEAD~N --signoff          # several
-```
-
-CI checks every non-merge commit and fails by commit SHA.
-
 ## Review
 
 CI covers form. A reviewer supplies what no keyless check can: whether an agent that

MAINTAINERS.md

@@ -222,7 +222,6 @@ the fix, the pin is the wrong pin.
 |---|---|---|---|
 | `validate.yml` | `validate` — `validate_skills.py`, `run_evals.py --validate`, link check | every PR | yes |
 | `validate.yml` | `install` — the installer resolves, lists, and installs from the catalog | every PR | yes |
-| `dco.yml` | sign-off on every non-merge commit, failing by commit SHA | every PR | yes |
 | `harbor-smoke.yml` | the oracle arm over every task in `tasks/` | PRs touching tasks or skills | yes |
 | `security.yml` | `actionlint`, `zizmor` | every PR | yes |
 | `codeql.yml` | code scanning, Python | PRs, push, weekly | reports |

README.md

@@ -186,11 +186,7 @@ favour someone does.
 
 ### 6. Open the pull request
 
-Open a pull request that clearly describes the skill, completes the PR checklist, and includes the required DCO-signed commit.
-
-```bash
-git commit -s -m "Add your-skill-name skill"      # -s is the DCO sign-off
-```
+Open a pull request that clearly describes the skill and completes the PR checklist.
 
 ## What CI checks
 
@@ -207,7 +203,6 @@ Blocking, keyless, and runnable on a fork:
   install script, a destructive delete, an instruction aimed at the agent's operator, a
   route for a secret out, or a way to switch a protection off
 - `skills.yaml` has an entry with a maintainer, and the catalog and the tree agree
-- every commit carries a DCO sign-off
 - the workflows themselves lint clean (`actionlint`, `zizmor`)
 - for a new skill: its Harbor task is solvable, oracle reward 1.0
 - for an imported skill: `skills.yaml`, `.source.json` and `NOTICE` agree, and the copy is
@@ -277,16 +272,10 @@ Apache-2.0 — see [LICENSE](LICENSE) and [NOTICE](NOTICE). A skill brought here
 another repository keeps its own licence, recorded in `skills.yaml` and in its
 `.source.json`.
 
-**DCO.** Every commit needs a `Signed-off-by` line, certifying you have the right to
-submit the contribution under Apache-2.0 — the same pattern as the Linux kernel.
-`.github/workflows/dco.yml` checks every non-merge commit on the pull request and fails
-it by commit SHA, so this is a gate rather than a request.
-
-```bash
-git commit -s -m "your message"      # sign off
-git commit --amend -s                # forgot on the last commit
-git rebase HEAD~N --signoff          # forgot on several
-```
+**Contributions.** Opening a pull request here licenses what is in it under Apache-2.0 —
+[CONTRIBUTING.md](CONTRIBUTING.md) states it, and section 5 of the licence says it for any
+contribution intentionally submitted for inclusion. Nothing else is asked: no sign-off
+trailer, no CLA, no separate agreement.
 
 **Security.** Report vulnerabilities via [SECURITY.md](SECURITY.md) or Intel PSIRT.