[wxy]

Summary

• add the complete GNU GPL version 3 license text and declare GPL-3.0-or-later in the root and all npm workspace manifests
• add a general-purpose Appilot Individual Contributor License Agreement based on the contributor model already used by wxy/ai-pulse-macos
• contributors retain copyright while granting broad, permanent copyright and patent licenses, including use in paid products and services
• require explicit acceptance through the standard PR comment; merely opening a PR is not treated as the signature record
• add authoritative English CLA text, a non-binding Simplified Chinese translation, bilingual contribution guidance, and a PR template
• add a SHA-pinned Node.js 24 CLA Assistant workflow and store versioned signatures on the dedicated cla-signatures branch
• add the active Require CLA for master GitHub ruleset requiring the CLA Assistant status check

CLA acceptance flow

1. A third-party contributor opens or updates a pull request.
2. CLA Assistant asks each unsigned human contributor to read CLA.md and post exactly I have read the CLA Document and I hereby sign the CLA.
3. The assistant records the GitHub identity, CLA version, pull request, and timestamp under signatures/v1/cla.json on cla-signatures.
4. The required CLA Assistant check blocks normal merging until every applicable contributor has signed.
5. The project owner and automation bots are allowlisted. The owner has an explicit PR-only bootstrap bypass in the ruleset because this PR introduces the workflow itself.

Ruleset: https://github.com/wxy/appilot/rules/23158715

Verification

• compared the CLA, contribution guide, workflow, and signature storage in wxy/ai-pulse-macos
• all 11 root/workspace manifests report GPL-3.0-or-later
• CLA workflow YAML parsed successfully
• CLA Action v3.0.0 commit 3e58ace6af840f66fcd80f68c08d76559140df5e and its Node.js 24 manifest were verified through the GitHub API
• npm run typecheck passed
• git diff --check passed
• active GitHub ruleset was read back from the API with required context CLA Assistant
• remote cla-signatures branch is initialized and unprotected; no PAT or additional repository secret is required
• existing untracked tmp/ remains excluded

Bootstrap note

The CLA workflow is not present on master until this PR is merged, so GitHub cannot produce its required check for this PR. The project owner must use the ruleset's explicit PR-only bypass once when merging #301. Future third-party PRs will run and must pass the CLA check normally.

Legal review note

The CLA follows the established AI Pulse agreement and Apache-style copyright, patent, provenance, and employer-authority provisions. Professional legal review is still advisable before relying on it in a high-stakes dispute.