Helpthread · zaridan · Jul 11, 2026 · Jul 11, 2026
@@ -20,21 +20,25 @@ Helpthread is the answer for people who already live on serverless infrastructur
 
 ## 3. Licensing & intellectual property
 
-Helpthread's core is licensed **AGPL-3.0**. All contributions require a **CLA**, so the project maintainer holds consolidated copyright over the codebase — this is what makes it lawful to also sell first-party commercial modules alongside the AGPL core, the well-established open-core structure used across commercial open source. Paid first-party modules will ship under a separate proprietary/commercial license, distributed through an official marketplace — a later phase, not a launch-day feature.
+Helpthread's core is licensed **AGPL-3.0**. Contributions are accepted under the **Developer Certificate of Origin (DCO)** — a sign-off on every commit, inbound license identical to outbound, no CLA, no copyright assignment. Contributors keep the copyright on their work, which makes the core's license permanent by structure rather than by promise. What makes it lawful to sell first-party commercial modules alongside the AGPL core is not ownership of the core — it is the module boundary and its plugin exception, defined below. Paid first-party modules ship under a separate proprietary/commercial license from their own closed repositories, distributed through an official marketplace — a later phase, not a launch-day feature.
+
+**Given up, deliberately:** dual-licensing the core — selling AGPL exceptions or relicensing later — is off the table once outside contributions land; no one can relicense the core without the consent of every contributor. That option is worth little here: the demonstrated buyers of AGPL exceptions *embed* a component in their own product, and Helpthread is an end application its users operate (running an unmodified AGPL helpdesk carries no copyleft obligations at all) — what remains, white-label resellers and blanket-AGPL-ban enterprises, is small. Also given up: a CLA's patent grant, warranties, and employer sign-offs — AGPL §11's per-contributor patent grant partially substitutes, and any indemnity offered to module customers is priced without upstream contributor representations. The revenue model is modules and the marketplace, not license arbitrage. The same structure binds Resonant IQ symmetrically: the company is a licensee of its contributors' code like anyone else, so core modifications running in any hosted offering get source-offered to its users under AGPL §13.
 
 **What's free and what's paid, stated early:** the core helpdesk — mail engine, conversations, agent inbox, knowledge base, the public API and MCP server, self-hosting — is AGPL-licensed free software, forever, and nothing free today gets paywalled retroactively. Paid, eventually: advanced first-party modules (AI assistants are the leading candidates) and possibly hosted convenience services. Monetization adds; it never subtracts.
 
 ### Module boundary
 
-The line between the AGPL core and commercial modules must be an engineered artifact, not an accident. Modules — first- or third-party — integrate through a narrowly-defined, documented public plugin API, and the core's license will carry an explicit linking permission for it (a plugin exception in the Classpath-exception tradition), so module authors are never left guessing whether their work becomes a derivative of the core. Where a module can live out-of-process — webhooks, the event API — that is the preferred shape. Drawing this boundary precisely is counsel-review work before the marketplace opens; the discipline it demands — narrow, stable, documented extension points — is the same discipline a good module API needs anyway.
+The line between the AGPL core and commercial modules must be an engineered artifact, not an accident. Modules — first- or third-party — integrate through a narrowly-defined, documented public plugin API, and the core's license will carry an explicit plugin exception for it (an AGPL-3.0 §7 additional permission in the Classpath-exception tradition), so module authors are never left guessing whether their work becomes a derivative of the core. Repository separation alone does no legal work — a build-time npm module compiles into the same running program as the core — so the exception text is the mechanism, and it carries the load for everyone: it covers network use (AGPL §13), not just conveyance, and it is deliberately symmetric — the same permission for first-party, third-party, and fork-based modules alike. First-party modules hold no privileged position: any hook a paid module needs ships in the public plugin API. Where a module can live out-of-process — webhooks, the event API — that is the preferred shape; it needs no exception at all.
+
+Under DCO the exception text is this project's real one-way door: once outside contributions merge, broadening it requires the consent of every copyright holder. Drawing the boundary precisely is therefore counsel-review work **before the first external contribution is accepted** — not before the marketplace opens — including how the exception text may evolve as the plugin API matures without ever becoming a back-door relicense of contributed code. The exception travels with every conveyed copy, so a fork keeps it and can grow its own module ecosystem; that is the accepted price of the trust structure, and it is why the assets that stay with the company — the Helpthread name and marks, the npm organization, the official marketplace — matter commercially. The discipline the boundary demands — narrow, stable, documented extension points — is the same discipline a good module API needs anyway.
 
 ### Provenance
 
-Helpthread is an independent implementation. The repository contains no code copied or derived from any copyleft-licensed project. The core is our own code, built on permissively-licensed foundations (RFCs for mail semantics, and MIT/Apache libraries and references such as postal-mime and Chatwoot's MIT core), with each license verified at adoption. Behavior is specified and validated against public standards, public documentation, and black-box observation of running systems. Every substantive change receives real human design and review before merge — ordinary pull-request review, preserved in git history — which is also what keeps AI-assisted work firmly copyrightable, and therefore dual-licensable, under current U.S. Copyright Office guidance.
+Helpthread is an independent implementation. The repository contains no code copied or derived from any copyleft-licensed project. The core is our own code, built on permissively-licensed foundations (RFCs for mail semantics, and MIT/Apache libraries and references such as postal-mime and Chatwoot's MIT core), with each license verified at adoption. Behavior is specified and validated against public standards, public documentation, and black-box observation of running systems. Every substantive change receives real human design and review before merge — ordinary pull-request review, preserved in git history — which is also what keeps AI-assisted work firmly copyrightable under current U.S. Copyright Office guidance. Copyright we can prove we hold is what gives the project standing to enforce the AGPL — copyright claims belong to whoever owns the lines at issue — and clean title to the commercial modules.
 
-**Ownership, decided:** Resonant IQ, Inc. holds the copyright and will run the marketplace — Helpthread is a Resonant IQ product. Remaining paperwork for counsel before the repository goes public: memorialize founder alignment in a short board consent, and draft the CLA in the company's name with successors-and-assigns language so a future spin-out of Helpthread into its own entity stays clean. **Open question:** the specific CLA instrument (individual and corporate CLA, likely administered via something like cla-assistant) is not yet finalized; it must be before any outside contribution is accepted.
+**Ownership, decided:** Resonant IQ, Inc. holds the copyright on its own work — pre-launch, that is the entire tree — owns the Helpthread name and marks, and will run the marketplace; Helpthread is a Resonant IQ product. Contributors keep theirs. Counsel paperwork, in deadline order: a short board consent memorializing founder alignment (before the repository goes public); the plugin exception text (before the first outside contribution is accepted — see the module boundary above); the trademark policy (before public launch). **Resolved 2026-07-10:** the contribution instrument is the DCO. The CLA that earlier drafts of this charter required is dropped — its consolidated-copyright rationale was wrong, and the relicensing power a CLA holds in reserve is precisely what the self-hosted audience this project serves has learned to distrust.
 
-This charter is not legal advice. Counsel reviews the licensing structure and the CLA before public launch.
+This charter is not legal advice. Counsel reviews the licensing structure, the plugin exception, and the trademark policy, each by its deadline above.
 
 ## 4. Architecture direction
 
@@ -73,8 +77,10 @@ Five things we do not trade away for speed, convenience, or a good demo:
 
 ## 7. Governance
 
-Solo-maintainer, BDFL model for now — there is one project, one person accountable for it, and that's honestly where it is. A CLA is required for every contribution, per the licensing section above. Conventional-commit conventions and PR review norms will get written down once there are contributors to write them down for; inventing process ahead of contributors is its own kind of scope creep, so this section stays short on purpose.
+Solo-maintainer, BDFL model for now — there is one project, one person accountable for it, and that's honestly where it is. Contributions are accepted under the DCO — every commit signed off, contributors keep their copyright — per the licensing section above. Conventional-commit conventions and PR review norms will get written down once there are contributors to write them down for; inventing process ahead of contributors is its own kind of scope creep, so this section stays short on purpose.
 
 ---
 
 **Status:** Written 2026-07-09, prior to the first code commit. This charter is the founding document of the Helpthread project and precedes any implementation.
+
+**Amended 2026-07-10 (HT-21):** §3 and §7 — the CLA/consolidated-copyright model replaced with DCO-only contributions; the module boundary's plugin exception promoted to the load-bearing legal mechanism, its counsel deadline moved to before the first external contribution; dual-licensing of the core deliberately given up; trademark policy added to pre-launch counsel work.
@@ -1,6 +1,6 @@
 # Helpthread — engine repo
 
-Helpthread is an open-source serverless helpdesk (AGPL-3.0 core, owned by Resonant IQ, Inc.). **CHARTER.md is the constitution** — read it before substantive work.
+Helpthread is an open-source serverless helpdesk (AGPL-3.0 core; a Resonant IQ, Inc. product). **CHARTER.md is the constitution** — read it before substantive work.
 
 ## References & provenance
 
@@ -12,7 +12,7 @@ Helpthread is an open-source serverless helpdesk (AGPL-3.0 core, owned by Resona
   - Modern TS/AI helpdesks (e.g. antiwork/helper) may be *looked at* for UX/AI patterns, but **their code is not adapted unless a permissive LICENSE is confirmed** — as of 2026-07-10 helper's and cossistant's licenses did not resolve on GitHub, so: look-only.
 - **FreeScout's role: a window into the Help Scout experience, nothing more.** Help Scout (closed SaaS) is the ease-of-use North Star; FreeScout is the open, self-hostable pane of glass we use to *model the interface* toward that bar. It is a UX/experience reference, never a code source. Its AGPL source is never read in a Helpthread session (the operating habit lives in `CLAUDE.local.md`).
 - Behavior is specified from RFCs, public documentation, and — where already captured — the black-box fixtures; we do not observe FreeScout further.
-- Every substantive change gets real human review before merge — ordinary PR review, preserved in git history. This is also what keeps AI-assisted work copyrightable and thus dual-licensable; a rubber stamp doesn't meet that bar.
+- Every substantive change gets real human review before merge — ordinary PR review, preserved in git history. This is also what keeps AI-assisted work copyrightable; a rubber stamp doesn't meet that bar.
 
 ## Coding discipline
 

@@ -4,14 +4,14 @@ Thanks for your interest this early. **Helpthread is not accepting external code
 
 ## Why not yet
 
-Helpthread is dual-licensed: an AGPL-3.0 core alongside commercially-licensed first-party modules (see [CHARTER.md](CHARTER.md) §3). For that model to work, the project maintainer must hold consolidated copyright over the codebase, which means every contributor signs a Contributor License Agreement (CLA) before their code can be merged. **The CLA isn't finalized yet.** Until it is, we can't accept pull requests — not because your work wouldn't be welcome, but because we can't lawfully merge it without the CLA in place, and we'd rather tell you up front than leave a PR hanging.
+Helpthread's core is AGPL-3.0, and contributions are accepted under the [Developer Certificate of Origin](https://developercertificate.org/) — you sign off your commits (`git commit -s`), you keep your copyright, and there is no CLA and never will be. Because contributors keep their copyright, the plugin exception that draws the line between the AGPL core and commercial modules (see [CHARTER.md](CHARTER.md) §3) effectively cannot be broadened once outside code lands. **That exception text isn't counsel-final yet.** Until it is, we can't responsibly merge external code — not because your work wouldn't be welcome, but because merging it would freeze legal text we're still getting right, and we'd rather tell you up front than leave a PR hanging.
 
 ## What you can do now
 
 - **Open an issue** — bug reports (once there's something to run), design questions, and feedback on the [charter](CHARTER.md) or the specs in `specs/` are genuinely useful and very welcome.
 - **Start a discussion** — thoughts on the architecture, the roadmap, or the approach.
 - **Watch or star** to follow along; the project is being built in the open.
 
-When the CLA is ready and the project is open for contributions, this file will change and say so. Until then, please don't invest time in a pull request — hold that energy for when we can actually accept it.
+When the exception text is final and the project is open for contributions, this file will change and say so — the requirement then will be a DCO sign-off on your commits and nothing else. Until then, please don't invest time in a pull request — hold that energy for when we can actually accept it.
 
 — Resonant IQ, Inc.