legal: add CLA, CONTRIBUTING, NOTICE, and data ownership notice

- CLA: contributors grant copyright + patent license to Geass Inc.
- CONTRIBUTING.md: how to report, PR requirements, CLA sign-off
- NOTICE: Apache 2.0 copyright notice for Geass Inc.
- data-notice: reported samples become proprietary training data

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ithiria894

.github/ISSUE_TEMPLATE/data-notice.md

@@ -0,0 +1,18 @@
+---
+name: About reported samples
+about: This is not an issue template. It explains how reported samples are used.
+---
+
+<!-- This file exists for transparency, not as a template to fill in. -->
+
+## How reported samples are used
+
+When you report a missed detection or false positive, the tool description you share may be used to:
+
+1. Diagnose why the scanner missed or false-alarmed.
+2. Add the sample (or a redacted version) to the training dataset for future probe versions.
+3. Include the sample in benchmark suites to prevent regressions.
+
+Reported samples become part of IntentProbe's proprietary training data, owned by Geass Inc. By submitting an issue with a sample, you agree that the sample may be used for these purposes.
+
+Always redact secrets, credentials, private URLs, and customer data before submitting.

CLA.md

@@ -0,0 +1,17 @@
+# Individual Contributor License Agreement
+
+By submitting a pull request or patch to this repository, you agree to the following terms:
+
+1. **Grant of Copyright License.** You grant Geass Inc. (and its successors) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute your contributions and derivative works.
+
+2. **Grant of Patent License.** You grant Geass Inc. (and its successors) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the work, where such license applies only to those patent claims licensable by you that are necessarily infringed by your contribution alone or by combination of your contribution with the work to which you submitted it.
+
+3. **You represent that you are legally entitled to grant the above licenses.** If your employer has rights to intellectual property that you create, you represent that you have received permission to make contributions on behalf of that employer, or that your employer has waived such rights for your contributions.
+
+4. **You represent that each of your contributions is your original creation.** You represent that your contribution submissions include complete details of any third-party license or other restriction of which you are personally aware and which are associated with any part of your contributions.
+
+5. **You are not expected to provide support for your contributions,** except to the extent you desire to provide support. You may provide support for free, for a fee, or not at all.
+
+6. **Signing.** By adding your name to the `Signed-off-by` trailer in your commit message (e.g., `Signed-off-by: Your Name <email>`), you indicate that you agree to this CLA for that contribution.
+
+This agreement is based on the Apache Individual Contributor License Agreement v2.0.

CONTRIBUTING.md

@@ -0,0 +1,35 @@
+# Contributing to IntentProbe
+
+Contributions are welcome. Here is what helps most:
+
+## Report missed detections
+
+If IntentProbe misses a poisoned tool you found in the wild, open a [Missed detection](https://github.com/mcpware/IntentProbe/issues/new?template=missed-detection.yml) issue. Every missed sample directly improves the next probe version.
+
+## Report false positives
+
+If a benign tool gets warned or blocked, open a [False positive](https://github.com/mcpware/IntentProbe/issues/new?template=false-positive.yml) issue.
+
+## Redact secrets
+
+Do not paste live credentials, API keys, private URLs, customer names, or personal data into issues or pull requests. Replace real values with placeholders.
+
+## Pull requests
+
+Before submitting a PR:
+
+1. Read the [CLA](CLA.md). By submitting, you agree to its terms.
+2. Add `Signed-off-by: Your Name <email>` to your commit message.
+3. Run the regression suites:
+
+```bash
+python -m research.activation_scanner_regression --no-build --pretty
+python -m research.activation_scanner_cli_regression --pretty
+python -m research.activation_scanner_hook_regression --pretty
+```
+
+## What is not accepted
+
+- Dependencies that add network calls or telemetry.
+- Changes that upload scan targets or results to external services.
+- Probe weight changes without a reproducible training command and benchmark comparison.

NOTICE

@@ -0,0 +1,12 @@
+IntentProbe
+Copyright 2026 Geass Inc.
+
+Licensed under the Apache License, Version 2.0.
+See LICENSE for the full license text.
+
+This product includes software developed by Geass Inc.
+(https://github.com/mcpware/IntentProbe)
+
+The activation probe methodology is described in:
+"Can Model Internals Detect MCP Tool Poisoning That Text Analysis Cannot?"
+DOI: 10.5281/zenodo.19990741