ci(framework): remove DCO sign-off requirement

Drop the Developer Certificate of Origin enforcement that was failing
pipelines on unsigned commits:

- delete .github/workflows/dco.yml (the only enforcement)
- remove the DCO required status check from .github/rulesets/main.json
  (the live ruleset already lacked it; this realigns the file with live)
- strip DCO references from CONTRIBUTING.md, README.md, MAINTAINERS.md,
  and the PR template

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Baptiste LAFOURCADE <baptiste.lafourcade@gmail.com>

Author: blafourcade

.github/PULL_REQUEST_TEMPLATE.md

@@ -14,7 +14,7 @@
 Walk a reviewer through the technical resolution: the approach you took, why
 this way over the alternatives, and anything non-obvious (trade-offs, edge
 cases, follow-ups). This narrative is the point of the PR. The conventional
-title, DCO sign-off, and pre-commit hooks are already enforced by CI, so don't
+title and pre-commit hooks are already enforced by CI, so don't
 re-assert them here. Spend your words on the *how*.
 -->
 

.github/rulesets/main.json

@@ -29,8 +29,7 @@
         "strict_required_status_checks_policy": false,
         "required_status_checks": [
           {"context": "lefthook (framework-local checks)"},
-          {"context": "Commitlint"},
-          {"context": "Verify Developer Certificate of Origin sign-off"}
+          {"context": "Commitlint"}
         ]
       }
     },

.github/workflows/dco.yml

@@ -15,7 +15,7 @@ flowchart TD
     Who{"Your profile?"}
     Pub["Public - discuss, react, upvote"]
     Core["Core Team - vote on roadmap priority"]
-    Cert["Certifie AIDD - branch, commit (DCO), open PR"]
+    Cert["Certifie AIDD - branch, commit, open PR"]
     Rev["Habilite AIDD - review (CODEOWNERS)"]
     Merge["Habilite AIDD - merge, release-please ships"]
 
@@ -106,10 +106,10 @@ No live reload - run `codex plugin marketplace upgrade` after each change to ref
 
 ## 2. Commit
 
-Format: `<type>(<scope>): description`, **signed off** for the [DCO](https://developercertificate.org/).
+Format: `<type>(<scope>): description`.
 
 ```bash
-git commit -s -m "feat(aidd-dev): add for-sure skill"
+git commit -m "feat(aidd-dev): add for-sure skill"
 ```
 
 **Scope** - one per commit (split cross-plugin changes):
@@ -125,19 +125,12 @@ git commit -s -m "feat(aidd-dev): add for-sure skill"
 - `feat` → minor · `fix` / `perf` → patch · `!` or `BREAKING CHANGE:` → major
 - `docs` / `refactor` / `style` / `test` / `build` / `ci` / `chore` → no release
 
-**DCO** - `-s` adds the `Signed-off-by` trailer. Forgot one?
-
-```bash
-git commit --amend --signoff       # last commit
-git rebase --signoff origin/main   # whole branch
-```
-
-The [`DCO`](./.github/workflows/dco.yml) check fails any unsigned commit. Versioning and the release bundles are automated - see [Releases](#releases).
+Versioning and the release bundles are automated - see [Releases](#releases).
 
 ## 3. Open a pull request
 
 - Work on a branch, not `main`.
-- **Fill the PR template** (applied automatically): explain *what* changed and *how* you resolved it technically - that narrative is the point of the PR. The conventional title, DCO sign-off, and pre-commit hooks are already enforced by CI, so don't spend the description re-asserting them.
+- **Fill the PR template** (applied automatically): explain *what* changed and *how* you resolved it technically - that narrative is the point of the PR. The conventional title and pre-commit hooks are already enforced by CI, so don't spend the description re-asserting them.
 - **Label the PR** so reviewers and the [Roadmap board](https://github.com/orgs/ai-driven-dev/projects/8) triage at a glance:
 
   | Label | When to use |

CONTRIBUTING.md

@@ -316,7 +316,7 @@ Install issues, load problems, and the framework's current limits → [`docs/TRO
 
 ## Contributing
 
-Everyone can shape this project. **Anyone** can open issues, react, and upvote ideas in [Discussions](https://github.com/ai-driven-dev/framework/discussions) (a signal); a counted roadmap vote is a benefit of **Core Team** membership in the [AIDD](https://www.ai-driven-dev.fr/) programme (training/community/coaching) and up, and **pull-request rights** are held by [Certifié and Habilité contributors](./GOVERNANCE.md#roles) so the standard stays consistent. Contributions are made under the [DCO](./CONTRIBUTING.md#2-commit) (sign off with `git commit -s`). See [`CONTRIBUTING.md`](./CONTRIBUTING.md) for the contribution flow, the commit scope discipline, and the templates each surface (skill, agent, rule, command) follows, and [`GOVERNANCE.md`](./GOVERNANCE.md) for the roles and how decisions get made.
+Everyone can shape this project. **Anyone** can open issues, react, and upvote ideas in [Discussions](https://github.com/ai-driven-dev/framework/discussions) (a signal); a counted roadmap vote is a benefit of **Core Team** membership in the [AIDD](https://www.ai-driven-dev.fr/) programme (training/community/coaching) and up, and **pull-request rights** are held by [Certifié and Habilité contributors](./GOVERNANCE.md#roles) so the standard stays consistent. See [`CONTRIBUTING.md`](./CONTRIBUTING.md) for the contribution flow, the commit scope discipline, and the templates each surface (skill, agent, rule, command) follows, and [`GOVERNANCE.md`](./GOVERNANCE.md) for the roles and how decisions get made.
 
 To build and ship a brand-new plugin through this marketplace, see [`docs/CREATE_PLUGIN.md`](docs/CREATE_PLUGIN.md).
 

README.md

@@ -17,7 +17,7 @@ How to operate this repository day to day. For **who** may do what and the decis
 
 - **Triage issues.** New issues auto-add to board #8. Set `Status` / `Area` / `Priority` / `Work Type`; link under an epic (native sub-issues) if relevant.
 - **Roadmap.** Priority is set by the community vote (mechanism in `GOVERNANCE.md`). Accepted items live on board #8 - keep `ROADMAP.md` as a pointer, do not maintain a second list.
-- **Review PRs.** Every PR needs a Habilité (CODEOWNERS) approval; checks `lefthook`, `Commitlint`, `DCO` must pass; squash-merge.
+- **Review PRs.** Every PR needs a Habilité (CODEOWNERS) approval; checks `lefthook`, `Commitlint` must pass; squash-merge.
 
 ## Releases
 
@@ -38,7 +38,7 @@ Versions live in `.release-please-manifest.json`. Forcing a version / pre-releas
 
 ## Branch protection & the bot bypass
 
-`main` accepts only PRs (no direct push, no force-push, no deletion) with a CODEOWNERS review and passing `lefthook` / `Commitlint` / `DCO`.
+`main` accepts only PRs (no direct push, no force-push, no deletion) with a CODEOWNERS review and passing `lefthook` / `Commitlint`.
 
 Two bypass actors (both `pull_request` mode, so neither can push directly to `main`):
 - the **aidd-bot GitHub App** (`Integration`) - release-please and the Dependabot auto-merge mint a token from it (`actions/create-github-app-token`), so their PRs trigger the required checks *and* the App merges them past the human-review rule.