docs: note GS-LF as richest aroma data (deferred for legal reasons); add CLA (#48)

- AROMA.md: state plainly that OpenPOM's curated GS-LF (~4,983 molecules) is the
  richest aroma-descriptor data found anywhere and exactly what we'd train on —
  deferred SOLELY for legal reasons (NonCommercial/proprietary), not technical.
  The clean route to comparable richness is PMP 2001 license or customer data.
- CLA.md: lightweight Contributor License Agreement — contributors keep copyright
  but grant a relicensing right, so Flavormancer can be both open-source and the
  basis of proprietary on-premise customer builds. Accepted via commit sign-off.
- CONTRIBUTING.md: require `git commit -s` sign-off (DCO + CLA).

Signed-off-by: Austin L. <86896075+rvnminers-A-and-N@users.noreply.github.com>

Author: rvnminers-A-and-N

CLA.md

@@ -0,0 +1,55 @@
+# Contributor License Agreement (CLA)
+
+> **Plain-language summary.** Flavormancer is meant to be offered *both* as an
+> open-source project *and* as proprietary, on-premise builds for commercial
+> customers. For that to be possible, the project needs the right to **relicense**
+> every contribution. By contributing, **you keep your copyright**, but you grant the
+> project owner a broad license to use and relicense your contribution. This document
+> is a template for the project's own small team — **get legal review before relying
+> on it commercially.**
+
+## Agreement
+
+By submitting a contribution (code, documentation, data, or other material) to this
+repository, **You** agree to the following for each contribution You submit:
+
+1. **Right to submit.** The contribution is Your original work, or You have sufficient
+   rights to submit it under these terms, and to Your knowledge it does not violate any
+   third party's intellectual-property rights. (This matters here in particular: do not
+   contribute data or model weights derived from NonCommercial or otherwise
+   commercially-restricted sources — see [`docs/SOURCES.md`](docs/SOURCES.md).)
+
+2. **Copyright license.** You **retain copyright** to Your contribution. You grant the
+   project owner (**Echelon Technology Solutions**) and downstream recipients of the
+   software a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license to
+   reproduce, modify, prepare derivative works of, publicly display, sublicense, and
+   distribute Your contribution and such derivative works.
+
+3. **Relicensing grant.** You expressly grant the project owner the right to license
+   and **relicense** Your contribution under any terms — including different
+   open-source licenses *and* **proprietary / commercial licenses** (e.g. closed,
+   on-premise builds delivered to customers). This grant is what allows the project to
+   be both open source and the basis of commercial offerings.
+
+4. **Patent license.** You grant a perpetual, worldwide, non-exclusive, royalty-free,
+   irrevocable patent license — for any patent claims You can license that are
+   necessarily infringed by Your contribution alone or combined with the project — to
+   make, use, offer to sell, sell, and distribute Your contribution.
+
+5. **No obligation.** The project owner is under no obligation to use or include Your
+   contribution.
+
+6. **As is.** Your contribution is provided "as is", without warranties of any kind.
+
+You retain all right to use Your own contribution for any other purpose.
+
+## How to accept
+
+Sign off every commit:
+
+```bash
+git commit -s        # adds a "Signed-off-by: Your Name <you@example.com>" line
+```
+
+The sign-off certifies the [Developer Certificate of Origin](https://developercertificate.org/)
+**and** records Your agreement to this CLA. Use a real name and a reachable email.

CONTRIBUTING.md

@@ -31,6 +31,10 @@ docs(data): document ChemTastesDB column names
 - **Types:** `feat fix docs chore refactor test perf`
 - **Scopes:** `training aroma api serving ui infra data docs`
 - Commits must be **signed** (GPG or SSH). PRs with unsigned commits won't merge.
+- Commits must also be **signed off** (`git commit -s`) — the `Signed-off-by:` line
+  certifies the [DCO](https://developercertificate.org/) and your agreement to the
+  project's [Contributor License Agreement](CLA.md), which lets Flavormancer be offered
+  both open-source and as proprietary on-premise builds. See [`CLA.md`](CLA.md).
 
 ## Pull requests
 

docs/AROMA.md

@@ -37,6 +37,16 @@ the whole answer:
 So **OpenPOM does *not* "come with commercially-allowed data"** — it comes with
 *NonCommercial* data. The code was never the blocker; the data always was.
 
+**The richest target — deferred for *legal* reasons, not technical ones.** To be
+explicit: OpenPOM's curated `curated_GS_LF_merged_4983.csv` (~4,983 molecules with
+expert odor labels) is the **richest aroma-descriptor dataset we found anywhere**, and
+it's exactly what we'd train on — it's what OpenPOM itself trains on, so the model
+*would* work. We defer it **solely because it is NonCommercial / proprietary**, not
+because of any limitation in our pipeline. A more legally-aggressive actor might train
+on it; for a commercial product we will not. The clean route to comparable richness is
+to **license** the equivalent data (Leffingwell **PMP 2001**) or to use the customer's
+own — same data quality, with the commercial rights attached.
+
 **What this means for us:** we keep only OpenPOM's *code* — the MIT architecture and
 training recipe — and we **never use its GS-LF-trained weights**. When clean fuel
 exists we **train our own weights from scratch** on it: either a **licensed copy**