Improve profile readme

.github/PULL_REQUEST_TEMPLATE.md

@@ -29,3 +29,4 @@ see the blast radius:
 - [ ] Tests added for new behaviour
 - [ ] Feature matrix updated if this affects a cross-platform capability
 - [ ] Docs / changelog updated if the change is user-facing
+- [ ] Commits are signed off (DCO) — `git commit -s`

.github/workflows/dco.yml

@@ -0,0 +1,51 @@
+name: DCO
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dco:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check Signed-off-by on all commits
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          commits=$(git rev-list --no-merges "$BASE_SHA".."$HEAD_SHA")
+          missing=0
+          for sha in $commits; do
+            body=$(git log -1 --format='%B' "$sha")
+            if ! echo "$body" | grep -qE '^Signed-off-by: .+ <.+@.+>'; then
+              short=$(git rev-parse --short "$sha")
+              subject=$(git log -1 --format='%s' "$sha")
+              echo "::error file=::Missing Signed-off-by on commit $short ($subject)"
+              missing=$((missing + 1))
+            fi
+          done
+          if [ "$missing" -gt 0 ]; then
+            echo ""
+            echo "❌ $missing commit(s) missing Signed-off-by."
+            echo ""
+            echo "To fix, rebase with signoff:"
+            echo "  git rebase --signoff origin/\${{ github.base_ref }}"
+            echo "  git push --force-with-lease"
+            echo ""
+            echo "Or amend the last commit:"
+            echo "  git commit --amend -s --no-edit"
+            echo ""
+            echo "See: https://developercertificate.org/"
+            exit 1
+          fi
+          echo "✅ All commits have Signed-off-by"

CONTRIBUTING.md

@@ -46,4 +46,36 @@ A pull request is ready to merge when:
 - **Small, focused PRs** are easier to review and land faster.
 - **Talk to us first** for big changes — open an issue or an RFC.
 
+## Developer Certificate of Origin (DCO)
+
+All contributions to the Dasher project must be signed off under the
+[Developer Certificate of Origin](https://developercertificate.org/). This is
+a lightweight alternative to a CLA — it affirms that you wrote (or have the
+right to submit) the code you're contributing.
+
+**How to sign off:** add `-s` (or `--signoff`) to your commit command:
+
+```sh
+git commit -s -m "your commit message"
+```
+
+This adds a `Signed-off-by:` trailer to the commit message automatically. If
+you forgot, you can amend:
+
+```sh
+git commit --amend -s --no-edit
+```
+
+For an existing PR with multiple unsigned commits, rebase with signoff:
+
+```sh
+git rebase --signoff BASE_BRANCH
+git push --force-with-lease
+```
+
+> **Why DCO instead of a CLA?** Dasher is MIT-licensed and community-driven. A
+> full CLA adds legal friction for volunteers. The DCO achieves provenance
+> tracking with a single line, and is the same model used by the Linux kernel,
+> Git, and many other open-source projects.
+
 _This file is the organisation-wide default. Individual repositories may add their own `CONTRIBUTING.md` with platform-specific build steps and rules, which take precedence here._