diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index b8e12cb..e56bdda 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -21,3 +21,7 @@
 # Root config and scripts
 /package.json @zeidalidiez
 /tsconfig*.json @zeidalidiez
+/LICENSE @zeidalidiez
+/COPYING @zeidalidiez
+/DCO @zeidalidiez
+/CONTRIBUTING.md @zeidalidiez
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..ee3dc9d
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,14 @@
+## Summary
+
+<!-- What changed and why? -->
+
+## Testing
+
+- [ ] `npm test`
+- [ ] `npm run typecheck`
+- [ ] `npm run build:web` (if web/build files changed)
+
+## License and DCO
+
+- [ ] I agree that this contribution is licensed under GPL-3.0-or-later, the same license as this project.
+- [ ] Every commit in this pull request includes a DCO sign-off (`Signed-off-by:`). Use `git commit -s`, or run `git rebase --signoff` to fix existing commits.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..5b925d3
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,39 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Unit tests
+        run: npm test
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Build web app
+        run: npm run build:web
diff --git a/.gitmessage b/.gitmessage
new file mode 100644
index 0000000..6aab9d4
--- /dev/null
+++ b/.gitmessage
@@ -0,0 +1,10 @@
+# <subject> (max 72 chars)
+#
+# <optional body>
+#
+# Every commit must include a DCO sign-off for the DCO GitHub App.
+# Use: git commit -s
+# Or add manually:
+# Signed-off-by: Your Name <your.email@example.com>
+#
+# See CONTRIBUTING.md and DCO for details.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..035030c
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,88 @@
+# Contributing to Grillo Project Hub
+
+Thank you for helping improve Grillo Project Hub.
+
+## License
+
+By contributing to this repository, you agree that your contributions will be
+licensed under the same terms as the project: **GNU General Public License
+v3.0 or later (GPL-3.0-or-later)**.
+
+See [LICENSE](LICENSE) for the full license text and [COPYING](COPYING) for the
+standard short copyright notice.
+
+## Developer Certificate of Origin (DCO)
+
+This project uses the [Developer Certificate of Origin 1.1](DCO). The
+[DCO GitHub App](https://github.com/apps/dco) checks that every commit in a
+pull request includes a sign-off line.
+
+Add a sign-off to each commit:
+
+```bash
+git commit -s -m "Your commit message"
+```
+
+That appends a line like:
+
+```text
+Signed-off-by: Your Name <your.email@example.com>
+```
+
+Use the same name and email as your Git author identity (`git config user.name`
+and `git config user.email`).
+
+### Fixing commits that are missing a sign-off
+
+If DCO fails on an open pull request, amend or rebase your branch so every
+commit is signed off:
+
+```bash
+# last commit only
+git commit --amend -s --no-edit
+
+# every commit on the branch (replace N with commit count)
+git rebase HEAD~N --signoff
+git push --force-with-lease
+```
+
+## How to contribute
+
+1. Fork the repository and create a feature branch from `main`.
+2. Enable the local commit template so Git reminds you to sign off:
+
+   ```bash
+   git config commit.template .gitmessage
+   ```
+
+3. Make your changes with tests where behavior changes.
+4. Commit with `git commit -s` so the DCO check passes.
+5. Run the local checks before opening a pull request:
+
+   ```bash
+   npm install
+   npm test
+   npm run typecheck
+   npm run build:web
+   ```
+
+6. Open a pull request against `main` with a clear summary and test notes.
+7. Wait for CI and required checks (including DCO) to pass before merging.
+
+Direct pushes to `main` are discouraged; use pull requests so CI and review
+can run first.
+
+## Source file notices
+
+New source files should include the short GPL header from [COPYING](COPYING)
+or this minimal form at the top of the file:
+
+```text
+// Grillo Project Hub — Copyright (C) 2026 ZDOSS
+// SPDX-License-Identifier: GPL-3.0-or-later
+```
+
+## Questions
+
+Open a GitHub issue for bugs, feature requests, or licensing questions before
+starting large changes.
diff --git a/COPYING b/COPYING
new file mode 100644
index 0000000..028aea1
--- /dev/null
+++ b/COPYING
@@ -0,0 +1,18 @@
+Grillo Project Hub
+Copyright (C) 2026 ZDOSS
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+The full text of GPLv3 is also available in the LICENSE file at the
+repository root.
diff --git a/DCO b/DCO
new file mode 100644
index 0000000..49b8cb0
--- /dev/null
+++ b/DCO
@@ -0,0 +1,34 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.
diff --git a/Readme.md b/Readme.md
index 2c3d2d1..e8990a1 100644
--- a/Readme.md
+++ b/Readme.md
@@ -93,4 +93,16 @@ Run them all with `npm test` (unit) and `npm run test:e2e` (browser).
 
 ## License
 
-See `LICENSE` in the repository root.
+Copyright (C) 2026 ZDOSS
+
+Grillo Project Hub is free software: you can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the Free
+Software Foundation, either version 3 of the License, or (at your option) any
+later version.
+
+- Full license text: [LICENSE](LICENSE)
+- Short notice: [COPYING](COPYING)
+- How to contribute under GPL: [CONTRIBUTING.md](CONTRIBUTING.md)
+- Contributor sign-off policy: [DCO](DCO) (use `git commit -s`)
+
+SPDX identifier: `GPL-3.0-or-later`
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index cdca283..a67edaf 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -2,6 +2,7 @@
   "name": "@gph/desktop",
   "version": "0.1.0",
   "private": true,
+  "license": "GPL-3.0-or-later",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/apps/desktop/src/main.tsx b/apps/desktop/src/main.tsx
index 38cfb1f..790b9e0 100644
--- a/apps/desktop/src/main.tsx
+++ b/apps/desktop/src/main.tsx
@@ -1,3 +1,9 @@
+/**
+ * Grillo Project Hub — desktop shell
+ * Copyright (C) 2026 ZDOSS
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
 import { StrictMode } from "react";
 import { createRoot } from "react-dom/client";
 import { BrowserRouter, Route, Routes } from "react-router-dom";
diff --git a/apps/web/package.json b/apps/web/package.json
index 30badc3..76e4df2 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -2,6 +2,7 @@
   "name": "@gph/web",
   "version": "0.1.0",
   "private": true,
+  "license": "GPL-3.0-or-later",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/apps/web/src/main.tsx b/apps/web/src/main.tsx
index 368a67f..3eaa981 100644
--- a/apps/web/src/main.tsx
+++ b/apps/web/src/main.tsx
@@ -1,3 +1,9 @@
+/**
+ * Grillo Project Hub — web/PWA shell
+ * Copyright (C) 2026 ZDOSS
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
 import { StrictMode } from "react";
 import { createRoot } from "react-dom/client";
 import { BrowserRouter, Route, Routes } from "react-router-dom";
diff --git a/package.json b/package.json
index 9e9c0c2..7812677 100644
--- a/package.json
+++ b/package.json
@@ -2,6 +2,7 @@
   "name": "grillo-project-hub",
   "version": "0.1.0",
   "private": true,
+  "license": "GPL-3.0-or-later",
   "description": "Grillo Project Hub - a free, open source, hybrid project management suite",
   "workspaces": [
     "packages/*",
diff --git a/packages/core/package.json b/packages/core/package.json
index 45f72b4..fd5ef58 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -2,6 +2,7 @@
   "name": "@gph/core",
   "version": "0.1.0",
   "private": true,
+  "license": "GPL-3.0-or-later",
   "type": "module",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index a17d5a4..d7517e4 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -1,3 +1,9 @@
+/**
+ * Grillo Project Hub — @gph/core
+ * Copyright (C) 2026 ZDOSS
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
 export * from "./domain/index";
 export * from "./storage/index";
 export * from "./export/index";
diff --git a/packages/ui/package.json b/packages/ui/package.json
index a3ee49a..7741720 100644
--- a/packages/ui/package.json
+++ b/packages/ui/package.json
@@ -2,6 +2,7 @@
   "name": "@gph/ui",
   "version": "0.1.0",
   "private": true,
+  "license": "GPL-3.0-or-later",
   "type": "module",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
diff --git a/packages/ui/src/index.ts b/packages/ui/src/index.ts
index 54a2498..792fb78 100644
--- a/packages/ui/src/index.ts
+++ b/packages/ui/src/index.ts
@@ -1,3 +1,9 @@
+/**
+ * Grillo Project Hub — @gph/ui
+ * Copyright (C) 2026 ZDOSS
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
 import "./theme/global.css";
 
 export * from "./theme";