ARMUR TECHNOLOGIES INC.
CORPORATE CONTRIBUTOR LICENSE AGREEMENT
Proposed version: 1.0-review-2026-10-21
INTERIM v1.0-review-2026-10-21 — ADOPTED AS PROJECT POLICY DIRECTION; UNDER FINAL LEGAL REVIEW; NOT YET OPEN FOR SIGNATURE

> Astra-reviewed proposed revision (2026-10-21). PROPOSED for counsel, not an
> approved license. It incorporates the individual CLA by reference; do not
> execute without Annex 1 attached.

## 1. Parties and incorporated terms

This agreement is between Armur Technologies Inc., a Delaware corporation
("Company"), and [ADD: corporate contributor's exact legal name and legal form]
("Organization"), organized in [ADD: jurisdiction]. It concerns Pentest Swarm AI,
https://github.com/Armur-Ai/Pentest-Swarm-AI.

Organization adopts the COMPLETE individual CLA identified below and attached
as Annex 1 ("Incorporated Terms"), subject only to the express substitutions
in this corporate agreement. Do not execute this form with a missing annex
or a reference only to a changing webpage.

Approved individual CLA version: [ADD]
SHA-256 of exact incorporated text: [ADD]
Annex 1 / immutable copy location: [ADD]

Throughout the Incorporated Terms, "You" and "Your" mean Organization, not the
signing employee, a parent, a subsidiary, or any other affiliate. Each additional
rights-owning entity requires its own grant executed by an authorized signer.
Sections 1, 2, 5 and 12 of the Incorporated Terms are adjusted only as expressly
specified below. The remaining provisions, including Company-only copyright
licensing, patent grants, consideration, transfer and mandatory-law limits,
apply without change.

## 2. Rights granted by Organization

Organization retains its ownership and grants the copyright and patent rights
specified in sections 3 and 4 of the Incorporated Terms for Covered Corporate
Contributions. The grant comes from Organization itself. No employee is treated
as assigning Organization's rights through an individual click or DCO sign-off.

"Covered Corporate Contributions" means the original authorship and rights
owned or validly licensable by Organization in Project Submissions within the
scope below. Excluded Material and third-party restrictions are handled as in
the Incorporated Terms. An employee's independently owned work is not included
merely because the employee appears on the roster.

## 3. Effective date and prospective scope

This corporate agreement becomes effective on the date the last of Company
and Organization signs an approved version. Organization authorizes the listed
contributors to submit Covered Corporate Contributions from that date while
listed and within their stated authority. Existing open PRs are covered only
if expressly identified below; earlier accepted material requires Schedule A.

Current open PRs expressly included: [repository, PRs, commit/head SHAs, or NONE]
Prospective scope: [defined Project contributions, business team or scope]
Effective date: [ADD upon completed execution]

## 4. Authorized contributor roster

List for each contributor: legal name; GitHub login; stable account ID where
available; authorized contribution scope; start date; end date if applicable.
The roster is Annex 2 and is maintained as a private record.

Organization may add or remove contributors through a written notice from its
designated authorized administrator, acknowledged by Company. Removal affects
future submissions after its effective date; it does not revoke grants already
made or erase existing contribution records. Changes do not add another legal
entity as a grantor. Company must verify the authority behind roster changes.

## 5. Historical scope

Historical coverage is NONE unless Organization separately executes Schedule A
identifying the historical contributions and accepts the exact incorporated
agreement version. Historical authors need not remain employees, but Organization
must actually own or have authority over the relevant rights. A list of old
commits does not itself establish that ownership.

## 6. Authority and disclosures

Organization represents that it owns or has authority to grant the specified
rights in Covered Corporate Contributions. Its signer represents that the
signer has authority to bind Organization. Organization will disclose known
third-party material, exclusions and ownership restrictions and will notify
Company of materially inaccurate disclosures learned later.

These corporate representations replace the natural-person legal-capacity and
employer-permission statements in section 5 of the Incorporated Terms. The
remaining disclosure and knowledge-qualified representations apply. Personal
contributor agreements cover any separately owned personal rights; they do not
replace this Organization's grant. DCO sign-off remains a separate project
submission requirement.

## 7. Execution and notice details

Organization notice address: [ADD]
Organization authorized administrator and private email: [ADD]
Company legal contact / notices: akhil@armur.ai (postal notice address to be added later)
Executed corporate version/hash: [ADD]
Annex 1 approved individual CLA version/hash: [ADD]
Annex 2 roster version/hash: [ADD]
Schedule A version/hash, if any: [ADD or NONE]

For Organization:
Authorized signer's legal name and title: [ADD]
Signature and date/timezone: [ADD]
Authority evidence/record reference: [ADD]

For Armur Technologies Inc.:
Authorized signer's legal name and title: [ADD]
Signature and date/timezone: [ADD]

Keep signed forms, identity records and authority evidence private. Publish
the unsigned approved form and contribution policy, not completed corporate
forms or private employee information.