the order here is backwards. publish the package first and let people apply without committing. right now GitLab gets the signal before employees even get the terms.