From 6f2a1191c305ce591024203747e1792816bb314c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 30 Sep 2026 23:24:12 +0100 Subject: [PATCH 1/4] docs: add Signed commits section to CONTRIBUTING Owner ruling D218. See docs/SIGNING-POLICY.adoc in hyperpolymath/standards. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f --- .github/CONTRIBUTING.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 7e3f9f8..430c70c 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -111,3 +111,18 @@ When you make a non-obvious design decision, write it down: - Estate-wide concerns (policy, conventions, CI): file at `hyperpolymath/standards/issues`. + +## Signed Commits + +Every commit that reaches the default branch must be signed; a ruleset refuses +unsigned pushes. Estate policy: +[SIGNING-POLICY](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc). + +- **People and interactive agents** sign with an SSH key registered on GitHub + as a *signing* key (`gpg.format=ssh`, `commit.gpgsign=true`). The committer + email must be verified on that account. +- **Apps, bots and workflows** never `git push` local commits. They write + through the API (`createCommitOnBranch`, the estate `signed-push` action, or a + squash merge) so that GitHub signs the commit. +- Merge PRs with **squash**. Rebase-merge replays commits unsigned and is + disabled. From 4547780619b11377874676a0b27ae16890418513 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 30 Sep 2026 23:27:55 +0100 Subject: [PATCH 2/4] docs: correct Signed commits section Owner ruling D218. See docs/SIGNING-POLICY.adoc in hyperpolymath/standards. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f --- .github/CONTRIBUTING.md | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 430c70c..d7ea656 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -112,7 +112,7 @@ When you make a non-obvious design decision, write it down: - Estate-wide concerns (policy, conventions, CI): file at `hyperpolymath/standards/issues`. -## Signed Commits +## Signed commits Every commit that reaches the default branch must be signed; a ruleset refuses unsigned pushes. Estate policy: @@ -122,7 +122,9 @@ unsigned pushes. Estate policy: as a *signing* key (`gpg.format=ssh`, `commit.gpgsign=true`). The committer email must be verified on that account. - **Apps, bots and workflows** never `git push` local commits. They write - through the API (`createCommitOnBranch`, the estate `signed-push` action, or a - squash merge) so that GitHub signs the commit. -- Merge PRs with **squash**. Rebase-merge replays commits unsigned and is - disabled. + through the API (`createCommitOnBranch` or the estate `signed-push` action) + so that GitHub signs each commit. +- Merge PRs with **squash**. The ruleset checks every commit on the PR branch, + not just the result, so one unsigned commit blocks the merge. Re-create such a + branch with signed commits (`git cherry-pick -S`) and open a new PR. + Rebase-merge replays commits unsigned and is disabled. From 2ef6b4a4fd0aa4fb7106412b8f2e7699570e8720 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 30 Sep 2026 23:45:44 +0100 Subject: [PATCH 3/4] docs: align existing signing guidance with SSH-for-people Owner ruling D218. See docs/SIGNING-POLICY.adoc in hyperpolymath/standards. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f --- .github/CONTRIBUTING.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index d7ea656..2c941d4 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -19,7 +19,7 @@ Prerequisites — the minimum versions and where to get them: - `` v\`\\` — ``. -- GPG signing key configured (estate policy — all commits must be +- SSH signing key configured (estate policy — all commits must be signed). See [standards/docs/secure-coding-training.md](https://github.com/hyperpolymath/standards/blob/main/docs/secure-coding-training.md). @@ -55,7 +55,7 @@ just fmt # auto-format just lint # static checks ``` -- All commits must be **GPG-signed** (CI enforces; see +- All commits must be **signed**, with SSH for people (CI enforces; see [standards](https://github.com/hyperpolymath/standards)). - All source files must carry an **SPDX-License-Identifier** header (CI From e195c67022a22746a047be44598de72a1cd00143 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 1 Oct 2026 00:07:23 +0100 Subject: [PATCH 4/4] docs: align Signed commits section with SSH-for-people and heading level Owner ruling D218. See docs/SIGNING-POLICY.adoc in hyperpolymath/standards. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f --- .github/CONTRIBUTING.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index 2c941d4..6f5f9a2 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -119,8 +119,8 @@ unsigned pushes. Estate policy: [SIGNING-POLICY](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc). - **People and interactive agents** sign with an SSH key registered on GitHub - as a *signing* key (`gpg.format=ssh`, `commit.gpgsign=true`). The committer - email must be verified on that account. + as a *signing* key (`gpg.format=ssh`, `user.signingkey=.pub`, + `commit.gpgsign=true`). The committer email must be verified on that account. - **Apps, bots and workflows** never `git push` local commits. They write through the API (`createCommitOnBranch` or the estate `signed-push` action) so that GitHub signs each commit.