docs: add Signed commits section to CONTRIBUTING

[hyperpolymath]

Adds a Signed commits section to this repo's CONTRIBUTING, per owner ruling D218. The estate policy is docs/SIGNING-POLICY.adoc in hyperpolymath/standards.

This repo's default branch is covered by the zero-bypass Require-Signed-Commits ruleset, and rebase-merge is off. The section tells contributors what that requires:

• People and interactive agents sign with an SSH signing key.
• Apps, bots and workflows write through the API, so GitHub signs their commits.
• PRs are merged with squash.

If the file already had its own signing section, that section is replaced in place instead of adding a second one. Lines elsewhere that told people to sign with GPG are changed to match the policy (SSH for people).

This is a docs-only change. The commit was created through createCommitOnBranch, so GitHub signs it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 9a8f34e0-6362-4e1f-94af-f780cec4c53e

📥 Commits

Reviewing files that changed from the base of the PR and between 02dc74f and c917e70.

📒 Files selected for processing (1)

• .github/CONTRIBUTING.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (10)

• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Licence consistency
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: build
• GitHub Check: analyze (actions, none)
• GitHub Check: security
• GitHub Check: analyze (rust, none)
• GitHub Check: semgrep-cloud-platform/scan

⚠️ CI failures not shown inline (2)

GitHub Actions: ReScript/Deno CI / 0_build.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run deno lint
 �[36;1mdeno lint�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 �[0m�[1m�[31merror[no-unused-vars]�[0m: �[0m�[1m`i` is never used�[0m
 ##[error]  �[0m�[38;5;12m-->�[0m �[0m�[36m/home/runner/work/phantom-metal-taste/phantom-metal-taste/scripts/build-site.mjs�[0m�[0m�[33m:96:55�[0m

---

GitHub Actions: ReScript/Deno CI / build: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run deno lint
 �[36;1mdeno lint�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 �[0m�[1m�[31merror[no-unused-vars]�[0m: �[0m�[1m`i` is never used�[0m
 ##[error]  �[0m�[38;5;12m-->�[0m �[0m�[36m/home/runner/work/phantom-metal-taste/phantom-metal-taste/scripts/build-site.mjs�[0m�[0m�[33m:96:55�[0m

🔇 Additional comments (1)

.github/CONTRIBUTING.md (1)

90-105: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Documentation
  • Added contribution guidance requiring signed commits on the default branch and PR branches, and squash-merging PRs. Rebase-merging is no longer available.

Walkthrough

The contribution guide now states signed-commit requirements for the default branch, signing instructions, and rules for creating and merging commits.

Changes

Signed-commit policy

Layer / File(s)	Summary
Signing and merge instructions .github/CONTRIBUTING.md	The guide specifies signing requirements for people, interactive agents, apps, bots and workflows. It also states that unsigned PR-branch commits block merging, and that contributors must squash-merge.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to c917e

The signing and recovery guidance aligns with the linked policy. No actionable issue remains that should block merging.

Architecture Summary

Architecture risk: 🔵 Low · up to c917e

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/CONTRIBUTING.md: Adds signed-commit instructions covering the default-branch requirement, SSH signing and verified-email settings for people and interactive agents, API-based commits for apps, bots and workflows, and squash merging. States that unsigned PR-branch commits block merging, gives git cherry-pick -S as a way to recreate such a branch, and notes that rebase-merge is disabled.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the documentation change and the specific signed-commits topic.
Description check	✅ Passed	The description is directly related to the documentation change and explains the signing policy, affected contributors, merge method, and scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit signs each commit with care,
SSH keys ready, verified email there.
Bots use the API to write,
Squash merges bring the branch in sight.
I nibble clover, pleased with this guide.}

_{Comment @coderabbitai help to get the list of available commands.}