docs: add Signed commits section to CONTRIBUTING by hyperpolymath · Pull Request #63 · hyperpolymath/typell

hyperpolymath · 2026-10-01T11:09:33Z

Adds a Signed commits section to this repo's CONTRIBUTING, per owner ruling D218. The estate policy is docs/SIGNING-POLICY.adoc in hyperpolymath/standards.

This repo's default branch is covered by the zero-bypass Require-Signed-Commits ruleset, and rebase-merge is off. The section tells contributors what that requires:

People and interactive agents sign with an SSH signing key.
Apps, bots and workflows write through the API, so GitHub signs their commits.
PRs are merged with squash.

If the file already had its own signing section, that section is replaced in place instead of adding a second one. Lines elsewhere that told people to sign with GPG are changed to match the policy (SSH for people).

This is a docs-only change. The commit was created through createCommitOnBranch, so GitHub signs it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f

Owner ruling D218. See docs/SIGNING-POLICY.adoc in hyperpolymath/standards. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f

coderabbitai · 2026-10-01T11:09:46Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (1)

.github/copilot-instructions.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 5a718360-82b0-4c64-894e-d47a5ba3e15a

📥 Commits

Reviewing files that changed from the base of the PR and between 793b731 and a28e77f.

📒 Files selected for processing (1)

CONTRIBUTING.adoc

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (26)

GitHub Check: governance / Debt ratchet
GitHub Check: governance / Language / package anti-pattern policy
GitHub Check: governance / Workflow security linter
GitHub Check: governance / Code quality + docs
GitHub Check: governance / Licence consistency
GitHub Check: scan / rust-secrets
GitHub Check: governance / Exemption ratchet
GitHub Check: governance / Trusted-base reduction policy
GitHub Check: scan / shell-secrets
GitHub Check: governance / Check Workflow Staleness
GitHub Check: governance / Well-Known (RFC 9116 + RSR)
GitHub Check: scan / gitleaks
GitHub Check: governance / Security policy checks
GitHub Check: governance / Actions lockfile verify
GitHub Check: governance / Allowlist Preflight
GitHub Check: rust-ci / Detect Cargo.toml
GitHub Check: governance / Guix packaging policy (Nix retired)
GitHub Check: governance / Live Actions policy (credentialed advisory)
GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
GitHub Check: Validate eclexiaiser manifest
GitHub Check: Validate DEED manifests
GitHub Check: Bench — Type System Performance
GitHub Check: E2E — Full Pipeline + Integration
GitHub Check: analyze (actions, none)
GitHub Check: Aspect — Safety Invariants
GitHub Check: semgrep-cloud-platform/scan

⚠️ CI failures not shown inline (22)

GitHub Actions: Proof Gate / 0_idris2 --check (ABI proof modules).txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run nix shell nixpkgs#idris2 -c ./scripts/check-idris2-proofs.sh
 �[36;1mnix shell nixpkgs#idris2 -c ./scripts/check-idris2-proofs.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 /home/runner/work/_temp/4c1d5712-e69d-4712-8910-746eb18d870b.sh: line 1: nix: command not found
 ##[error]Process completed with exit code 127.

GitHub Actions: Proof Gate / idris2 --check (ABI proof modules): docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run nix shell nixpkgs#idris2 -c ./scripts/check-idris2-proofs.sh
 �[36;1mnix shell nixpkgs#idris2 -c ./scripts/check-idris2-proofs.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 /home/runner/work/_temp/4c1d5712-e69d-4712-8910-746eb18d870b.sh: line 1: nix: command not found
 ##[error]Process completed with exit code 127.

GitHub Actions: Dogfood Gate / 1_Validate K9 contracts.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 7 K9 file(s)
   Validating: ./.machine_readable/svc/k9/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-hunt.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-kennel.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-yard.k9.ncl
   Validating: ./container/deploy.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'

GitHub Actions: Dogfood Gate / Validate K9 contracts: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]K9 Configuration Validation
 Scanning . for K9 files (.k9, .k9.ncl)...
 Found 7 K9 file(s)
   Validating: ./.machine_readable/svc/k9/examples/ci-config.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/project-metadata.k9.ncl
   Validating: ./.machine_readable/svc/k9/examples/setup-repo.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-hunt.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-kennel.k9.ncl
   Validating: ./.machine_readable/svc/k9/template-yard.k9.ncl
   Validating: ./container/deploy.k9.ncl
 ##[error]Missing K9! magic number. First non-empty line must be exactly 'K9!'

GitHub Actions: Dogfood Gate / 3_Groove manifest check.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / Groove manifest check: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

GitHub Actions: Dogfood Gate / 4_Validate eclexiaiser manifest.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate TOML structure using Python 3.11+ tomllib�[0m
 �[36;1mpython3 -c "�[0m
 �[36;1mimport tomllib, sys�[0m
 �[36;1mwith open('eclexiaiser.toml', 'rb') as f:�[0m
 �[36;1m    data = tomllib.load(f)�[0m
 �[36;1mproject = data.get('project', {})�[0m
 �[36;1mif not project.get('name', '').strip():�[0m
 �[36;1m    print('ERROR: project.name is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfunctions = data.get('functions', [])�[0m
 �[36;1mif not functions:�[0m
 �[36;1m    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfor fn in functions:�[0m
 �[36;1m    if not fn.get('name', '').strip():�[0m
 �[36;1m        print('ERROR: function name cannot be empty', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1m    if not fn.get('source', '').strip():�[0m
 �[36;1m        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1mprint(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')�[0m
 �[36;1m" || {�[0m
 �[36;1m  echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"�[0m

GitHub Actions: Dogfood Gate / Validate eclexiaiser manifest: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run if [ ! -f "eclexiaiser.toml" ]; then
 �[36;1mif [ ! -f "eclexiaiser.toml" ]; then�[0m
 �[36;1m  # Check if repo has a Containerfile — if so, recommend eclexiaiser�[0m
 �[36;1m  if [ -f "Containerfile" ]; then�[0m
 �[36;1m    echo "::warning::Containerfile present but no eclexiaiser.toml. Run \`eclexiaiser init\` to scaffold energy/carbon budgets."�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "has_manifest=false" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mecho "has_manifest=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Validate TOML structure using Python 3.11+ tomllib�[0m
 �[36;1mpython3 -c "�[0m
 �[36;1mimport tomllib, sys�[0m
 �[36;1mwith open('eclexiaiser.toml', 'rb') as f:�[0m
 �[36;1m    data = tomllib.load(f)�[0m
 �[36;1mproject = data.get('project', {})�[0m
 �[36;1mif not project.get('name', '').strip():�[0m
 �[36;1m    print('ERROR: project.name is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfunctions = data.get('functions', [])�[0m
 �[36;1mif not functions:�[0m
 �[36;1m    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)�[0m
 �[36;1m    sys.exit(1)�[0m
 �[36;1mfor fn in functions:�[0m
 �[36;1m    if not fn.get('name', '').strip():�[0m
 �[36;1m        print('ERROR: function name cannot be empty', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1m    if not fn.get('source', '').strip():�[0m
 �[36;1m        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)�[0m
 �[36;1m        sys.exit(1)�[0m
 �[36;1mprint(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')�[0m
 �[36;1m" || {�[0m
 �[36;1m  echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"�[0m

GitHub Actions: Governance / 4_governance _ Workflow security linter.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1m# Standards exercises its pull-request scripts; every consumer uses�[0m
 �[36;1m# the canonical scripts fetched from this workflow's immutable�[0m
 �[36;1m# Standards revision.�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / 6_governance _ Language _ package anti-pattern policy.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
 �[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-language-policy.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::language-policy gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / 8_governance _ Well-Known (RFC 9116 + RSR).txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

GitHub Actions: Governance / 9_governance _ Security policy checks.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / 12_governance _ Actions lockfile verify.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

GitHub Actions: Governance / governance _ Actions lockfile verify: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at job.workflow_sha failed?)"�[0m

🧰 Additional context used

📓 Path-based instructions (1)

Source excerpt: SPDX: `MPL-2.0` on all new files.

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Files:

CONTRIBUTING.adoc

🔇 Additional comments (1)

CONTRIBUTING.adoc (1)

114-129: LGTM!

📝 Summary

Summary by CodeRabbit

Documentation
- Updated contribution guidance to require signed commits for changes reaching the default branch, using a GitHub-registered SSH signing key and verified committer email.
- Pull requests must be squash-merged; rebase merging is disabled, and unsigned commits on a pull request branch prevent merging. Affected branches must be recreated with signed commits before a new pull request is opened.
- Apps, bots and workflows must use the specified API or signed-push action rather than pushing local commits.

Walkthrough

CONTRIBUTING.adoc adds commit-signing requirements for default-branch commits and pull request branches. It specifies signing methods for people and automated contributors, requires squash merges, and describes how to handle branches with unsigned commits.

Changes

Contributor commit-signing policy

Layer / File(s)	Summary
Commit signing and pull request rules `CONTRIBUTING.adoc`	The guidance requires signed commits, specifies signing methods for people and automated contributors, and requires squash merges. It also states that unsigned commits on pull request branches block merging and that affected branches must be recreated with signed commits. Rebase merging is disabled.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to a28e7

The contribution guidance is consistent with the documented signed-commit checks. Some external settings and automation details could not be confirmed, but the review found no demonstrated contributor failure.

Security Architecture Review

Security architecture risk: 🔵 Low · up to a28e7

The change adds contributor signing guidance without changing executable controls or granting permissions. No introduced security weakness was established, but the stated enforcement settings and automated signing guarantees are not fully verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

inferred — The directly affected security surface is contributor guidance for commits and PRs reaching this repository’s default branch. The changed text does not itself expand tenant, service, credential, or data-store authority.

Trust Boundaries and Controls

observed — The document assigns signing responsibility to contributors for interactive commits and to GitHub for API-created automation commits. It attributes unsigned-commit rejection to a ruleset; the text is not evidence that the full hosted configuration or every credential’s signing behavior matches those assertions.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the purpose and main changes, but it omits the required RSR Quality Checklist and a dedicated Testing section. It also does not explicitly address the applicable documentation…	Add the RSR Quality Checklist with applicable items checked. Add a Testing section that states the validation performed, or explains why no tests apply to this documentation-only change. Confirm that documentation was updated.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the documentation change to CONTRIBUTING and matches the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the purpose and main changes, but it omits the required RSR Quality Checklist and a dedicated Testing section. It also does not explicitly address the applicable documentation checklist item.

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks each commit’s mark
And signs each hop before the dark
Squash the trail to make it neat
Signed commits keep the branch complete
Then off I bound on tidy feet}

_{Comment @coderabbitai help to get the list of available commands.}

docs: add Signed commits section to CONTRIBUTING

a28e77f

Owner ruling D218. See docs/SIGNING-POLICY.adoc in hyperpolymath/standards. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f

coderabbitai Bot approved these changes Oct 1, 2026

View reviewed changes

hyperpolymath mentioned this pull request Oct 1, 2026

Estate: needs me hyperpolymath/standards#1109

Open

hyperpolymath merged commit 106311b into main Oct 1, 2026
36 of 43 checks passed

hyperpolymath deleted the docs/signing-policy-d218 branch October 1, 2026 19:38

Navigation Menu

Uh oh!

docs: add Signed commits section to CONTRIBUTING - #63

docs: add Signed commits section to CONTRIBUTING#63
hyperpolymath merged 1 commit into
mainfrom
docs/signing-policy-d218

hyperpolymath commented Oct 1, 2026

Uh oh!

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Oct 1, 2026

Uh oh!

coderabbitai Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Security Architecture Review

❌ Failed checks (1 warning)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading