From 9f3c450f74e6e17394cd3ebea3ad5fbdff696200 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 14:03:47 +0000 Subject: [PATCH 1/3] notes: re-sign a reviewed PR from its reviewed head; record the squash path The routine re-signed with `git rebase --exec ... upstream/main`, which replays every commit after upstream's tip. On a PR branch that started from an older main that is itself a rebase: tried on PR 62's stack, it rewrote all five commits, the two Joshua had reviewed included. A new section re-signs only the commits added since the reviewed head (`git rebase --exec ... `) and pushes them as a fast-forward; tried on the same stack, it rewrote the three new commits only and left the tree unchanged. A second section records the squash-merge path #192 took: GitHub signs the squash commit, but its message defaults to the fork PR's description and lands on upstream main unchanged, and the signature is GitHub's key rather than one registered to the contributor, which upstream CONTRIBUTING item 3 has not been asked about. The branch list marks wip/pr62-theta as superseded by #192, kept rather than deleted. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01HtyPfZ1MWBB94RawgzQgz7 --- notes/commit-signing.md | 51 +++++++++++++++++++++++++++++++++++++++-- 1 file changed, 49 insertions(+), 2 deletions(-) diff --git a/notes/commit-signing.md b/notes/commit-signing.md index 0ae6671..d3b9d76 100644 --- a/notes/commit-signing.md +++ b/notes/commit-signing.md @@ -18,7 +18,8 @@ on 2026-10-19. ## The routine -On the machine with your key, for a branch a session prepared: +On the machine with your key, for a branch a session prepared before review +started, or after Joshua asked for a rebase: ```sh git fetch upstream main # JoshuaJewell/MetaManifold-WebUI @@ -29,6 +30,46 @@ git log --format='%h %G? %s' upstream/main..HEAD # see the table below git push --force-with-lease origin # before review, or after a requested rebase ``` +The `--exec` line replays every commit after `upstream/main` onto its tip, so on +a branch that started from an older `main` it is itself a rebase, whether or not +the line before it ran. + +### A PR already under review + +Once review has started, re-sign only the commits added since the head Joshua +reviewed, and push them as a fast-forward; the reviewed commits keep their +hashes and signatures: + +```sh +git fetch origin # this fork +git switch -c origin/ +git rebase --exec 'git commit --amend --no-edit -S' +git log --format='%h %G? %s' ..HEAD # see the table below +git push origin : # fast-forward: no --force +``` + +`` is the PR's head commit when the review was given. A prepared +branch must start there; if it does not, the push is refused as a non +fast-forward, and nothing is rewritten. + +### Squash-merging the fork PR instead + +Squash-merging a fork PR into `upstream/` on GitHub also works: GitHub +signs the squash commit (Verified, with its own key) and the upstream PR moves +forward by that one commit. Three things change: + +- The prepared commits become one, so their separate messages are lost. +- The squash commit's message defaults to the fork PR's title and description, + fork-internal notes and `(#NNN)` fork references included, and it lands on + Joshua's `main` unchanged. Replace it in the merge dialog with a message that + stands on its own upstream (CONTRIBUTING item 8). +- The signature is GitHub's key, not yours. It shows Verified, but item 3 asks + for a key registered to your account, so this path has not been cleared with + Joshua. + +This happened with #192: its squash commit `e28e832` on `upstream/glmgampoi-r` +carries #192's whole description as its message. + What `%G?` prints, and what to do: | status | meaning | action | @@ -50,4 +91,10 @@ GitHub's Verified badge is what upstream checks. ## Branches known to need re-signing -- `wip/pr62-theta` (3 unsigned commits, 2026-10-19), if it becomes a PR. +None at present. + +- `wip/pr62-theta` is superseded: #192 carried its theta commit on PR 62's + reviewed head `efe1df1`, and was squash-merged as `e28e832`. Its other two + commits are PR 62's, rebased onto upstream `78ffc2f` after review had + started, so it should not be pushed to `upstream/glmgampoi-r`. Kept, not + deleted. From 6e84fefe0561b0be360bfbd5cb53ccd84e60bc65 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 14:07:54 +0000 Subject: [PATCH 2/3] notes: list #192's commits as the replacement for e28e832 The owner chose to replace the squash commit e28e832 on upstream/glmgampoi-r with #192's three commits, re-signed. Those commits are still reachable as refs/pull/192/head after the branch was deleted, so the entry gives the fetch, the re-sign from the reviewed head, an empty-diff check against e28e832, and a push whose lease names e28e832. The sequence was rehearsed in a scratch clone with a no-signature amend and `git push --dry-run`: three commits rewritten, no diff, lease accepted, nothing pushed. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01HtyPfZ1MWBB94RawgzQgz7 --- notes/commit-signing.md | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/notes/commit-signing.md b/notes/commit-signing.md index d3b9d76..544e9f3 100644 --- a/notes/commit-signing.md +++ b/notes/commit-signing.md @@ -91,8 +91,23 @@ GitHub's Verified badge is what upstream checks. ## Branches known to need re-signing -None at present. - +- `refs/pull/192/head` (`10e099b`): #192's three unsigned commits on PR 62's + reviewed head `efe1df1`. They are to replace the squash commit `e28e832` on + `upstream/glmgampoi-r` (owner's call, 2026-10-20); the tree is identical. + GitHub keeps a merged PR's head ref after its branch is deleted, so: + + ```sh + git fetch origin pull/192/head:pr62-next upstream/glmgampoi-r + git switch pr62-next + git rebase --exec 'git commit --amend --no-edit -S' efe1df1 + git log --format='%h %G? %s' efe1df1..HEAD # see the table above + git diff --stat origin/upstream/glmgampoi-r HEAD # expect no output + git push --force-with-lease=upstream/glmgampoi-r:e28e832fd52466f5192406025fe6b16d9fd99ae1 \ + origin pr62-next:upstream/glmgampoi-r + ``` + + The lease names `e28e832`, so the push is refused if anything else has + landed there since. - `wip/pr62-theta` is superseded: #192 carried its theta commit on PR 62's reviewed head `efe1df1`, and was squash-merged as `e28e832`. Its other two commits are PR 62's, rebased onto upstream `78ffc2f` after review had From b18c3b243728fe0adc85d04826ea4a69dab397bd Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 14:11:26 +0000 Subject: [PATCH 3/3] notes: check the reviewed head is contained before re-signing The note said a prepared branch that did not start at the reviewed head would have its push refused, with nothing rewritten. That is false: `git rebase ` replays such a branch onto the reviewed head, upstream commits it carries included, and the result then pushes as a fast-forward. On wip/pr62-theta it would replay Joshua's 78ffc2f, re-signed as the contributor's, along with copies of the PR's commits. Both re-sign sequences now run the rebase only after `git merge-base --is-ancestor HEAD` succeeds. Tried in a scratch worktree: the guard stopped the rebase on wip/pr62-theta and left HEAD unchanged, and on refs/pull/192/head it let the three commits through with the tree unchanged. The squash section now says "upstream CONTRIBUTING" for items 3 and 8, since this fork's CONTRIBUTING numbers its items differently, and the superseded wip/pr62-theta moves from the re-signing list to a section of its own. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01HtyPfZ1MWBB94RawgzQgz7 --- notes/commit-signing.md | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/notes/commit-signing.md b/notes/commit-signing.md index 544e9f3..2cc8384 100644 --- a/notes/commit-signing.md +++ b/notes/commit-signing.md @@ -43,14 +43,20 @@ hashes and signatures: ```sh git fetch origin # this fork git switch -c origin/ -git rebase --exec 'git commit --amend --no-edit -S' +git merge-base --is-ancestor HEAD && + git rebase --exec 'git commit --amend --no-edit -S' git log --format='%h %G? %s' ..HEAD # see the table below git push origin : # fast-forward: no --force ``` -`` is the PR's head commit when the review was given. A prepared -branch must start there; if it does not, the push is refused as a non -fast-forward, and nothing is rewritten. +`` is the PR's head commit when the review was given, and the +prepared branch must contain it. The `merge-base` check stops the re-sign when +it does not. Without that check, `git rebase ` would replay the +branch onto the reviewed head, along with any upstream commits it carries, and +the push would then go through as a fast-forward. On `wip/pr62-theta`, for +example, it would replay Joshua's `78ffc2f` re-signed as yours, together with +copies of the PR's own commits. When the check stops it, nothing is rewritten, +and pushing the untouched branch is refused as a non fast-forward. ### Squash-merging the fork PR instead @@ -62,10 +68,11 @@ forward by that one commit. Three things change: - The squash commit's message defaults to the fork PR's title and description, fork-internal notes and `(#NNN)` fork references included, and it lands on Joshua's `main` unchanged. Replace it in the merge dialog with a message that - stands on its own upstream (CONTRIBUTING item 8). -- The signature is GitHub's key, not yours. It shows Verified, but item 3 asks - for a key registered to your account, so this path has not been cleared with - Joshua. + stands on its own upstream (upstream CONTRIBUTING item 8). +- The signature is GitHub's key, not yours. It shows Verified, but upstream + CONTRIBUTING item 3 asks for a key registered to your account, so this path + has not been cleared with Joshua. (This fork's own CONTRIBUTING numbers its + items differently.) This happened with #192: its squash commit `e28e832` on `upstream/glmgampoi-r` carries #192's whole description as its message. @@ -99,7 +106,8 @@ GitHub's Verified badge is what upstream checks. ```sh git fetch origin pull/192/head:pr62-next upstream/glmgampoi-r git switch pr62-next - git rebase --exec 'git commit --amend --no-edit -S' efe1df1 + git merge-base --is-ancestor efe1df1 HEAD && + git rebase --exec 'git commit --amend --no-edit -S' efe1df1 git log --format='%h %G? %s' efe1df1..HEAD # see the table above git diff --stat origin/upstream/glmgampoi-r HEAD # expect no output git push --force-with-lease=upstream/glmgampoi-r:e28e832fd52466f5192406025fe6b16d9fd99ae1 \ @@ -108,6 +116,11 @@ GitHub's Verified badge is what upstream checks. The lease names `e28e832`, so the push is refused if anything else has landed there since. + +## Superseded branches + +Kept for the record. Do not re-sign or push them. + - `wip/pr62-theta` is superseded: #192 carried its theta commit on PR 62's reviewed head `efe1df1`, and was squash-merged as `e28e832`. Its other two commits are PR 62's, rebased onto upstream `78ffc2f` after review had