[hyperpolymath]

Adds a Signed commits section to this repo's CONTRIBUTING, per owner ruling D218. The estate policy is docs/SIGNING-POLICY.adoc in hyperpolymath/standards.

This repo's default branch is covered by the zero-bypass Require-Signed-Commits ruleset, and rebase-merge is off. The section tells contributors what that requires:

• People and interactive agents sign with an SSH signing key.
• Apps, bots and workflows write through the API, so GitHub signs their commits.
• PRs are merged with squash.

If the file already had its own signing section, that section is replaced in place instead of adding a second one. Lines elsewhere that told people to sign with GPG are changed to match the policy (SSH for people).

This is a docs-only change. The commit was created through createCommitOnBranch, so GitHub signs it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 59cc04b1-f39a-485f-a802-ac5b1d98b881

📥 Commits

Reviewing files that changed from the base of the PR and between 42301a7 and d73ad4d.

📒 Files selected for processing (1)

• .github/CONTRIBUTING.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (9)

• GitHub Check: copilot-pull-request-reviewer
• GitHub Check: github-advanced-security
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: analyze (javascript-typescript, none)
• GitHub Check: Validate K9 contracts
• GitHub Check: Validate DEED manifests
• GitHub Check: Empty-linter (invisible characters)
• GitHub Check: Groove manifest check
• GitHub Check: semgrep-cloud-platform/scan

🔇 Additional comments (1)

.github/CONTRIBUTING.md (1)

123-138: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Documentation
  • Updated contribution guidance to require signed commits and squash-merging for pull requests. Unsigned commits block merging, and rebase-merging is no longer available.

Walkthrough

The contribution guide adds signed-commit requirements for people and automated commit authors. It also states that pull requests require squash merges and that unsigned commits block merging.

Changes

Commit signing and merging

Layer / File(s)	Summary
Signing and merge requirements .github/CONTRIBUTING.md	The guide requires people and interactive agents to use registered SSH signing keys and verified committer email addresses. Apps, bots, and workflows must use the API or the signed-push action. Unsigned pull request commits block merging, and pull requests must use squash merges.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to d73ad

The guide’s signing and squash-merge instructions are consistent with the verified ruleset behavior; no actionable merge risk was established.

Architecture Summary

Architecture risk: 🔵 Low · up to d73ad

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/CONTRIBUTING.md: Adds signed-commit guidance requiring SSH signing for people and interactive agents, API or signed-push commits for apps, bots and workflows, and squash merges. It states that unsigned PR-branch commits block merging and rebase-merge is disabled.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the documentation change in CONTRIBUTING.
Description check	✅ Passed	The description is directly related to the documentation changes and explains the signed-commit policy updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit signs each commit with care,
Then checks the keys are registered there.
Bots send commits through API,
Or signed-push brings them by.
Squash the branch; let unsigned wait,
The guide now shows the proper gate.}

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot review overview

🟢 Approval recommended

The documentation accurately reflects the referenced estate signing policy.

Review effort: Balanced
Findings: None

What changed in this PR

Adds contributor guidance for the repository’s signed-commit policy.

Changes:

• Documents SSH signing for people and interactive agents.
• Explains API-based signing for automation and squash-only merging.

File	Description
.github/​CONTRIBUTING.md	Adds signed-commit requirements and remediation guidance.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.