[hyperpolymath]

Adds a Signed commits section to this repo's CONTRIBUTING, per owner ruling D218. The estate policy is docs/SIGNING-POLICY.adoc in hyperpolymath/standards.

This repo's default branch is covered by the zero-bypass Require-Signed-Commits ruleset, and rebase-merge is off. The section tells contributors what that requires:

• People and interactive agents sign with an SSH signing key.
• Apps, bots and workflows write through the API, so GitHub signs their commits.
• PRs are merged with squash.

If the file already had its own signing section, that section is replaced in place instead of adding a second one. Lines elsewhere that told people to sign with GPG are changed to match the policy (SSH for people).

This is a docs-only change. The commit was created through createCommitOnBranch, so GitHub signs it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3f8e9559-e34f-4777-aa62-b2a792e9ac34

📥 Commits

Reviewing files that changed from the base of the PR and between 9a5c34f and e82d22d.

📒 Files selected for processing (1)

• CONTRIBUTING.adoc

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (26)

• GitHub Check: pipeline / Secret scanning / rust-secrets
• GitHub Check: pipeline / Secret scanning / shell-secrets
• GitHub Check: pipeline / SAST (semgrep)
• GitHub Check: pipeline / Secret scanning / gitleaks
• GitHub Check: secret-scan / rust-secrets
• GitHub Check: secret-scan / shell-secrets
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Live Actions policy (credentialed advisory)
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Debt ratchet
• GitHub Check: secret-scan / gitleaks
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Guix packaging policy (Nix retired)
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: lake-build
• GitHub Check: Required contexts are producible
• GitHub Check: semgrep-cloud-platform/scan
• GitHub Check: Analyze (actions)

🔇 Additional comments (1)

CONTRIBUTING.adoc (1)

43-44: 📐 Maintainability & Code Quality

The signing statement is supported by the active Require-Signed-Commits ruleset, which targets ~DEFAULT_BRANCH. The repository merge-method settings remain unavailable. The active Require-Linear-History ruleset does not establish that rebase-merge is disabled.

---

📝 Summary

Summary by CodeRabbit

• Documentation
  • Added guidance on signed commits, including signing requirements for commits reaching the default branch and how people, bots and workflows should create signed commits.
  • Clarified that pull requests must use squash merges and cannot contain unsigned commits; rebase merges are unavailable.

Walkthrough

CONTRIBUTING.adoc adds guidance for signing commits, automated contribution methods, and pull request merge rules.

Changes

Signed commit guidance

Layer / File(s)	Summary
Signing and merge requirements CONTRIBUTING.adoc	Explains signing methods for people and automated workflows. States that pull requests must use squash merges because unsigned commits block merging, and that rebase-merge is disabled.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Suggested reviewers: metadatastician

Merge Risk: ⚪ Minimal · up to e82d2

This documentation-only change is mergeable. Signing enforcement is confirmed; whether rebase merging is disabled could not be confirmed from the available repository settings.

Security Architecture Review

Security architecture risk: 🔵 Low · up to e82d2

The change adds contribution guidance, not executable controls. No introduced vulnerability was established, but its claims about signing and merge enforcement have not been verified against the repository’s actual configuration.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The supported security scope is repository commit provenance and merge eligibility for people, interactive agents, and automation. The changed surface provides no evidence of expanded runtime, tenant, infrastructure, or credential authority.

Trust Boundaries and Controls

• observed — People and interactive agents are instructed to use GitHub-registered SSH signing keys and verified committer email. Apps, bots, and workflows are instructed to avoid pushing local commits and instead use GitHub-mediated signing. The text does not establish the resulting automation signer identity or prove preservation of original authorship.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly relates to the documentation change. It explains the signed-commit policy, SSH signing, API-based commits, and squash merges.
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding a Signed commits section to CONTRIBUTING.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit signs each commit neat,
Then checks the branch before its feet.
A squash carries work along,
Signed commits keep the record strong.
The rabbit hops, the guidance clear.}

_{Comment @coderabbitai help to get the list of available commands.}