🤖 Generated by the Agentic Engineer
Evidence
Measured 2026-08-07 while answering acceptance criterion 4 of #132 — newest commit of a live branch
per lane, read from the commit's own verification object:
| Lane |
signed |
claude/* |
yes |
cursor/* |
yes |
codex/* |
no — reason: unsigned |
chore/template-sync_* (template-sync App) |
no — reason: unsigned |
| Dependabot / Renovate |
yes (GitHub authors and signs those) |
Problem
Two of the four write lanes push unsigned commits. Nothing is broken today: direct pushes to default
branches are blocked by the pull_request rule, and what lands is a GitHub-created squash commit, so
history stays signed regardless.
The cost is optionality. Commit signature verification cannot be required on branches while two lanes
would be refused by it, so the strongest form of that control stays permanently out of reach for
reasons that have nothing to do with whether it is wanted. #132 recommends scoping the rule to the
default branch precisely to avoid that tax — a sound call, and one this issue exists so we are not
stuck with forever.
Signing also makes the lanes distinguishable at the commit level, which is worth something on its own:
every machine-local lane authors as the same identity, so the signature is the only per-lane evidence
a commit carries.
Expected behaviour
Every automated write lane signs its commits, so requiring signatures anywhere is a policy choice
rather than a breaking change.
Suggested approach
- The
codex/* lane's signing is host-local runtime configuration. Per the shared contract, one
agent instance does not change another's runtime configuration — prepare the exact change and hand
it to the maintainer.
- The template-sync App's commits are created by its workflow; commits made through the GitHub API
with an App token are signed by GitHub, so this is likely a matter of how that workflow commits
rather than a missing key.
Acceptance criteria
Blocks the branch-scoped option in #132.
Evidence
Measured 2026-08-07 while answering acceptance criterion 4 of #132 — newest commit of a live branch
per lane, read from the commit's own
verificationobject:claude/*cursor/*codex/*reason: unsignedchore/template-sync_*(template-sync App)reason: unsignedProblem
Two of the four write lanes push unsigned commits. Nothing is broken today: direct pushes to default
branches are blocked by the
pull_requestrule, and what lands is a GitHub-created squash commit, sohistory stays signed regardless.
The cost is optionality. Commit signature verification cannot be required on branches while two lanes
would be refused by it, so the strongest form of that control stays permanently out of reach for
reasons that have nothing to do with whether it is wanted. #132 recommends scoping the rule to the
default branch precisely to avoid that tax — a sound call, and one this issue exists so we are not
stuck with forever.
Signing also makes the lanes distinguishable at the commit level, which is worth something on its own:
every machine-local lane authors as the same identity, so the signature is the only per-lane evidence
a commit carries.
Expected behaviour
Every automated write lane signs its commits, so requiring signatures anywhere is a policy choice
rather than a breaking change.
Suggested approach
codex/*lane's signing is host-local runtime configuration. Per the shared contract, oneagent instance does not change another's runtime configuration — prepare the exact change and hand
it to the maintainer.
with an App token are signed by GitHub, so this is likely a matter of how that workflow commits
rather than a missing key.
Acceptance criteria
codex/*branch commit reportsverified: true.verified: true.verificationobject, not by inspecting configuration.Blocks the branch-scoped option in #132.