CONTRIBUTING.md documents the DCO App as a required status check, but it is not installed or enforcing

[bpamiri]

Drift

CONTRIBUTING.md § Developer Certificate of Origin (DCO) → Enforcement states:

The DCO GitHub App runs as a required status check on every PR. It verifies that every commit in the PR carries a valid Signed-off-by: trailer and blocks merge if any are missing. The app comments on the PR with a fixup suggestion when it finds an unsigned commit.

None of that is currently true:

• The develop branch ruleset's only required status check is Bot PR TDD Gate (gh api repos/wheels-dev/wheels/rules/branches/develop → required_status_checks lists exactly one context).
• No DCO check appears on recent PRs (e.g. fix(public): encode path in route-tester verb-mismatch message, scan alternatives only on no-match #2995, test(router): cover nested named capture groups in constraint normalization #2996, test(wheelstest): cover the empty-server_name localhost guard in base-URL CGI detection #2998 — checks are Auto-Label PR, Bot PR TDD Gate, Lucee 7 + SQLite (LuCLI), Reviewer A/B, Validate Commit Messages, Update docs).
• An unsigned commit on test(wheelstest): cover the empty-server_name localhost guard in base-URL CGI detection #2998 sailed through every check; the only thing that caught it was a code review. Reviewer A then escalated it to a merge "blocker" by quoting this CONTRIBUTING.md section — a false positive caused directly by the drift.

Options

1. Make the docs true: install https://github.com/apps/dco on the repo and add its check to the develop ruleset's required status checks. (Needs org/repo admin.)
2. Make the docs honest: reword § Enforcement to say sign-off is a documented convention enforced by review, not a status check.

Either resolves the drift; the wrong state is the current one, where contributors and bot reviewers both reason from documentation that doesn't match the repo.

🤖 Generated with Claude Code

[wheels-bot]

Wheels Bot — Triage

Classified as docs-request.

Docs scope

CONTRIBUTING.md § Developer Certificate of Origin (DCO) → Enforcement needs to be reconciled with actual repo state. The current text states the DCO GitHub App "runs as a required status check on every PR" and "blocks merge if any are missing" — but the develop branch ruleset's required checks list contains only Bot PR TDD Gate, no DCO app appears on recent PRs (#2995/#2996/#2998), and an unsigned commit on #2998 passed all checks. Either install the DCO app and add its context to the required-checks list (option 1, admin action), or reword § Enforcement to describe sign-off as a documented convention verified during code review rather than as a status check (option 2, docs-only).

Confidence: low

The deliverable's location is concrete, but the direction is a policy choice (enforce DCO via app vs. enforce via review) that the bot shouldn't make unilaterally — option 1 is out of scope for a docs PR and option 2 forecloses it.

<!-- wheels-bot:triage:3000 -->
<!-- wheels-bot:triage-class:docs-request -->