docs(contributing): DCO sign-off is review-enforced, not a required status check

[bpamiri]

What

Docs-only fix for the DCO documentation drift reported in #3000.

• CONTRIBUTING.md § Enforcement — rewritten. It claimed the DCO GitHub App "runs as a required status check on every PR" and blocks merge. It does not: the app is not installed on this repository, and the develop ruleset's only required status check is Bot PR TDD Gate (verified: gh api repos/wheels-dev/wheels/rules/branches/develop lists exactly that one context; no DCO check appears on fix(public): encode path in route-tester verb-mismatch message, scan alternatives only on no-match #2995/test(router): cover nested named capture groups in constraint normalization #2996/test(wheelstest): cover the empty-server_name localhost guard in base-URL CGI detection #2998). The section now describes the actual policy: sign every commit with git commit -s; the trailer is verified during code review (human and bot); a missing sign-off surfaces as a fix-before-merge review request, never as a failing check.
• CONTRIBUTING.md § Grandfathering — "The DCO is enforced on new PRs only" → "The DCO applies to new PRs only" for consistency (the rest is unchanged).
• .claude/commands/_shared-rails.md — the bot-rails DCO bullet carried the same false claim and is read by review-pr.md; it is exactly how Reviewer A false-escalated the unsigned commit on test(wheelstest): cover the empty-server_name localhost guard in base-URL CGI detection #2998 into a check-blocked "blocker". The bullet now states there is no DCO status check and instructs reviewers to treat a missing sign-off as a review request (suggesting git rebase --signoff develop). The bot's own sign-off requirement for commits it authors is unchanged.

Why

Contributors and bot reviewers were both reasoning from documentation that does not match the repo. This takes option 2 from the issue ("make the docs honest").

Follow-up: automated enforcement (deliberately NOT in this PR)

This PR intentionally adds no CI workflow and no required status check. Automated DCO enforcement remains available as a separate maintainer decision, either of:

• Install https://github.com/apps/dco on the repo and add its context to the develop ruleset's required status checks (org/repo-admin action), then update § Enforcement to match; or
• Add a small non-required CI job that checks Signed-off-by: trailers on PR commits and reports (without blocking).

Test evidence

Markdown-only diff (CONTRIBUTING.md, .claude/commands/_shared-rails.md) — neither file is on any CFML load path. Full core suite run anyway on Lucee 7 + SQLite (docker wheels-test-lucee7:v1.0.0):

• Final (with this diff): 4293 pass / 12 fail / 0 error (4323 specs, 18 skipped)
• All 12 failures are in wheels.tests.specs.internal.testClientSpec (TestClient loopback HTTP in the port-mapped container). Verified pre-existing: with this diff stashed (pristine develop @ 345b30dcb), the same bundle yields the identical 41 pass / 12 fail / 0 error — zero new failures from this change.
• Verification greps per plan: no remaining markdown claims that DCO "is/runs as a required status check" repo-wide (the only apps/dco mentions left are the corrected sections and a historical CHANGELOG.md release entry, which is not edited per project policy).

Fixes #3000

🤖 Generated with Claude Code

[wheels-bot]

Wheels Bot — Reviewer A

TL;DR: This is a docs-only correction that aligns CONTRIBUTING.md and _shared-rails.md with the repository's actual DCO enforcement policy. Both files previously claimed the DCO GitHub App was a required status check that blocks merges; it is not. The PR fixes that gap in both the contributor-facing docs and the bot-rails shared instruction file. The changes are accurate, self-consistent, and well-evidenced. Verdict: approve.

---

Correctness

No issues. The factual claims in both files are consistent with each other and with the evidence supplied in the PR body:

• CONTRIBUTING.md § Enforcement: now correctly states sign-off is verified during code review, not by an automated status check; notes that Bot PR TDD Gate is the only merge-blocking check on develop.
• _shared-rails.md: updated to instruct bot reviewers to treat a missing sign-off as a fix-before-merge review request, not a CI failure.
• The git rebase --signoff develop suggestion added to _shared-rails.md is consistent with the existing CONTRIBUTING.md § Forgot to sign off? example (line 74).
• The #forgot-to-sign-off anchor referenced at CONTRIBUTING.md:85 exists (line 63 heading).

---

Docs

Four other command files (update-docs.md, address-review.md, write-docs.md, propose-fix.md) still contain the phrase "DCO enforcement; see _shared-rails.md" in their commit-step instructions. Each defers to _shared-rails.md for the policy detail, so they will naturally surface the corrected text to any bot that reads them. No update is strictly required, but a follow-up pass to s/DCO enforcement/DCO sign-off policy/ in those four files would remove any residual ambiguity for a human reader skimming one file in isolation.

No changelog fragment needed — docs-type PRs are exempt per CLAUDE.md § Changelog entries.

---

Commits

Single commit 9032301fd:

• Type docs, scope contributing — both valid.
• Header docs(contributing): DCO sign-off is review-enforced, not a required status check = 80 chars (under 100).
• Body explains the why clearly (false claim caused Reviewer A false-escalation on #2998).
• Signed-off-by: Peter Amiri <peter@alurium.com> present.
• PR title is a valid conventional-commit header under 100 chars.

---

[wheels-bot]

Wheels Bot — Reviewer B (round 1)

A's review is accurate and well-evidenced. Verified all cited claims against the diff and the repo state; found no sycophancy, no false positives, and no missed issues. Verdict alignment is correct. Converging on approve.

Sycophancy

None detected. A explicitly verified each factual claim rather than rubber-stamping: the anchor existence, line numbers, file references, and commit metadata were all checked.

False positives

None detected. Spot-checked A's specific claims:

• ### Forgot to sign off? heading at line 63 of CONTRIBUTING.md — confirmed.
• git rebase --signoff develop example consistent with the new _shared-rails.md suggestion — confirmed (A cited line 74; it is at line 75, a trivial off-by-one that affects nothing).
• Four command files (propose-fix.md, address-review.md, write-docs.md, update-docs.md) all contain exactly (DCO enforcement; see _shared-rails.md) with an explicit pointer to the file being updated — A's claim that they naturally surface the corrected policy is correct.
• Commit header docs(contributing): DCO sign-off is review-enforced, not a required status check = 80 chars — confirmed.
• Signed-off-by: Peter Amiri <peter@alurium.com> present on the commit — confirmed.
• No changelog fragment needed for a docs-type PR — correct per CLAUDE.md § Changelog entries.

Missed issues

None detected. The diff is markdown-only (CONTRIBUTING.md and .claude/commands/_shared-rails.md); no CFML load paths are touched, so cross-engine concerns do not apply. The internal link [Forgot to sign off?](#forgot-to-sign-off) added to the new Enforcement section resolves correctly against the existing heading. PR targets develop as required.

Verdict alignment

A's approve verdict is consistent with finding zero issues on a straightforward factual-correction PR with a clean commit and passing test run.

Convergence

Fully aligned. The PR corrects a false factual claim in both contributor docs and bot-rails, is docs-only with no functional impact, has a valid signed commit, and has been independently verified. No changes are needed before merge.