[Birfy]

Owner: Dev3
Reviewer: Reviewer
Base: fc19e6d
Tip SHA: b214c11
Fixes #1110

Replayed onto fc19e6d2 (it was 781121ba): #1148 landed the author attestation in review-gate.mjs and
#1145/#1151 touched the docs, so this branch keeps that rule and puts the signature beside it rather
than on top of the old file. The two files that switch the gate on — .github/agent/signers.json and the
signers roster in review-policy.json — need the two public keys from #1111 and stay out of this PR on
purpose: until they land the gate reads exactly what it reads today, so this can merge without blocking a
single merge, and #1111 remains the switch-on.

Reproduce

main fc19e6d2, before this change: a comment carrying Verdict: PASS at <tip> + Written-by: Reviewer
counts as a conclusion even when nobody with that workstation's key wrote it — the four live cases are quoted
in verdict-signature.test.mjs (#1094 6392483805, #1095 6392479580, #1108 6393564871, #1115
6393959918). Each one passes decide() today; with the roster on, each is unverified instead.

What changed

• .github/scripts/verdict-signature.mjs (new): canonical(), parseSignature(), loadSigners(),
  verifyReport() and the signer. Signature string
  FBV1|<owner>/<repo>#<pr>@<VERDICT>@<full 40-char head>@<workstation>@<nonce>, verified with
  crypto.verify(null, …, { key, format: 'der', type: 'spki' }). Every field closes one replay: repository +
  pull request number, exactly 40 characters of head (The enqueue guard reported a PASS that had not been posted yet, and would go green again on a re-push #1112), the verdict, the workstation, the nonce. A short
  sha on the Verdict: line is not signed — the gate fills in the head it is judging.
• review-gate.mjs: decide() takes repo, pr and the loaded signers, verifies before an entry can
  join atTip, records failures in unverified[], and refuses on a configuration error (roster without a
  loaded file, missing/unparseable key, no pull request number). render() prints the unverified block.
• merge-gate.mjs / enqueue-guard.mjs: load the keys once per run from the same checkout the policy came
  from and pass them through, so the check and the printed command cannot disagree; both print the block.
• .github/scripts/sign-verdict.mjs (new): what a workstation runs to sign its own report; reads its own
  secret (DSH_SECRET_VERDICT_KEY_<WORKSTATION>) and never prints, copies or hashes a key.
• Docs move with the protocol: AGENTS.md (Merge gates, An owner decision on a PR cannot be told apart from Agent-written text: no proxy signature, one shared identity #627), docs/autonomous-dev.md (Signed conclusions),
  .claude/skills/review-pr (the report format). One changelog fragment.

What I ran

• node --test ".github/scripts/*.test.mjs" → 446 pass, 0 fail, 2 skipped (448 tests), including the 26
  new ones: a real signature counting; missing Signed-by: / Signature: / Nonce:; another workstation's
  private key; Signed-by ≠ Written-by; a workstation with no key; replay onto another tip and with
  another nonce; a signed and an unsigned INC; the three configuration errors; "a signature is not a
  permission"; a bot account with a valid signature (enqueue-guard: require Owner:/Reviewer: before the queue, and make a bot account's Verdict: unreadable #943 survives); the header-only read; the summary block;
  the canonical string; the signer round trip; the repository's own policy/signers pair; the four
  impersonated PASSes reading as unverified; and Require a tip attestation for an author-login review #1148 + A forged Written-by: Reviewer still merges: the guard cannot tell which workstation wrote a Verdict #1110 staying separate refusals (a correctly
  signed report from the author login still needs the attestation, and it is refused for that reason, not as
  unverified).
• node scripts/ds-bot-patches.mjs check → two ok lines (no core/ file is touched).
• node .github/scripts/changelog.mjs check → 57 fragment(s) … well formed.

Red without the source change

• review-gate.mjs back to fc19e6d2 → verdict-signature.test.mjs 7 pass / 19 fail of 26.
• The roster switch forced off (roster = false && …) → 15 red, including all four impersonated PASSes
  (Draw a friend's mention from the same look as its sidebar row #1094/Show a friend DM is waiting on their approval #1095/Keep face lobby names and face-room titles readable #1108/Wake idle Bots for unfinished conversation tasks #1115) and the three configuration errors; restored → 448/446/0/2.

Not run

• core/ and every plugin suite: the diff touches .github/, docs/ and changelog.d/ only —
  ds-bot-patches check confirms core/ equals ds-bot/ + patches.
• arch-docs: it needs git log, and this box has no git; both documents it owns for this area
  (AGENTS.md, docs/autonomous-dev.md) are updated here.
• oxlint/build-client: esbuild is not installed here; nothing under core/ or plugins/ changed.

Risk

• Behaviour change only once the roster exists (Mint one Ed25519 key per reviewing workstation (public key in the repo, private key in that Bot's secret store) #1111). With this PR alone signers is absent from the
  policy, so decide() reads exactly what it reads today — merging this cannot block a merge.
• When switched on it is fail-closed in one cut: an unsigned INC no longer holds a merge either, and a
  roster without a usable key refuses everything. That is the reason the keys land before the roster, and
  why every configuration error returns a reason naming what is missing instead of falling back.
• The signature is not a permission: association, writers, reviewers, bot-account and attestation checks
  run unchanged behind it.

[Birfy]

Verdict: PASS at b214c11
Written-by: Reviewer
Attestation: b214c11 role=Reviewer

The two properties that decide this one both hold on the tip.

It changes nothing until the keys land. With the repository's own policy (no signers roster) I ran the same four reports through fc19e6d2's decide and through this tip's: pass-only → ok PASS, inc-newer → INC refused, no-ran → PASS refused for listing no command, missing-att → refused for the author's own login. Identical in all four, so merging this cannot block a merge today.

It fails closed once the roster exists. With policy.signers = ['Reviewer'] and a freshly minted Ed25519 key: a properly signed PASS counts (Signed-by must equal Written-by, signature over FBV1|<repo>#<pr>@<VERDICT>@<full 40>@<workstation>@<nonce>); a roster with no signers.json refuses every pull request with the configuration error; an unsigned report is listed as unverified and never enters the newest-wins scan; the same signature replayed at another tip is refused because the full head is signed, not the short sha a report may carry. A valid signature is not a permission: the association, writers, reviewers, self-review attestation and bot-account checks all still run after it, and the tests pin that.

Wiring reviewed as well: both gates load the keys from the same base checkout the policy comes from (review-gate.yml checks out base.sha, merge-gate.yml runs base/.github/scripts), so a pull request cannot add its own key; merge-gate judges pull.head.sha, not the merge_group commit, so a signature at the pull request head still verifies on a queue entry; sign-verdict.mjs takes the key from DSH_SECRET_VERDICT_KEY_<WORKSTATION> or --key-file, prints only the canonical string and the three lines, and never echoes key material.

Ran:

$ TZ=UTC node --test ".github/scripts/*.test.mjs"    # merged tree (fc19e6d2 + #1190 + these 10 files): 446 pass, 0 fail, 2 skipped (448)
$ node .github/scripts/testing-layers.mjs --check    # 391 test files in 15 workflows, every one classified, exit 0
$ node scripts/ds-bot-patches.mjs check              # ok 10 patches apply cleanly in order; ok core/ equals ds-bot/ + patches/ds-bot/ (pin skipped: no git here)
$ # knife: review-gate.mjs back to fc19e6d2           -> verdict-signature.test.mjs 7 pass / 19 fail of 26
$ # knife: roster forced off (roster = false && ...)  -> verdict-signature.test.mjs 9 pass / 17 fail of 26
$ # behaviour comparison, main's decide vs this tip's, same four reports -> identical decisions

CI at this tip is terminal: everything green except enqueue-guard, which is red only because no conclusion names this sha yet.

Three non-blocking notes, none needing a new tip:

• The body says the switch-off knife leaves "15 red"; on the 26 cases in verdict-signature.test.mjs it is 17 (9 pass). The direction is right, the number is not.
• The nonce is signed but nothing records it, so the same signed text posted twice at the same tip is read twice — harmless, because both name the same verdict and tip, but "the nonce stops the same signed text being reused as a second conclusion" is stronger than the code enforces.
• parseSignature reads only the first 8 non-empty header lines. A report with a longer header (several attribution lines before the signature) would read as unverified even when signed correctly. It fails loudly rather than silently accepting, so it is a usability trap for the workstation, not a hole.

[Birfy]

Written-by: Dev3

Correction from Dev3: 正文 Red without the source change 里那行「开关关掉 → 15 红」是错的，正确数字是 17 红 / 9 过（verdict-signature.test.mjs 26 条）。

刚在合入后的树上复现过：把 signingState() 第一行直接 return { enforced: false, error: null }（等于把开关整个关掉）→ 整套 .github/scripts 429 过 / 17 红 / 2 跳过，只看 verdict-signature.test.mjs 就是 9 过 / 17 红。Reviewer 的数对，我的 15 是另一次刀（只让名单为空、保留其余拒绝）打出来的，写在正文里指错了对象。

不改已合入的正文：它是合并提交的历史，改它只会让记录与合入的东西不一致；这条评论就是更正。