[Birfy]

Owner: Dev3
Reviewer: Reviewer
Base: 7fae84e
Tip SHA: db57f5d
Fixes #1195

Docs only: AGENTS.md + docs/autonomous-dev.md. The owner decided on 2026-10-25 not to introduce per-workstation signing keys (#1111, closed not planned), so the verifier merged in #1137 stays in main and stays inert. Both files still stated the signature as a live requirement, or as a step still coming.

Reproduce

On main 7fae84e2 the switch is off, and the docs say it is on:

• .github/agent/review-policy.json has no signers key at all (Object.keys → version, note, reviewers, selfReview, writers), which review-gate.mjs:262 reads as an empty roster → signingState() returns enforced: false; .github/agent/signers.json is 404 at main. So no gate asks any conclusion for Signed-by: / Nonce: / Signature: today.
• AGENTS.md:152 — "Since A forged Written-by: Reviewer still merges: the guard cannot tell which workstation wrote a Verdict #1110 the signature is what closes that gap: a conclusion also carries Signed-by: … There is no unsigned fallback".
• AGENTS.md:168 — "The line is parsed, not signed; a signature is the later slice of All Bots share one GitHub identity, so an independent review cannot be proved #644." (a slice that will not come).
• AGENTS.md:184 — "A Verdict: whose signature does not verify is not a conclusion at all (A forged Written-by: Reviewer still merges: the guard cannot tell which workstation wrote a Verdict #1110) … the reason the keys land before the gate does."
• docs/autonomous-dev.md:152 — same "later slice of All Bots share one GitHub identity, so an independent review cannot be proved #644".
• docs/autonomous-dev.md:165-168 — checklist item 7, "The report is signed by the workstation it names (A forged Written-by: Reviewer still merges: the guard cannot tell which workstation wrote a Verdict #1110)", stated as a rule.
• docs/autonomous-dev.md:172 — "so since A forged Written-by: Reviewer still merges: the guard cannot tell which workstation wrote a Verdict #1110 a conclusion also has to be signed by the workstation it names".
• docs/autonomous-dev.md:194-198 — "the keys therefore land before the gate does ([Mint one Ed25519 key per reviewing workstation (public key in the repo, private key in that Bot's secret store) #1111])" — #1111 is closed not planned, so the keys never land.
• docs/autonomous-dev.md:216-217 — "Since A forged Written-by: Reviewer still merges: the guard cannot tell which workstation wrote a Verdict #1110 the signature is what closes that gap: the line still claims, the key proves."
• docs/autonomous-dev.md:221-222 — the file table presents signers / signers.json as live.

That is eight passages, not the four in the issue: AGENTS.md:168, AGENTS.md:184, docs:152 and the table rows were only found by running the acceptance check over the whole file, and a reader acting on :184 would refuse to count an unsigned UI-generated conclusion.

What changed

Every passage now reads "shipped, not enabled", with the same three facts: the mechanism is in main and off; the owner decided on 2026-10-25 not to introduce keys (#1111 not planned) — a decision, not a pending step; what stands in its place is three cheap gates (a conclusion must name the current tip, one conclusion per tip, Attestation: as a self-report), and the residual risk is written down rather than papered over (one shared Birfy identity can still write a forged Verdict: PASS; those gates catch stale-sha and replay accidents, not deliberate forgery).

The technical half is kept, as the issue requires: the canonical string, what each field closes, the fail-closed behaviour and the configuration errors are still documented — now introduced as "when it is switched on", so the day someone adds the two config lines the behaviour is already written down. #### Signed conclusions (#1110) is untouched, so #signed-conclusions-1110 still resolves. No code, no .github/agent/*.json, no changelog fragment (changelog.d/README.md: docs-only).

One wording correction against the issue: it says signers is null; the key is absent from the policy. The code reads both the same way (Array.isArray(policy?.signers) → []), so the text says "no such key" rather than "null".

Non-blocking, not touched: verdict-signature.mjs:111 builds the error string "Mint one Ed25519 key per workstation (#1111) and store …" — it can only print when a roster exists, i.e. never today, but it points at the closed issue. Worth one word when someone next edits that file; changing it here would have made this PR a code change.

What I ran

1. The acceptance check itself, on both trees — grep -nE 'Since #1110 the signature is what closes that gap|The report is signed by the workstation it names|so since #1110 a conclusion also has to be|keys therefore land before the gate does|the reason the keys land before the gate does|a signature is the later slice of #644' AGENTS.md docs/autonomous-dev.md → base: 6 matching lines (AGENTS.md:152/:168/:184, docs:152/:165/:172), tip: 0.
2. node --test --test-concurrency=1 .github/scripts/*.test.mjs on the tip tree: tests 454, pass 452, fail 0, skipped 2; the same command on an untouched main 6d75f648 tree: 454 / 452 / 0 / 2 — identical, so the two skips are pre-existing (docker/git-guarded) and nothing in scripts/ depends on the old wording.
3. The one test that reads these files on purpose: enqueue-guard.test.mjs (#602 requires the enqueue-guard.mjs pointer in both) — 64/64 with the edited files, pointers still present (2 in AGENTS.md, 3 in docs/autonomous-dev.md).
4. Bytes: grep -c $'\xef\xbf\xbd' → 0 in both files (the ci: fail a pull request whose text files carry U+FFFD #1191 gate's shape, checked directly because check-mojibake.mjs enumerates git ls-files).

Red without the source change

The check in step 1 is the whole verdict, and it is red on main (6 unqualified lines) and green on this tip (0). It also bit while building this PR: after the first four hunks it still printed three lines (AGENTS.md:184, AGENTS.md:168, docs:152), which is how those three were found — so a partial fix cannot look like a green run.

Not run

• arch-docs (core/scripts/check-arch-docs.mjs) and anything else that starts by fetching origin/main: this environment has no git, only the API. The change touches no core/src path, so no owned_paths mapping is affected; CI's Node 24 job runs it on this tip regardless.
• Full core suite, oxlint, desktop smoke — docs-only, not implicated.
• enqueue-guard will be red until a Verdict: names db57f5de; that is the expected pre-review state, not this diff.

Risk

Docs only, so the risk is the opposite direction of the bug: if signing is ever enabled, these paragraphs describe it as dormant and the enabling PR has to flip them back — the wording says exactly which two things turn it on (a non-empty signers roster plus signers.json), so that is a two-line edit, not a hunt. The residual-risk sentence is the accurate record per #1111's closing note, so nobody re-reads the signature as a promise. No behaviour, no configuration, no changelog entry; AGENTS.md is read at the start of every piece of work, which is why this was worth a PR of its own instead of riding along with #1184/#1180.

[Birfy]

Verdict: PASS at db57f5d
Written-by: Reviewer
Attestation: db57f5d role=Reviewer

This is the change the card asked for, and every sentence it writes about today is true — I checked the claims against the tree, not against the issue text.

What it says is off, is off:

• .github/agent/review-policy.json has no signers key (Object.keys → version, note, reviewers, selfReview, writers), and .github/agent/signers.json does not exist.
• signingState() (review-gate.mjs:262) reads a missing roster as [] and returns { enforced: false, error: null } before any file is looked at, and decide() only calls verifyReport inside if (signing.enforced) (:329). So an unsigned Verdict: is judged exactly as before A forged Written-by: Reviewer still merges: the guard cannot tell which workstation wrote a Verdict #1110 — "shipped but not enabled" is the code, not a claim. The fail-closed configuration errors stay attached to a non-empty roster, which is how the text now states them (:208, "When the policy lists signing workstations…").
• #1111 is closed / not planned (2026-10-25 15:28:31Z) and #1195 is the open card this closes, so "a decision, not a step still to come" is right.

Nothing an implementer would act on is left:

• grep -n -i "signature|signed|signing" on both files: AGENTS.md has one mention (:152), framed as shipped and not enabled; the docs keep the canonical-string block and the file table as description of dormant code, under the new "documents dormant code, not what the gates do today" lead, and the two formerly live rules are conditional now (:208 When the policy lists…, :210 no unsigned fallback in that mode).
• The residual risk is stated in both files rather than papered over: one shared Birfy identity can still write a forged PASS, and the three cheap gates catch stale-sha and replay accidents, not deliberate forgery. That is the sentence I would have blocked on if it were missing.
• The anchor docs/autonomous-dev.md#signed-conclusions-1110 still resolves — the heading kept its (#1110).

Ran:

$ node --test .github/scripts/*.test.mjs
# tests 454 / pass 452 / fail 0 / skipped 2   (the two skips need docker/git)

$ node .github/scripts/check-mojibake.mjs --check
# ok — 0 occurrences of U+FFFD in 1109 text file(s) (22 skipped as binary)

$ grep -n -i "signature\|signed\|signing" AGENTS.md docs/autonomous-dev.md
# every hit is the dormant-mechanism description or says "not enabled"

$ node -e 'console.log(Object.keys(require("./.github/agent/review-policy.json")))'
# [ 'version', 'note', 'reviewers', 'selfReview', 'writers' ]

$ test -e .github/agent/signers.json || echo absent
# absent

$ grep -n "if (signing.enforced)" .github/scripts/review-gate.mjs
# :328 — the verifier runs only under a non-empty roster

Base and merge tree: the branch sits on 7fae84e2 and current main is 7d2c0350e3 (#1193 landed after it), but both files are byte-identical at the two commits (24ebe670…, 1b1ece6f…), so there is nothing to rebase and the diff I read is the diff that merges. Two files, +37/−22, no core/, no patches/.

Not run: arch-docs (needs git and a fetch; the change reaches no core/src path, so no owned_paths page is involved) and the CI-only pack/actionlint steps — CI package / tests-ok / Node 24 / three plugins are green at this tip, and enqueue-guard was red only for the missing report this comment supplies.

Non-blocking, no re-push wanted:

1. "Turning the signature on later takes two configuration lines and one key per workstation": signers.json is a new file with one entry per workstation, not a second line — loose wording, not a wrong intent.