docs: add Signed commits section to CONTRIBUTING

[hyperpolymath]

Adds a Signed commits section to this repo's CONTRIBUTING, per owner ruling D218. The estate policy is docs/SIGNING-POLICY.adoc in hyperpolymath/standards.

This repo's default branch is covered by the zero-bypass Require-Signed-Commits ruleset, and rebase-merge is off. The section tells contributors what that requires:

• People and interactive agents sign with an SSH signing key.
• Apps, bots and workflows write through the API, so GitHub signs their commits.
• PRs are merged with squash.

If the file already had its own signing section, that section is replaced in place instead of adding a second one. Lines elsewhere that told people to sign with GPG are changed to match the policy (SSH for people).

This is a docs-only change. The commit was created through createCommitOnBranch, so GitHub signs it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f4e1e9d2-a8e8-40bb-b744-29bcea74dbdf

📥 Commits

Reviewing files that changed from the base of the PR and between b357094 and 5c21cd9.

📒 Files selected for processing (1)

• .github/CONTRIBUTING.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (18)

• GitHub Check: semgrep-cloud-platform/scan
• GitHub Check: scan / gitleaks
• GitHub Check: scan / shell-secrets
• GitHub Check: governance / Licence consistency
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Security policy checks
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Guix primary / Nix fallback policy
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Code quality + docs
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
• GitHub Check: Julia 1.10 - ubuntu-latest
• GitHub Check: Julia 1.11 - ubuntu-latest
• GitHub Check: Julia 1.11 - macos-latest
• GitHub Check: Analyze (actions)

🔇 Additional comments (1)

.github/CONTRIBUTING.md (1)

73-88: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Documentation
  • Added guidance on commit signing, including requirements for SSH signing keys and verified committer email.
  • Clarified that pull requests must be squash-merged and unsigned commits block merging.
  • Documented signing requirements for apps, bots and workflows.

Walkthrough

The contributing guide now describes commit-signing requirements for people, interactive agents, apps, bots and workflows. It also states that pull requests must be squash-merged and that unsigned commits on a pull request branch block merging.

Changes

Commit signing guidance

Layer / File(s)	Summary
Document commit signing and merge requirements .github/CONTRIBUTING.md	The guide specifies SSH signing and a verified committer email for people and interactive agents. Apps, bots and workflows must use the API or signed-push action. The guide also states that pull requests must be squash-merged, unsigned commits block merging, and rebase-merge is disabled.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 5c21c

This documentation change adds commit-signing and merge guidance. Available evidence establishes no concrete user-facing failure; the repository’s rebase-merge setting remains unverified.

Architecture Summary

Architecture risk: 🔵 Low · up to 5c21c

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/CONTRIBUTING.md: Adds signing requirements for commits reaching the default branch, specifying SSH signing and verified committer email for people and interactive agents, API-based signed commits for apps, bots and workflows, and squash merges because unsigned PR-branch commits block merging and rebase-merge is disabled.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a Signed commits section to CONTRIBUTING.
Description check	✅ Passed	The description directly explains the documentation change, its signing policy context, and the affected contributor guidance.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit signs a commit with care,
An SSH key joins it there.
The guide says squash to merge the line,
Verified email makes it fine.
Then hops away beneath the pine.}

_{Comment @coderabbitai help to get the list of available commands.}

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR