From a530a38ddcf2a961db193af158f049c3f87b5b9f Mon Sep 17 00:00:00 2001 From: Aninda Ray Date: Sun, 14 Jun 2026 22:02:01 -0700 Subject: [PATCH] docs: document signed-merge policy (squash/merge, not rebase) main is kept signed/Verified on GitHub. Rebase-merge re-creates the merged commit without a signature (it left one unverified commit on main); squash and merge-commit are GitHub-signed. Document the policy in CONTRIBUTING so future merges keep main verified. Co-Authored-By: Claude Opus 4.8 (1M context) --- CONTRIBUTING.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c60856a..1118f14 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -49,6 +49,14 @@ The offline suite uses scripted adapters — no API keys required. Live evaluation against real models, and the SWE-bench Docker path, are reserved for separate benchmarking and are not part of CI. +## Merging + +Commits and tags on `main` are signed (SSH) and show as **Verified** on +GitHub. To keep `main` fully verified, merge pull requests with **Squash +and merge** or **Create a merge commit** — GitHub signs the resulting +commit automatically. Avoid **Rebase and merge**: it re-creates the +commit without a signature, leaving an unverified commit on `main`. + ## Evaluation methodology and operational data A larger body of operational evaluation work — per-instance stream