docs(#2252): clarify DCO policy to exempt autonomous agent commits

[fullsend-ai-coder]

The DCO bullet in AGENTS.md mandated sign-off for all commits without distinguishing human from bot authorship. This contradicted CONTRIBUTING.md, which already exempts autonomous agent commits. The review agent flagged this policy contradiction during PR #2240 and a human reviewer requested a clarification issue.

Update the DCO bullet to mirror the CONTRIBUTING.md language: human-proposed commits must sign off, human-driven agent sessions should sign off, and autonomous agent commits are exempt because the DCO is a human attestation that no one is present to make in an autonomous session.

Note: make lint could not run (shellcheck download blocked by sandbox network policy). This is a docs-only change with no code to test.

---

Closes #2252

Post-script verification

• Branch is not main/master (agent/2252-clarify-dco-bot-exemption)
• Secret scan passed (gitleaks — 0f53834f72372426c24dc0ede0030486a3e510ea..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

Site preview

Preview: https://ceabf0bc-site.fullsend-ai.workers.dev

Commit: c1f72501941fca3cf5f71a106d8d49411a56c6c0

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:53 PM UTC · Completed 7:01 PM UTC
Commit: 8ee5782 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] AGENTS.md:15 — AGENTS.md is a protected path that requires human approval. The PR modifies the DCO policy bullet to exempt autonomous agent commits. The linked issue (Clarify AGENTS.md DCO policy: exempt agent-authored commits #2252) and PR description explain the rationale. Human approval is always required for protected-path changes, regardless of context.

Info

• [content-density] AGENTS.md:15 — The DCO bullet compresses three paragraphs from CONTRIBUTING.md into a single bullet, stripping rationale and implementation details. Line 14 uses a cross-reference pattern (linking to COMMITS.md for details), while line 15 is now four sentences with no cross-reference anchor. Consider adding a cross-reference to CONTRIBUTING.md in a future PR.
• [phrasing-consistency] AGENTS.md:15 — AGENTS.md provides both sign-off methods (flag and manual trailer) while CONTRIBUTING.md mentions only one. The more explicit phrasing is appropriate for an agent audience that may execute commands programmatically.
• [scope-alignment] AGENTS.md:15 — The change correctly addresses the documented policy contradiction identified in issue Clarify AGENTS.md DCO policy: exempt agent-authored commits #2252. The updated bullet point matches CONTRIBUTING.md's three-tier DCO distinction.
• [architectural-coherence] AGENTS.md:15 — The three-tier distinction (human commits must sign off, human-driven agent sessions should sign off, autonomous agents are exempt) is architecturally sound and aligns with the project's trust model.

Previous run

Review

Findings

Medium

• [protected-path] AGENTS.md:15 — AGENTS.md is a protected path that requires human approval. The PR modifies the DCO policy bullet. Human approval is always required for protected-path changes, regardless of context.

Low

• [consistency] AGENTS.md:15 — The DCO bullet in AGENTS.md uses different wording than the canonical DCO policy in CONTRIBUTING.md (lines 9-15). While the semantic content aligns, the two files describe the same policy with different emphasis and detail level, creating some maintenance burden for future DCO policy changes.
  Remediation: Either (a) make AGENTS.md reference CONTRIBUTING.md for the DCO policy instead of duplicating it, or (b) if duplication is intentional for contributor convenience, use near-identical wording.

Info

• [formatting] AGENTS.md:15 — The new DCO bullet uses bold for both modal verb emphasis and a section-header style phrase. This directly mirrors CONTRIBUTING.md's formatting, so it is appropriate for the alignment goal.
• [documentation-structure] AGENTS.md:15 — The new DCO bullet is now the longest bullet in the section. Consider moving rationale to a sub-section or cross-reference in a future PR, matching the commit-message bullet's pattern of linking to COMMITS.md for details.
• [scope-alignment] AGENTS.md:15 — The change correctly addresses the documented policy contradiction identified in issue Clarify AGENTS.md DCO policy: exempt agent-authored commits #2252.
• [architectural-coherence] AGENTS.md:15 — The three-tier distinction (human commits must sign off, human-driven agent sessions should sign off, autonomous agents are exempt) is architecturally sound and aligns with the project's trust model.
• [authorization] AGENTS.md — Trivial documentation-only change with clear authorization from issue Clarify AGENTS.md DCO policy: exempt agent-authored commits #2252. No scope creep.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:19 PM UTC · Completed 7:28 PM UTC
Commit: c1f7250 · View workflow run →

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 12:00 PM UTC · Completed 12:10 PM UTC
Commit: c1f7250 · View workflow run →

[fullsend-ai-retro]

Retro: PR #2256 — clarify DCO policy to exempt autonomous agent commits

Timeline

1. Triage (June 12, 18:36 UTC) — Agent accepted issue #2252 and labeled it ready-to-code.
2. Code (18:42) — Agent created PR #2256 with a single change to AGENTS.md, adding a detailed DCO policy bullet.
3. Review (18:49–19:01) — Agent flagged protected-path (medium, requiring human approval) and content-density (info, noting the bullet compressed three paragraphs into one). Both findings were accurate.
4. Human review (19:14) — @ralphbean left an inline comment ("Too much information") with a suggestion to condense the bullet, then approved. Committed the simplification as c1f7250.
5. Re-review (19:16–19:28) — Triggered by the human's commit; completed cleanly.
6. Merge (June 15, 11:55) — PR merged by @ralphbean.

Assessment

The workflow performed well overall. The review agent correctly identified the two key issues (protected path needing human approval, and excessive verbosity). No fix agent ran — appropriate since the only actionable finding involved a protected path.

The single friction point was code agent verbosity: the agent over-expanded the DCO bullet, requiring human rework to condense it. This is a known pattern already tracked by #2047 ("Code agent over-explains domain knowledge in agent prompt files, causing rework"). Additionally, the triage agent's acceptance of an issue targeting a protected path without flagging the constraint is tracked by #2290.

No new proposals filed — both improvement opportunities are already covered by open issues.