From 8ee5782b039346f9c450063a448b0866b5624de2 Mon Sep 17 00:00:00 2001 From: fullsend-code <278716306+fullsend-ai-coder[bot]@users.noreply.github.com> Date: Fri, 12 Jun 2026 18:48:33 +0000 Subject: [PATCH 1/2] docs(#2252): clarify DCO policy to exempt autonomous agent commits The DCO bullet in AGENTS.md mandated sign-off for all commits without distinguishing human from bot authorship. This contradicted CONTRIBUTING.md, which already exempts autonomous agent commits. The review agent flagged this policy contradiction during PR #2240 and a human reviewer requested a clarification issue. Update the DCO bullet to mirror the CONTRIBUTING.md language: human-proposed commits must sign off, human-driven agent sessions should sign off, and autonomous agent commits are exempt because the DCO is a human attestation that no one is present to make in an autonomous session. Note: make lint could not run (shellcheck download blocked by sandbox network policy). This is a docs-only change with no code to test. Closes #2252 --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index d256bc01b..e41dc8650 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -12,7 +12,7 @@ Fullsend is a platform for fully autonomous agentic development for GitHub-hoste - The target audience for problem documents is any contributor community considering autonomous agents — keep language accessible and avoid presuming solutions. - Always run `make lint` before submitting changes and fix any failures. - You **must** read and follow [COMMITS.md](COMMITS.md) when writing or reviewing commit messages. Getting the prefix right is not optional — GoReleaser uses it to build release notes. -- This repository requires a [Developer Certificate of Origin (DCO)](https://developercertificate.org/). Every commit **must** be signed off: use `git commit -s` (or add `Signed-off-by: Your Name ` as a trailer). Commits without a sign-off will fail CI. +- This repository requires a [Developer Certificate of Origin (DCO)](https://developercertificate.org/). Human-proposed commits **must** be signed off: use `git commit -s` (or add `Signed-off-by: Your Name ` as a trailer). Human-driven agent sessions (e.g., using Claude Code locally) should also sign off — the human directing the session is the one certifying the DCO. **Autonomous agent commits are exempt:** the DCO is a human attestation of personhood and legal authority to contribute, and no human is present to make that certification in an autonomous session. These agents commit using the GitHub App's bot identity, which the [Probot DCO app](https://github.com/apps/dco) auto-skips. The human who merges the PR accepts responsibility for the contribution. - Never commit secrets (tokens, API keys, PEM keys, gcloud credentials) or sensitive data (GCP project names, service account identifiers, Model Armor template names, internal hostnames). Use environment variables with no defaults for sensitive values. ## Go code From c1f72501941fca3cf5f71a106d8d49411a56c6c0 Mon Sep 17 00:00:00 2001 From: Ralph Bean Date: Fri, 12 Jun 2026 15:14:42 -0400 Subject: [PATCH 2/2] chore: reduce verbosity Signed-off-by: Ralph Bean --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index e41dc8650..57c1b4ff4 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -12,7 +12,7 @@ Fullsend is a platform for fully autonomous agentic development for GitHub-hoste - The target audience for problem documents is any contributor community considering autonomous agents — keep language accessible and avoid presuming solutions. - Always run `make lint` before submitting changes and fix any failures. - You **must** read and follow [COMMITS.md](COMMITS.md) when writing or reviewing commit messages. Getting the prefix right is not optional — GoReleaser uses it to build release notes. -- This repository requires a [Developer Certificate of Origin (DCO)](https://developercertificate.org/). Human-proposed commits **must** be signed off: use `git commit -s` (or add `Signed-off-by: Your Name ` as a trailer). Human-driven agent sessions (e.g., using Claude Code locally) should also sign off — the human directing the session is the one certifying the DCO. **Autonomous agent commits are exempt:** the DCO is a human attestation of personhood and legal authority to contribute, and no human is present to make that certification in an autonomous session. These agents commit using the GitHub App's bot identity, which the [Probot DCO app](https://github.com/apps/dco) auto-skips. The human who merges the PR accepts responsibility for the contribution. +- This repository requires a [Developer Certificate of Origin (DCO)](https://developercertificate.org/). Human-proposed commits **must** be signed off: use `git commit -s` (or add `Signed-off-by: Your Name ` as a trailer). Human-driven agent sessions (e.g., using Claude Code locally) should also sign off — the human directing the session is the one certifying the DCO. **Autonomous agent commits are exempt** and must never supply the DCO with `-s` or with `Signed-off-by`. These agents commit using the GitHub App's bot identity, which the [Probot DCO app](https://github.com/apps/dco) auto-skips. - Never commit secrets (tokens, API keys, PEM keys, gcloud credentials) or sensitive data (GCP project names, service account identifiers, Model Armor template names, internal hostnames). Use environment variables with no defaults for sensitive values. ## Go code