Reject unsigned commits on main

[RhettCreighton]

User outcome: every commit accepted on main has verifiable Rhett Creighton authorship, so native proof receipts cannot be paired with unsigned source history.

Observed 2026-09-02T19:10:00Z: main advanced to 4b60290. The raw Git commit has no gpgsig block and GitHub reports commit.verification.verified=false, reason=unsigned.

Acceptance:

• A normal push of an unsigned commit to refs/heads/main is rejected server-side.
• Signed SSH commits from the configured Rhett Creighton key remain accepted.
• The enforcement is tested without consuming paid GitHub Actions minutes.
• Documentation and hooks state the same server-side boundary truthfully.

The existing unsigned shared commit must not be removed with force or history rewriting.

[RhettCreighton]

Fresh evidence on 2026-09-03T01:52:00Z: origin/main advanced from afc38f6 to b26aa65 through 19 consecutive commits. Every commit is unsigned (no gpgsig; %G?=N), and every message carries a forbidden external Co-Authored-By trailer. The required server-side rejection is therefore still absent.

A current local bypass also exists in tools/ship.sh: its ahead-of-main path invokes git push --no-verify origin main before ship gates and build preflight. This is not evidence of how this particular stack landed, but it defeats the native receipt hook and must be removed or made incapable of updating main. Shared history must not be force-rewritten.

[RhettCreighton]

Verified through the GitHub branch-protection API on 2026-09-03: required_signatures.enabled is false for main. required_linear_history.enabled=true, enforce_admins.enabled=true, and allow_force_pushes.enabled=false, but the server currently does not enforce signed commits. This directly explains how the 25 unsigned commits could update main; local hooks alone cannot establish the repository-wide invariant.

[RhettCreighton]

Restored the missing server rail on 2026-09-03: enabled GitHub required-signature protection for main and read back required_signatures=true, alongside required_linear_history=true, enforce_admins=true, and allow_force_pushes=false. No history was rewritten. The 25 already-landed unsigned commits remain immutable evidence; all future main updates are now server-rejected unless signed.

[RhettCreighton]

Completed the end-to-end signature rail on 2026-09-03: registered the laptop’s existing ED25519 public key as a GitHub signing key after explicit device authorization. GitHub now reports commits signed by that key as verified=true, reason=valid; branch protection still reads back required_signatures=true, required_linear_history=true, and enforce_admins=true. No private key material moved or changed.

[RhettCreighton]

Coordination is migrating to Z23's native task, candidate, action, and receipt system. Work continues there; GitHub Issues are no longer the coordination authority.