[P1] [Contributions/IP] Apply the protected-main ruleset for enforced DCO

[KeyffMS]

Implemented state

SightAdapt uses DCO 1.1 and has repository-owned contribution-provenance controls.

PR #145 was merged as 26772597c1d458de55483a37967df182ab9f831c and implemented:

• identity-bound Signed-off-by verification for every pull-request commit;
• rejection of a valid-looking trailer belonging to an unrelated identity;
• removal of the spoofable [bot] author-name/email exception;
• exact trusted-bot allowlisting by pull-request actor login, numeric GitHub ID, actor type and commit author/committer emails;
• an empty production bot allowlist by default;
• policy fixtures for signed, unsigned, mismatched, spoofed-bot, trusted-bot and wrong-actor-ID scenarios;
• contributor, employer/client, AI-assistance, third-party-material and exception policies;
• historical non-owner contribution review;
• exact required main protection settings and evidence requirements in docs/legal/REPOSITORY-PROTECTION.md.

Verified CI result

GitHub Actions DCO run 30555690716 passed:

• all policy fixtures;
• spoofed [bot] metadata was rejected;
• a trusted fixture bot passed only with the exact actor ID/type and email record;
• all 10 real commits in PR Harden DCO identity checks and contribution provenance #145 passed identity-bound sign-off verification;
• no production bot exception was used.

The full Windows build/release run 30555690678 also passed, including 210 tests and the complete release-compliance pipeline.

Acceptance criteria

• Choose and document DCO 1.1 rather than a CLA.
• Require authorship or authorization certification.
• Require permission to distribute contributions under the MIT License and identified compatible third-party terms.
• Add a signed-off commit check.
• Bind accepted trailers to the commit author or committer identity.
• Define employer/client contribution handling.
• Require copied/generated/third-party material disclosure.
• Define AI-assisted contribution review and responsibility.
• Prohibit unknown or incompatible material.
• Document exceptions and private supporting evidence.
• Apply the policy to code, tests, documentation, assets and data.
• Replace spoofable bot-name matching with an exact trusted identity allowlist.
• Add automated blocking tests for unsigned and spoofed contributions.
• Apply and verify an active GitHub ruleset or branch protection for main.

Only remaining repository-admin action

Configure main so that:

• changes require a pull request;
• Verify commit sign-offs is a required status check;
• the build/test check is required;
• checks must pass on the current head;
• direct pushes, force pushes and branch deletion are blocked;
• no standing administrator/maintainer bypass is enabled.

Then retain non-secret evidence in this Issue: ruleset name/status, required checks, bypass list, push/deletion settings and a blocked unsigned-commit merge attempt.

The connected GitHub integration used for implementation has repository admin permission but does not expose branch-protection/ruleset read or mutation operations. Therefore this Issue remains open rather than claiming an unverified setting.

Close condition

Close as completed after the active main protection configuration and blocking evidence are recorded. This is a GitHub repository setting, not an external legal audit.

[KeyffMS]

Wynik audytu uzupełniającego — 2026-07-30

Ocena: w większości kompletne, lecz egzekwowanie repozytorium nie zostało potwierdzone; ponownie otwarte.

DCO, szablon PR i workflow istnieją. Repozytorium nie zawiera jednak dowodu, że check DCO jest wymaganym statusem dla main, że direct push jest ograniczony oraz że merge nie może ominąć kontroli. Wyjątek botów opiera się wyłącznie na nazwie/adresie autora zawierającym [bot], co można podrobić w metadanych commita.

Pozostałe prace

• skonfigurować i udokumentować repository rules/branch protection wymagające PR oraz pozytywnego checka DCO;
• ograniczyć możliwość direct push i pomijania checków;
• rozpoznawać wyjątki botów na podstawie zweryfikowanej tożsamości GitHub App/bota lub jawnej allowlisty, a nie dowolnej nazwy autora;
• zachować dowód konfiguracji i test blokującego scenariusza.

Issue może zostać zamknięte po potwierdzeniu, że polityka jest nie tylko opisana, ale rzeczywiście wymuszana.

[KeyffMS]

Triage priority — P1

Reason: the DCO workflow and provenance policy exist, but there is no verified repository ruleset/branch-protection evidence making the check mandatory. The current bot exception is based on author name/email text and can be imitated in commit metadata.

Close only when:

• Verify commit sign-offs is a required check for protected branches;
• direct pushes and administrator bypass are controlled and documented;
• bot exceptions use a trusted identity/allowlist rather than a spoofable string pattern;
• provenance exceptions remain recorded with supporting evidence.

Escalation: move to P0 before accepting the first independent external contribution.