fix(docs): format.signOff does not sign commits, and remediation is unavailable

Both review points were factually right and my original text was wrong.

1. `git config format.signOff true` — which I had recommended as the *better*
   option — only defaults the -s flag for `git format-patch`. `git commit` never
   reads it, and there is no `commit.signoff` equivalent. Verified all three in a
   throwaway repo: format.signOff → no trailer; commit.signoff → no effect; a
   prepare-commit-msg hook → works. Shipping that advice would have been worse
   than saying nothing, since it looks like a fix and silently changes nothing.

   Now recommends `git commit -s`, gives the verified hook for automation, and
   names format.signOff explicitly as a trap — the name invites exactly the
   mistake I made, so it is worth warning about rather than omitting.

2. The DCO app's empty remediation-commit flow needs
   `allowRemediationCommits.individual`. This repo ships no DCO config, so it
   runs with that disabled and the original unsigned commits keep failing. The
   escape hatch I offered does not exist here; rewriting is the only repair, so
   the text now says to coordinate before rewriting shared history instead.

Mirror updated with both corrections.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HDdo1rNRVQnVRRdsqSrvG3
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-11 22:29:54 -04:00
commit b3242bc04c

View file

@ -103,7 +103,7 @@ Both exist and do different jobs. Theme files (`src/theme/<Component>.ts`) custo
- **A test or smoke must not touch real user state.** The web smokes run against a throwaway catalog via the shared `scripts/lib/prod-web-server.mjs` helper, never the developer's `~/.mcp-inspector/mcp.json` (#1977); the cli/tui smokes drive a temp `--catalog`. A new smoke spawning its own server, or teardown that removes a work dir without first awaiting `stopChild` (the #1801 race — `child-cleanup.mjs` exports both halves and both are required), should be flagged.
- **Every PR references an issue**, first body line `Closes #<ISSUE_NUMBER>`.
- **Every PR carries exactly one version label**, `v1` or `v2`, matching its base branch.
- **Every commit carries a `Signed-off-by:` trailer.** The DCO check is a hard merge gate and fails on a single unsigned commit; `git commit -s`, or `git config format.signOff true` once per clone. Repairing pushed commits means `git rebase HEAD~<n> --signoff` + `git push --force-with-lease`.
- **Every commit carries a `Signed-off-by:` trailer.** The DCO check is a hard merge gate and fails on a single unsigned commit. Use `git commit -s` (note `format.signOff` does *not* sign `git commit` — only `format-patch`; automate with a `prepare-commit-msg` hook instead). Repairing pushed commits means `git rebase HEAD~<n> --signoff` + `git push --force-with-lease`; remediation commits are not enabled on this repo.
- Update the relevant `README.md` / `AGENTS.md` when a change adds, removes, renames, or repurposes a file or folder, changes the structure or tech stack, or introduces a command, dependency, or architectural pattern.
## What to prioritize in review