[pascalandy]

Dirty files could make an unfixed HEAD pass signoff. A later HEAD change could also separate the signed commit from its evidence.

Core and the template now use the shared SDK signoff program. It freezes the SHA, checks a detached worktree, clears caller task variables, saves a receipt, and signs that SHA. Success keeps the landing script's Signed off on <sha> line.

Proved by: dirty-fix regression red on the old script and green after; template wiring red before and green after; full uv run --no-project --python 3.12 just check; scratch-clone signoff with stubbed gh recording the frozen SHA.

• 1. Spec: the sections that the card reads cover every command, flag, JSON key, and error code you add or change
• 2. Scenario: each scenario that the card proves fails for the missing behavior
• 3. Code: those scenarios pass
• 4. Text: each new user-facing string is a catalog entry with a description. n/a: repository task output, no ncly strings
• 5. Checks: just check passes
• 6. Verify: an agent that did not write the change runs verify-nicely on each feature that the card affects, and the pull request quotes its evidence. n/a: just signoff is a maintainer recipe, and no verify-nicely feature covers it. Independent proof instead: Sol round 3 reran bash scripts/signoff-test.sh at 8147d2fa (pass, "including persisted settings and overlay rejection"), and the landing of this pull request is the first real run of the new signoff
• 7. Docs: the card is done in its backlog item, README.md shows any change a user sees, and a skill teaches any command you add: the extension's, or nicely for core. Repository instructions and the contract teach this developer task
• 8. Sign off: just signoff passes, or just signoff-layers for a stack. pending: root

Review fixes: signoff drops caller GOFLAGS and turns GOWORK off, so an overlay cannot sign a broken SHA (Sol S1); the fixture disables commit signing (S2); the doc explains recovery after SIGKILL (S3); signoff keeps the caller's GOENV and masks a persisted GOFLAGS with a blank value, so settings such as GOPRIVATE stay (S5, caller-go-env red exit 1, green exit 0). Declined: S4, a hand-edited Go module cache; Go writes those files read-only, and the card covers the working tree. go mod verify before signing is a follow-up.

Root review: Opus 5.5 read the full diff and each fix, wrote the S5 fix, and rebased onto T4 (nicely#394). The one conflict, in sdk/extensionrepo/program.go, keeps both the test and the signoff dispatch lines.

Reviewed with sol-loop: 3 rounds with gpt-6.1-sol on xhigh. Sol verdict: approved

by GPT-6.1-Sol via Codex

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 8dedcd82-8d2d-4eb9-86b2-03d551d9acaa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}