infra: org ruleset required_signatures blocks PRs carrying commits from machines with unregistered signing keys — register every lane machine's key (found via PR #591)

[kyle-sexton]

Found at PR #591's merge digest (control tower, 2026-07-20). The org ruleset (17988999) sets required_signatures: true, gating on every constituent commit of a PR — a single commit signed with an unregistered key (UNKNOWN_KEY) or unsigned (NO_SIG) blocks the merge even when everything else is clean, and the failure surfaces only as an opaque mergeStateStatus: BLOCKED.

Evidence: #591 had 2 UNKNOWN_KEY commits (authored on a lane machine whose signing key GitHub doesn't recognize) + 1 NO_SIG (an agent worktree commit that skipped signing); the desktop's config produces VALID commits.

Actions:

1. Inventory each machine running lanes (desktop, personal laptop, work laptop) — confirm user.signingkey + gpg.format config AND that the key is registered on the GitHub account. Register missing keys.
2. Ensure agent worktrees inherit signing config (the NO_SIG commit suggests a worktree/env where commit.gpgsign didn't apply).
3. Babysit/tower diagnostic: when mergeStateStatus is BLOCKED with green checks + zero threads, check commit verification states before anything else (this failure mode reads as "mystery block").

Cross-repo note: ruleset itself is github-iac-owned; no ruleset change recommended — fix the keys, keep the protection.

[kyle-sexton]

This was generated by AI during triage.

Triage — T3, needs-human.

Mixed action set: item 1 (register each lane machine's signing key on its GitHub account) is inherently a human credential/identity action — no autonomous coding agent can register a signing key on someone's GitHub account. Items 2 (agent worktrees inheriting signing config) and 3 (babysit/tower diagnostic runbook addition) are agent-doable once item 1 is done, but the issue is one coherent unit and item 1 gates the rest.

Priority: high — this currently blocks a live, open PR (#591, mergeStateStatus: BLOCKED on required_signatures), satisfying the "blocks other work" criterion. Could not record a native blocked-by edge from PR #591 to this issue — gh pr edit has no --add-blocked-by/--blocked-by flag (native issue-dependency linking appears to be an Issues-only surface via this CLI). Noting the block here in lieu of a machine-visible dependency edge; flagging as a lane-tooling gap.

wayfind:task (execution runbook for a human, not an open design question).

[kyle-sexton]

This was generated by AI during triage.

Decision brief — how to close the signing-key gap that required_signatures exposes.

Problem

The org signing ruleset requires every commit on a PR to carry a signature GitHub can verify, and a signature verifies only when the key is registered to a GitHub account. PRs are silently BLOCKED (as on #591) whenever a lane machine's commits are signed with a key GitHub doesn't recognize (UNKNOWN_KEY) or aren't signed at all (NO_SIG) — so the real decision is who registers each lane machine's signing key, and how we keep that from recurring.

Current setup (verified in melodic-software/github-iac)

• The ruleset is IaC-managed, not ad-hoc: OrgRulesets.cs:160 defines OrganizationRuleset("signing") — Target=branch, Enforcement=active, Rules.RequiredSignatures = true, Protect = true.
• It is gated on the requires-signing custom property, which defaults to true and applies org-wide (OrgCustomProperties.cs:8,31; OrgRulesets.cs:165). So the protection is on for every governed repo by design.
• Provenance is intentional: GovernedRepository.cs:73 documents that provenance = "cryptographic commit signing plus PR review, not a DCO text trailer." This is a deliberate governance choice, not an accident.
• Conclusion: no ruleset change is warranted. The enforcement is working as designed; the gap is missing/unregistered keys on the signing side. (This matches the issue body's cross-repo note.)

External facts (GitHub commit-signature verification)

• A commit shows Verified only when signed with a GPG/SSH/S-MIME key registered to a GitHub account and the signer identity matches; otherwise it is Unverified, which required_signatures treats as failing. See GitHub Docs, "About commit signature verification" (docs.github.com/authentication/managing-commit-signature-verification/about-commit-signature-verification) and "Available rules for rulesets → Require signed commits." (Cited from GitHub's documented behavior; I did not live-fetch the pages in this session — treat exact wording as unverified.)
• Registering a signing key is a per-user, per-account identity action on the GitHub account that authored the commits — it is not org/repo config, so the Pulumi GitHub provider in github-iac does not manage it. (Unverified: I did not confirm the provider lacks a user-signing-key resource; flagging as a security-relevant assumption to check before ruling IaC out entirely.)

Security framing (device-bound material)

A commit signing key's private half is device-bound material: per the org secret-binding policy (NIST IR 7966 / SP 800-57), you generate it per device, never copy or sync the private half, and distribute only the public half (here, by registering it on the account). That principle drives the options below — any approach that copies one private key across machines is the anti-pattern, not a shortcut.

What I could NOT verify (please confirm before acting)

• Which machines actually run lanes (issue body says desktop / personal laptop / work laptop), their current user.signingkey + gpg.format (ssh vs openpgp), and which keys are already registered on the account. This requires per-machine + per-account inspection I can't do from here.

Options

Option A — Register each lane machine's own device-bound key manually, now (RECOMMENDED).
On every lane machine: confirm a dedicated signing key exists (an SSH-format signing key is usually the least-friction choice; GPG also works), then register only the public half to the GitHub account as a signing key. Most secure — one private key per device, per-machine revocation, nothing copied. Reversible (remove the key from the account). Cost: a manual step per machine; must be repeated when a machine is added — which is exactly what Option B fixes.

Option B — Do A, then codify it as a documented onboarding step (RECOMMENDED, pairs with A).
Capture "generate device signing key → register public half → set commit.gpgsign=true + gpg.format" as a lane-machine onboarding runbook/skill so the gap can't silently recur. Additive to A, not a substitute. This is the durable fix for the recurring class of failure; A fixes the machines blocking #591 today. Low risk, fully reversible.

Option C — One shared signing key copied to every machine. (NOT RECOMMENDED.)
Simplest to reason about, but it copies device-bound private material across machines — directly violates the secret-binding policy, creates a single point of compromise, and destroys per-machine revocation. Reject unless there is an overriding reason, and only with explicit approval.

Option D — Move key registration into github-iac IaC. (Likely not applicable — verify.)
Attractive for consistency, but signing keys are account-scoped identity material, not org/repo config, so they probably fall outside the Pulumi GitHub provider's managed surface. Confirm before pursuing; if unsupported, record it as "cannot be expressed in IaC" per the IaC-first doc and keep A+B.

RECOMMENDED: A + B. Register each lane machine's own device-bound key now to unblock #591 (Option A), and capture the registration as an onboarding step so new machines don't reintroduce the block (Option B). This unblocks the live PR without weakening the protection and stops the failure mode from returning — while honoring the device-bound-key security posture. Reversible at every step.

Note: items 2 (agent worktrees inheriting commit.gpgsign) and 3 (babysit/tower BLOCKED-with-green-checks diagnostic) from the issue body are agent-doable follow-ons, but both are gated on the human key-registration decision above (the needs-human label reflects this). This is a brief only — no label change, no close, no key registration performed.

[kyle-sexton]

Operator packet (drain session) — Class C host / multi-machine items

These cannot be fully finished in the cloud-agent VM. Concrete host actions:

Issue	Action on operator host
#631 (this issue)	Register SSH signing keys for MELO-DESK-001 / MELO-LAP-001 (and any other lane machines) as GitHub SSH signing keys. Cloud Cursor Agent commits already verify; desk/laptop keys still need registration for local merges.
#1774	Stop creating git worktrees under system temp / dead-session scratchpads; use the source-control convention roots only. Reap orphaned registrations.
#1776	Reap clean disposable worktrees across the 6 measured roots (115/142 were clean). Prefer the fleet hygiene / source-control prune paths; do not leave convention-forbidden roots populated.
#1976	Dispose stranded/* quarantine refs across org repos: 50 hold unique content — review per-ref before delete; 2 are redundant and safe to drop.
#1456	Live-test dometrain-mcp host behaviors (401 rendering, duplicate plugin.json name) on a real MCP host.
#2061	Product-level Claude Code plugin cache keyed by version — document local workaround (reinstall / bump version) until upstream cache key includes commit; no in-repo fix fully solves it.
#778	Ignite standing routine + C2 evidence drain on Desktop/routines surfaces (machine-local).
#535	Autonomy lane runtime resilience (cloud Routines, auto-mode verification, STOP notifications) — operator/runtime surfaces.

No new issues filed. In-repo slices for these items continue separately when applicable; this packet is the host checklist.

[kyle-sexton]

Operator packet update (drain session final)

Open backlog after drain wave — intentional KEEP set only:

Standing telemetry (do not close)

• Lane telemetry: attend-queue #1198 Lane telemetry: attend-queue
• Lane telemetry: babysit-loop #1214 Lane telemetry: babysit-loop
• Lane telemetry: work-loop #1248 Lane telemetry: work-loop
• ops: loop-lane telemetry — running per-lane status (babysit / triage / work) #502 ops: loop-lane telemetry

Host / multi-machine Class C

• infra: org ruleset required_signatures blocks PRs carrying commits from machines with unregistered signing keys — register every lane machine's key (found via PR #591) #631 signing keys on desk/laptop (this issue)
• Git worktrees are being created in system temp and dead-session scratchpad paths, leaving orphaned registrations #1774 / Worktrees accumulate unreaped: 115 of 142 were clean and disposable, across 6 roots including one the convention forbids #1776 unreaped / mis-rooted worktrees
• stranded/* quarantine refs: 50 of 52 hold content that exists nowhere else #1976 stranded/* unique-content disposition across org repos
• dometrain-mcp: two unresolved MCP-host behavior questions (401 rendering, duplicate plugin.json name) need a live test #1456 dometrain-mcp live host test
• Plugin cache is keyed by version number, so post-install commits under the same version are invisible #2061 Claude Code plugin cache keyed by version (product)
• autonomy: ignite the 2-to-3 loop — first standing routine (hourly C2 drain) + C2-promotion evidence drain on the proving ground #778 autonomy ignition (Desktop/routines)
• autonomy: lane runtime resilience — event-triggered cloud Routines, auto-mode verification, deterministic stop gate, STOP notifications, PostCompact re-injection #535 autonomy lane runtime resilience (cloud Routines)

Design carriers (need maintainer/host ratify before code)

• guardrails: block-noncanonical-commit resolves the repository at the outer invocation when the nested one determines it #1500 / guardrails: alias_launch_dir misses a nested alias when show-prefix is empty under locating globals (live bypass on main) #1553 guardrails path-composition vs alias-lookup chokepoint
• work-items:work-loop: 4 audit findings (compound-shell classifier risk, unvalidated persisted state, exit-condition prose, no pattern-escalation) #1668 work-loop audit findings (structural)
• babysit-loop: wire effective promotion-state resolution into the merge rung partition #1695 babysit-loop promotion-state → merge partition
• work-items/work-loop: the frontier-tier signal is read from the issue body with no refusal attached #1716 frontier-tier signal refusal attachment
• autonomy: no field-tested provenance signal exists for an issue's author #1718 provenance signal for issue author
• fix(discipline): sweep-all degrades fully silent when fork subagents are unavailable #1681 sweep-all silent degrade when forks unavailable
• /plugin configure: bare vs marketplace-suffixed form is unresolved fleet-wide #1360 /plugin configure bare vs marketplace-suffixed form

Program umbrellas (tracking surfaces)

• quality-net: skill changes ship with zero regression detection — 120 evals.json unexecuted, skill-quality:check uninvoked (staged eval/gate/pass^k umbrella) #530 quality-net evals/gates
• ci: portability lint lane — enforce declared agnosticism mechanically (19-issue coupling class + top review-churn source) #531 portability lint lane
• convention: false-green checks — surfaces report success while the capability is dead or findings invisible (liveness-assertion umbrella) #532 false-green checks convention

Everything else from the pre-drain ~240 open issues was closed via merged PRs or frontier disposition this session. No new issues left open from this drain.

[kyle-sexton]

Operator packet refresh — drain session bc-f3123271 (2026-08-13)

Cloud Cursor Agent commits continue to verify under the org signing ruleset (constituent commits on recent merges show verification.verified=true). Desk/laptop keys remain the open host gap.

Host actions still required

Issue	Action	Done when
#631 (this)	Register SSH signing keys for MELO-DESK-001 / MELO-LAP-001 (and any other lane machines) on the GitHub account used to push from those hosts	gh api user/ssh_signing_keys lists each machine key; a local signed commit on a test PR verifies
#1774	Stop creating worktrees under system temp / dead-session scratchpads; reap orphaned registrations via convention roots only	git worktree list across fleet shows no /tmp or dead-scratchpad paths
#1776	Reap clean disposable worktrees (audit found 115/142 clean); in-repo detector peel ships separately this drain	Clean reclaimable worktrees removed; forbidden roots empty
#1976	Dispose stranded/* across org repos — 50 unique-content, 2 redundant	Per-ref land/abandon/archive recorded; redundant pair deleted
#1456	Live-test dometrain-mcp host behaviors (401 rendering, duplicate plugin.json name)	Answers posted on the issue
#2061	Upstream Claude Code cache keyed by version — local workaround until product fix	Documented workaround landed in-repo; upstream still open
#778 / #535	Desktop/routines ignition + lane runtime resilience on operator/runtime surfaces	Routines firing + evidence on proving ground

Telemetry KEEP (do not close): #502, #1198, #1214, #1248.

No new issues filed from this refresh.