docs(dco): let maintainer-operated automation sign off - #11850
Merged
Conversation
The AI-assistant policy says an AI agent must never add a Signed-off-by trailer, because only a human can certify the DCO. That is right for the case it was written for: an assistant helping a contributor who then signs off themselves. It does not fit automation a maintainer runs. Those pull requests have no human submitter, so nothing ever signs and the DCO check blocks them permanently. Sixty-one open pull requests from the maintenance bot are in exactly that state, every one of them correctly following the documented rule. Carve out the case: automation a maintainer operates signs off with that maintainer's identity. The maintainer certifies the DCO, as they do for a commit they typed by hand, because they configured the automation, own its output, and take responsibility on merge. The Assisted-by trailer still records that a model wrote the code, so provenance is unchanged. Keep the exception narrow. An assistant helping an outside contributor still must not sign off, and a bot must not sign for anyone but its operator, including on a contributor's branch it pushes to. Assisted-by: Claude:claude-opus-5 Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem
61 open pull requests from
localai-org-maint-botfail DCO. Every one of them is correctly following the documented policy.AGENTS.mdsays:and
.agents/ai-coding-assistants.md:38says:The bot obeys both. It emits
Assisted-by: Codex:gpt-5in exactly the documented format and adds neitherSigned-off-bynorCo-Authored-By.The rule was written for an AI assistant helping a human contributor, who then signs off themselves. It does not fit automation a maintainer runs, because those pull requests have no human submitter to sign. Applied literally there, nothing ever signs, and DCO blocks the PR permanently. That is not a bug in the bot; it is a gap in the policy.
The change
Automation a maintainer operates signs off with that maintainer's identity:
This is not the AI certifying the DCO. The maintainer is, exactly as they do for a commit they typed by hand: they configured the automation, they own its output, and they take responsibility for it on merge. The
Assisted-bytrailer still records that a model produced the code, so the provenance trail is unchanged.The exception is deliberately narrow and does not widen the rule for anyone else:
That last point is not hypothetical: #11677 is currently blocked because the bot pushed a commit onto a contributor's branch, and the contributor rightly refuses to sign someone else's commit.
Files
All four policy surfaces, kept consistent:
AGENTS.md(CLAUDE.mdis a symlink to it).agents/ai-coding-assistants.mddocs/content/reference/ai-coding-assistants.mdCONTRIBUTING.mdFollow-up, not in this PR
The generator itself needs to start emitting the trailer. It does not live in this repository (no crontab entry, no systemd timer, nothing in
.github/workflows), and the evidence is that it reads these policy files for its rules, so this change is what it should pick up. The 61 already-open PRs each still need a sign-off added to their existing commits.🤖 Generated with Claude Code
https://claude.ai/code/session_01UxkheFa72CEpeEJbijyjxe