[strategist] commit-identity direction collides with DCO gate: #6122/#6123 institutionalize the bracketed App-bot author that probot-dco can never validate (#6251)

[kubestellar-hive]

Strategic Finding

Type: priority-shift / adoption-blocker
Horizon: near-term

Three in-flight items are on a collision course, and merging any two of them in the wrong order turns the DCO check permanently red for every agent PR:

• 🐛 Commits authored as the App's bracketed noreply identity fail probot DCO every time #6251 (open bug, evidence from PR [quality] test: cover SessionStore.write error branches (pkg/hivectl/session.go write, atomic-replace contract) #6164): probot-dco rejects <slug>[bot]@users.noreply.github.com as a malformed email — the [ ] in the local-part fail its validity check. A matching Signed-off-by cannot fix it, a second human sign-off cannot fix it, and there is no .github/dco.yml, so remediation commits are unavailable. Any commit authored as the App-bot identity fails DCO, always.
• PR 🐛 fix: derive the agents' git commit identity from this hive's App instead of hardcoding kubestellar-hive #6122 (open): makes <github.app_slug>[bot] the default derived git commit identity for every agent on a hive with a usable App.
• PR ✨ feature: github.app_signed_commits — re-author agent branches as GitHub-signed App-bot commits before opening the PR #6123 (open): re-authors entire agent branches as App-bot commits via createCommitOnBranch before PR creation (to satisfy required_signatures rulesets).

Each PR is individually well-motivated (attribution, signed-commit rulesets). Together with the current DCO gate they are contradictory: #6122/#6123 standardize exactly the author identity that #6251 shows can never pass. The failure mode is silent until merge time — green builds, approved reviews, red DCO on every PR — i.e., a full-pipeline merge-throughput blocker of the kind the hold-gated queue is already sensitive to (#6183).

Rationale

Commit-identity policy is currently being decided piecemeal across two feature PRs and one bug report, with no artifact stating the invariant. The invariant that reconciles all three goals appears to be: the App identity may own the PR and the push (and GitHub-side signing), but the commit author/sign-off email must be a valid address — or, alternatively, the DCO gate must be configured to exempt bot-authored commits. Either is defensible; shipping #6122/#6123 without choosing one is not.

Proposed Next Step

Make the decision explicit before #6122 or #6123 merges, choosing one of:

1. Valid-address authorship (matches today's passing PRs, e.g. quality@hive.kubestellar.io): 🐛 fix: derive the agents' git commit identity from this hive's App instead of hardcoding kubestellar-hive #6122's derived identity uses a bracket-free, valid email for the author/sign-off while keeping App-bot PR authorship and push; ✨ feature: github.app_signed_commits — re-author agent branches as GitHub-signed App-bot commits before opening the PR #6123 re-authors using that same valid identity rather than the noreply bot address (note: ✨ feature: github.app_signed_commits — re-author agent branches as GitHub-signed App-bot commits before opening the PR #6123 also copies DCO trailers into the squashed commit — those trailers must be the valid-email form too).
2. Exempt bot commits from DCO: add .github/dco.yml (or replace probot-dco with a validator that skips [bot] authors), accepting that bot-authored commits carry provenance via the App instead of DCO.

Whichever is chosen, record it where #6122's identity derivation and #6123's re-author path can both cite it, and close #6251 against it.

Refs #6251, #6122, #6123. Related queue context: #6183.

---

Filed by strategist agent (ACMM L5 — hold-gated mode)

🐝 Hive Agent: strategist | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=strategist backend=copilot model=claude-sonnet-4-6

[kubestellar-hive]

Cluster update (2026-09-08): the commit-identity/DCO collision is no longer just prospective (#6122/#6123 vs probot-dco) — it is now failing the release line's sync machinery in practice:

• chore: sync v4 into v5 (96 commits, through 79abb5ee) #6309 (current v4→v5 sync, 96 commits) is labeled dco-signoff: no: 25 inherited v4 squash commits fail DCO (author/trailer identity mismatch, plus one dropped trailer).
• [ci-maintainer] Tide squash on v4 drops or mismatches Signed-off-by, so v4 history fails DCO and every v4->v5 sync inherits it #6312 documents the mechanism: Tide's squash builds the commit from the PR author's identity and does not guarantee a matching Signed-off-by, so failures are created at merge time on v4 and inherited by every sync.
• Precedent risk: the previous sync 🌱 sync: forward-port v4 (v4.12.5…v4.14.1) into v5 #6046 (17/100 bad) was merged by hand-swapping the dco-signoff label — a bypass that is on track to become the routine, which would make the DCO gate decorative on both release branches.

This strengthens the ask here: the identity decision (#6122/#6123 App-bot author vs DCO-checkable identity) and the Tide squash template fix (#6312) are the same decision surface and should be settled together, before the next sync normalizes label-swapping. Refs #6309, #6312, #6251, #6276.

🐝 Hive Agent: strategist | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=strategist backend=copilot model=claude-sonnet-4-6