Require consent and review for autosquash

[onechat] / .agents / skills / commit / SKILL.md

diff --git a/.agents/skills/commit/SKILL.md b/.agents/skills/commit/SKILL.md
index 11b5eb2f53d6850e26e3f97dc5eca7d3086eb410..f1ef4896e128e68469aa11ee2f02c33ddf0f58ad 100644 (file)
--- a/.agents/skills/commit/SKILL.md
+++ b/.agents/skills/commit/SKILL.md
@@ -30,13 +30,24 @@ exception does not permit unsigned code or documentation commits.
    commit hook still runs. Never skip it with `--no-verify`.
 6. Cryptographically verify each new normal commit's signature against
    the configured key before reporting completion. A signature header
    commit hook still runs. Never skip it with `--no-verify`.
 6. Cryptographically verify each new normal commit's signature against
    the configured key before reporting completion. A signature header

-   alone is not verification. If verification fails, stop and report it.
-   Do not claim completion or publish the commit.
+   alone is not verification. If `gpg.ssh.allowedSignersFile` is not
+   set, use a temporary allowed-signers file with the configured key. Do
+   not change the Git configuration. If verification fails, stop and
+   report it. Do not claim completion or publish the commit.

 
 ## Size
 
 - Commit often. Split the work into small, coherent, working steps, and
   do not wait for a full feature.
 
 ## Size
 
 - Commit often. Split the work into small, coherent, working steps, and
   do not wait for a full feature.

+- Use fixup commits for review corrections when the task requires them.
+  Report the corrections and the pending fixups, but do not report the
+  work as complete while `fixup!` or `squash!` commits remain.
+- Before autosquashing, obtain the user's explicit approval to rewrite
+  the affected commit range. Permission to create a fixup does not
+  authorize a history rewrite. If approval is absent, stop and ask.
+- After an approved autosquash, sign and verify each rewritten normal
+  commit, rerun the required checks, and obtain independent review of
+  the final range before reporting completion.

 - Push code only with the user's authorization. A remote does not give
   permission to push.
 - Rebase before an authorized push only when the task permits it. Do not
 - Push code only with the user's authorization. A remote does not give
   permission to push.
 - Rebase before an authorized push only when the task permits it. Do not


@@ -75,6 +86,8 @@ exception does not permit unsigned code or documentation commits.
   `git interpret-trailers --trailer` before the message check. Never use
   a closing keyword such as "Fixes" or "Closes".
 - Link the bug report when a change fixes a reported bug.
   `git interpret-trailers --trailer` before the message check. Never use
   a closing keyword such as "Fixes" or "Closes".
 - Link the bug report when a change fixes a reported bug.

+- Include a stable archive URL when a change comes from a mailing-list
+  or forum discussion.

 - Do not add an AI tool as co-author. Do not add attribution trailers.
 
 ## Example
 - Do not add an AI tool as co-author. Do not add attribution trailers.
 
 ## Example