commit hook still runs. Never skip it with `--no-verify`.
6. Cryptographically verify each new normal commit's signature against
the configured key before reporting completion. A signature header
- alone is not verification. If verification fails, stop and report it.
- Do not claim completion or publish the commit.
+ alone is not verification. If `gpg.ssh.allowedSignersFile` is not
+ set, use a temporary allowed-signers file with the configured key. Do
+ not change the Git configuration. If verification fails, stop and
+ report it. Do not claim completion or publish the commit.
## Size
`git interpret-trailers --trailer` before the message check. Never use
a closing keyword such as "Fixes" or "Closes".
- Link the bug report when a change fixes a reported bug.
+- Include a stable archive URL when a change comes from a mailing-list
+ or forum discussion.
- Do not add an AI tool as co-author. Do not add attribution trailers.
## Example