CodeRabbit pushes unsigned bot commits that block PRs on required_signatures

[hyperpolymath]

Finding

PR #177 was BLOCKED after every check went green, every review thread was resolved and the code-scanning alert set matched main. The only remaining blocker was required_signatures (rulesets 18110203 and 24256098): two commits on the branch were authored and committed by coderabbitai[bot] and carry no signature.

Measured 2026-10-01 via pulls/177/commits .commit.verification and GraphQL commit.signature:

commit	author	signature
6aa1b3e	coderabbitai[bot]	none
a3ac208	coderabbitai[bot]	none
5a24ec2, 0f59a03, e71cd18	owner	VALID

Nothing in a check-run census shows this. The PR looked ready on every surface except the per-commit verification field.

Cause

CodeRabbit's "commit suggestion" / auto-commit feature pushes commits as the bot's own identity, unsigned. On a repository with required_signatures every such commit makes the PR unmergeable until a human rewrites history. The cure applied on #177 was a git rebase -S of the bot pair only (tree-identical, empty diff) and a --force-with-lease push.

Acceptance criteria

• CodeRabbit no longer pushes commits to branches of this repository (its committable-suggestions / auto-commit setting is off in .coderabbit.yaml or the app config), or its commits arrive signed.
• After the change, a PR that accepts a CodeRabbit suggestion shows every commit with a valid signature in pulls/{N}/commits.
• No PR in this repository opened after the change is blocked on required_signatures by a bot commit (positive control: fix(proofs): census reads logical roots from _CoqProject; restore FilesystemCNO.lean pending #167 #177 before the re-sign was so blocked).

Related: #177, #176. Config change is the owner's to make; this issue records the finding and the criteria per the standing stopping rule.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QYY8Gp4v4x2J7iSNn1vZ57