docs(research): no DCO check runs in this fork, so drops cannot be blocked by one (#354)

[tucktuck101]

Summary

Adds one research document establishing that launchpad-26/buzz runs no DCO check at all, so a vendor drop carrying unmodified upstream commits and an automation-authored merge commit cannot be blocked by one. The "required DCO Check" described in the root AGENTS.md belongs to block/buzz; launchpad/AGENTS.md:251-252 repeats the claim about this fork, where it is false. Sign-off is enforced locally by a lefthook commit-msg hook, which --no-verify, git rebase and git cherry-pick all bypass.

Related issue

Closes #354

Issue type

Task

---

Agent provenance

Field	Value
Harness / provider	Claude Code
Model	claude-opus-5
Session reference	N/A - harness exposes no run id
Initiating human	@tucktuck101

Objective

Add launchpad/Research/354-dco-check-on-vendor-drops.md recording whether this fork's DCO check accepts upstream commits and automation-authored merge commits.

Impacted components

launchpad/Research/354-dco-check-on-vendor-drops.md

Approach and rejected alternatives

Established the answer by scanning the check names GitHub actually reported on this repository's pull requests, and contrasting against block/buzz, rather than by reading configuration. Configuration was the obvious alternative and it cannot answer the question: there is no DCO workflow in .github/workflows/, so the check would have to be a GitHub App, and app installations are not readable without admin:org. Observed check names are the only evidence available to this token.

Rejected: opening a throwaway draft PR with an unsigned upstream commit, which is what #354's own definition of done asked for. Forty PRs' worth of check names, including two upstream syncs, show no DCO context at all, and the previous drop's unsigned merge commit is already in launchpad's history — so the empirical test would confirm an absence already visible. Named as a limitation in the document rather than silently skipped.

Rejected: fixing launchpad/AGENTS.md in this PR. Adopting a DCO check on a fork whose purpose is merging someone else's commits has consequences (upstream reverts and GitHub merge commits fail it), so which way the drift gets resolved is a decision, not an edit. Raised in Escalations.

Verification

Command run:

gh pr list --repo launchpad-26/buzz --state all --limit 40 --json number --jq '.[].number' \
  | while read p; do gh pr view $p --repo launchpad-26/buzz \
      --json statusCheckRollup --jq '.statusCheckRollup[]? | (.name // .context)'; done \
  | sort -u | grep -iE 'dco|sign|licen'

gh pr list --repo block/buzz --state merged --limit 3 --json number --jq '.[].number' \
  | while read p; do gh pr view $p --repo block/buzz \
      --json statusCheckRollup --jq '.statusCheckRollup[]? | (.name // .context)' | grep -iE 'dco|sign'; done

MB=f8692fa9b52ddcfeb4b95fb4862109983509f131
for c in $(git rev-list $MB..upstream/main); do
  git log -1 --format='%B' $c | grep -qi '^Signed-off-by:' || echo "UNSIGNED: $(git log -1 --format='%h %s' $c)"
done

grep -n -iE 'dco|signed-off|commit -s' launchpad/AGENTS.md
git log -1 --format='%h %an%n%B' de1c127fbe7b12bf862e461986e41f1059963228

Raw output:

$ ... launchpad-26/buzz ... | grep -iE 'dco|sign|licen'
   NONE found in 40 PRs

$ ... block/buzz ...
DCO Check
DCO Check
DCO Check

$ for c in $(git rev-list $MB..upstream/main); do ... done
UNSIGNED: 08eb46ef3 Revert "fix(acp): gate relay-signed workflow messages on their attributed author" (#6311)
signed=66 unsigned=1

$ grep -n -iE 'dco|signed-off|commit -s' launchpad/AGENTS.md
246:git commit -s                          # -s is required: DCO check
251:- **`git commit -s` every time.** The DCO check fails any commit without a
252:  `Signed-off-by` trailer.

$ git log -1 --format='%h %an%n%B' de1c127fbe7b12bf862e461986e41f1059963228
de1c127fb tucktuck101
Merge pull request #216 from launchpad-26/sync-upstream-2026-08-18

chore: sync launchpad with upstream block/buzz main (113 commits)

• Tests or checks were run and the raw output is pasted above
• The diff is confined to the scope of the linked issue
• No secrets, keys, tokens or hostnames were added to tracked files

Not verified

I could not enumerate installed GitHub Apps — GET /orgs/launchpad-26/installations requires admin:org, which this token lacks — so I cannot rule out a DCO app installed but not reporting on pull requests. I scanned 40 of this repository's 216 pull requests, not all of them. I did not run the empirical test in #354's definition of done (push an unsigned commit, open a draft PR, read the result); the finding is inference from the absence of the check context across 40 PRs plus the previous drop's unsigned merge commit already sitting in launchpad. I did not check whether the Buzz-generated sign-off identities in upstream's commits (Duncan <dcfd242e…@buzz.block.builderlab.xyz>) correspond to real people, which would matter to a stricter author-matching check. I did not run just ci; the diff is one markdown file under launchpad/Research/ and I make no claim about the full gate.

Security implications

None from the diff — one markdown document, no code, config or workflow change. The finding has a security-adjacent consequence worth stating: provenance on this fork's commits rests on a bypassable local hook rather than a CI gate, and the fork's own normative guide says otherwise. Anyone relying on launchpad/AGENTS.md's claim as an assurance that every commit carries attributable sign-off is relying on something that is not enforced.

Escalations

The launchpad/AGENTS.md:251-252 drift needs a decision, not an edit. Two ways to resolve it: correct the sentence to describe the local hook, or adopt a DCO check so the sentence becomes true. The second has a real cost — upstream reverts (one already in the current backlog) and GitHub's own merge commits carry no trailer, so a DCO check would fail every future vendor drop until configured to tolerate them. I have not chosen; it belongs to #273 or its own issue.

A second-order observation, raised not decided: the instruction that commissioned this work also asserted the DCO check exists here. Three independent sources now repeat a claim nothing enforces. Whatever the fix, it should land in launchpad/AGENTS.md rather than only in a research document, because that is the file people and agents actually read.

[serina-mcfall]

Independent review — no blockers, one non-blocking issue filed

Reviewed in a fresh context, verifying by re-running rather than reading. I am an agent and do not approve — posting as a comment so @serina-mcfall can.

The core claim is independently confirmed true, along with every quoted line number and config snippet:

• No DCO/sign-off/licence check across 40 recent PRs in this fork — zero matches.
• block/buzz PRs do show DCO Check — the contrast holds.
• PR #216 has exactly 36 distinct checks, none DCO-related.
• launchpad/AGENTS.md:251-252 states "The DCO check fails any commit without a Signed-off-by trailer" — verbatim, at those line numbers. Root AGENTS.md:134 makes the same claim, which is correct for upstream and wrong for this fork.
• The lefthook commit-msg hook adds sign-off locally, and the file's own header documents the git rebase/cherry-pick gap.
• PR #216's merge commit de1c127fb carries no Signed-off-by.
• No DCO workflow exists — 13 workflows, none DCO-related.

Non-blocker, filed as #382: the confidence section says "40 PRs, not all 216". The repository has 99 pull requests, not 216 — that looks like PR #216 (referenced throughout) read back as a total, which is easy to do when issues and PRs share one numbering sequence. Worth noting the error runs conservative: real coverage is 40/99 ≈ 40%, not 40/216 ≈ 18.5%, so the document understates its own thoroughness.

Not verified: GitHub App installations (needs admin:org; 403/404 for this token, matching the document's own account), whether sign-off identities correspond to real people, and the empirical push-an-unsigned-commit test — which the document deliberately did not run and says so.

Correct placement, no private-tooling paths. Ready for approval once you're happy with #382 as a follow-up rather than a change here.

[benmitchell11]

Reviewed by independently re-checking the document's claims against the actual repo content (checked out pr-370 locally, plus live gh api/gh pr calls against this repo and block/buzz).

Verified directly:

• AGENTS.md:134 and launchpad/AGENTS.md:246,251-252 quote exactly as cited — the root file's DCO claim and the fork's own repeated claim both check out verbatim.
• No DCO workflow file exists in .github/workflows/; lefthook.yml:44-48 (the commit-msg hook) and lefthook.yml:14-15 (the note that git rebase/git cherry-pick skip it) match exactly.
• .github/workflows/launchpad-pr-check.yml and launchpad/scripts/pr_body_check.py grep hits are confirmed unrelated prose, as claimed.
• Re-ran the live check-name scan on PR #216: confirmed 23/23 SUCCESS checks, none named DCO/sign/licen — matches the doc's table exactly.
• Confirmed block/buzz PRs (checked block#6496, a different PR than the doc's sample but same result) do carry a "DCO Check" context, corroborating the fork/upstream contrast.
• Merge commit de1c127fb message matches verbatim, no Signed-off-by trailer, as claimed.
• Commit 08eb46ef3 (the cited unsigned revert) exists with the exact message quoted and genuinely has no Signed-off-by trailer.
• Added the real block/buzz upstream remote and checked sign-off ratio over the merge-base range: today (with upstream having advanced from 67 to 80 commits since the doc was written) the ratio is 79/80 signed, with the single unsigned commit still being the same cited revert — consistent with and corroborating the doc's 66/67 snapshot.

Not independently checked: GitHub App installations (needs admin:org, same limitation the author notes) and whether the Buzz-generated sign-off identities correspond to real people — both explicitly flagged as unchecked by the document itself, appropriately.

Scope: The document sticks to findings; it explicitly declines to decide whether AGENTS.md should be fixed or a DCO check adopted, correctly routing that as a decision for #273/Escalations rather than deciding it inline.

Nothing wrong found. This is a well-evidenced, accurately-cited document.

[serina-mcfall]

Approved. Independent review found no blockers; non-blocking findings are filed as follow-up issues.