Fix unsigned commit 825db2c blocking signed pushes

[mcj-coder]

Summary

Pre-push hook blocks pushes when local GPG verification cannot confirm commits that GitHub already marks as verified. Update the hook to accept GitHub-verified commits without requiring local re-signing.

Acceptance Criteria

• Pre-push enforcement treats commits with verification.verified == true from the GitHub API as acceptable even if local GPG verification fails (commit 872e2ae)
• Pre-push enforcement still blocks unsigned/invalid commits that are not GitHub verified (commit 872e2ae)
• Pre-push enforcement skips validation for commits already on origin/main (commit d514a8d)
• Documentation or instructions reflect verification-based acceptance (no requirement to re-sign commit 825db2c) (commit 872e2ae)
• Evidence of the updated enforcement behavior is posted (issue comment)

Notes

• This issue replaces the earlier requirement to re-sign commit 825db2c.
• Blocking issue surfaced while pushing PR docs: add baseline failure blocking rule #362 (issue Document baseline test failure handling and block work until resolved #361).

[mcj-coder]

RED: Failing Checklist (Before Application)

• Issue #363 acceptance criteria allow GitHub-verified commits as valid
• Acceptance criteria explain that GitHub verification can satisfy signed-commit enforcement
• Notes reflect the shift away from re-signing commit 825db2c

Failure Notes:

• Current acceptance criteria require amending or replacing commit 825db2c
• No acceptance criteria mention GitHub-verified commits as acceptable
• Issue notes describe re-signing rather than verification-based acceptance

[mcj-coder]

GREEN: Passing Checklist (After Application)

• Issue #363 acceptance criteria allow GitHub-verified commits as valid
• Acceptance criteria explain that GitHub verification can satisfy signed-commit enforcement
• Notes reflect the shift away from re-signing commit 825db2c

Analytical Evidence:

• Issue update: issue #363

Process Verification:

This is analytical verification (process-only). No repository files modified.

[mcj-coder]

Plan Approval Request

• Plan: 2026-01-14-issue-363-gh-verified-pre-push.md
• Commit: 7765ee9

Please confirm plan approval before implementation.

[mcj-coder]

Plan Approval Confirmed

Approval recorded via the 👍 reaction on the plan approval comment:

• Plan approval comment

Proceeding with implementation per the approved plan.

[mcj-coder]

Implementation Update\n\n- Updated .husky/pre-push: commit 872e2ae\n- Updated docs/playbooks/enable-signed-commits.md: commit 872e2ae\n- Updated plan checklist: commit edbf6aa\n\n## Verification\n\n- gh api repos/mcj-coder/development-skills/commits/825db2c --jq '.commit.verification' -> �erified: true,

eason: valid\n- git log --show-signature -1 825db2c -> Can't check signature: No public key\n\nThis documents that GitHub reports the commit as verified while local verification fails, which the updated pre-push hook now accepts.

[mcj-coder]

PR opened: #364

[mcj-coder]

RED: Failing Checklist (Branch-Only Signature Validation)\n\n- [ ] .husky/pre-push skips signature validation for commits already in origin/main\n- [ ] Only commits unique to the feature branch are validated for signatures\n\nFailure Notes:\n\n- Current hook re-checks commits that are already on the base branch after a rebase