ci: preserve signed canonical integrations

.aiwg/bt6-maintainer.yaml

@@ -15,8 +15,8 @@ tracker:
 delivery:
   requireCiGreen: true
   requireCurrentHead: true
-  defaultMergeMethod: "rebase"
-  allowedMergeMethods: ["rebase"]
+  defaultMergeMethod: "merge"
+  allowedMergeMethods: ["merge"]
 validation:
   quick:
     - "python -m ruff check --select F app.py obliteratus tests scripts/check_coverage_thresholds.py scripts/check_supply_chain_policy.py scripts/gemma4_12b_recursive_loop.py"

CONTRIBUTING.md

@@ -61,6 +61,13 @@ currently fingerprint
 signing path. Maintainers preserve the original contributor as author when carrying
 their work and keep maintainer hardening or test commits separately attributable.
 
+Canonical integration must preserve a verifiable signature. Use an exact
+fast-forward of the audited signed head, or the repository's configured merge
+method after confirming that the resulting canonical commit is verified. Do not
+use GitHub rebase merge: GitHub recreates the commits and can publish unsigned
+canonical objects even when the pull-request head was signed. Post-merge
+reconciliation must verify the commit that actually landed on `main`.
+
 Verify your local commit before pushing:
 
 ```bash

WORKSPACE.md

@@ -59,6 +59,11 @@ regression and 80%/75% new-module floors; 94%/84% mature CPU-scope coverage;
 selective mutation at 85%; repeat and duration budgets; Windows checkpoint
 contracts; packaging; and supply-chain certification.
 
+Canonical integrations must retain a verifiable commit signature. The repository
+profile permits merge integration, not GitHub rebase integration, because rebase
+can recreate an audited signed head as an unsigned canonical commit. Verify the
+actual `main` commit after every merge; never rewrite `main` to repair history.
+
 Release CI additionally validates wheel and sdist metadata, installs each distribution
 in an independent environment outside the checkout, exercises both CLI entry
 paths, and retains the distributions plus evidence. Immutable CI action/tool

tests/test_aiwg_workspace_contracts.py

@@ -6,6 +6,8 @@ import json
 from datetime import datetime
 from pathlib import Path
 
+import yaml
+
 
 ROOT = Path(__file__).resolve().parents[1]
 
@@ -102,3 +104,12 @@ def test_workspace_authority_and_delivery_permissions_remain_explicit():
     assert config["remotes"]["primary"] == "origin"
     assert config["remotes"]["issue_tracker"] == "origin"
     assert config["remotes"]["ci"] == "origin"
+
+
+def test_delivery_profile_preserves_signed_canonical_history():
+    profile = yaml.safe_load(
+        (ROOT / ".aiwg" / "bt6-maintainer.yaml").read_text(encoding="utf-8"),
+    )
+
+    assert profile["delivery"]["defaultMergeMethod"] == "merge"
+    assert profile["delivery"]["allowedMergeMethods"] == ["merge"]