From 4848fea62cc0e719a5b0c6be0eacd60737e2d2a8 Mon Sep 17 00:00:00 2001
From: Joseph Magly <1159087+jmagly@users.noreply.github.com>
Date: Thu, 20 Aug 2026 23:17:45 -0400
Subject: [PATCH] ci: preserve signed canonical integrations

---
 .aiwg/bt6-maintainer.yaml              |  4 ++--
 CONTRIBUTING.md                        |  7 +++++++
 WORKSPACE.md                           |  5 +++++
 tests/test_aiwg_workspace_contracts.py | 11 +++++++++++
 4 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/.aiwg/bt6-maintainer.yaml b/.aiwg/bt6-maintainer.yaml
index ed3cdda..5105c19 100644
--- a/.aiwg/bt6-maintainer.yaml
+++ b/.aiwg/bt6-maintainer.yaml
@@ -15,8 +15,8 @@ tracker:
 delivery:
   requireCiGreen: true
   requireCurrentHead: true
-  defaultMergeMethod: "rebase"
-  allowedMergeMethods: ["rebase"]
+  defaultMergeMethod: "merge"
+  allowedMergeMethods: ["merge"]
 validation:
   quick:
     - "python -m ruff check --select F app.py obliteratus tests scripts/check_coverage_thresholds.py scripts/check_supply_chain_policy.py scripts/gemma4_12b_recursive_loop.py"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 7b7465f..03612c1 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -61,6 +61,13 @@ currently fingerprint
 signing path. Maintainers preserve the original contributor as author when carrying
 their work and keep maintainer hardening or test commits separately attributable.
 
+Canonical integration must preserve a verifiable signature. Use an exact
+fast-forward of the audited signed head, or the repository's configured merge
+method after confirming that the resulting canonical commit is verified. Do not
+use GitHub rebase merge: GitHub recreates the commits and can publish unsigned
+canonical objects even when the pull-request head was signed. Post-merge
+reconciliation must verify the commit that actually landed on `main`.
+
 Verify your local commit before pushing:
 
 ```bash
diff --git a/WORKSPACE.md b/WORKSPACE.md
index 6ca0e66..dc5271d 100644
--- a/WORKSPACE.md
+++ b/WORKSPACE.md
@@ -59,6 +59,11 @@ regression and 80%/75% new-module floors; 94%/84% mature CPU-scope coverage;
 selective mutation at 85%; repeat and duration budgets; Windows checkpoint
 contracts; packaging; and supply-chain certification.
 
+Canonical integrations must retain a verifiable commit signature. The repository
+profile permits merge integration, not GitHub rebase integration, because rebase
+can recreate an audited signed head as an unsigned canonical commit. Verify the
+actual `main` commit after every merge; never rewrite `main` to repair history.
+
 Release CI additionally validates wheel and sdist metadata, installs each distribution
 in an independent environment outside the checkout, exercises both CLI entry
 paths, and retains the distributions plus evidence. Immutable CI action/tool
diff --git a/tests/test_aiwg_workspace_contracts.py b/tests/test_aiwg_workspace_contracts.py
index 57c7795..10e7a81 100644
--- a/tests/test_aiwg_workspace_contracts.py
+++ b/tests/test_aiwg_workspace_contracts.py
@@ -6,6 +6,8 @@ import json
 from datetime import datetime
 from pathlib import Path
 
+import yaml
+
 
 ROOT = Path(__file__).resolve().parents[1]
 
@@ -102,3 +104,12 @@ def test_workspace_authority_and_delivery_permissions_remain_explicit():
     assert config["remotes"]["primary"] == "origin"
     assert config["remotes"]["issue_tracker"] == "origin"
     assert config["remotes"]["ci"] == "origin"
+
+
+def test_delivery_profile_preserves_signed_canonical_history():
+    profile = yaml.safe_load(
+        (ROOT / ".aiwg" / "bt6-maintainer.yaml").read_text(encoding="utf-8"),
+    )
+
+    assert profile["delivery"]["defaultMergeMethod"] == "merge"
+    assert profile["delivery"]["allowedMergeMethods"] == ["merge"]