# Recipe: federation commit signing (AG-03 trailers + git setup)

> **Audience:** every contributor — human or agent — to any `mgf-*`
> repository. This applies to **every single MGF software project**,
> without exception.
> **What this is:** the one-time git setup and the per-commit discipline
> that satisfy [`AGENTS.md` **AG-03**](../standards/AGENTS.md#AG-03): every
> commit carries the two federation signing trailers.

## The rule (AG-03)

Every commit in an `mgf-*` repo MUST end with **both** trailers:

```
Signed-off-by: Bassam Alsanie <bassam@magogi.org>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
```

- **`Signed-off-by:`** — the human who reviewed and endorses the change.
  In this federation that is always **`Bassam Alsanie <bassam@magogi.org>`**.
- **`Co-Authored-By:`** — the agent that drafted it: **model name +
  context-size note**, with the vendor's `noreply` email. Update the model
  string to whatever agent actually did the work (e.g. a future
  `Claude Opus 5 (1M context)`, or a vendor-equivalent for a non-Claude
  agent). The version matters: it lets `git log` archaeology tell which
  agent produced which history.

Both are mandatory. `Signed-off-by:` alone hides the agent; `Co-Authored-By:`
alone hides the human review. Either omission breaks the audit story and
fails AG-03.

## One-time setup

### 1. Your git identity (once per machine)

```sh
git config --global user.name  "Bassam Alsanie"
git config --global user.email "bassam@magogi.org"
```

This sets the commit **author/committer** identity. The `Signed-off-by:`
trailer (below) is separate — it is the explicit review attestation AG-03
requires, not the same thing as the author header.

### 2. A commit template (per `mgf-*` repo)

Each `mgf-*` repo ships a `.gitmessage` at its root pre-filled with the two
trailers, and points git at it **locally** (per-repo, so the trailers never
leak into your non-MGF/personal repos):

```sh
git config commit.template .gitmessage
```

New repos get this automatically from the cookiecutter scaffold
(`templates/cookiecutter-mgf-project/`). To adopt it in an existing repo
that predates this recipe, copy the `.gitmessage` from here (or any current
`mgf-*` repo) and run the line above.

With the template wired, `git commit` (no `-m`) opens an editor with both
trailers already present — fill in the subject/body above them and the
trailers ride along.

## The common case: committing with `-m`

Agents (and anyone using `git commit -m`) bypass the editor template, so the
trailers must be **in the message string**. Put them at the very end, after
a blank line:

```sh
git commit -m "feat(scope): land the slice

What changed and why.

Signed-off-by: Bassam Alsanie <bassam@magogi.org>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>"
```

> `git commit -s` appends only `Signed-off-by:` (from your `user.*` config) —
> it does **not** add `Co-Authored-By:`, so `-s` alone does not satisfy
> AG-03. Write both trailers explicitly.

## Verify

```sh
# the last commit must carry BOTH trailers
git log -1 --format='%(trailers:key=Signed-off-by,valueonly)|%(trailers:key=Co-Authored-By,valueonly)'

# audit a range: list any commits MISSING a trailer
git log --format='%H %s%n%(trailers:key=Co-Authored-By)' <range>
```

A commit that prints an empty value for either trailer is non-conformant —
amend it (if unpushed) or note the gap.

## Related

- [`../standards/AGENTS.md`](../standards/AGENTS.md#AG-03) — **AG-03**, the
  binding rule this recipe serves (and its §3 rationale).
- [`codeberg-pr.md`](codeberg-pr.md) — landing the signed commits as a
  Codeberg PR.
- [`cohort-release-wave.md`](cohort-release-wave.md) /
  [`federation-sync-prompt.md`](federation-sync-prompt.md) — both instruct
  agents to commit with these trailers.
