DCO: AGENTS.md promises identity enforcement that neither the hook nor CI does

[ivany-nv]

Two things to settle: a doc claim that is currently false, and — if we want to make it true — which rule survives contact with how the repo is actually used.

The gap

AGENTS.md § Commits states:

The name and e-mail must match the committer's git identity (git config user.name / git config user.email).

A commit-msg pre-commit hook enforces this.

Neither half is enforced:

• scripts/check_dco_signoff.py matches ^Signed-off-by: \S.*<\S+> and stops. It never reads git config; the identity requirement appears only inside its own error text.
• .github/workflows/dco.yml checks the trailer is present and well-formed. No identity comparison.

So Signed-off-by: Anybody <a@b.c> passes locally and in CI. That matters because a sign-off certifies that you have the right to submit the work — a trailer naming someone else certifies nothing.

Why the obvious fix is wrong

I wrote the strict version (compare against GIT_COMMITTER_IDENT, require at least one matching trailer), and it passed every case I could invent. Then I ran it against six months of real history:

	count	share
non-merge commits on main	586
sign-off matches author	155	26%
no sign-off at all	405	69%
sign-off present, does not match	26	4%

The 405 are largely an artifact — 229 carry a (#NNN) subject, i.e. squash merges, where the message is rewritten and the trailer is dropped. What lands on main says little about what the contributor committed.

The 26 real mismatches are the problem, because they are not abuse:

author=farbod-nv <fmotlagh@nvidia.com>
signed=Farbod Motlagh <fmotlagh@nvidia.com>       same address; the git name is a GitHub handle

author=rwiltz <...+rwiltz@users.noreply.github.com>
signed=Rafael Wiltz <rwiltz@nvidia.com>           GitHub noreply vs corporate address

Both are arguably more DCO-correct than the git identity is: the DCO asks for a real legal name, and git author names are routinely the GitHub handle. A strict name comparison would have blocked at least three contributors mid-workflow to close a gap nobody is exploiting. I closed #1013 for that reason.

What to decide

1. Do we want identity enforcement at all? If not, the fix is one line — stop claiming it in AGENTS.md, keep presence-only checking. That is a legitimate answer; the DCO's force comes from the act of signing, not from a machine verifying the name.

2. If yes, which rule? Candidates, roughly in order of how much they would disrupt:

rule	catches	breaks
e-mail only, ignore name	wrong person entirely	noreply-vs-corporate users
e-mail, with *+user@users.noreply.github.com → corporate mapping	same	nothing visible in the sample
warn, do not block	nothing, but surfaces it	nothing
full name + e-mail	everything	at least 3 current contributors

3. Local, CI, or both? The hook is commit-msg, so --no-verify bypasses it and CI sees nothing. dco.yml is the only place a guarantee can actually hold — but that changes what CI rejects for everyone, which is why this is an issue and not a PR.

Notes

• A working strict implementation exists on ivany-nv/dco-identity-check (d132e9a37) if a variant of it turns out to be wanted. Do not merge it as-is.
• Whatever we pick, AGENTS.md and dco.yml should end up saying the same thing. Today they disagree with each other and with the hook.

cc @jiwenc — you own AGENTS.md § Commits and both DCO checks.