[enricopiovesan]

Summary

• Implements the owner decision in sign-artifacts can't auto-commit new signatures to main (needs bot push access or a PAT) #341 / decision-log entry 113 (option 1): the sign-artifacts job now opens an auto-merge follow-up PR (chore/signatures-<sha>) with the new signature.json siblings instead of attempting a direct push to main, which the traverse-governance-* rulesets always rejected (the cause of the red-main signature gap after Publish text.truncate@1.0.0 #487, feat(catalog): model.execute@1.1.0 normative model_evidence (#641) #645, feat(capabilities): Spec 026 model rights backfill for five agents (#623) #646).
• Needs the SIGNATURE_PR_TOKEN repo secret (PAT/App token; GITHUB_TOKEN PRs don't trigger required checks). Inert until the owner provisions it: without the secret, or on any failure, the step only warns and the artifact-signatures artifact remains the manual fallback.
• Not [skip ci] (the PR must run capability-validation, now a required check, Re-add spec-alignment + capability-validation as required checks (#39 drifted) #511); checkout no longer persists GITHUB_TOKEN credentials, so job permission drops from contents: write to read. No ruleset bypass added (option 2 stays rejected).
• Runbook (docs/artifact-signing.md step 3) rewritten; decision-log entry 136 added.

Governing Spec

• 001-registry-foundation

Project Item

• Project 3 / sign-artifacts can't auto-commit new signatures to main (needs bot push access or a PAT) #341

Definition of Done

• Decision recorded (entry 113 + new entry 136)
• sign-artifacts updated to open the signature PR via a CI-triggering token
• docs/artifact-signing.md step 3 updated
• Owner provisions SIGNATURE_PR_TOKEN (cannot be done by an agent)
• Verified on the next real new-capability publish (issue stays open until then)

Validation

• Workflow YAML parses; the step's shell passes bash -n.
• Ran the step script in a sandbox git repo with a local bare remote and a stub gh: no changes (exits clean), no token (warning only), token (branch pushed, PR created, auto-merge queued with the expected args).
• Real end-to-end path is only observable on a real publish with the token present.

🤖 Generated with Claude Code