Add commit signing detection to setup skill

.agents/skills/setup/SKILL.md

@@ -258,7 +258,74 @@ A value counts as "set" if it is present, uncommented, and non-empty in `.codeca
 
 ---
 
-### Phase 2 — Label population
+### Phase 2 — Commit signing
+
+Check whether commit signing is already configured at any level (local or global):
+
+```bash
+git config --get commit.gpgsign
+```
+
+If the output is `true`, display `Commit signing: enabled` in the health summary area and skip to Phase 3.
+
+If not `true`, ask: **"Does this project require signed commits? (yes/no)"**
+
+Wait for response.
+
+- **no / skip** → continue to Phase 3.
+- **yes** → proceed with signing setup.
+
+**Verify a signing key exists:**
+
+```bash
+git config --get user.signingkey
+```
+
+**If a signing key is found**, show the proposed change and confirm:
+
+```
+I'll enable commit and tag signing for this repo:
+
+  git config commit.gpgsign true
+  git config tag.gpgsign true
+
+  Signing key: <truncated-key>
+
+Proceed? (yes/no)
+```
+
+Wait for confirmation. Write only on yes. If no, skip to Phase 3.
+
+Continue to Phase 3.
+
+**If no signing key is found**, detect the signing format:
+
+```bash
+git config --get gpg.format
+```
+
+- If `ssh` → suggest: `git config user.signingkey ~/.ssh/id_ed25519.pub` (adjust path to the user's key). Ask the user for their SSH public key path.
+- If `gpg` or unset → suggest: run `gpg --list-secret-keys --keyid-format=long` to find a key ID. Ask the user for their GPG key ID.
+
+Once the user provides a key value, show the proposed changes and confirm:
+
+```
+I'll configure signing for this repo:
+
+  git config user.signingkey <provided-key>
+  git config commit.gpgsign true
+  git config tag.gpgsign true
+
+Proceed? (yes/no)
+```
+
+Wait for confirmation. Write only on yes. If no, skip to Phase 3.
+
+If the user has no signing key and doesn't know how to create one, point them to GitHub's signing key documentation and stop: "Set up a signing key first, then run `/setup` again to enable commit signing."
+
+---
+
+### Phase 3 — Label population
 
 Run:
 
@@ -290,7 +357,7 @@ Wait for response.
 
 After this step (or if labels were non-zero initially), run `gh label list --limit 100 --json name,color,description` again.
 
-If `TICKET_LABELS` is unset or fewer than 5 labels exist, add a note: "`/start` works best with a clear issue-label pool (`TICKET_LABELS`), and `/qa` needs explicit QA lifecycle labels (`ready-for-qa`, `qa-passed`, `qa-failed`). Consider a lightweight priority scheme (e.g. `priority:high`, `priority:medium`, `priority:low`) if the team needs triage support. If the team runs planned iterations, set `DEFAULT_MILESTONE` in Phase 3; otherwise leave it unset so `/start` auto-detects."
+If `TICKET_LABELS` is unset or fewer than 5 labels exist, add a note: "`/start` works best with a clear issue-label pool (`TICKET_LABELS`), and `/qa` needs explicit QA lifecycle labels (`ready-for-qa`, `qa-passed`, `qa-failed`). Consider a lightweight priority scheme (e.g. `priority:high`, `priority:medium`, `priority:low`) if the team needs triage support. If the team runs planned iterations, set `DEFAULT_MILESTONE` in Phase 4; otherwise leave it unset so `/start` auto-detects."
 
 Display the results as a numbered list:
 
@@ -308,7 +375,7 @@ Wait for the user's response.
 
 - **yes** → use all labels
 - **numbers** (e.g. `1,3,5`) → use only those labels
-- **no / skip / anything else** → skip this phase, continue to Phase 3
+- **no / skip / anything else** → skip this phase, continue to Phase 4
 
 Show the exact change before writing:
 
@@ -324,7 +391,7 @@ Wait for confirmation. Write only on yes.
 
 ---
 
-### Phase 3 — Optional config walkthrough (profile-aware)
+### Phase 4 — Optional config walkthrough (profile-aware)
 
 First, infer the current profile using the same rules as Phase 1.
 
@@ -346,7 +413,7 @@ The walkthrough adapts based on profile. Walk through each applicable unset valu
 
 ---
 
-### Phase 4 — Team sharing
+### Phase 5 — Team sharing
 
 After completing or skipping the config walkthrough, say:
 
@@ -364,11 +431,11 @@ Add a note: `/start` can be used to create well-formed GitHub issues without wri
 
 ## Hard rules
 
-- Only modify `.codecannon.yaml`. Do not touch any other file (except running `CodeCannon/sync.py`, which modifies `.claude/commands/` — permitted only with explicit user approval).
+- Only modify `.codecannon.yaml` and local git config (Phase 2 signing setup). Do not touch any other file (except running `CodeCannon/sync.py`, which modifies `.claude/commands/` — permitted only with explicit user approval).
 - Do not run `sync.py` without explicit user permission.
 - Do not create `.codecannon.yaml` without explicit user permission.
 - Do not report a configuration problem unless confident the condition is genuinely broken. Prefer false negatives over false positives on all diagnostic checks.
 - Never fetch more than 100 labels in a single command. `gh label list --limit 100` is the ceiling.
-- Do not skip any human gate in Phase 2 or Phase 3 — each write requires confirmation.
+- Do not skip any human gate in Phase 2, Phase 3, or Phase 4 — each write requires confirmation.
 - If the user skips a config value, do not ask again. Move on.
-<!-- generated by CodeCannon/sync.py | skill: setup | adapter: codex | hash: 641d16b6 | DO NOT EDIT — run CodeCannon/sync.py to regenerate -->
+<!-- generated by CodeCannon/sync.py | skill: setup | adapter: codex | hash: 47495978 | DO NOT EDIT — run CodeCannon/sync.py to regenerate -->

.claude/commands/setup.md

@@ -253,7 +253,74 @@ A value counts as "set" if it is present, uncommented, and non-empty in `.codeca
 
 ---
 
-### Phase 2 — Label population
+### Phase 2 — Commit signing
+
+Check whether commit signing is already configured at any level (local or global):
+
+```bash
+git config --get commit.gpgsign
+```
+
+If the output is `true`, display `Commit signing: enabled` in the health summary area and skip to Phase 3.
+
+If not `true`, ask: **"Does this project require signed commits? (yes/no)"**
+
+Wait for response.
+
+- **no / skip** → continue to Phase 3.
+- **yes** → proceed with signing setup.
+
+**Verify a signing key exists:**
+
+```bash
+git config --get user.signingkey
+```
+
+**If a signing key is found**, show the proposed change and confirm:
+
+```
+I'll enable commit and tag signing for this repo:
+
+  git config commit.gpgsign true
+  git config tag.gpgsign true
+
+  Signing key: <truncated-key>
+
+Proceed? (yes/no)
+```
+
+Wait for confirmation. Write only on yes. If no, skip to Phase 3.
+
+Continue to Phase 3.
+
+**If no signing key is found**, detect the signing format:
+
+```bash
+git config --get gpg.format
+```
+
+- If `ssh` → suggest: `git config user.signingkey ~/.ssh/id_ed25519.pub` (adjust path to the user's key). Ask the user for their SSH public key path.
+- If `gpg` or unset → suggest: run `gpg --list-secret-keys --keyid-format=long` to find a key ID. Ask the user for their GPG key ID.
+
+Once the user provides a key value, show the proposed changes and confirm:
+
+```
+I'll configure signing for this repo:
+
+  git config user.signingkey <provided-key>
+  git config commit.gpgsign true
+  git config tag.gpgsign true
+
+Proceed? (yes/no)
+```
+
+Wait for confirmation. Write only on yes. If no, skip to Phase 3.
+
+If the user has no signing key and doesn't know how to create one, point them to GitHub's signing key documentation and stop: "Set up a signing key first, then run `/setup` again to enable commit signing."
+
+---
+
+### Phase 3 — Label population
 
 Run:
 
@@ -285,7 +352,7 @@ Wait for response.
 
 After this step (or if labels were non-zero initially), run `gh label list --limit 100 --json name,color,description` again.
 
-If `TICKET_LABELS` is unset or fewer than 5 labels exist, add a note: "`/start` works best with a clear issue-label pool (`TICKET_LABELS`), and `/qa` needs explicit QA lifecycle labels (`ready-for-qa`, `qa-passed`, `qa-failed`). Consider a lightweight priority scheme (e.g. `priority:high`, `priority:medium`, `priority:low`) if the team needs triage support. If the team runs planned iterations, set `DEFAULT_MILESTONE` in Phase 3; otherwise leave it unset so `/start` auto-detects."
+If `TICKET_LABELS` is unset or fewer than 5 labels exist, add a note: "`/start` works best with a clear issue-label pool (`TICKET_LABELS`), and `/qa` needs explicit QA lifecycle labels (`ready-for-qa`, `qa-passed`, `qa-failed`). Consider a lightweight priority scheme (e.g. `priority:high`, `priority:medium`, `priority:low`) if the team needs triage support. If the team runs planned iterations, set `DEFAULT_MILESTONE` in Phase 4; otherwise leave it unset so `/start` auto-detects."
 
 Display the results as a numbered list:
 
@@ -303,7 +370,7 @@ Wait for the user's response.
 
 - **yes** → use all labels
 - **numbers** (e.g. `1,3,5`) → use only those labels
-- **no / skip / anything else** → skip this phase, continue to Phase 3
+- **no / skip / anything else** → skip this phase, continue to Phase 4
 
 Show the exact change before writing:
 
@@ -319,7 +386,7 @@ Wait for confirmation. Write only on yes.
 
 ---
 
-### Phase 3 — Optional config walkthrough (profile-aware)
+### Phase 4 — Optional config walkthrough (profile-aware)
 
 First, infer the current profile using the same rules as Phase 1.
 
@@ -341,7 +408,7 @@ The walkthrough adapts based on profile. Walk through each applicable unset valu
 
 ---
 
-### Phase 4 — Team sharing
+### Phase 5 — Team sharing
 
 After completing or skipping the config walkthrough, say:
 
@@ -359,11 +426,11 @@ Add a note: `/start` can be used to create well-formed GitHub issues without wri
 
 ## Hard rules
 
-- Only modify `.codecannon.yaml`. Do not touch any other file (except running `CodeCannon/sync.py`, which modifies `.claude/commands/` — permitted only with explicit user approval).
+- Only modify `.codecannon.yaml` and local git config (Phase 2 signing setup). Do not touch any other file (except running `CodeCannon/sync.py`, which modifies `.claude/commands/` — permitted only with explicit user approval).
 - Do not run `sync.py` without explicit user permission.
 - Do not create `.codecannon.yaml` without explicit user permission.
 - Do not report a configuration problem unless confident the condition is genuinely broken. Prefer false negatives over false positives on all diagnostic checks.
 - Never fetch more than 100 labels in a single command. `gh label list --limit 100` is the ceiling.
-- Do not skip any human gate in Phase 2 or Phase 3 — each write requires confirmation.
+- Do not skip any human gate in Phase 2, Phase 3, or Phase 4 — each write requires confirmation.
 - If the user skips a config value, do not ask again. Move on.
-<!-- generated by CodeCannon/sync.py | skill: setup | adapter: claude | hash: 5e6dfbef | DO NOT EDIT — run CodeCannon/sync.py to regenerate -->
+<!-- generated by CodeCannon/sync.py | skill: setup | adapter: claude | hash: 410c035d | DO NOT EDIT — run CodeCannon/sync.py to regenerate -->

.cursor/rules/setup.mdc

@@ -259,7 +259,74 @@ A value counts as "set" if it is present, uncommented, and non-empty in `.codeca
 
 ---
 
-### Phase 2 — Label population
+### Phase 2 — Commit signing
+
+Check whether commit signing is already configured at any level (local or global):
+
+```bash
+git config --get commit.gpgsign
+```
+
+If the output is `true`, display `Commit signing: enabled` in the health summary area and skip to Phase 3.
+
+If not `true`, ask: **"Does this project require signed commits? (yes/no)"**
+
+Wait for response.
+
+- **no / skip** → continue to Phase 3.
+- **yes** → proceed with signing setup.
+
+**Verify a signing key exists:**
+
+```bash
+git config --get user.signingkey
+```
+
+**If a signing key is found**, show the proposed change and confirm:
+
+```
+I'll enable commit and tag signing for this repo:
+
+  git config commit.gpgsign true
+  git config tag.gpgsign true
+
+  Signing key: <truncated-key>
+
+Proceed? (yes/no)
+```
+
+Wait for confirmation. Write only on yes. If no, skip to Phase 3.
+
+Continue to Phase 3.
+
+**If no signing key is found**, detect the signing format:
+
+```bash
+git config --get gpg.format
+```
+
+- If `ssh` → suggest: `git config user.signingkey ~/.ssh/id_ed25519.pub` (adjust path to the user's key). Ask the user for their SSH public key path.
+- If `gpg` or unset → suggest: run `gpg --list-secret-keys --keyid-format=long` to find a key ID. Ask the user for their GPG key ID.
+
+Once the user provides a key value, show the proposed changes and confirm:
+
+```
+I'll configure signing for this repo:
+
+  git config user.signingkey <provided-key>
+  git config commit.gpgsign true
+  git config tag.gpgsign true
+
+Proceed? (yes/no)
+```
+
+Wait for confirmation. Write only on yes. If no, skip to Phase 3.
+
+If the user has no signing key and doesn't know how to create one, point them to GitHub's signing key documentation and stop: "Set up a signing key first, then run `/setup` again to enable commit signing."
+
+---
+
+### Phase 3 — Label population
 
 Run:
 
@@ -291,7 +358,7 @@ Wait for response.
 
 After this step (or if labels were non-zero initially), run `gh label list --limit 100 --json name,color,description` again.
 
-If `TICKET_LABELS` is unset or fewer than 5 labels exist, add a note: "`/start` works best with a clear issue-label pool (`TICKET_LABELS`), and `/qa` needs explicit QA lifecycle labels (`ready-for-qa`, `qa-passed`, `qa-failed`). Consider a lightweight priority scheme (e.g. `priority:high`, `priority:medium`, `priority:low`) if the team needs triage support. If the team runs planned iterations, set `DEFAULT_MILESTONE` in Phase 3; otherwise leave it unset so `/start` auto-detects."
+If `TICKET_LABELS` is unset or fewer than 5 labels exist, add a note: "`/start` works best with a clear issue-label pool (`TICKET_LABELS`), and `/qa` needs explicit QA lifecycle labels (`ready-for-qa`, `qa-passed`, `qa-failed`). Consider a lightweight priority scheme (e.g. `priority:high`, `priority:medium`, `priority:low`) if the team needs triage support. If the team runs planned iterations, set `DEFAULT_MILESTONE` in Phase 4; otherwise leave it unset so `/start` auto-detects."
 
 Display the results as a numbered list:
 
@@ -309,7 +376,7 @@ Wait for the user's response.
 
 - **yes** → use all labels
 - **numbers** (e.g. `1,3,5`) → use only those labels
-- **no / skip / anything else** → skip this phase, continue to Phase 3
+- **no / skip / anything else** → skip this phase, continue to Phase 4
 
 Show the exact change before writing:
 
@@ -325,7 +392,7 @@ Wait for confirmation. Write only on yes.
 
 ---
 
-### Phase 3 — Optional config walkthrough (profile-aware)
+### Phase 4 — Optional config walkthrough (profile-aware)
 
 First, infer the current profile using the same rules as Phase 1.
 
@@ -347,7 +414,7 @@ The walkthrough adapts based on profile. Walk through each applicable unset valu
 
 ---
 
-### Phase 4 — Team sharing
+### Phase 5 — Team sharing
 
 After completing or skipping the config walkthrough, say:
 
@@ -365,11 +432,11 @@ Add a note: `/start` can be used to create well-formed GitHub issues without wri
 
 ## Hard rules
 
-- Only modify `.codecannon.yaml`. Do not touch any other file (except running `CodeCannon/sync.py`, which modifies `.claude/commands/` — permitted only with explicit user approval).
+- Only modify `.codecannon.yaml` and local git config (Phase 2 signing setup). Do not touch any other file (except running `CodeCannon/sync.py`, which modifies `.claude/commands/` — permitted only with explicit user approval).
 - Do not run `sync.py` without explicit user permission.
 - Do not create `.codecannon.yaml` without explicit user permission.
 - Do not report a configuration problem unless confident the condition is genuinely broken. Prefer false negatives over false positives on all diagnostic checks.
 - Never fetch more than 100 labels in a single command. `gh label list --limit 100` is the ceiling.
-- Do not skip any human gate in Phase 2 or Phase 3 — each write requires confirmation.
+- Do not skip any human gate in Phase 2, Phase 3, or Phase 4 — each write requires confirmation.
 - If the user skips a config value, do not ask again. Move on.
-<!-- generated by CodeCannon/sync.py | skill: setup | adapter: cursor | hash: e7b58d48 | DO NOT EDIT — run CodeCannon/sync.py to regenerate -->
+<!-- generated by CodeCannon/sync.py | skill: setup | adapter: cursor | hash: 8032985f | DO NOT EDIT — run CodeCannon/sync.py to regenerate -->