DCO: AGENTS.md promises identity enforcement that neither the hook nor CI does

Two things to settle: a doc claim that is currently false, and — if we want to make it true — which rule survives contact with how the repo is actually used.

The gap

AGENTS.md § Commits states:

The name and e-mail must match the committer's git identity (git config user.name / git config user.email).

A commit-msg pre-commit hook enforces this.

Neither half is enforced:

• scripts/check_dco_signoff.py matches ^Signed-off-by: \S.*<\S+> and stops. It never reads git config; the identity requirement appears only inside its own error text.
• .github/workflows/dco.yml checks the trailer is present and well-formed. No identity comparison.

So Signed-off-by: Anybody <a@b.c> passes locally and in CI. That matters because a sign-off certifies that you have the right to submit the work — a trailer naming someone else certifies nothing.

Why the obvious fix is wrong

I wrote the strict version (compare against GIT_COMMITTER_IDENT, require at least one matching trailer), and it passed every case I could invent. Then I ran it against six months of real history:

The 405 are largely an artifact — 229 carry a (#NNN) subject, i.e. squash merges, where the message is rewritten and the trailer is dropped. What lands on main says little about what the contributor committed.

The 26 real mismatches are the problem, because they are not abuse:

author=farbod-nv <fmotlagh@nvidia.com>
signed=Farbod Motlagh <fmotlagh@nvidia.com>       same address; the git name is a GitHub handle

author=rwiltz <...+rwiltz@users.noreply.github.com>
signed=Rafael Wiltz <rwiltz@nvidia.com>           GitHub noreply vs corporate address

Both are arguably more DCO-correct than the git identity is: the DCO asks for a real legal name, and git author names are routinely the GitHub handle. A strict name comparison would have blocked at least three contributors mid-workflow to close a gap nobody is exploiting. I closed #1013 for that reason.

What to decide

1. Do we want identity enforcement at all? If not, the fix is one line — stop claiming it in AGENTS.md, keep presence-only checking. That is a legitimate answer; the DCO's force comes from the act of signing, not from a machine verifying the name.

2. If yes, which rule? Candidates, roughly in order of how much they would disrupt:

3. Local, CI, or both? The hook is commit-msg, so --no-verify bypasses it and CI sees nothing. dco.yml is the only place a guarantee can actually hold — but that changes what CI rejects for everyone, which is why this is an issue and not a PR.

Notes

• A working strict implementation exists on ivany-nv/dco-identity-check (d132e9a37) if a variant of it turns out to be wanted. Do not merge it as-is.
• Whatever we pick, AGENTS.md and dco.yml should end up saying the same thing. Today they disagree with each other and with the hook.

cc @jiwenc — you own AGENTS.md § Commits and both DCO checks.