T180: the DCO changelog entry is about a git signature, not a receipt

docs.mdx

@@ -219,7 +219,7 @@ the framework's own interrupt, and a framework with no such primitive does not n
 
 {/* generated from the suite, pyproject and the soak (mdx) — run the generator */}
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **5,970 tests**, every version specified before it was written and every requirement mutation-tested.
+- **5,975 tests**, every version specified before it was written and every requirement mutation-tested.
 - **24 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite.
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak).

docs/production/index.mdx

@@ -28,7 +28,7 @@ need. `test_the_first_line_of_the_section_says_which_store_and_why` asserts the
 
 {/* generated from the suite, pyproject and the soak (full) — run the generator */}
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **5,970 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
+- **5,975 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
 - **24 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. [Read more](/docs/security/verify-guarantees).
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. [Read more](/docs/production/postgres).
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [Read more](/docs/production/soak).

generated/readiness.full.mdx

@@ -1,6 +1,6 @@
 {/* generated from the suite, pyproject and the soak (full) — run the generator */}
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **5,970 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
+- **5,975 tests**, every version specified before it was written and every requirement mutation-tested. [Read more](/docs/how-this-is-built).
 - **24 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates. [Read more](/docs/security/verify-guarantees).
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite. [Read more](/docs/production/postgres).
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [Read more](/docs/production/soak).

generated/readiness.json

@@ -9,6 +9,6 @@
     "positive_control": true,
     "unexplained": 0
   },
-  "tests": 5970,
+  "tests": 5975,
   "version": "0.9.0"
 }

generated/readiness.mdx

@@ -1,6 +1,6 @@
 {/* generated from the suite, pyproject and the soak (mdx) — run the generator */}
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **5,970 tests**, every version specified before it was written and every requirement mutation-tested.
+- **5,975 tests**, every version specified before it was written and every requirement mutation-tested.
 - **24 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite.
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak).

generated/readiness.readme.md

@@ -1,6 +1,6 @@
 <!-- generated from the suite, pyproject and the soak (readme) — run the generator -->
 - **Version 0.9.0**, on [PyPI](https://pypi.org/project/ctrlrun/), Python 3.11 and later.
-- **5,970 tests**, every version specified before it was written and every requirement mutation-tested.
+- **5,975 tests**, every version specified before it was written and every requirement mutation-tested.
 - **24 guarantees you can check in your own setup**, with `ctrlrun verify` against your policy, on your store's backend, in a scratch store it creates.
 - **One host: a file.** SQLite, no server, no ops. **Many hosts: Postgres**, the same guarantees, graded by the same suite.
 - **Soaked for 20m 0s on postgres**: 889,735 actions, 0 unattributed ambiguous outcomes, positive control fired. Nothing here establishes what only accumulates over days. [What it does not establish](https://ctrlrun.dev/docs/production/soak).

tests/test_release_documents.py

@@ -131,6 +131,13 @@ def _load(name: str) -> set[str]:
         "`APPROVAL_REQUESTED`; the gateway serves the signed inbound grant/deny at",
         # v0.7 item 3: "the executor signature" is a function's parameters, not a receipt.
         "re-derives it and a `reconcile` hook reads the attempt off the record. The executor signature is",  # noqa: E501
+        # v0.9: the DCO check. "Signs off" is the Developer Certificate of Origin trailer on a
+        # git commit, and "GitHub's own signature" is GitHub's signature on that commit, read
+        # back through its API. Neither is a signature on a receipt, which is the thing
+        # `SPEC-v0.6.md` §6.4 says this project does not do.
+        "- **The DCO check refused every Dependabot pull request.** Dependabot signs its commits off as",  # noqa: E501
+        "included. A sign-off under another address is now accepted on exactly one fact that is not a",  # noqa: E501
+        "string anyone can set: GitHub's own signature on the commit, read back through the API. There",  # noqa: E501
     ),
     "docs/THREAT_MODEL.md": (
         "| A forged or tampered token | `JWTIdentityProvider` verifies the signature against a JWKS or a pinned key, with the algorithm taken from its own allow-list and never from the token (RFC 8725 §3.1) |",  # noqa: E501