From 2a687f4a4661a0aa00e542619970b43aa943967e Mon Sep 17 00:00:00 2001
From: "rubas-agent[bot]" <334313564+rubas-agent[bot]@users.noreply.github.com>
Date: Tue, 29 Sep 2026 00:55:45 +0200
Subject: [PATCH] AGENTS.md: commit through createCommitOnBranch

main requires signed commits, so a bot PR with commits from git push stays blocked.
---
 AGENTS.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index 939d632..dfca111 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -33,6 +33,12 @@ covers install, the token, and usage.
   release. A tag that someone deletes comes back on the next push. To recover a failed build or
   release, run `release.yml` through `workflow_dispatch`.
 
+- `main` requires signed commits, and the bot cannot sign a commit. It also cannot read the rule,
+  so a PR with commits from a plain `git push` shows only `BLOCKED`. Commit through the GraphQL
+  mutation `createCommitOnBranch`, which GitHub signs: stage the change, then run
+  `gh-signed-commit "<headline>" ["<body>"]` from rubas/dotfiles. It also creates the branch on
+  GitHub.
+
 ## Pitfalls
 
 - `flake.nix` repeats the package version as a literal. Bump it in the same commit as