Intake DCO check skips merge commits

[asdd-agent]

Summary

The intake DCO check counted every commit in the PR range, including merge commits. A merge commit carries no change of its own and cannot be signed off without rewriting history, so a routine update of a branch with its base (or the GitHub "Update branch" button) adds an unsigned merge commit that fails DCO with no clean remedy. Build the commit list with --no-merges, matching the DCO convention. The intake self-test guards the flag.

Disclosure (required - ASDD)

• Entirely human-authored
• Authored or co-authored by an AI agent under human direction

Agent identity: asdd-agent
Instructed by (human handle): welsbach

Checklist

• Exactly one lane label (chore)
• Signed off (git commit -s)

[welsbach]

check

[github-actions]

ASDD review - advisory (recommendation: comment)

Produced by an automated agent under human direction. Advisory only: a human approves and merges.
Nothing here merges automatically.

The PR adds --no-merges to the git log command in the intake workflow so merge commits are excluded from the DCO check, fixing a bug where routine branch updates produced an unsigned merge commit that failed DCO with no clean remedy. A self-test guards the flag's continued presence. The change is a one-flag bug fix that aligns with the DCO convention (the DCO app also skips merges). No security concerns: the workflow path remains read-only for analysis, no secrets are involved, and no dependencies changed. The change is non-normative - the DCO requirement itself is unchanged, only the implementation's handling of merge commits is corrected - and the author's chore declaration matches. | Adversarial pass: The PR adds a single --no-merges flag to the intake DCO commit-list command, a matching self-test guard, and a CHANGELOG entry. The change is proportionate: one concept (exclude merge commits from DCO), one flag, one guard, one note. The self-test is a string-presence grep rather than a behavioral test, but it is consistent with the existing test style and serves as a regression guard against accidental removal. The workflow comments are slightly verbose for a one-flag change but explain a genuinely non-obvious edge case. I could not find a strong reason to block or rework this PR; the change reduces complexity (removes a false-failure mode) rather than adding it. Security scan (deterministic + SAST): no new issues. Impact scan: 1 finding(s), 0 block.

CODE - ok

• note: The self-test greps for the literal string '--no-merges' anywhere in the workflow file, so it would also match the flag appearing in a comment rather than in the actual git log command. Acceptable for a guard test but worth noting if the workflow gains other uses of the string.

SECURITY - ok

No findings.

SPEC - ok

• note: No linked spec, but this is a chore-level one-flag bug fix to the reference implementation's DCO handling, exempt from the spec requirement.

IMPACT - concerns

• note: Non-normative bug fix to the reference implementation. The DCO MUST is unchanged; only the implementation's merge-commit handling is corrected to match the DCO convention. Declared as chore, which matches the classification.
• warn: This change touches a behavioural surface (a gate, lens, agent prompt, or the runtime seam: .github/asdd/intake-check.test.sh). If it changes behaviour adopters rely on for conformance, it is normative: declare it and add an impact analysis and target version. If it preserves behaviour, no action.

QUALITY - ok

• note: The self-test greps for the literal string '--no-merges' in the workflow YAML rather than exercising the behavior. A comment containing the flag would satisfy the test. This is a weak guard but consistent with the file's existing test style and acceptable for a regression check.
• note: The test resolves the workflow path as $DIR/../workflows/asdd-intake.yml. I cannot verify this relative path is correct from the diff alone; a human should confirm the directory relationship holds at runtime.

---

_{Generated by the ASDD advisory review. Mode: live.}