Context
We evaluated enforcing commit trailers in Stackbilt-dev/aegis with @stackbilt/cli 1.9.3 on 2026-09-15 and decided to make them advisory (requireTrailers: false). Enforcement cost a lot and returned little, for reasons that sit in Charter rather than aegis.
Findings
- References are never resolved.
validateCommits marks every Governed-By / Resolves-Request value valid: true with resolved_id: null (packages/cli/src/commands/validate.ts). Any string satisfies the gate, so an enforced trailer proves only that someone typed one.
- Risk patterns are hardcoded to one layout.
HIGH_RISK_PATTERNS in packages/git/src/risk.ts is ^worker/handlers/, ^worker/services/, ^worker/mcp/, ^migrations/, \.sql$. Aegis code lives in web/src/**, so only .sql matches. 0 of the last 40 aegis commits were classified HIGH. trailerThreshold therefore does nothing there, and the only enforceable mode is strict, meaning a trailer on every commit.
- Strict mode doesn't separate automation. Dependabot bumps and autonomous
do_sandbox commits (chore: autonomous task …) would all need trailers.
- No consumers. Nothing outside Charter's own
validate and audit reads trailers. In stack-arcade, where they have been enforced since 2026-09-13, 3 of 58 commits carry them, and the three governance CI failures were range and setup issues, not prevented defects.
Proposal
- Resolve references:
Governed-By against ADR files matched by a configurable glob (e.g. docs/adr/*.md, 6_Sprint_Backlog_ADRs/*.md), and Resolves-Request against GitHub issues. Report unresolved references as a failure.
- Per-repo risk patterns in
.charter/config.json (e.g. git.riskPatterns.high: ["web/migrations/**", "web/schema.sql", "web/src/auth*"]), with the current list as the default.
- An author or path exemption for automation (e.g.
dependabot[bot], auto/* branches).
With those in place, a HIGH-threshold advisory gate would flag commits that matter and verify their references point at something real. At that point aegis would reconsider enforcing trailers.
Context
We evaluated enforcing commit trailers in
Stackbilt-dev/aegiswith@stackbilt/cli1.9.3 on 2026-09-15 and decided to make them advisory (requireTrailers: false). Enforcement cost a lot and returned little, for reasons that sit in Charter rather than aegis.Findings
validateCommitsmarks everyGoverned-By/Resolves-Requestvaluevalid: truewithresolved_id: null(packages/cli/src/commands/validate.ts). Any string satisfies the gate, so an enforced trailer proves only that someone typed one.HIGH_RISK_PATTERNSinpackages/git/src/risk.tsis^worker/handlers/,^worker/services/,^worker/mcp/,^migrations/,\.sql$. Aegis code lives inweb/src/**, so only.sqlmatches. 0 of the last 40 aegis commits were classified HIGH.trailerThresholdtherefore does nothing there, and the only enforceable mode is strict, meaning a trailer on every commit.do_sandboxcommits (chore: autonomous task …) would all need trailers.validateandauditreads trailers. In stack-arcade, where they have been enforced since 2026-09-13, 3 of 58 commits carry them, and the three governance CI failures were range and setup issues, not prevented defects.Proposal
Governed-Byagainst ADR files matched by a configurable glob (e.g.docs/adr/*.md,6_Sprint_Backlog_ADRs/*.md), andResolves-Requestagainst GitHub issues. Report unresolved references as a failure..charter/config.json(e.g.git.riskPatterns.high: ["web/migrations/**", "web/schema.sql", "web/src/auth*"]), with the current list as the default.dependabot[bot],auto/*branches).With those in place, a HIGH-threshold advisory gate would flag commits that matter and verify their references point at something real. At that point aegis would reconsider enforcing trailers.