docs(nest): replace commit attribution policy with the runtime facts (#8236)

## What

The nest `AGENTS.md` template
(`desktop/src-tauri/src/managed_agents/nest_agents.md`) ships to every
Buzz user's agents. Its "Git Commit Attribution" section is cut from a
general attribution policy (separate claims, author "per applicable
policy", hypothetical repos that require a human author, "stop and ask")
down to what the runtime actually does:

- `buzz-acp` sets a default git identity and signing. Agents use it, but
change the author when a repository or their human needs a different
one. The operator can opt out with `BUZZ_GIT_IDENTITY=user`.
- Credit the other party with `Co-authored-by`: the human you work for
when you commit as yourself, or yourself when you commit as them.
- Follow each repository's own `AGENTS.md` for sign-off (DCO) and other
attribution rules.

The buzz-acp base prompt gets the same co-author default.
`NEST_AGENTS_VERSION` goes from 6 to 7 so existing nests refresh, and
the template test now asserts the new content.

## Why

Agents read the old section as a puzzle to solve on every commit. They
looked for an applicable policy, wondered whether the human should be
the author, and stalled. DCO and sign-off rules are per-repository and
already live in each repo's own `AGENTS.md` (this repo says `git commit
-s`), so they don't belong in a template that every OSS user's agents
read.

Companion buzz-app change: block/buzz-app#833.

## Validation

`cargo test --lib managed_agents::nest` in `desktop/src-tauri`: 55
passed, including the legacy-attribution upgrade test.

I pushed with `--no-verify`: the change is Markdown plus a version
constant and a test, and the nest tests above are the relevant suite. CI
runs the full set.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: Bradley Axen <baxen@squareup.com>
Co-authored-by: bundled00 <f172256d14c11991d58561c98a594e7397d64087502e7bc90f2c0e8d0d45363f@buzz.block.builderlab.xyz>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

crates/buzz-acp/src/base_prompt.md

@@ -132,7 +132,7 @@ These are guidelines, not a fixed procedure — apply judgment to the task in fr
 - After selecting a repository or worktree, read its root `AGENTS.md` and any path-local `AGENTS.md` files that apply before planning or editing. The workspace-level file is team context; it does not replace repository-owned instructions.
 - Treat repository-owned product, architecture, and vision documents as design constraints, not optional background. Read the relevant documents before making non-trivial plans, and surface any intentional conflict with them.
 - Make file changes in a worktree, not on the default branch. When continuing recent work, reuse the existing one rather than creating another.
-- The runtime sets your git commit identity and signing. Don't override them with `user.*` config, `-c user.*`, `--author` or another signing key. Add co-author or sign-off trailers only when the repository or the person you're working for requires them. If a repository requires a different commit author, tell the person running you instead of overriding the identity; they can switch your commits to their own git identity with `BUZZ_GIT_IDENTITY=user`.
+- The runtime gives you a default git commit identity and signing key. Use it unless a repository or the person you're working for needs a different author, then change it. Credit the human you work for with a `Co-authored-by` trailer (or yourself, if you commit as them), and follow the repository's `AGENTS.md` for sign-off rules.
 
 ## Autonomy
 

desktop/src-tauri/src/managed_agents/nest.rs

@@ -48,7 +48,7 @@ const BUZZ_CLI_SKILL_MD: &str = include_str!("nest_skill.md");
 /// Template content version for AGENTS.md static content (above managed markers).
 /// Bump this when changing `nest_agents.md` to trigger refresh on existing installs.
 /// Version 1 is implicitly "before this mechanism existed" (no version file).
-const NEST_AGENTS_VERSION: u32 = 6;
+const NEST_AGENTS_VERSION: u32 = 7;
 
 /// Template content version for SKILL.md.
 /// Bump this when changing `nest_skill.md` to trigger refresh on existing installs.

desktop/src-tauri/src/managed_agents/nest/tests.rs

@@ -42,23 +42,13 @@ fn nest_skill_contains_safe_mention_workflow() {
 }
 
 #[test]
-fn nest_agents_template_separates_commit_attribution_claims() {
+fn nest_agents_template_defers_commit_policy_to_repositories() {
     assert_eq!(AGENTS_MD.matches("## Git Commit Attribution").count(), 1);
-    assert!(AGENTS_MD.contains(
-        "Git authorship, co-authorship, DCO sign-off, and cryptographic signing are separate claims"
-    ));
-    assert!(AGENTS_MD
-        .contains("Request, approval, review, or accountability alone is not co-authorship"));
-    assert!(AGENTS_MD.contains("A sign-off is not an approval marker"));
-    assert!(AGENTS_MD.contains("Never use another person's signing key"));
-    assert!(AGENTS_MD.contains("inspect every outgoing commit against the actual upstream or base"));
-    assert!(AGENTS_MD.contains("An agent-owned repository may use the agent as author"));
+    assert!(AGENTS_MD.contains("the runtime sets a default git identity and signing"));
+    assert!(AGENTS_MD.contains("`BUZZ_GIT_IDENTITY=user`"));
+    assert!(AGENTS_MD.contains("Credit the other party with a `Co-authored-by` trailer"));
+    assert!(AGENTS_MD.contains("Follow each repository's own `AGENTS.md` for sign-off (DCO)"));
     assert!(!AGENTS_MD.contains("every commit MUST include a `Signed-off-by`"));
-    // Managed-runtime delta: describes the default agent identity and the
-    // `user` opt-out without reintroducing mandatory human-trailer policy.
-    assert!(AGENTS_MD.contains("### Managed runtime default"));
-    assert!(AGENTS_MD.contains("`BUZZ_GIT_IDENTITY` unset or `agent`"));
-    assert!(AGENTS_MD.contains("The operator can opt out per-agent with `BUZZ_GIT_IDENTITY=user`"));
 }
 
 #[test]

desktop/src-tauri/src/managed_agents/nest_agents.md

@@ -46,22 +46,9 @@ created: 2026-01-15
 
 ## Git Commit Attribution
 
-Git authorship, co-authorship, DCO sign-off, and cryptographic signing are separate claims. Follow repository-local rules and the authorizing human's explicit directions; do not infer attribution from repository ownership or from who requested, approved, or reviewed the work.
+When Buzz runs you through its `buzz-acp` harness, the runtime sets a default git identity and signing: you commit as yourself (your display name and `<pubkey>@<relay-host>`), signed with your agent key. Use it unless a repository or the person you work for needs a different author, then change it (for example with `--author` or `-c user.*`). The operator can also switch an agent to their own git identity with `BUZZ_GIT_IDENTITY=user`.
 
-- **Author:** use the person or agent required by the applicable policy. If no policy specifies an author, use the identity that actually authored the change.
-- **Co-authors:** add `Co-authored-by` only for other people or agents who materially authored the change. Request, approval, review, or accountability alone is not co-authorship.
-- **DCO:** add `Signed-off-by` only when repository policy requires that identity's DCO certification. A sign-off is not an approval marker.
-- **Identity:** resolve required identities from trusted local configuration or explicit verified direction; never hard-code or guess them. A managed runtime may make effective `git config user.*` values identify the agent. Stop and ask if a required identity cannot be established.
-- **Signing:** use only the signing key configured for the committing identity. Never use another person's signing key.
-- **Verify before pushing:** inspect every outgoing commit against the actual upstream or base and confirm its attribution matches the applicable policy.
-
-A repository may require an accountable human as author and the implementing agent as co-author. An agent-owned repository may use the agent as author and require no human trailer. In both cases, repository-local policy controls.
-
-### Managed runtime default
-
-When Buzz runs you through its stock `buzz-acp` harness, by default (`BUZZ_GIT_IDENTITY` unset or `agent`) its `GIT_CONFIG_*` environment variables set your agent nostr identity and signing as the default for commits you create: `user.email` is `<pubkey>@<relay-host>`, `user.name` is your display name (or npub), and commits are signed with your agent key (NIP-GS). These outrank repo and global `user.*` config, but not repo `author.*`/`committer.*` config, and amend or cherry-pick keep the original author. Treat this as your identity under the rules above, and do not override it with `user.*` config, `-c user.*`, `--author` or another signing key. If a repository's policy requires a different author, tell the operator instead.
-
-The operator can opt out per-agent with `BUZZ_GIT_IDENTITY=user`. In `user` mode the runtime injects no identity or signing settings, so Git uses the operator's ordinary configuration. It also drops inherited `GIT_CONFIG_*` identity, signing, `author.*`, `committer.*` and include entries so a nested agent cannot inherit its parent's identity. Relay git authentication works in both modes. A custom agent harness gets only relay git authentication and controls its own commit attribution.
+Credit the other party with a `Co-authored-by` trailer: when you commit as yourself, credit the human you work for (`git config --global user.name` and `user.email` give their identity); when you commit as them, credit yourself. Follow each repository's own `AGENTS.md` for sign-off (DCO) and other attribution rules.
 
 <!-- BEGIN BUZZ MANAGED — regenerated automatically, do not edit below -->
 ## Active Agents