diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index c79a4d2..2017d00 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -25,3 +25,20 @@ under MPL-2.0 (with MPL-2.0 as automatic legal fallback).
 See [CONTRIBUTING.adoc](../CONTRIBUTING.adoc) for the build walkthrough,
 code/test conventions, metadata workflow and release/fleet coordination.
 See [launch readiness](../docs/LAUNCH-READINESS.adoc) before proposing a release.
+
+## Signed commits
+
+Every commit that reaches the default branch must be signed; a ruleset refuses
+unsigned pushes. Estate policy:
+[SIGNING-POLICY](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc).
+
+- **People and interactive agents** sign with an SSH key registered on GitHub
+  as a *signing* key (`gpg.format=ssh`, `user.signingkey=<key>.pub`,
+  `commit.gpgsign=true`). The committer email must be verified on that account.
+- **Apps, bots and workflows** never `git push` local commits. They write
+  through the API (`createCommitOnBranch` or the estate `signed-push` action)
+  so that GitHub signs each commit.
+- Merge PRs with **squash**. The ruleset checks every commit on the PR branch,
+  not just the result, so one unsigned commit blocks the merge. Re-create such a
+  branch with signed commits (`git cherry-pick -S`) and open a new PR.
+  Rebase-merge replays commits unsigned and is disabled.
diff --git a/CONTRIBUTING.adoc b/CONTRIBUTING.adoc
index 870269a..dfff9c6 100644
--- a/CONTRIBUTING.adoc
+++ b/CONTRIBUTING.adoc
@@ -56,3 +56,20 @@ Do not change the Action image digest until the artifact at that digest has been
 tested. Coordinate JSON taxonomy/exit-status changes with consumers and the optional
 fleet bridge. Do not change a shared fleet API here. Release approval belongs to
 maintainers after link:docs/LAUNCH-READINESS.adoc[the launch gates], not to a score.
+
+== Signed commits
+
+Every commit that reaches the default branch must be signed; a ruleset refuses
+unsigned pushes. Estate policy:
+https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc[SIGNING-POLICY].
+
+* **People and interactive agents** sign with an SSH key registered on GitHub
+  as a *signing* key (`gpg.format=ssh`, `user.signingkey=<key>.pub`,
+  `commit.gpgsign=true`). The committer email must be verified on that account.
+* **Apps, bots and workflows** never `git push` local commits. They write
+  through the API (`createCommitOnBranch` or the estate `signed-push` action)
+  so that GitHub signs each commit.
+* Merge PRs with **squash**. The ruleset checks every commit on the PR branch,
+  not just the result, so one unsigned commit blocks the merge. Re-create such a
+  branch with signed commits (`git cherry-pick -S`) and open a new PR.
+  Rebase-merge replays commits unsigned and is disabled.