monorepo: investigate signed-commit subject corruption after a subpath push

[genedna]

Summary

After pushing a signed commit to a pre-existing Monorepo subpath, libra log --oneline displayed the first line of the embedded GPG signature header instead of the commit subject:

9c37c04 gpgsig -----BEGIN PGP SIGNATURE-----

The commit message still existed after the signature block, but the normal one-line history view became misleading and appeared corrupted. The same signed commit pushed to the Monorepo root did not show the symptom.

The report observes the symptom through Libra, so ownership is not yet proven. Mega2 must first determine whether its subpath materialization or persisted commit serialization places gpgsig in the message region. If the stored object is correct and only Libra renders it incorrectly, this issue should link the Libra defect and be closed with the evidence.

Versions and environment

• Mega2 image: genedna/mega2:latest
• Deployment: local macOS OrbStack evaluation stack
• Client: Libra 0.23.46 with vault.signing = true
• Comparison: Monorepo root push versus push to a pre-created child path

Reproduction

1. Create a signed commit with Libra.
2. Create the target Monorepo child path using the supported product write flow.
3. Push the signed commit to that child path.
4. Inspect the result with:
   • libra log --oneline;
   • a standard Git clone and git log --oneline;
   • git cat-file -p <commit> on the served commit;
   • the equivalent root-path control case.

Actual behavior

The subpath case shows gpgsig as the apparent subject in Libra one-line history. The root-path control appears normal.

Expected behavior

• A GPG signature remains a Git commit header and never becomes the visible commit subject.
• One-line history shows the actual subject for a signed commit.
• Raw commit structure, commit identity, and signature-verification semantics remain valid for the selected storage policy.
• The implementation owner is established from raw-object evidence rather than guessed from one client view.

Scope boundaries

In scope:

• Comparing the raw commit object, Mega2 storage or materialization output, Git output, and Libra output.
• Correcting Mega2 serialization or subpath projection if it is the source.
• Adding the corresponding regression fixture.

Out of scope:

• Disabling commit signing by default.
• Weakening GPG verification or rewriting signatures merely to change display.
• Changing unrelated root-path behavior.

Acceptance criteria

1. The investigation records the raw commit bytes and one-line output for both root and subpath controls.
2. A signed subpath push preserves a structural separation between the gpgsig header block and the commit message.
3. Standard Git and Libra show the same expected subject after the responsible implementation is fixed.
4. Regression coverage includes a multiline armored GPG signature and a non-empty subject.
5. If Mega2 is not the source, the issue contains the comparison evidence and a link to the corresponding Libra issue before closure.

Related evidence

• User trial report dated 2026-09-23, section P1-3.