docs: record retroactive DCO signoffs for the 10 unsigned commits on v2/main

Problem

Ten commits on v2/main have no Signed-off-by: trailer. They merged on 2026-08-11/12, right after the probot DCO app was suspended (after #1981), when nothing was checking signoffs. All ten are already on main and already released (2.2.0 and 2.3.0), so they can't be fixed by rewriting history. Found while building #2616, whose sweep of v2/main since 2026-08-12 turned up exactly these ten.

Commit	Author	PR	Released	Subject
eb5bba62ede2c27d9082a833bcf23e34d4cda2ee	cliffhall	#1983	2.2.0	fix(tui): bundle React-rendering deps so a consumer install can't split React
3c1bbbcb5fda7e4eb393f7323f1b347726ccc440	cliffhall	#1983	2.2.0	fix(tui): correct ink-form's misspelled incomplete-form hint
39575ff060bcc7f4a7478a19d1d58ec568c39e2c	cliffhall	#1983	2.2.0	test(tui): drive the ink-form patch through the plugin, and drop the esbuild type import
9fd5bc177cb9e40e651756c533fed14526043bc6	cliffhall	#1983	2.2.0	chore: drop the orphaned root override, and correct the TUI coverage note
94a227b9c12451ee7810f1177e4992ac4713742c	cliffhall	#1983	2.2.0	fix(tui): widen the root react range so an external ink can't split React
b70aed691418a7e2e98c897cba6ab44ad422f648	cliffhall	#1987	2.2.0	test(fix): probe a single-source route when waiting for the dead transport
cf834633ba99a569ae766083bde166646fc13ac6	olaservo	#1994	2.3.0	fix: add eol=lf policy to .gitattributes so Windows checkouts stay clean
9f7895dcd976daca6bbe41efc1b381ec4e82b0c1	olaservo	#1995	2.3.0	fix: invoke the registered SIGINT listener directly in run-method.test instead of emitting a process-wide signal
9c6e4aeb4e827937abbef489ac5cd154a8919d6a	olaservo	#1996	2.3.0	fix: settle ink input-handler re-subscription after frame waits in TUI App tests
e3a026802bc8037afe025ecd8f42ce54c811f26d	olaservo	#1997	2.3.0	fix: resolve node bins via package.json instead of spawning npx .cmd shims so the verify/smoke scripts run on Windows

Fix: a retroactive signoff record, committed by each author

Add docs/dco-retroactive-signoffs.md. Each author adds their own section in their own signed-off commit. A signoff certifies the signer's own right to contribute the code, so nobody can make it on someone else's behalf. That rules out one person writing both sections, and it rules out a squash merge (see step 3).

Each certification commit must be authored and signed off with the same identity as your original commits:

• @cliffhall: cliffhall <[email protected]>
• @olaservo: olaservo <[email protected]>

Check with git config user.name and git config user.email before committing.

Step 1, @cliffhall: start the branch, add the header and your section, open the PR

git fetch origin
git switch -c v2/docs/2617-dco-retroactive-signoffs origin/v2/main

Create docs/dco-retroactive-signoffs.md with this content:

# Retroactive DCO signoffs

Every commit in this repository carries a Developer Certificate of Origin
signoff (`Signed-off-by:`), checked by `.github/workflows/dco.yml`. The commits
listed below merged on 2026-08-11/12 without one, while the probot DCO app that
used to enforce this was suspended and nothing replaced it (#2566, #2616). They
are already on `main` and in released versions, so their history is not
rewritten. Instead each author certifies them here.

Each section below was added by its author in a commit that the author both
wrote and signed off. That commit is the author's retroactive `Signed-off-by:`
for every commit the section lists. To verify, run:

    git log --format='%h %an <%ae>%n%(trailers:key=Signed-off-by)' -- docs/dco-retroactive-signoffs.md

## cliffhall <[email protected]>

I, Cliff Hall, am the author of the commits below. I certify that each of
them was contributed in accordance with the Developer Certificate of Origin,
version 1.1 (https://developercertificate.org/), and this signed-off commit
adds my `Signed-off-by: cliffhall <[email protected]>` to each of them.

| Commit | PR | Subject |
| --- | --- | --- |
| `eb5bba62ede2c27d9082a833bcf23e34d4cda2ee` | #1983 | fix(tui): bundle React-rendering deps so a consumer install can't split React |
| `3c1bbbcb5fda7e4eb393f7323f1b347726ccc440` | #1983 | fix(tui): correct ink-form's misspelled incomplete-form hint |
| `39575ff060bcc7f4a7478a19d1d58ec568c39e2c` | #1983 | test(tui): drive the ink-form patch through the plugin, and drop the esbuild type import |
| `9fd5bc177cb9e40e651756c533fed14526043bc6` | #1983 | chore: drop the orphaned root override, and correct the TUI coverage note |
| `94a227b9c12451ee7810f1177e4992ac4713742c` | #1983 | fix(tui): widen the root react range so an external ink can't split React |
| `b70aed691418a7e2e98c897cba6ab44ad422f648` | #1987 | test(fix): probe a single-source route when waiting for the dead transport |

Also add a row for the file to the documentation table in README.md (## Documentation), per the doc-maintenance rule in AGENTS.md. Then:

npm run format
git add docs/dco-retroactive-signoffs.md README.md
git commit -s -m "docs: retroactive DCO signoff for cliffhall's unsigned commits (#2617)"
git push -u origin HEAD
gh pr create --repo modelcontextprotocol/inspector --base v2/main --label v2 --draft \
  --title "docs: retroactive DCO signoffs for the 10 unsigned commits on v2/main (#2617)" \
  --body "Closes #2617"

Leave it as a draft until step 2 is in.

Step 2, @olaservo: add your section in your own commit

git fetch origin
git switch v2/docs/2617-dco-retroactive-signoffs
git pull

Append this to the end of docs/dco-retroactive-signoffs.md:

## olaservo <[email protected]>

I, Ola Hungerford, am the author of the commits below. I certify that each of
them was contributed in accordance with the Developer Certificate of Origin,
version 1.1 (https://developercertificate.org/), and this signed-off commit
adds my `Signed-off-by: olaservo <[email protected]>` to each of them.

| Commit | PR | Subject |
| --- | --- | --- |
| `cf834633ba99a569ae766083bde166646fc13ac6` | #1994 | fix: add eol=lf policy to .gitattributes so Windows checkouts stay clean |
| `9f7895dcd976daca6bbe41efc1b381ec4e82b0c1` | #1995 | fix: invoke the registered SIGINT listener directly in run-method.test instead of emitting a process-wide signal |
| `9c6e4aeb4e827937abbef489ac5cd154a8919d6a` | #1996 | fix: settle ink input-handler re-subscription after frame waits in TUI App tests |
| `e3a026802bc8037afe025ecd8f42ce54c811f26d` | #1997 | fix: resolve node bins via package.json instead of spawning npx .cmd shims so the verify/smoke scripts run on Windows |

Then:

npx prettier --write docs/dco-retroactive-signoffs.md
git add docs/dco-retroactive-signoffs.md
git commit -s -m "docs: retroactive DCO signoff for olaservo's unsigned commits (#2617)"
git push

Then comment on this issue that your part is in.

Step 3, @cliffhall: verify and merge

git pull
npm run local:dco    # every commit on the branch is signed off
git log --format='%h %an <%ae>%n%(trailers:key=Signed-off-by)' -- docs/dco-retroactive-signoffs.md

The git log output must show exactly two commits, each authored and signed off by the person whose section it adds. Mark the PR ready, let the DCO check go green, and then:

⚠️ Merge with "Create a merge commit", not "Squash and merge". A squash replaces both commits with one commit authored by whoever clicks merge, so @olaservo's certification would no longer be @olaservo's own commit. That is the property this whole record rests on.

Done when

• docs/dco-retroactive-signoffs.md is on v2/main, with two sections, each added by a commit that its own author wrote and signed off.
• The README documentation table lists the file.
• It reaches main with the next milestone merge, alongside the released code it covers.