feat: the attribution gate refuses an AI git identity - #222
Merged
Conversation
A commit authored and committed as Claude <noreply@anthropic.com> carried a fully compliant message — Assisted-by: trailer, no banned footer — and sailed through the gate, because the gate read messages and bodies only. The contributor graph is built from commit authorship plus Co-authored-by trailers, so that identity put an AI at #2 in the graph twice over: once for the commit itself, and again on each squash merge, where the forge auto-appends a Co-authored-by for any branch author who is not the PR author. (That history was rewritten out of main today; the gate is what keeps it out from here.) The commits half now checks the author and committer identity before the message: a whole-name match on the assistant names AI tools stamp by default, plus the vendors' address space. Vendor-agnostic in intent like the co-authorship ban, though an identity ban can only enumerate — both lists say to extend them as new defaults are met in the wild. A human whose name merely contains an assistant's name still passes, and the bot exemption is untouched. The corpus grows a commits-mode section proving all of it against a scratch repository — watched fail before the check existed, pass after. Assisted-by: Claude:claude-fable-5
This was referenced Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The contributor graph showed an AI at #2. Investigation traced it to one commit authored and committed as
Claude <noreply@anthropic.com>— with a fully compliant message — plus the two squash merges of that identity's branch commits, where the forge auto-appendedCo-authored-by:trailers. The gate read only messages and bodies, so a compliant message under an AI identity passed clean. The history has been rewritten out of main; this gate change is what keeps it out.What
scripts/check-attribution.shcommits half now refuses an AI author or committer identity: whole-name match on the assistant names AI tools stamp by default (claude,chatgpt,copilot,gemini,codex,devin), plus the vendors' address space (@anthropic.com,@openai.com). Vendor-agnostic in intent like the co-authorship ban (iss-215); an identity ban can only enumerate, and both lists say to extend them as new defaults appear.scripts/check-attribution-cases.shgrows a commits-mode section: a scratch repository proving the four refusals, the two acceptances, and the bot exemption. Watched fail (4 cases) before the check existed; 22/22 after.make preflightclean;gofmt -l .empty.Assisted-by: Claude:claude-fable-5