AI collaboration: recognition ruleset + in-adapter GitHub author classification (foundation)

[gkanitz]

Parent

Design spec: docs/superpowers/specs/2026-07-27-ai-native-contribution-design.md (AI-native contribution, wave 1). This is the foundation slice of that feature.

What to build

The recognition foundation for the "AI collaboration" signal, wired end-to-end on GitHub so a reviewed PR's author is classified as an AI agent / bot / human and that classification is visible in the report JSON — without changing what data CodeRepute fetches.

A new embedded, versioned recognition ruleset (airuleset.json, following the existing metrics/bands/bands.json go:embed precedent: a top-level version plus entries mapping known agent identities/bot-logins to a canonical agent id, e.g. copilot, devin). A matcher takes an author identity and returns a small class string: the canonical agent id when the ruleset matches, "bot" when only structural bot-type matches (GitHub author type: "Bot" / *[bot] login), or "" for a human author.

The GitHub adapter, at its existing "someone else's PR" branch, classifies the reviewed PR's author against the matcher and records ONLY the resulting class string on provider.Review. The human colleague's identity must never leave the adapter — this preserves the existing "subject-only data leaves the adapter / no colleague profiles" architecture. The transparency manifest gains an entry recording the ruleset version used.

No new API endpoints: this uses the reviewed-PR author already in hand at the classification point. The neverRequested lists and route tables must be unchanged, so the manifest's "no commit data" attestation stays true.

Acceptance criteria

• airuleset.json is embedded via go:embed with a top-level version field and entries mapping agent identities to canonical agent ids, matching the metrics/bands/bands.json structure.
• The matcher returns the canonical agent id for a ruleset-recognized author, "bot" for an author matched only by structural bot-type (GitHub type:"Bot" or *[bot] login), and "" for a human author. (Unit tests for each case.)
• provider.Review carries the class string; the GitHub adapter sets it by classifying the reviewed PR's author at the "someone else's PR" branch.
• The reviewed PR author's human identity (login, id, profile) is never written to provider.Review or any output — only the class string leaves the adapter. (Test asserts no colleague identity on the emitted Review.)
• No new API endpoints are requested: the GitHub neverRequested list and route table are unchanged, and the existing manifest "no commit data / no colleague profiles" tests still pass.
• The transparency manifest records the recognition ruleset version.
• The class string is present in the report JSON for a GitHub review on a recognized-agent-authored PR (end-to-end verifiable).
• go test ./..., go vet ./..., and gofmt -l . pass.

Blocked by

None - can start immediately.