fix(merge-pr): enforce agent attribution

[andrei-hasna]

Summary

• require the merge executor to resolve the acting agent through an exact stable Todos agent ID
• refuse identity mismatches, unresolved identities, missing or duplicate merge trailers, and post-merge provenance drift
• verify the merged commit parent, tree, message trailer, and exact head before reporting success
• model GitHub squash-message behavior in the regression fixture, including duplicate display-name identities

Verification

• python3 -m unittest discover -s .codewith/skills/merge-pr/tests -p 'test_*.py' — 29 tests passed locally
• Blacksmith Testbox run 31695420972 on exact head 1e6febb1e0ec7df6a328b7d8aa512778d7622591
• staged secret scan — 4 files scanned, 0 findings

Provenance

Fixes Todos task 9a1bc19f-0497-48db-9d29-856d95adf0b3 without rewriting the published merge history of PRs #581 or #582.

[andrei-hasna]

[REVIEW] NO_GO — #585 @ 1e6febb — lens: correctness+security+gates, reviewer unresolved-account002 (1 of 1)

Reviewed the exact origin/main...HEAD candidate at 1e6febb1e0ec7df6a328b7d8aa512778d7622591, including the full surrounding implementation and tests in .codewith/skills/merge-pr/SKILL.md, references/merge-safety.md, scripts/merge_pr_execute.py, and tests/test_merge_pr_execute.py.

Gates and commands:

• bun install: exit 0; setup only, not a repository gate.
• Typecheck: no script declared in package.json.
• Test gate: none declared in package.json; this repository declares no test gate.
• THE LANE'S CHOSEN COMMAND: python3 .codewith/skills/merge-pr/tests/test_merge_pr_execute.py: exit 0, 7/7 passed. This is not a declared gate and does not block by itself.
• Forge command gh pr view 585 --repo hasna/codewith --json statusCheckRollup: exit 0; 22 SUCCESS, 5 SKIPPED, 0 FAILURE. Checks read: Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS; cla — SUCCESS; Check for spelling errors — SUCCESS; Blob size policy — SUCCESS; cargo-deny — SUCCESS; build-test — SUCCESS; Detect changed areas — SUCCESS; python-sdk — SUCCESS; Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS; Format / etc — SKIPPED; Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS; sdks — SUCCESS; Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS; Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS; Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS; Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED; cargo shear — SKIPPED; Argument comment lint package — SKIPPED; Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS; Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS; Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS; Argument comment lint - Linux — SUCCESS; Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS; Argument comment lint - Windows — SUCCESS; Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS; CI results (required) — SUCCESS; [code]smith — SKIPPED.

Blocking P1 finding:

• scripts/merge_pr_execute.py strips every body line in validate_body_file and every post-merge line in agent_trailer_blockers. A reachable body containing Agent: Severianus is accepted before mutation and accepted after mutation, although the raw merged commit has no line beginning Agent: . The repository's attribution query therefore cannot find the trailer while the executor reports merged_verified, defeating the new exact-agent provenance gate.
• Reproduction from the lane's chosen command: validate_body_file='Severianus' and agent_trailer_blockers=[] for that indented raw body.

No other concrete, reachable, in-scope P0/P1 defects found. The small remedy is to preserve nonblank lines exactly during both validations and add a regression test; this candidate is NO_GO until that fix is present and focused verification passes.

Non-blocking follow-up: the repository declares no test gate, so the focused Python test lane is useful evidence only and must not be treated as an official gate.

[andrei-hasna]

Fix for the 1e6febb1e0ec7df6a328b7d8aa512778d7622591 review finding is pushed in 532645168b2dccfd37dd24b72726ca857608bed4.

validate_body_file and agent_trailer_blockers now preserve every nonblank body line exactly and ignore only whitespace-only blank lines. Indented or otherwise noncanonical Agent: trailers are refused before mutation and rejected during postverification. Added regression coverage for the pre-mutation refusal; the focused lane is 8/8. The refreshed forge checks are still running on the new head.

[andrei-hasna]

[REVIEW] GO — #585 @ 5326451 — lens: correctness+security+gates, reviewer unresolved-account002 (1 of 1)

Focused re-review of the named indented-trailer defect and its direct regressions passes. The validators now preserve raw nonblank lines; the indented form is refused before mutation and rejected in postverification, while the canonical Agent: Severianus form passes. No other concrete, reachable, in-scope P0/P1 findings remain.

Gates and commands:

• THE LANE'S CHOSEN COMMAND: python3 .codewith/skills/merge-pr/tests/test_merge_pr_execute.py: exit 0, 8/8 passed. This is not a declared repository gate.
• THE LANE'S CHOSEN COMMAND: the direct validator control: exit 0; indented_validate=refused, indented_postverify=['merged_agent_trailer_count_mismatch', 'merged_agent_trailer_not_final'], canonical_validate='Severianus', canonical_postverify=[]. This is evidence for the named fix, not a repository gate.
• Forge command gh pr view 585 --repo hasna/codewith --json statusCheckRollup: exit 0; 21 SUCCESS, 5 SKIPPED, 0 FAILURE, 1 IN_PROGRESS. Checks read: Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS; cla — SUCCESS; Check for spelling errors — SUCCESS; Blob size policy — SUCCESS; cargo-deny — SUCCESS; build-test — SUCCESS; Detect changed areas — SUCCESS; python-sdk — SUCCESS; Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS; sdks — IN_PROGRESS; Format / etc — SKIPPED; Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS; Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS; Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS; Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS; Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED; cargo shear — SKIPPED; Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS; Argument comment lint package — SKIPPED; Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS; Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS; Argument comment lint - Linux — SUCCESS; Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS; Argument comment lint - Windows — SUCCESS; Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS; CI results (required) — SUCCESS; [code]smith — SKIPPED.
• Typecheck: no script declared in package.json.
• Test gate: none declared in package.json; this repository declares no test gate.

Merge was not executed because the authoritative sdks check is still IN_PROGRESS. This is a gate wait, not a code finding.

Non-blocking follow-up: the repository should eventually declare an explicit test gate if maintainers want package-level test enforcement; no undeclared command was used as a blocker.

[andrei-hasna]

[REVIEW] GO — #585 @ 5326451 — lens: correctness+security+gates, reviewer unresolved-account002 (1 of 1)

Scope read:

• Compared the exact candidate against origin/main at 3f11b42.
• Read the full diff and surrounding source for .codewith/skills/merge-pr/SKILL.md, .codewith/skills/merge-pr/references/merge-safety.md, .codewith/skills/merge-pr/scripts/merge_pr_execute.py, and .codewith/skills/merge-pr/tests/test_merge_pr_execute.py.

Commands and gates:

• Setup only (not a repository gate): bun install — exit 0.
• The repository declares no typecheck script.
• The repository declares no test gate: package.json has no test script. I did not invent one.
• The lane's chosen command (not a repository-declared gate): python3 -m unittest discover -s .codewith/skills/merge-pr/tests -p 'test_merge_pr_execute.py' — exit 0; 8 tests run, 0 failures, 0 errors.
• The lane's chosen command (not a repository-declared gate): git diff --check origin/main...HEAD — exit 0; 0 whitespace errors.
• Forge required-check read: gh pr view 585 --repo hasna/codewith --json statusCheckRollup — exit 0; 22 SUCCESS, 5 SKIPPED, 0 FAILURE.

Forge checks read:

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS
• Format / etc — SKIPPED
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• sdks — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SKIPPED
• Argument comment lint package — SKIPPED
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Argument comment lint - Linux — SUCCESS
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• CI results (required) — SUCCESS
• [code]smith — SKIPPED

Blocking findings:

• None. I found no concrete, currently reachable, in-scope P0/P1 correctness, security, data/session integrity, unsafe mutation/rollback, or required-gate defect in this exact candidate.

Non-blocking follow-ups:

• The missing package.json test script is noted as a process gap only; it is not used as a false blocker.