Follow-up to #406, which fixed the trailer parse. This is the remaining rule problem it surfaced.
The situation
AGENTS.md says:
AI tools never add Signed-off-by or Co-Authored-By. The human submitter owns and reviews the change.
check-commit-trailers.py enforces it by rejecting any Co-authored-by whose value matches an AI identity token (bot, agent, claude, codex, …).
GitHub adds a Co-authored-by line automatically on squash merge, naming the account that opened the pull request. Most PRs in this repository are opened by localai-bot or localai-org-maint-bot, so the line GitHub writes is:
Co-authored-by: localai-org-maint-bot <306269227+localai-org-maint-bot@users.noreply.github.com>
That trips the AI-identity rule, and the commit fails the gate. Real instance on main: f64f2b71. It was invisible until #406 fixed the parse, which is why it reads as a new failure and is not one.
Why the rule is catching the wrong thing
The rule exists so an AI cannot claim authorship of the code. That is a real concern and it stays.
But GitHub is not making an authorship claim. It is mechanically recording which account pressed the button, and that account has an audit trail. The honest statement about AI involvement is already carried, separately and explicitly, by:
AI-Assisted: true
Assisted-by: AGENT:claude-opus-5 [Claude Code]
Those are the trailers that make the claim. Co-authored-by added by the forge is attribution of a submitter, not a claim that a model wrote the change. Conflating the two means the gate reds main for correctly-authored work while the actual AI declaration sits right above it, unread.
Proposed change
Narrow, and keyed on something the forge controls rather than on trust:
- A
Co-authored-by whose address is a GitHub account noreply address (…@users.noreply.github.com) is accepted, even when the name matches an AI identity token. That is the form GitHub generates for the submitting account.
- Every other
Co-authored-by naming an AI identity stays forbidden — a hand-written Co-authored-by: Claude <claude@anthropic.com> still fails.
Signed-off-by is untouched: still forbidden for an AI identity, with no exemption. Sign-off is a legal assertion, not attribution.
AGENTS.md gains the distinction in the same change, so the prose and the checker say the same thing.
Scope
Requires a spec, a red-before test per case, and mutation evidence in tests/scripts/test_check_commit_trailers.py, per AGENTS.md §"Changing the rules or a checker". This loosens an attribution rule, so the guards matter more than the relaxation: the hand-written-AI-co-author case and the Signed-off-by case must both stay red, and be asserted to stay red.
Follow-up to #406, which fixed the trailer parse. This is the remaining rule problem it surfaced.
The situation
AGENTS.mdsays:check-commit-trailers.pyenforces it by rejecting anyCo-authored-bywhose value matches an AI identity token (bot,agent,claude,codex, …).GitHub adds a
Co-authored-byline automatically on squash merge, naming the account that opened the pull request. Most PRs in this repository are opened bylocalai-botorlocalai-org-maint-bot, so the line GitHub writes is:That trips the AI-identity rule, and the commit fails the gate. Real instance on
main:f64f2b71. It was invisible until #406 fixed the parse, which is why it reads as a new failure and is not one.Why the rule is catching the wrong thing
The rule exists so an AI cannot claim authorship of the code. That is a real concern and it stays.
But GitHub is not making an authorship claim. It is mechanically recording which account pressed the button, and that account has an audit trail. The honest statement about AI involvement is already carried, separately and explicitly, by:
Those are the trailers that make the claim.
Co-authored-byadded by the forge is attribution of a submitter, not a claim that a model wrote the change. Conflating the two means the gate redsmainfor correctly-authored work while the actual AI declaration sits right above it, unread.Proposed change
Narrow, and keyed on something the forge controls rather than on trust:
Co-authored-bywhose address is a GitHub account noreply address (…@users.noreply.github.com) is accepted, even when the name matches an AI identity token. That is the form GitHub generates for the submitting account.Co-authored-bynaming an AI identity stays forbidden — a hand-writtenCo-authored-by: Claude <claude@anthropic.com>still fails.Signed-off-byis untouched: still forbidden for an AI identity, with no exemption. Sign-off is a legal assertion, not attribution.AGENTS.mdgains the distinction in the same change, so the prose and the checker say the same thing.Scope
Requires a spec, a red-before test per case, and mutation evidence in
tests/scripts/test_check_commit_trailers.py, perAGENTS.md§"Changing the rules or a checker". This loosens an attribution rule, so the guards matter more than the relaxation: the hand-written-AI-co-author case and theSigned-off-bycase must both stay red, and be asserted to stay red.