feat(factory): source-standards model refuses AI attribution in commits and PR text

beddari commented

2026-09-18 08:20:52 +00:00

Owner

Outcome

Nothing published as the author carries AI attribution: no Co-Authored-By naming an agent or a model, no "generated with" footer, in commit messages or in pull request titles and bodies, whatever the agent's harness asks.

The rule is in the source-standards skill. The program enforces it, with capability and policy on different models:

@swamp/git gains commit_messages (extensions/models/git_commit_messages.ts): the commits in base..head with their full messages. A fact about the repository, no rule; upstream log has subjects only and no range.
@dataverket/source-standards (extensions/models/source_standards.ts, one instance source-standards, no credentials) is the program's counterpart of the skill: commits over that data, text over a PR title and body, each recorded before failing. fabrikk-attest runs commit_messages then commits before signing, so a tainted branch is never attested. The pull-request stage runs text before pr_ensure sends the PR; this PR's text went through it.
validate-attestation adds checks 5 and 6: the same grep over the branch's commits, and over the PR title and body from the event, read through the environment and never interpolated into the script.

One pattern, in source_standards.ts, copied literally into CI. A test pins the copy and proves the model over git's data and the shell recipe agree on a real repository.

The other extensions were reviewed for the same smell, policy inside a wrapper of an external system, and are clean: paths_digest, the Flux reset, and every forgejo method are capability with the rule as an argument; the fabrikk-owned types carry policy by design.

Protected paths

.agents/skills/adversary-source-standards/SKILL.md, .forgejo/workflows/validate-attestation.yaml, extensions/, models/, workflows/. No ADR: factory machinery, no new dependency.

Verified

29 extension tests pass, including the recipe agreement on a real repository and the CI pattern pin.
fabrikk-attest validates (24 checks); the definition validates (13 stages); docs-check passes.
source-standards text refuses a body with the footer and passes a clean one; commit_messages then commits ran over seven real commits of main.

## Outcome Nothing published as the author carries AI attribution: no `Co-Authored-By` naming an agent or a model, no "generated with" footer, in commit messages or in pull request titles and bodies, whatever the agent's harness asks. The rule is in the source-standards skill. The program enforces it, with capability and policy on different models: - **`@swamp/git` gains `commit_messages`** (`extensions/models/git_commit_messages.ts`): the commits in `base..head` with their full messages. A fact about the repository, no rule; upstream `log` has subjects only and no range. - **`@dataverket/source-standards`** (`extensions/models/source_standards.ts`, one instance `source-standards`, no credentials) is the program's counterpart of the skill: `commits` over that data, `text` over a PR title and body, each recorded before failing. `fabrikk-attest` runs `commit_messages` then `commits` before signing, so a tainted branch is never attested. The `pull-request` stage runs `text` before `pr_ensure` sends the PR; this PR's text went through it. - **`validate-attestation` adds checks 5 and 6**: the same grep over the branch's commits, and over the PR title and body from the event, read through the environment and never interpolated into the script. One pattern, in `source_standards.ts`, copied literally into CI. A test pins the copy and proves the model over git's data and the shell recipe agree on a real repository. The other extensions were reviewed for the same smell, policy inside a wrapper of an external system, and are clean: `paths_digest`, the Flux `reset`, and every forgejo method are capability with the rule as an argument; the fabrikk-owned types carry policy by design. ## Protected paths `.agents/skills/adversary-source-standards/SKILL.md`, `.forgejo/workflows/validate-attestation.yaml`, `extensions/`, `models/`, `workflows/`. No ADR: factory machinery, no new dependency. ## Verified - 29 extension tests pass, including the recipe agreement on a real repository and the CI pattern pin. - `fabrikk-attest` validates (24 checks); the definition validates (13 stages); docs-check passes. - `source-standards text` refuses a body with the footer and passes a clean one; `commit_messages` then `commits` ran over seven real commits of `main`.

beddari added 1 commit

2026-09-18 08:20:52 +00:00

feat(factory): source-standards model refuses AI attribution in commits and PR text

validate-attestation / validate (pull_request) Failing after 2m52s

Details

86505a4439

Nothing published as the author carries a Co-Authored-By naming an agent
or a "generated with" footer. The rule goes into the source-standards
skill; the program enforces it, with capability and policy on different
models:

- @swamp/git gains commit_messages (extensions/models/git_commit_messages.ts):
  the commits in base..head with full messages, a fact and no rule;
  upstream log has subjects only and no range.
- @dataverket/source-standards (extensions/models/source_standards.ts, one
  instance, no credentials) is the program's counterpart of the skill:
  `commits` over that data, `text` over a PR title and body, each recorded
  before failing. fabrikk-attest runs commit_messages then commits before
  signing; the pull-request stage runs text before pr_ensure sends the PR.
- validate-attestation adds checks 5 and 6: the same grep over the
  branch's commits, and over the PR title and body from the event, passed
  through the environment.

One pattern, in source_standards.ts, copied literally into CI; a test pins
the copy and proves the model over git's data and the shell recipe agree
on a real repository. Docs, code map, and README follow.

beddari added 2 commits

2026-09-18 09:00:56 +00:00

refactor(factory): check commit messages at verify preflight, not at attest eac53aa56f

A tainted trailer found at attesting sent the work item back through
implementing, both test tiers, and a full review round for a reword.
fabrikk-verify's preflight already refuses a dirty tree and a moved HEAD;
the source-standards `commits` check joins it there, before the stack
comes up. Attest need not repeat it: it refuses unless the verify record
concerns headSha, and base..headSha at verify covers what attest would
see at the same commit. CI check 5 stays as the independent recheck.
Docs, skill, and the factory's stage description follow.

refactor(factory): PR text is an instruction to the agent, not a method

validate-attestation / validate (pull_request) Failing after 2m50s

Details

bb13f6b725

Only the title reaches main, in Forgejo's merge commit, and CI check 6
already reads title and body from the event. A method run before
pr_ensure bought nothing the pull-request prompt and the skill do not
already say. Drop `text` from the source-standards model and its tests;
the prompt keeps one clause at the point of action. `commits` stays.

beddari added 1 commit

2026-09-18 09:04:35 +00:00

chore(claude): turn the harness's AI attribution off at the source

validate-attestation / validate (pull_request) Failing after 2m58s

Details

5318e301e0

A committed .claude/settings.json sets attribution.commit and .pr to
empty, so Claude Code offers no Co-Authored-By trailer or "generated
with" footer to begin with. Prevention only: the source-standards check
at verify preflight and CI check 5 stay the trust. swamp's own repo
commits a settings.json too, but leaves attribution on.

beddari added 1 commit

2026-09-18 09:09:20 +00:00

Merge branch 'main' into attribution-check

validate-attestation / validate (pull_request) Failing after 2m48s

Details

304491dca1

beddari merged commit 345ea641f9 into main

2026-09-18 09:09:33 +00:00

beddari deleted branch attribution-check

2026-09-18 09:09:33 +00:00

beddari referenced this pull request from a commit

2026-09-18 09:09:35 +00:00