bug(ci): the harness instructs sessions to add a Co-authored-by trailer the project forbids and this gate rejects #17719

What

Four commits on main carry Co-authored-by: Claude <noreply@anthropic.com>:

1c00b680ef2eab32183fd1e3a7ef085d96172e34  fix(plugins)/docs(redis) ...
31a01bdb387f4aba774f8837761eeb90f1af1d5d
b0f3ac188c81f4462cd4df1b07d5d99a5a12b0cd
c9b412b4481c07cfaa3c0695ea24a5a44c17eee8

They blocked the v0.10.0 promotion (#17717) alongfive five unrelated identity-trailer commits, and they are not the same defect. A misconfigured user.name is an artefact claiming no attribution; Co-authored-by: Claude is a real attribution claim — the thing no-commit-trailers.yml (#13654) exists to reject. #17718 baselined the five and deliberately held these four for that reason.

The cause is a standing instruction, not a mistake

The agent harness tells each session, in its own system context, to append an attribution trailer to every commit it creates — Co-Authored-By: Claude …. The project's rules forbid commit trailers entirely (mrveiss is sole author) and this gate enforces that.

So a session that follows its harness instruction produces a commit this repository rejects, and a session that follows the project rule ignores its harness instruction. Both are "doing as told". The harness text does defer — it says a project's own instructions take precedence — but that deference is a sentence inside the same block as the instruction, and it is being missed.

This is why baselining these four would not have helped. The five identity trailers are bounded: the user.name override is gone, checked across every worktree config and the global, so no new ones are being minted. This class has no such closure — every future session is instructed to produce it. A baseline entry per instance is an unbounded list, and the file's own header forbids exactly that.

What makes it expensive

It is invisible until a release. no-commit-trailers.yml scans BASE..HEAD on pull_request, and a squash-created trailer does not exist in that range — so per-PR checks pass and only a promotion PR sees it. Nine commits accumulated before anyone noticed, across two unrelated causes, and the release was the thing that stopped.

Acceptance criteria

• Sessions do not append the attribution trailer to commits in this repository — by whatever mechanism reaches them reliably, not by each session remembering. A rule that is deferred-to inside the same text that states the instruction has already been shown not to reach every reader
• The four commits above are resolved by an explicit ruling — baselined as their own class with the reasoning written down, or accepted as permanently-red-at-promotion, not left implicit
• A check that a project-level no-trailers rule and a harness-level attribution instruction cannot both be satisfied is surfaced at commit time, not at promotion. The pre-commit hook chain already runs lint-conventions; this is the same class of check
• Whether Generated with [Claude Code] in PR bodies is in scope is decided — the gate's own comment mentions it, and PR bodies are not commits

Not claimed

I have not established whether any session is currently adding the trailer, or whether all four predate a correction. I checked the t identity source and found it closed; I did not run the equivalent check for this one, because "is any session currently instructed to do this" is not answerable from the repository.

Refs #17717
Refs #17718
Refs #13654