[kpcyrd]

Related to #278

[Copilot]

🟡 Changes recommended

The check misses contributor commits and other AI identities, and inspection failures incorrectly report success.

3 open issues

• Shallow checkout misses contributor commits during attribution checks · New
• Pipeline ignores inspection failures and reports success · New
• Attribution matcher accepts unsupported AI identities · New

What changed in this PR

Adds an automated authorship check to support the human-only attribution policy introduced in #278.

Changes:

• Adds a pull-request workflow for checking authorship metadata.
• Adds a script that scans author, committer, and co-author fields for a Claude/Anthropic signature.

File	Description
contrib/​ai-policy.sh	Scans commit metadata and reports prohibited attribution.
.github/​workflows/​ai-policy.yml	Runs the authorship check on pull requests.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The attribution filter accepts explicit AI co-author credits that the check is intended to reject.

3 open issues

• Reject all configured AI co-author identities and emails · New
• Pipeline ignores inspection failures and reports success
• Attribution matcher accepts unsupported AI identities

1 resolved since last review

• Shallow checkout misses contributor commits during attribution checks

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The check can reject compliant contributions because it scans accepted history and treats quoted examples as attribution.

5 open issues

• Reject all configured AI co-author identities and emails
• Pipeline ignores inspection failures and reports success
• Restrict attribution checks to commits introduced by the PR · New
• Parse co-author trailers instead of scanning full commit messages · New
• Attribution matcher accepts unsupported AI identities

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The identity matcher allows Copilot co-authorship while reporting a successful human-only attribution check.

6 open issues

• Reject all configured AI co-author identities and emails
• Pipeline ignores inspection failures and reports success
• Copilot co-author attribution bypasses human-only check · New
• Parse co-author trailers instead of scanning full commit messages
• Restrict attribution checks to commits introduced by the PR
• Attribution matcher accepts unsupported AI identities

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No blocking issues remain in the final review.

1 open issue

• Copilot co-author attribution bypasses human-only check

5 resolved since last review

• Reject all configured AI co-author identities and emails
• Pipeline ignores inspection failures and reports success
• Parse co-author trailers instead of scanning full commit messages
• Restrict attribution checks to commits introduced by the PR
• Attribution matcher accepts unsupported AI identities

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unescaped domain patterns can reject legitimate human attribution and need literal-dot escaping.

1 open issue

• Escape dots in domain regexes to prevent false positives · New

1 resolved since last review

• Copilot co-author attribution bypasses human-only check

_{Review effort: Balanced}