chore: drop the co-author trailer gate, keep harvested credit

The Lint job ran scripts/check-coauthor-trailers.py on every commit range and
rejected any Co-authored-by trailer that was not a human in .github/AUTHOR_MAP
or one of two hardcoded agent identities. In practice it rejected ordinary
agent commits -- the default trailer most tools append fails it -- so every
contributor and every agent had to learn a rule that bought tidiness and
nothing else.

Removed: the 46-line "Check harvested contributor credit" step in ci.yml, the
checker, its test, and its five fixtures. Also the stale mention in the
light-change path filter.

Kept, deliberately: harvested contributor credit. auto-close-harvested.yml is
independent of the deleted script -- it reads "Harvested from PR #N by @handle"
from the commit message -- so a contributor's PR still closes with credit when
their work lands, and .github/AUTHOR_MAP remains the canonical human identity
list. The rule that survives is "name the humans who did the work". The rule
that goes is "no tool may appear in a trailer".

The two skills that called the checker now read trailers with git log directly.
CONTRIBUTING.md and AGENTS.md say what is true now instead of describing a gate
that no longer exists.

actionlint is clean on the edited workflow.

Signed-off-by: CodeWhale Bot <bot@codewhale.net>

Author: CodeWhale Bot

.github/workflows/ci.yml

@@ -137,13 +137,13 @@ jobs:
             # arm (fail-safe default-heavy). Light-classified scripts below
             # are exercised by ALWAYS-on jobs/steps that run regardless of
             # `heavy` (check-versions.sh / check-ohos-deps.sh via Version
-            # drift, check-coauthor-trailers.py via Lint, dev-cache/dev-test
+            # drift, dev-cache/dev-test
             # self-checks via Version drift), so no coverage is lost.
             case "${path}" in
               scripts/release/npm-wrapper-smoke.js|scripts/mobile-smoke.sh|scripts/check-provider-registry.py)
                 heavy=true
                 ;;
-              docs/*|*.md|packaging/aur/*|.github/PULL_REQUEST_TEMPLATE.md|.github/ISSUE_TEMPLATE/*|.github/scripts/agent-task-metadata.test.sh|.github/workflows/agent-task-labels.yml|.github/workflows/auto-tag.yml|.github/workflows/stale.yml|.github/workflows/triage.yml|scripts/release/check-versions.sh|scripts/release/check-ohos-deps.sh|scripts/release/install-dogfood.sh|scripts/release/install-dogfood.test.sh|scripts/release/prepare-release.sh|scripts/release/prepare-release.test.sh|scripts/check-coauthor-trailers.py|scripts/dev-cache.sh|scripts/dev-cache.test.sh|scripts/dev-cargo.sh|scripts/dev-test.sh)
+              docs/*|*.md|packaging/aur/*|.github/PULL_REQUEST_TEMPLATE.md|.github/ISSUE_TEMPLATE/*|.github/scripts/agent-task-metadata.test.sh|.github/workflows/agent-task-labels.yml|.github/workflows/auto-tag.yml|.github/workflows/stale.yml|.github/workflows/triage.yml|scripts/release/check-versions.sh|scripts/release/check-ohos-deps.sh|scripts/release/install-dogfood.sh|scripts/release/install-dogfood.test.sh|scripts/release/prepare-release.sh|scripts/release/prepare-release.test.sh|scripts/dev-cache.sh|scripts/dev-cache.test.sh|scripts/dev-cargo.sh|scripts/dev-test.sh)
                 ;;
               *)
                 heavy=true
@@ -430,52 +430,6 @@ jobs:
       - name: Check website locale dictionary parity
         if: github.event_name != 'schedule'
         run: node web/scripts/check-locales.mjs
-      - name: Check harvested contributor credit
-        if: github.event_name != 'schedule'
-        shell: bash
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          PR_MERGE_SHA: ${{ github.sha }}
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          set -euo pipefail
-          python3 scripts/test_check_coauthor_trailers.py
-          if [[ "${EVENT_NAME}" == "pull_request" ]]; then
-            # Pull-request base.sha can lag the merge ref's actual base parent.
-            # Comparing it to the synthetic merge checkout therefore
-            # rechecks unrelated commits that landed on the base after the PR
-            # opened. Use the merge ref's immutable parents: the base snapshot
-            # used to synthesize it and the exact PR head, while excluding the
-            # synthetic merge itself.
-            if [[ "$(git rev-parse HEAD)" != "${PR_MERGE_SHA}" ]]; then
-              echo "::error::credit check is not running at the event merge SHA" >&2
-              exit 1
-            fi
-            read -r BASE_PARENT HEAD_PARENT EXTRA_PARENT < <(
-              git show -s --format='%P' "${PR_MERGE_SHA}"
-            )
-            if [[ -z "${BASE_PARENT}" || -z "${HEAD_PARENT}" || -n "${EXTRA_PARENT}" ]]; then
-              echo "::error::pull-request merge ref must have exactly two parents" >&2
-              exit 1
-            fi
-            if [[ "${HEAD_PARENT}" != "${PR_HEAD_SHA}" ]]; then
-              echo "::error::merge ref head parent does not match the event PR head" >&2
-              exit 1
-            fi
-            RANGE="${BASE_PARENT}..${HEAD_PARENT}"
-            if [[ -z "$(git rev-list -1 "${RANGE}")" ]]; then
-              echo "::error::pull-request credit range is empty" >&2
-              exit 1
-            fi
-          elif [[ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]]; then
-            RANGE="${{ github.event.before }}..${{ github.sha }}"
-          else
-            RANGE="HEAD~1..HEAD"
-          fi
-          python3 scripts/check-coauthor-trailers.py \
-            --author-map .github/AUTHOR_MAP \
-            --range "$RANGE" \
-            --check-authors
       - name: Skip Rust lint for light change
         if: needs.changes.outputs.heavy != 'true'
         run: echo "No executable Rust changes detected; preserving required Lint context."

AGENTS.md

@@ -150,10 +150,19 @@ Report commands actually run and distinguish source, local tests, packaged
 artifacts, CI, and public release state. Describe the evidence actually needed
 for the claim; a test count is not a proxy for product quality.
 
-Community reports, PRs, logs, and reviews are evidence. Canonical human
-identities come from `.github/AUTHOR_MAP`; `Co-authored-by` credit is for
-humans and for recognized agent contributors (the exact identities listed in
-`AGENT_CONTRIBUTOR_IDENTITIES` in `scripts/check-coauthor-trailers.py`, such as
-`Codewhale Agent`); unknown bot/tool trailers are still rejected.
+Community reports, PRs, logs, and reviews are evidence.
+
+**Harvested contributor credit is still a rule.** When a contributor's work
+lands as our commit, that commit carries `Harvested from PR #N by @handle` and a
+`Co-authored-by` naming them at their GitHub-linked address, so
+`auto-close-harvested.yml` closes their PR with credit and the contribution
+graph reflects reality. Canonical human identities come from
+`.github/AUTHOR_MAP`.
+
+**Whether a bot or agent also appears in a trailer no longer matters.** The CI
+check that policed trailer identities was removed: it rejected ordinary agent
+commits and cost more than the tidiness it bought. Give humans their credit; do
+not spend time scrubbing tool trailers.
+
 Leave unrelated work intact and keep new enforcement dry-run unless explicitly
 approved.

CONTRIBUTING.md

@@ -188,12 +188,11 @@ Use clear, descriptive commit messages following conventional commits:
 
 Example: `feat: add doctor subcommand for system diagnostics`
 
-**Do not leave AI-assistant co-author trailers on your commits.** Using an
-assistant is welcome and needs no disclosure, but many tools append something
-like `Co-authored-by: Claude <noreply@anthropic.com>` automatically, and the
-`Lint` job rejects it — `scripts/check-coauthor-trailers.py` requires
-contributor trailers to name humans, because those trailers feed the GitHub
-contribution graph. If CI fails on this, drop the line and force-push:
+**AI-assistant co-author trailers are fine.** Using an assistant is welcome and
+needs no disclosure, and CI no longer rejects an auto-appended
+`Co-authored-by: <some tool>` line. What we do care about is that the humans who
+did the work are named — `Co-authored-by` feeds the GitHub contribution graph.
+Remove an auto-appended line only if you want to:
 
 ```bash
 git rebase -i origin/main   # reword each commit, delete the Co-authored-by line

docs/skills/gh-credit-harvest/SKILL.md

@@ -50,7 +50,7 @@ this skill lands a credited commit and posts thanks; the workflow closes the PR.
    ```bash
    cargo fmt --all
    cargo test -p <crate>            # the crate(s) the PR touched, not the whole workspace
-   python3 scripts/check-coauthor-trailers.py --author-map .github/AUTHOR_MAP --range HEAD~1..HEAD --check-authors
+   git log -1 --format='%an <%ae>%n%(trailers:key=Co-authored-by)'  # credit the human, from .github/AUTHOR_MAP
    ```
 7. Post a brief, warm, specific thank-you on the PR — name what the change fixed, no drama. Leave the PR open; the workflow closes it with credit when the commit lands on `main`:
    ```bash

docs/skills/gh-treasure-hunt/SKILL.md

@@ -69,7 +69,7 @@ alone, and never merge/close/tag without Hunter's approval.
    The `Harvested from PR #N by @handle` line lets `auto-close-harvested.yml`
    close the PR with credit once the commit reaches `main`. Validate trailers:
    ```bash
-   python3 scripts/check-coauthor-trailers.py --author-map .github/AUTHOR_MAP --range BASE..HEAD --check-authors
+   git log BASE..HEAD --format='%h %an <%ae>%n%(trailers:key=Co-authored-by)'  # credit the human, from .github/AUTHOR_MAP
    ```
 8. Sanity-check anything you would actually land locally before recommending it:
    ```bash