Run 20260903T194455Z-140c59 against pmorissette/ffn was exported and published with the operator's personal email address as the commit author. It was a local git config mistake, discovered only after the pull request was open, and fixing it required asking the maintainer to rewrite the author and force-push a green branch (he did, promptly — but that is a cost a maintainer should never have to pay for a harness-detectable mistake).
What happened, in order:
- The run finished and
export-patch produced the patch package. Nothing in it looks at commit authorship.
- The branch was pushed with the personal email as author of the commit.
- The pull request was filed. The problem surfaced while writing the submission follow-up, by reading the commit on GitHub.
- The operator asked the maintainer to rewrite the author before merge. The rewrite landed as
7cc05ab and the personal email never entered upstream history — but only because the maintainer cooperated and the branch was worth the force-push.
prepare-submission already reads the diff for hygiene findings a maintainer would see first. Author identity is exactly that class of problem: it says something about the submission, not the code, and a maintainer sees it immediately. The gate that catches it should live there, next to the whitespace checks:
- Record the author name and email of every commit the run would publish.
- Refuse, or record as a finding, when an author email is not the one the operator has designated for public work. Which address that is — the account's noreply address, a project alias — is the operator's to configure; the harness's job is to compare against something instead of publishing whatever the local
git config happens to hold.
- The same check applies to the committer field, and to any co-author trailer in the message.
Evidence: ffn #330 carried the commit as fa60886 before the rewrite; what merged is 7cc05ab with the author wolfgang-aura <169568318+wolfgang-aura@users.noreply.github.com>. The full path is recorded in docs/runs/0009-ffn-330-first-merge.md.
Run
20260903T194455Z-140c59againstpmorissette/ffnwas exported and published with the operator's personal email address as the commit author. It was a localgit configmistake, discovered only after the pull request was open, and fixing it required asking the maintainer to rewrite the author and force-push a green branch (he did, promptly — but that is a cost a maintainer should never have to pay for a harness-detectable mistake).What happened, in order:
export-patchproduced the patch package. Nothing in it looks at commit authorship.7cc05aband the personal email never entered upstream history — but only because the maintainer cooperated and the branch was worth the force-push.prepare-submissionalready reads the diff for hygiene findings a maintainer would see first. Author identity is exactly that class of problem: it says something about the submission, not the code, and a maintainer sees it immediately. The gate that catches it should live there, next to the whitespace checks:git confighappens to hold.Evidence: ffn #330 carried the commit as
fa60886before the rewrite; what merged is7cc05abwith the authorwolfgang-aura <169568318+wolfgang-aura@users.noreply.github.com>. The full path is recorded indocs/runs/0009-ffn-330-first-merge.md.