feat(gate): ADR-0074 materialization + no-coauthorship kombi (gitleaks value-rule + pytest commit-msg gate + auto-strip hook)

[FabioLeitao]

feat(gate): ADR-0074 materialization + no-coauthorship kombi (gitleaks value-rule + pytest commit-msg gate + auto-strip hook)

Summary

Materializes the phantom ADR-0074 (supply-chain Layer 1 — digest pins + Rust SCA), closing the dangling #987/#998 references, and ships a deterministic no-coauthorship kombi that was born during the ADR-0074 smoke-test. Cohesive PR: the gate is the mechanism the ADR-0074 smoke-test exercised.

Why these ship together

The ADR-0074 smoke-test (blind cursor-agent materializing the phantom) surfaced that Cursor injects Co-authored-by: Cursor into commits despite the "Commit Attribution" toggle being OFF — Anysphere's own position: "toggles are suggestions, not enforceable" (forum #161253; prior SEV-1). This repo therefore mechanically enforces what the vendor toggle won't (mechanism > trust).

What's in it

ADR-0074 — born Proposed, en_US, canonical sections, exact metadata (ADR-0045 §3/§5/§7). Resolves the #987/#998 dangling refs.

No-coauthorship kombi (defense-in-depth):

• tests/test_commit_no_tool_coauthorship.py — fail-closed pytest gate on commit messages (ANY Co-authored-by: fails; no human allowlist — a name is forgeable). Deterministic esporro lists the violated ADRs to re-read in full.
• .gitleaks.toml — no-coauthorship-at-all content rule (extend.useDefault=true preserves all default secret rules).
• .githooks/commit-msg + pre-commit commit-msg stage — auto-strips injected Co-authored-by: at commit time (defeats the broken toggle; the pytest gate is the LOUD backstop).
• Wired into pre-commit + CI (.github/workflows/ci.yml, gitleaks.yml now --config .gitleaks.toml).

Pre-existing FP hygiene (allowlist by VALUE, never by path):

• .gitleaks.toml regexes allowlist for the synthetic demo key (correct-key-12345) and the public GPG fingerprint (D6F81740…) — non-weakening (a new/real secret in the same files is still caught).
• core/demo/synthetic_corpus.py — source-fix of the synthetic placeholder (cosmetic).

Evidence preservation (history is never rewritten)

Commit b9ef0e14 (the smoke-test ADR-0074 commit) carries the injected Co-authored-by: Cursor and is intentionally preserved as evidence of the Cursor injection bug (for Anysphere/Anthropic analysis + transparency/dogfooding). The pytest gate exempts it by hash with a documented reason — a specific, sanctioned exception (not a weakening). No git reset/--amend/filter-repo.

RCA (ADR-0047)

Root cause of the co-author: vendor-side, non-enforced control (Cursor Commit-Attribution toggle inoperative). Fix is at the root the operator controls — the repo's own commit-msg hook + gate — not a symptom suppression.

Acceptance criteria

• ./scripts/check-all.sh green (pre-commit + 1600+ pytest + Bandit + Zizmor + Semgrep). ADR-0080.
• test_commit_no_tool_coauthorship passes (HEAD clean; b9ef0e1 exempted).
• test_gitleaks_config passes; gitleaks detect = no leaks.
• test_adr_governance_phase1 = 9 passed (ADR-0074 conformant: born-Proposed, en_US, H1, date).
• Auto-strip hook proven end-to-end (Cursor injected → hook stripped → HEAD 80620964 has zero Co-authored-by).
• Committed via git commit NORMAL — no --no-verify / commit-tree / bypass.
• docs/plans/PLAN_NO_COAUTHORSHIP_GATE.md + plans_hub_sync + PLANS_TODO entry.

Grounded in

ADR-0037 (self-audit governance) · 0045 (ADR metadata) · 0046 (operator intent) · 0047 (RCA-first) · 0049 (no brittle) · 0056 (no --no-verify bypass) · 0062 (agent containment) · 0071 (self-protecting gate) · 0079 (rigor canon) · 0080 (local gate inviolable). ADR-0074 lineage: #987/#997/#998.

🤖 Generated with Claude Code

[FabioLeitao]

🔔 @FabioLeitao — PR #1165 VERDE: 14/14 checks pass, 0 fails. Fix gitleaks wrong-key (FP sintetico) landou LIMPO (co-author=0). Kombi anti-co-author + ADR-0074 prontos. Falta so o teu selo (Gate-Change sig) pra mergear.

[FabioLeitao]

Gate-Close-Approved-By: @FabioLeitao (#1165) | ADR-0074 + kombi anti-co-author; b9ef0e1 preservado como evidencia (forum #161253) | 2026-07-04

-----BEGIN SSH SIGNATURE-----
U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgyEpOM79Y37xE8qOhlhghEfLh9P
TzRdk6n8nzLfBNGqwAAAAEZmlsZQAAAAAAAAAGc2hhNTEyAAAAUwAAAAtzc2gtZWQyNTUx
OQAAAECELbfFImzRhl9Ski63k4mH0c/MCAptwvbAZ1sXy8XdN1e87Y+iFGpR/xAOEYAWtP
vEstvI886Xq0MHJAgo+EgL
-----END SSH SIGNATURE-----

[FabioLeitao]

Gate-Close-Approved-By: @FabioLeitao (#1165) | ADR-0074 + kombi anti-co-author; b9ef0e1 preservado como evidencia (forum #161253) | head=d5493b4fc8b2bacbdacbbad950bb2ca17b634f5b | 2026-07-05

-----BEGIN SSH SIGNATURE-----
U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgyEpOM79Y37xE8qOhlhghEfLh9P
TzRdk6n8nzLfBNGqwAAAAEZmlsZQAAAAAAAAAGc2hhNTEyAAAAUwAAAAtzc2gtZWQyNTUx
OQAAAEDdTNGg1RC/tsDdGFBN2cxsHOoUWRVWXGC+kO3yuc2RP/PAygvmRLXRjm575H0hpo
quRspfC2cu8zkDLvGRGqAC
-----END SSH SIGNATURE-----