Trailer verification not enforced: 51% of production commits missing required agent trailers; format drift; direct push to beta

[steilerDev]

Severity: High — found during a deep project review (2026-07-06) of the last 60 commits on beta (52 non-merge; 35 touch production paths).

1. Trailer verification is not being enforced — 51% violation rate, trending worse

18 of 35 production-touching commits are missing at least one required agent trailer; 8 have zero agent trailers — including the two most recent feature commits:

SHA	Production paths	Missing trailer(s)	Present
df3c122a (#1797, 45 files)	backend, frontend, translator, e2e	all four	none
3a849616 (#1786)	backend, frontend, translator, e2e	all four	none
38ab2b0b (#1739), 6eea9b34 (#1703/04)	frontend, e2e	both	none
131610f6 (#1780)	frontend	frontend-developer	3× generic "Claude Sonnet 4.6" (no agent name)
5cab9256 (#1775), 39739776 (#1774), 4b5b90e8 (#1773), 9b4ce24d (#1768), d514645f (#1724)	backend/frontend/translator	dev trailers	dev-team-lead only — contradicts "dev-team-lead never modifies production files"
c17141f5 (#1757), 7b8ae38e (#1755)	e2e	e2e-test-engineer	qa-integration-tester (wrong agent)
94568637 (#1747)	backend, frontend, translator, e2e	frontend, translator, e2e	backend-developer only
a4fc9ba5 (#1742)	frontend, e2e	e2e-test-engineer	frontend-developer only
b3bf3722, b8d653b1, 88748bbf, 05e720df (style bot)	frontend (+e2e)	all	none

Likely mechanism: squash-merge drops trailers that existed on feature-branch commits — the squash body isn't being rebuilt with the union of trailers.

2. Trailer format drift — 8+ variants

Mandated: Co-Authored-By: Claude <agent-name> (<model>) <noreply@anthropic.com>. Observed: bare-model trailers with no agent name (Claude Opus 4.8 ×6, Claude Sonnet 4.6 ×7, Claude Opus 4.8 (1M context) ×2, Claude Opus 4.6 ×1); literal escaped angle brackets (Claude <product-architect> ×2); Co-authored-by vs Co-Authored-By casing (~40% lowercase); 3 spellings of the same model.

3. Related process violations

• Direct push to protected beta: 2b3579be sits on beta's first-parent history with no PR (its near-identical successor cf4244e3 then landed properly via PR fix(e2e): update diary-r2-uat Scenario 2 for manual-default diary filter #1792). c5a7c19e and 7f518f9e also lack any PR of their own.
• 3 of 29 feat/fix commits have neither Fixes #N nor a PR-suffix.

Suggested fixes

1. Rebuild the squash-commit body with the union of feature-branch trailers at merge time (the /develop step 6h verification should run against the squash result, not the branch commits).
2. Root-cause note: the trailer rules also have a spec gap for QA-authored co-located tests (see the skills-defects issue) — some "wrong agent" trailers above are that gap, not sloppiness.
3. Consider a CI check that validates trailer presence/format on production-path commits.

[steilerDev]

[orchestrator] Resolved in PR #1852 (squash-merged to beta). Investigation found THREE failure modes, partially overturning the issue's hypothesis: (1) commit-time omission — dev-team-lead trusted the orchestrator's contributing-agents list; its [MODE: commit] now self-derives the required trailer set from the staged diff; (2) true squash-body loss on single-commit PRs — all squash-merging skills now rebuild the merge body explicitly with the case-normalized trailer union (canonical pattern documented in CLAUDE.md); (3) format drift via fix-e2e's direct-commit path — now uses the canonical table string. New scripts/check-trailers.sh is the single source of truth, wired both into /develop step 6h and a new REQUIRED CI trailer-check job (skips for Dependabot/human/non-production PRs). Verified live against known-good and known-bad historical commits. Historical violations are noted in the issue as the record — history is not rewritten. Follow-up: env-intermediary fix for the pre-existing base_ref interpolation pattern in ci.yml (2 occurrences). Will reach main with the next beta promotion.

[github-actions]

🎉 This issue has been resolved in version 2.13.0-beta.21 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀