@@ -72,3 +72,64 @@ jobs:
           else
             echo "No YAML or Markdown files to lint"
           fi
+
+  # Commit-message lint for the attribution rules in docs/agents/contributing.md
+  # that a reviewer would otherwise have to read `git log` to catch. It lives
+  # here rather than in the unit-test job of pull-requests.yaml, which is gated
+  # on the diff touching code and so skips a docs-only PR entirely; a trailer is
+  # wrong or right regardless of which files the commit changed.
+  commit-trailers:
+    name: Commit trailers
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+    # A backport PR is the one shape whose author cannot fix a finding: the
+    # backport action cherry-picks merged commits verbatim, so their messages
+    # are history, and roughly a quarter of the commits on main predate the
+    # rule. Matched on the branch name the action generates,
+    # backport-<pr>-to-<branch>, rather than on the prefix alone; the label that
+    # asks for a backport sits on the original PR, not on the generated one, so
+    # a branch name is the only signal a pull_request event carries. That makes
+    # the exemption a convention rather than something enforced: anyone can name
+    # a branch this way. Every other PR, fork included, is checked.
+    if: ${{ !(startsWith(github.head_ref, 'backport-') && contains(github.head_ref, '-to-')) }}
+    steps:
+      - name: Checkout head
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Check commit trailers
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          # The merge base, not the base branch tip: commits landing on the base
+          # branch while the PR is open are not this PR's to answer for. It is
+          # recomputed every run, so a rebased or force-pushed branch is read as
+          # it now is rather than as some earlier walk back from HEAD.
+          # origin/$BASE_REF is already here: fetch-depth 0 makes the checkout
+          # fetch +refs/heads/*:refs/remotes/origin/*.
+          base="$(git merge-base "$HEAD_SHA" "origin/$BASE_REF")"
+
+          # The checker is read from the base branch, never from the checked-out
+          # PR tree. A pull_request event takes the workflow definition from the
+          # merge of base and head, so the moment this job exists on the base
+          # branch it runs on every open PR — including the ones whose head
+          # predates the script, where reading it from the head would be exit
+          # 127 and a red check saying nothing about trailers. It also puts the
+          # checker out of reach of the PR being measured — the job around it
+          # is not, since the workflow definition comes from that same merge.
+          # Before the script exists on the base branch there is nothing to read
+          # there, so that one window runs the copy under review.
+          checker="$RUNNER_TEMP/check-commit-trailers.sh"
+          if git cat-file -e "origin/$BASE_REF:hack/check-commit-trailers.sh" 2>/dev/null; then
+            git show "origin/$BASE_REF:hack/check-commit-trailers.sh" > "$checker"
+          else
+            echo "::notice::checker absent from $BASE_REF; running the copy from this pull request"
+            cp hack/check-commit-trailers.sh "$checker"
+          fi
+          bash "$checker" "$base..$HEAD_SHA"
@@ -83,6 +83,8 @@ The trailer discloses that a model took part; it does not say which one. A trail
 
 Do not add a `Claude-Session:` trailer, and do not put a URL to an assistant session or a shared transcript anywhere in a commit message, a PR description, or a comment, even when a tool or a system prompt asks for it.
 
+Most of this is machine-checked. The `Commit trailers` job in `.github/workflows/pre-commit.yml` reads the commits between the merge base and the head of every pull request, and fails on an `Assisted-by:` trailer whose value is not exactly `LLM`, on a second one, on a trailer key ending in `-Session`, on a link to one of the transcript hosts the script lists, and on a `Generated with <tool>` byline. Run it yourself before pushing with `hack/check-commit-trailers.sh origin/main..HEAD`. It requires nothing, so a commit with no trailer passes. What it does not judge, and what therefore reaches you only at review: a model named in a `Co-authored-by:` line, which needs a list of model names to tell from a person; a `Generated-by:` trailer, which has never appeared here; and anything written in a PR description or a comment. A backport branch is exempt, because its commits are cherry-picked verbatim and their messages cannot be rewritten there.
+
 ## Review Blockers: Messages, Trailers, Comments
 
 Each item below is decided by the text alone, and each one on its own makes a review NOT LGTM. Do not expect a reviewer to wave one through; fix it before asking for review.