[kinqsradio]

Change

AI attribution trailers reached engine main through squash bodies, so orbyn.dev gets a guard. AI use is disclosed in the pull request body only.

• scripts/check-commit-messages.mjs <base> <head> fails when a commit in the range has:
  • a Co-Authored-By: line naming an AI tool (Claude, Anthropic, OpenAI, Codex, Copilot, Cursor, Codebuff and others) or one of their addresses;
  • "Generated with", or "Generated by" an AI tool;
  • a line that starts with the robot emoji.
    A co-author who is a person passes, and so does prose that only mentions a tool.
• A new CI job, "No AI attribution trailers", runs it on pull requests with the full history and the PR's base and head commits. "CI result", the check main already requires, now needs it, so no protection change is made. On pushes to main the job is skipped, and "CI result" accepts that.
• CONTRIBUTING and AGENTS say the same: no trailers, and write your own squash message when merging.

Audit of what is already here

• main from feat: orbyn.dev as the Orbyn product line home #264 on (every commit merged since the old app was removed): no trailers.
• The 10 leftover branches on origin: none of their commits has one. There are no open pull requests.
• The old app's history before feat: orbyn.dev as the Orbyn product line home #264 has 359 commits with trailers (Claude, Codex and Codebuff). I did not rewrite it.

Checks

• node --test scripts/check-commit-messages.test.mjs: 4 tests, including one against a real temporary repository. It is also the first step of the new job.
• The matching rules run over all 1,747 commit messages on main: they flag exactly the 359 that contain a trailer-like phrase, with no misses and no extras.
• node scripts/check-commit-messages.mjs over 86a59f7a..origin/main passes.
• Not verifiable before merge: that the job fails on a bad commit in CI. I'll prove that on a throwaway pull request and close it.

Risk and undo

• A commit that quotes a banned phrase in a message, for example "Generated with" in an unrelated sentence, fails until it is reworded. That is the intended strictness.
• The check cannot see the squash message GitHub writes at merge time, because it does not exist while the PR is open. Whoever merges writes the body.
• Revert the PR to remove the job.

AI usage

Claude Code with Claude Sonnet 5.5 (claude-sonnet-5-5) wrote the script, tests and workflow change at Products Research's request. No external sources.