[dhpwd]

Implements DHP-41

What changed

PRs that a coding agent opens under its own identity now count for the person the agent names as co-author, instead of for the agent.

• Agent identity. An email, after .mailmap and ignoring case, that matches any GitHub App bot's no-reply address (<id>+<name>[bot]@users.noreply.github.com), or is one of three agent addresses that pattern misses: Copilot's coding agent and Cursor's two agent addresses. The pattern and list sit together at the top of src/scan.js
• Credit. A PR whose author is an agent counts for the first Co-authored-by: trailer whose identity, after .mailmap, isn't an agent. Squash PRs read the squash commit's message, and merge PRs the branch tip's. Trailers are read from any line, ignoring case, CRLF and surrounding whitespace. They need a name and an email. Only the first person counts, so --all-authors counts each PR once. Crediting runs before the author filter, so the filter, the no-match warning and the JSON all see the credited person
• Other bots. Dependency and automation bots match the same pattern, so a bot PR that names a person counts for them. That follows the groom decision and is in the spec's design decisions and known limits
• JSON. PR rows gain agent_email after author_email. It holds the agent's email whenever the git author is an agent, whether or not a person took the credit, and is null otherwise. Nothing in the repo reads it
• Warning. When the no-match warning lists a coding agent (the three addresses, or the Copilot, Devin, Cursor and Jules no-reply logins), it adds a hint on how to claim its PRs. Dependency bots never get the hint
• Docs. The spec (design decision, Detecting PRs rule and known limits, JSON, Repo warnings, budget, Verification), README note, .claude/CLAUDE.md (budget line, PR attribution as a design decision) and docs/patterns/git.md describe this as current state

Also on this branch, from review:

• Both check-mailmap calls now pass contacts on stdin through one helper (mapIdentities). With arguments, a repo with many distinct co-authors could pass the command-line limit, and git() throws on that, which would end the whole scan. That fix has no test, because the fixtures can't make a big enough message
• tests/fixtures.js gains a verbatim commit option, so a test can keep CRLF line endings

Git process budget

Throwaway GIT_TRACE count: two fixture repos, each with 15 agent squash PRs (with trailers), 15 human squash PRs, 15 agent merge PRs and 15 direct commits. Processes per repo:

Scan	log	check-mailmap	check-attr	config	for-each-ref
default author	2	2	1	1	1
--all-authors	2	1	1	0	1
--author other@…	2	2	1	0	1

That's the main log plus the branch-tip call, and at most two check-mailmap (the author filter's and the trailers'). Nothing runs per commit or per PR. The counted PRs (25 / 45 / 20) matched the fixture.

Verification

• npm test (124 pass) and npm run typecheck
• Each new test was checked by mutating the code it guards and watching it fail: trailer case, CRLF, agent-trailer skipping, the empty-email and no-name rules, .mailmap mapping by name and email, merge PRs reading the tip, the list addresses, and coding-agent-only hints
• The report code is unchanged, so the browser report check doesn't apply

Held findings

None of these gate release.

• No warning when agent PRs credit your no-reply address while your other PRs in the repo match. The hint's "pass --author with its email" also drops your own PRs elsewhere, since --author replaces the default filter. Both are decisions on settled warning behaviour – DHP-42
• An AI tool's own trailer (e.g. Claude <noreply@anthropic.com>) before the person's takes an agent PR's credit. Skipping it would reopen the groom's agent-identity scope, so it's recorded as a known limit – DHP-43
• Tip-only credit for merge PRs, backport bots counting for the original author, and ID-less bot addresses: these follow the ticket's settled rules. The first two are now in the spec's known limits
• No version bump: settled at groom (0.x until DHP-34)
• agent_email set on the failed-tip fallback when the merge commit's author is an agent: this matches the field's definition, so no change
• No warning when the trailer check-mailmap fails, and the per-entry comments on AGENT_EMAILS: both are as the ticket specifies
• copilot-swe-agent[bot] in the coding-agent list never matches a known address: the ticket lists it, and it does no harm
• Direct commits by agents aren't credited to a co-author: direct commits are out of scope
• A credited PR takes the trailer's name, so one email can show two names and a name-only --author can miss it. This follows the ticket's mapped-name rule, as for squash merges recorded under another name
• A \x1f inside a tip message cuts it short, the same assumption LOG_FORMAT makes

Review

Cubic didn't review this branch. It isn't installed on this repo: none of PRs #1–#8 has a cubic review or check run, and #9 has none either. The branch had a structural review (spec and conventions) and a local /code-review at xhigh, and their findings were applied or triaged above.

Release readiness

Nothing beyond merging blocks release. The scan JSON gains agent_email, which nothing in the repo reads. No follow-on actions.

🤖 Generated with Claude Code