this repository's own history publishes agent session identifiers, and nothing checks for it

[MongLong0214]

Three commits reachable from main carry a trailer naming an agent session:

X-Claude-Session: https://claude.ai/code/session_…

commit
fc1009b	docs: correct four factual defects in the README, and fix the hero SVG (#643)
97c6b45	spec: 서명 모드에 signer allowlist 요구를 정본에 반영 (#645)
8a49ddc	COMMITLORE_BIN carried none of the checks its sibling config key already had

No open branch carries one, and the merge that landed after this was found does not.

This is not a CommitLore defect

SPEC §3 is explicit about the slot:

| X-<Name>: | free text | yes | Organization extension — preserved, never interpreted by the core |

and §150 requires that every key be in §3 or match X-<Name>. So Claude-Session: is refused as unknown-key, and X-Claude-Session: is accepted — exactly as specified. The product did what it says it does; the extension slot did its job.

What is missing is a rule of this repository's own, about what belongs in a public commit history. Session identifiers are execution metadata: they say which agent run produced a change, which is an internal detail of how the work was done rather than a decision about the code. A public git history is a permanent, mirrored surface, and a decision record is the wrong place to file operational bookkeeping.

Why it cannot be cleaned up

main has allow_force_pushes=false, and rewriting shared history is not on the table regardless. These three are permanent. The only thing left to decide is whether there is a fourth.

Suggested acceptance

test/dogfood.test.ts already asserts that this repository obeys its own protocol against its real history. The same place can hold this:

• no commit reachable from main introduces a trailer whose key or value names an agent session, beyond an explicit baseline
• the baseline holds exactly the three commits above, listed by SHA, so the rule is enforceable today rather than after an impossible cleanup
• the failure message says which commit and which trailer, because the fix has to happen before the merge — afterwards there is no fix

A baseline is the honest shape here for the same reason dogfood-baseline.json exists: the repository cannot pass a rule retroactively, and pretending otherwise would mean either weakening the rule or never adopting it.

Where it came from

I merged two of the three today without reading the squash body. The third predates that. Recording it because the same omission produced a second defect in the same session — a commit subject that is the only non-English one in the last forty — and both were preventable by reading what was about to become public.

[MongLong0214]

Reproduced, and scoped

Scanning the last 400 commits on main for session identifiers in the message —
either an X-…Session: trailer or a session URL:

fc1009b  docs: correct four factual defects in the README
97c6b45  spec: 서명 모드에 signer allowlist 요구를 정본에 반영 (#645)

Two, both merged in one evening, both mine. main forbids force pushes, so the
history is permanent and the fix is prevention rather than repair.

Why the existing checks did not catch it

X-<Name> is the organization extension slot (SPEC §3), preserved verbatim by
design, and §150 accepts any key matching it. So X-Claude-Session: is a
valid record under the protocol — the schema is not the layer that should
refuse it, and teaching the schema to know about particular vendors would be
worse than the problem.

This is a repository policy: this project publishes its history, so agent
session identifiers do not belong in it. Another repository could reasonably
want the opposite.

Where the check belongs

.commitlore-policy.json is the repository-local mechanism that already exists
for this shape of rule. A deny-list of trailer keys, enforced at commit-msg,
refuses the trailer at the point where it can still be edited — before it is
permanent.

Two properties worth keeping when it is written:

• A pattern, not a vendor list. X-*Session* and a URL shape, so the next
  tool's identifier is caught without anyone updating a list. The failure mode
  of a vendor list is that it only ever catches yesterday's tool.
• The message says what to do. These trailers arrive from tooling the author
  did not type, so "remove X-Claude-Session:" has to name the line, not the
  rule.

Not fixing it in the current branch — it is unrelated to what that PR carries,
and bundling it would make the review harder rather than the cycle shorter.

[MongLong0214]

Closing with a decision: the exposure is not being reverted, and the recurrence
is being blocked.

What is exposed

Two commits on main of a public repository carry X-Claude-Session: trailers
with session URLs: fc1009b and 97c6b45.

Why the history is not being rewritten

1. It is public main. The commits are already in clones, forks and CI
   caches. Rewriting does not un-publish them; it only breaks everyone else's
   copy.
2. A session URL is not a credential. It opens only for the owning account,
   so what leaked is an identifier, not access.
3. The cost exceeds the benefit. Rewriting main immediately before a
   release is the class of decision that produced a green merge broke main and nothing noticed for two hours #665.

What is being done instead

Recurrence is blocked at commit-msg via .commitlore-policy.json, as a
pattern rather than a vendor list — X-*Session* and a session-URL shape — so
the next tool's identifier is caught without anyone maintaining a list. The
message names the offending line rather than the rule, because these trailers
arrive from tooling the author did not type.

That lands in the 0.9.0 bundle and belongs in the release notes.

Why the protocol did not stop it

X-<Name> is the organization extension slot (SPEC §3), preserved verbatim, and
§150 accepts anything matching it. X-Claude-Session: is a valid record. This is
a repository policy — this project publishes its history — not a schema defect,
and teaching the schema about particular vendors would be worse than the problem.

One thing I am not folding away

The trailers came from a harness, but I merged both commits, and the merge
procedure at the time did not include reading the assembled squash body. It does
now. Recording that here so the fix is not remembered as purely upstream.

[MongLong0214]

Rule settled, and where it has to live

Decision from the CTO: refuse session-link trailers in public repositories,
allow them in private ones. Not a blanket ban — the trailer has tracing value,
and only publication makes it a problem.

Recording the implementation constraints found while starting it, because they
change the shape.

The visibility flag cannot be discovered at commit time

Three options, and only one is observable:

• gh repo view --json visibility — puts a network call in commit-msg, on the
  path that must work offline and fast.
• Inferring from the remote URL — wrong for private GitHub repos, self-hosted
  hosts, and any repo with no remote yet.
• Declared in .commitlore-policy.json — observable, versionable, and wrong
  only if someone writes it wrong.

Third. And per the CTO: an absent declaration falls to refuse. The two
misjudgements are asymmetric — public-but-allowed is permanent exposure,
private-but-refused is an inconvenience. Same asymmetry that decided #638.

But the policy file is not currently committed

.commitlore-policy.json exists in this checkout and is untracked, and
src/core/capture-policy.ts is the only reader — it is capture configuration.
A visibility declaration that lives in an untracked file cannot govern a
repository: a fresh clone would have no declaration, fall to refuse, and every
contributor would hit it.

So this needs either the policy file committed with a public field, or the
declaration read from git config. That is a decision about what the file is,
not a detail of this check, and it is the next thing to settle.

Match on the value, not the key

Claude-Session: was refused by SPEC §3 and became X-Claude-Session:, which
the extension slot accepts. A key-name list would have been defeated by exactly
that rename, on the first try, by the person who wrote it. Match the value shape
(claude.ai/code/session_… and its analogues) so the next tool is caught without
anyone updating a list.