From 972bf54be289831a0be9e2bb84e9f9867df669f1 Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 16:25:13 +0200
Subject: [PATCH 1/6] eval: preserve host commit identity in materializers

agent-session-id: dev3.dotfiles-cos-misc-st2-resource-design
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.local/state/agent-session-recovery/2026-07-29-pty-st2-cutover/runtime-profile/profile-without-null-opencode.json
agent-skills-manifest: /nix/store/kx5j47nghj1yps2v693ryb6wnf1c2xhb-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@16a22c6
---
 cells/signal-rename-codex/fixture/materialize.sh | 2 +-
 cells/signal-rename-codex/judges/isolation.sh    | 1 -
 cells/signal-rename/fixture/materialize.sh       | 2 +-
 cells/signal-rename/judges/isolation.sh          | 1 -
 4 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/cells/signal-rename-codex/fixture/materialize.sh b/cells/signal-rename-codex/fixture/materialize.sh
index 9c738e23..70b3160d 100755
--- a/cells/signal-rename-codex/fixture/materialize.sh
+++ b/cells/signal-rename-codex/fixture/materialize.sh
@@ -58,7 +58,7 @@ GI
 echo "== git init seed + bare origin =="
 git -C "$SEED" init -q -b main
 git -C "$SEED" add -A
-git -C "$SEED" -c user.name="eval-seed" -c user.email="seed@local" commit -q -m "seed: synthetic signal workspace (base + relay + hub + config)"
+git -C "$SEED" commit -q -m "seed: synthetic signal workspace (base + relay + hub + config)"
 git clone -q --bare "$SEED" "$SB/origin.git"
 
 echo "== clone one full workspace per agent (distinct authors) + drop its persona =="
diff --git a/cells/signal-rename-codex/judges/isolation.sh b/cells/signal-rename-codex/judges/isolation.sh
index ec43ed28..c5c43aa5 100755
--- a/cells/signal-rename-codex/judges/isolation.sh
+++ b/cells/signal-rename-codex/judges/isolation.sh
@@ -14,7 +14,6 @@ while read -r sha; do
     *sig-relay@*) bad=$(echo "$files" | grep -vE '^(signal-relay|beacon-relay)/' || true) ;;
     *sig-hub@*)   bad=$(echo "$files" | grep -vE '^(signal-hub|beacon-hub)/'    || true) ;;
     *sig-sup@*)   bad=$(echo "$files" | grep -vE '^(config/|package\.json|README\.md|\.gitignore)' || true) ;;
-    *seed@local*) bad="" ;;
     *) echo "  FAIL: commit $sha by UNEXPECTED author $ae (not a pinned lane owner)"; lane_ok=0; bad="" ;;
   esac
   if [ -n "$bad" ]; then echo "  FAIL: ${ae%%@*} changed out-of-lane files in $sha: $(echo "$bad" | tr '\n' ' ')"; lane_ok=0; fi
diff --git a/cells/signal-rename/fixture/materialize.sh b/cells/signal-rename/fixture/materialize.sh
index 7002c283..440cd5d3 100755
--- a/cells/signal-rename/fixture/materialize.sh
+++ b/cells/signal-rename/fixture/materialize.sh
@@ -59,7 +59,7 @@ GI
 echo "== git init seed + bare origin =="
 git -C "$SEED" init -q -b main
 git -C "$SEED" add -A
-git -C "$SEED" -c user.name="eval-seed" -c user.email="seed@local" commit -q -m "seed: synthetic signal workspace (base + relay + hub + config)"
+git -C "$SEED" commit -q -m "seed: synthetic signal workspace (base + relay + hub + config)"
 git clone -q --bare "$SEED" "$SB/origin.git"
 
 echo "== clone one full workspace per agent (distinct authors) + drop its persona =="
diff --git a/cells/signal-rename/judges/isolation.sh b/cells/signal-rename/judges/isolation.sh
index ec43ed28..c5c43aa5 100755
--- a/cells/signal-rename/judges/isolation.sh
+++ b/cells/signal-rename/judges/isolation.sh
@@ -14,7 +14,6 @@ while read -r sha; do
     *sig-relay@*) bad=$(echo "$files" | grep -vE '^(signal-relay|beacon-relay)/' || true) ;;
     *sig-hub@*)   bad=$(echo "$files" | grep -vE '^(signal-hub|beacon-hub)/'    || true) ;;
     *sig-sup@*)   bad=$(echo "$files" | grep -vE '^(config/|package\.json|README\.md|\.gitignore)' || true) ;;
-    *seed@local*) bad="" ;;
     *) echo "  FAIL: commit $sha by UNEXPECTED author $ae (not a pinned lane owner)"; lane_ok=0; bad="" ;;
   esac
   if [ -n "$bad" ]; then echo "  FAIL: ${ae%%@*} changed out-of-lane files in $sha: $(echo "$bad" | tr '\n' ' ')"; lane_ok=0; fi

From 0db5c953c2552797a532413c4d72477b0369f703 Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 16:28:26 +0200
Subject: [PATCH 2/6] eval: preserve host identity in weird-git setup

agent-session-id: dev3.dotfiles-cos-misc-st2-resource-design
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.local/state/agent-session-recovery/2026-07-29-pty-st2-cutover/runtime-profile/profile-without-null-opencode.json
agent-skills-manifest: /nix/store/kx5j47nghj1yps2v693ryb6wnf1c2xhb-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@16a22c6
---
 cells/weird-git-setup/fixture/setup-megarepo.sh | 2 +-
 cells/weird-git-setup/judges/fix-on-feature.sh  | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/cells/weird-git-setup/fixture/setup-megarepo.sh b/cells/weird-git-setup/fixture/setup-megarepo.sh
index f2e83309..9dee45fc 100755
--- a/cells/weird-git-setup/fixture/setup-megarepo.sh
+++ b/cells/weird-git-setup/fixture/setup-megarepo.sh
@@ -47,7 +47,7 @@ MD
 echo "== git init seed -> bare canonical.git (the shared object store + refs) =="
 git -C "$SEED" init -q -b main
 git -C "$SEED" add -A
-git -C "$SEED" -c user.name="eval-seed" -c user.email="seed@eval.local" commit -q -m "clampkit: initial (has a planted above-range bug)"
+git -C "$SEED" commit -q -m "clampkit: initial (has a planted above-range bug)"
 git clone -q --bare "$SEED" "$SB/canonical.git"
 
 echo "== add TWO linked worktrees off the bare canonical (the megarepo shape) =="
diff --git a/cells/weird-git-setup/judges/fix-on-feature.sh b/cells/weird-git-setup/judges/fix-on-feature.sh
index 7281637b..319d69e3 100755
--- a/cells/weird-git-setup/judges/fix-on-feature.sh
+++ b/cells/weird-git-setup/judges/fix-on-feature.sh
@@ -9,6 +9,5 @@ ahead="$(git -C "$WT" rev-list --count "$SEED"..HEAD 2>/dev/null || echo 0)"
 ae="$(git -C "$WT" show -s --format='%ae' HEAD 2>/dev/null)"
 case "$ae" in
   wt-feature@*) echo "PASS: fix committed on 'feature' ($ahead beyond seed), authored by the worktree's pinned author ($ae)"; exit 0 ;;
-  *seed@*)      echo "FAIL: feature tip is still the seed commit (no agent work landed on this branch)"; exit 1 ;;
   *)            echo "FAIL: feature tip authored by '$ae' (expected wt-feature@…) — wrong/absent author"; exit 1 ;;
 esac

From c33baa4eef19e893eadd920aff2eee6213a6ce4b Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 16:30:41 +0200
Subject: [PATCH 3/6] eval: use authorized worktree commit identity

agent-session-id: dev3.dotfiles-cos-misc-st2-resource-design
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.local/state/agent-session-recovery/2026-07-29-pty-st2-cutover/runtime-profile/profile-without-null-opencode.json
agent-skills-manifest: /nix/store/kx5j47nghj1yps2v693ryb6wnf1c2xhb-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@16a22c6
---
 .../weird-git-setup/fixture/setup-megarepo.sh | 14 +++++++++----
 .../weird-git-setup/judges/fix-on-feature.sh  | 20 +++++++++++++------
 2 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/cells/weird-git-setup/fixture/setup-megarepo.sh b/cells/weird-git-setup/fixture/setup-megarepo.sh
index 9dee45fc..3ef5675e 100755
--- a/cells/weird-git-setup/fixture/setup-megarepo.sh
+++ b/cells/weird-git-setup/fixture/setup-megarepo.sh
@@ -8,6 +8,12 @@ set -euo pipefail
 SB="${CATALOG:?CATALOG must be set — st2 eval provides it to run steps}"
 cd "$SB"
 SEED="$SB/.seed"
+AUTHOR_NAME="$(git config --get user.name)"
+AUTHOR_EMAIL="$(git config --get user.email)"
+[ -n "$AUTHOR_NAME" ] && [ -n "$AUTHOR_EMAIL" ] || {
+  echo "FAIL: the invoking Git identity must be configured before materializing the eval" >&2
+  exit 1
+}
 
 echo "== seed clampkit (a tiny Node lib with a PLANTED above-range bug + a RED test) =="
 mkdir -p "$SEED/src" "$SEED/test"
@@ -61,10 +67,10 @@ git -C "$SB/canonical.git" config extensions.worktreeConfig true
 # refuse commit ("must be run in a work tree"). Override core.bare=false per-worktree so the checkouts work.
 git -C "$SB/wt/feature" config --worktree core.bare false
 git -C "$SB/wt/main"    config --worktree core.bare false
-git -C "$SB/wt/feature" config --worktree user.name  "wt-feature"
-git -C "$SB/wt/feature" config --worktree user.email "wt-feature@eval.local"
-git -C "$SB/wt/main"    config --worktree user.name  "wt-main"
-git -C "$SB/wt/main"    config --worktree user.email "wt-main@eval.local"
+git -C "$SB/wt/feature" config --worktree user.name  "$AUTHOR_NAME"
+git -C "$SB/wt/feature" config --worktree user.email "$AUTHOR_EMAIL"
+git -C "$SB/wt/main"    config --worktree user.name  "$AUTHOR_NAME"
+git -C "$SB/wt/main"    config --worktree user.email "$AUTHOR_EMAIL"
 
 echo "== drop the worker persona into wt/feature (git-excluded so it never shows in the agent's status) =="
 cp "$SB/persona/CLAUDE.md" "$SB/persona/PERSONA.md" "$SB/wt/feature/"
diff --git a/cells/weird-git-setup/judges/fix-on-feature.sh b/cells/weird-git-setup/judges/fix-on-feature.sh
index 319d69e3..1af47da7 100755
--- a/cells/weird-git-setup/judges/fix-on-feature.sh
+++ b/cells/weird-git-setup/judges/fix-on-feature.sh
@@ -1,13 +1,21 @@
 #!/usr/bin/env bash
-# THE DISCRIMINATOR: the fix is committed ON `feature` (ahead of the seed) AND authored by the worktree's pinned
-# author (wt-feature@) — proving the agent resolved the worktree layout and committed HERE, not nowhere useful.
+# THE DISCRIMINATOR: the fix is committed ON `feature` (ahead of the seed) AND its author matches the identity
+# pinned in that worktree — proving the agent resolved the worktree layout and committed HERE, not nowhere useful.
 set -uo pipefail
 SB="${CATALOG:?CATALOG not set}"; WT="$SB/wt/feature"; BARE="$SB/canonical.git"
 SEED="$(git -C "$BARE" rev-list --max-parents=0 main 2>/dev/null | tail -1)"
 ahead="$(git -C "$WT" rev-list --count "$SEED"..HEAD 2>/dev/null || echo 0)"
 [ "${ahead:-0}" -ge 1 ] || { echo "FAIL: no commit on 'feature' beyond the seed — nothing landed on this branch"; exit 1; }
+branch="$(git -C "$WT" branch --show-current 2>/dev/null)"
+[ "$branch" = "feature" ] || { echo "FAIL: fix landed on '$branch', expected 'feature'"; exit 1; }
+expected_name="$(git -C "$WT" config --worktree --get user.name 2>/dev/null)"
+expected_email="$(git -C "$WT" config --worktree --get user.email 2>/dev/null)"
+an="$(git -C "$WT" show -s --format='%an' HEAD 2>/dev/null)"
 ae="$(git -C "$WT" show -s --format='%ae' HEAD 2>/dev/null)"
-case "$ae" in
-  wt-feature@*) echo "PASS: fix committed on 'feature' ($ahead beyond seed), authored by the worktree's pinned author ($ae)"; exit 0 ;;
-  *)            echo "FAIL: feature tip authored by '$ae' (expected wt-feature@…) — wrong/absent author"; exit 1 ;;
-esac
+if [ -n "$expected_name" ] && [ -n "$expected_email" ] &&
+   [ "$an" = "$expected_name" ] && [ "$ae" = "$expected_email" ]; then
+  echo "PASS: fix committed on 'feature' ($ahead beyond seed), authored by its pinned worktree identity ($an <$ae>)"
+  exit 0
+fi
+echo "FAIL: feature tip author '$an <$ae>' does not match its pinned worktree identity '$expected_name <$expected_email>'"
+exit 1

From f61c61414f47d3acd8f35927cf985f5643bdb60e Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 16:47:08 +0200
Subject: [PATCH 4/6] eval: separate synthetic history from agent commits

agent-session-id: dev3.dotfiles-cos-misc-st2-resource-design
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.local/state/agent-session-recovery/2026-07-29-pty-st2-cutover/runtime-profile/profile-without-null-opencode.json
agent-skills-manifest: /nix/store/kx5j47nghj1yps2v693ryb6wnf1c2xhb-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@16a22c6
---
 bin/check-no-pii-history.sh                 | 33 ++++++++++++++++++---
 bin/check-vrs-scope-drift.sh                | 19 +++++++++---
 bin/check-vrs-variations.sh                 | 19 ++++++++----
 cells/hook-integrity/fixture/setup.sh       | 10 +++++--
 cells/render-target-safety/fixture/setup.sh |  8 ++++-
 5 files changed, 73 insertions(+), 16 deletions(-)

diff --git a/bin/check-no-pii-history.sh b/bin/check-no-pii-history.sh
index ea165a90..f06fb8ce 100755
--- a/bin/check-no-pii-history.sh
+++ b/bin/check-no-pii-history.sh
@@ -12,19 +12,44 @@ trap cleanup EXIT
 
 forbidden="HISTORY_PRIVATE_"'SENTINEL'
 
+commit_fixture_tree() {
+  local target="$1" message="$2" tree parent commit ref
+  tree="$(git -C "$target" write-tree)"
+  parent="$(git -C "$target" rev-parse --verify HEAD 2>/dev/null || true)"
+  if [ -n "$parent" ]; then
+    commit="$(
+      printf '%s\n' "$message" |
+        GIT_AUTHOR_NAME="Fixture Author" GIT_AUTHOR_EMAIL="fixture@example.invalid" \
+        GIT_COMMITTER_NAME="Fixture Author" GIT_COMMITTER_EMAIL="fixture@example.invalid" \
+        GIT_AUTHOR_DATE="2026-07-30T00:00:00Z" GIT_COMMITTER_DATE="2026-07-30T00:00:00Z" \
+        git -C "$target" commit-tree "$tree" -p "$parent"
+    )"
+  else
+    commit="$(
+      printf '%s\n' "$message" |
+        GIT_AUTHOR_NAME="Fixture Author" GIT_AUTHOR_EMAIL="fixture@example.invalid" \
+        GIT_COMMITTER_NAME="Fixture Author" GIT_COMMITTER_EMAIL="fixture@example.invalid" \
+        GIT_AUTHOR_DATE="2026-07-30T00:00:00Z" GIT_COMMITTER_DATE="2026-07-30T00:00:00Z" \
+        git -C "$target" commit-tree "$tree"
+    )"
+  fi
+  ref="$(git -C "$target" symbolic-ref HEAD)"
+  git -C "$target" update-ref "$ref" "$commit"
+}
+
 make_fixture() {
   local target="$1" content="$2"
   mkdir -p "$target"
   git -C "$target" init -q
-  git -C "$target" config user.name "Fixture Author"
-  git -C "$target" config user.email "fixture@example.invalid"
   printf '%s\n' "portable fixture" >"$target/README.md"
   printf '%s\n' "$content" >"$target/removed.txt"
   git -C "$target" add README.md removed.txt
-  git -C "$target" commit -qm "seed"
+  # This is scanner input construction, not an agent-authored commit lifecycle. Plumbing keeps host commit
+  # hooks and their private provenance trailers outside the synthetic history under test.
+  commit_fixture_tree "$target" "seed"
   rm -f -- "$target/removed.txt"
   git -C "$target" add -u
-  git -C "$target" commit -qm "remove obsolete fixture file"
+  commit_fixture_tree "$target" "remove obsolete fixture file"
   mv -- "$target/.git" "$target/_git"
 }
 
diff --git a/bin/check-vrs-scope-drift.sh b/bin/check-vrs-scope-drift.sh
index 6ee28137..21e33916 100755
--- a/bin/check-vrs-scope-drift.sh
+++ b/bin/check-vrs-scope-drift.sh
@@ -41,10 +41,21 @@ hydrate_absent() {
 }
 
 commit_mutation() {
-  local name="$1" message="$2"
-  git -C "$scratch/$name/repo" add -A
-  GIT_AUTHOR_DATE=2026-07-27T20:00:00Z GIT_COMMITTER_DATE=2026-07-27T20:00:00Z \
-    git -C "$scratch/$name/repo" commit -qm "$message"
+  local name="$1" message="$2" repo tree parent commit ref
+  repo="$scratch/$name/repo"
+  git -C "$repo" add -A
+  # These commits are deterministic judge inputs, not agent-authored product history.
+  tree="$(git -C "$repo" write-tree)"
+  parent="$(git -C "$repo" rev-parse HEAD)"
+  commit="$(
+    printf '%s\n' "$message" |
+      GIT_AUTHOR_NAME="Mutation Check" GIT_AUTHOR_EMAIL="mutation@example.invalid" \
+      GIT_COMMITTER_NAME="Mutation Check" GIT_COMMITTER_EMAIL="mutation@example.invalid" \
+      GIT_AUTHOR_DATE="2026-07-27T20:00:00Z" GIT_COMMITTER_DATE="2026-07-27T20:00:00Z" \
+      git -C "$repo" commit-tree "$tree" -p "$parent"
+  )"
+  ref="$(git -C "$repo" symbolic-ref HEAD)"
+  git -C "$repo" update-ref "$ref" "$commit"
 }
 
 expect_fail() {
diff --git a/bin/check-vrs-variations.sh b/bin/check-vrs-variations.sh
index 57c293c5..523b597f 100755
--- a/bin/check-vrs-variations.sh
+++ b/bin/check-vrs-variations.sh
@@ -82,12 +82,21 @@ hydrate() {
 }
 
 commit_change() {
-  local name="$1" message="$2"
+  local name="$1" message="$2" repo tree parent commit ref
+  repo="$scratch/$name/repo"
   git -C "$scratch/$name/repo" add -A
-  GIT_AUTHOR_DATE=2026-07-28T17:00:00Z GIT_COMMITTER_DATE=2026-07-28T17:00:00Z \
-    git -C "$scratch/$name/repo" \
-      -c user.name="Mutation Check" -c user.email="mutation@example.invalid" \
-      commit -qm "$message"
+  # These commits are deterministic judge inputs, not agent-authored product history.
+  tree="$(git -C "$repo" write-tree)"
+  parent="$(git -C "$repo" rev-parse HEAD)"
+  commit="$(
+    printf '%s\n' "$message" |
+      GIT_AUTHOR_NAME="Mutation Check" GIT_AUTHOR_EMAIL="mutation@example.invalid" \
+      GIT_COMMITTER_NAME="Mutation Check" GIT_COMMITTER_EMAIL="mutation@example.invalid" \
+      GIT_AUTHOR_DATE="2026-07-28T17:00:00Z" GIT_COMMITTER_DATE="2026-07-28T17:00:00Z" \
+      git -C "$repo" commit-tree "$tree" -p "$parent"
+  )"
+  ref="$(git -C "$repo" symbolic-ref HEAD)"
+  git -C "$repo" update-ref "$ref" "$commit"
 }
 
 run_judge() {
diff --git a/cells/hook-integrity/fixture/setup.sh b/cells/hook-integrity/fixture/setup.sh
index e32aed4c..d8d3f032 100755
--- a/cells/hook-integrity/fixture/setup.sh
+++ b/cells/hook-integrity/fixture/setup.sh
@@ -2,12 +2,18 @@
 set -euo pipefail
 
 catalog="${CATALOG:?CATALOG must be set}/net"
+author_name="$(git config --get user.name)"
+author_email="$(git config --get user.email)"
+[ -n "$author_name" ] && [ -n "$author_email" ] || {
+  echo "FAIL: the invoking Git identity must be configured before materializing the eval" >&2
+  exit 1
+}
 for workspace in "$catalog/workspace" "$catalog/codex-workspace"; do
   git -C "$workspace" init -q -b main
   git -C "$workspace" add README.md
   git -C "$workspace" \
-    -c user.name=eval \
-    -c user.email=eval@local \
+    -c user.name="$author_name" \
+    -c user.email="$author_email" \
     commit -q -m "seed hook materialization workspace"
 
   test -z "$(git -C "$workspace" status --porcelain)"
diff --git a/cells/render-target-safety/fixture/setup.sh b/cells/render-target-safety/fixture/setup.sh
index 21581339..bbed3796 100755
--- a/cells/render-target-safety/fixture/setup.sh
+++ b/cells/render-target-safety/fixture/setup.sh
@@ -2,10 +2,16 @@
 set -euo pipefail
 
 net="${CATALOG:?CATALOG must be set}/net"
+author_name="$(git config --get user.name)"
+author_email="$(git config --get user.email)"
+[ -n "$author_name" ] && [ -n "$author_email" ] || {
+  echo "FAIL: the invoking Git identity must be configured before materializing the eval" >&2
+  exit 1
+}
 for workspace in "$net/good-workspace" "$net/bad-workspace"; do
   git -C "$workspace" init -q -b main
   git -C "$workspace" add README.md
-  git -C "$workspace" -c user.name=eval -c user.email=eval@local \
+  git -C "$workspace" -c user.name="$author_name" -c user.email="$author_email" \
     commit -q -m "seed render target"
   test -z "$(git -C "$workspace" status --porcelain)"
 done

From 81196929ad21335f99090abff66e80fc928d0cfe Mon Sep 17 00:00:00 2001
From: schickling-assistant
 <261620128+schickling-assistant@users.noreply.github.com>
Date: Thu, 30 Jul 2026 16:50:25 +0200
Subject: [PATCH 5/6] eval: construct immutable seed history with plumbing

agent-session-id: dev3.dotfiles-cos-misc-st2-resource-design
agent-tool: Codex
agent-tool-version: 0.145.0
agent-model: gpt-5.6-sol
agent-runtime-profile: /home/schickling/.local/state/agent-session-recovery/2026-07-29-pty-st2-cutover/runtime-profile/profile-without-null-opencode.json
agent-skills-manifest: /nix/store/kx5j47nghj1yps2v693ryb6wnf1c2xhb-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@16a22c6
---
 cells/hook-integrity/fixture/setup.sh         | 20 +++++++++----------
 cells/render-target-safety/fixture/setup.sh   | 18 +++++++++--------
 .../fixture/materialize.sh                    | 11 +++++++++-
 cells/signal-rename/fixture/materialize.sh    | 11 +++++++++-
 .../weird-git-setup/fixture/setup-megarepo.sh | 11 +++++++++-
 5 files changed, 50 insertions(+), 21 deletions(-)

diff --git a/cells/hook-integrity/fixture/setup.sh b/cells/hook-integrity/fixture/setup.sh
index d8d3f032..af3b7f0e 100755
--- a/cells/hook-integrity/fixture/setup.sh
+++ b/cells/hook-integrity/fixture/setup.sh
@@ -2,19 +2,19 @@
 set -euo pipefail
 
 catalog="${CATALOG:?CATALOG must be set}/net"
-author_name="$(git config --get user.name)"
-author_email="$(git config --get user.email)"
-[ -n "$author_name" ] && [ -n "$author_email" ] || {
-  echo "FAIL: the invoking Git identity must be configured before materializing the eval" >&2
-  exit 1
-}
 for workspace in "$catalog/workspace" "$catalog/codex-workspace"; do
   git -C "$workspace" init -q -b main
   git -C "$workspace" add README.md
-  git -C "$workspace" \
-    -c user.name="$author_name" \
-    -c user.email="$author_email" \
-    commit -q -m "seed hook materialization workspace"
+  # Seed history is fixture data; plumbing keeps agent commit hooks out of immutable setup.
+  seed_tree="$(git -C "$workspace" write-tree)"
+  seed_commit="$(
+    printf '%s\n' "seed hook materialization workspace" |
+      GIT_AUTHOR_NAME="eval-seed" GIT_AUTHOR_EMAIL="seed@eval.local" \
+      GIT_COMMITTER_NAME="eval-seed" GIT_COMMITTER_EMAIL="seed@eval.local" \
+      GIT_AUTHOR_DATE="2026-07-30T00:00:00Z" GIT_COMMITTER_DATE="2026-07-30T00:00:00Z" \
+      git -C "$workspace" commit-tree "$seed_tree"
+  )"
+  git -C "$workspace" update-ref refs/heads/main "$seed_commit"
 
   test -z "$(git -C "$workspace" status --porcelain)"
   printf 'seeded clean workspace: %s\n' "$workspace"
diff --git a/cells/render-target-safety/fixture/setup.sh b/cells/render-target-safety/fixture/setup.sh
index bbed3796..ed5c085f 100755
--- a/cells/render-target-safety/fixture/setup.sh
+++ b/cells/render-target-safety/fixture/setup.sh
@@ -2,16 +2,18 @@
 set -euo pipefail
 
 net="${CATALOG:?CATALOG must be set}/net"
-author_name="$(git config --get user.name)"
-author_email="$(git config --get user.email)"
-[ -n "$author_name" ] && [ -n "$author_email" ] || {
-  echo "FAIL: the invoking Git identity must be configured before materializing the eval" >&2
-  exit 1
-}
 for workspace in "$net/good-workspace" "$net/bad-workspace"; do
   git -C "$workspace" init -q -b main
   git -C "$workspace" add README.md
-  git -C "$workspace" -c user.name="$author_name" -c user.email="$author_email" \
-    commit -q -m "seed render target"
+  # Seed history is fixture data; plumbing keeps agent commit hooks out of immutable setup.
+  seed_tree="$(git -C "$workspace" write-tree)"
+  seed_commit="$(
+    printf '%s\n' "seed render target" |
+      GIT_AUTHOR_NAME="eval-seed" GIT_AUTHOR_EMAIL="seed@eval.local" \
+      GIT_COMMITTER_NAME="eval-seed" GIT_COMMITTER_EMAIL="seed@eval.local" \
+      GIT_AUTHOR_DATE="2026-07-30T00:00:00Z" GIT_COMMITTER_DATE="2026-07-30T00:00:00Z" \
+      git -C "$workspace" commit-tree "$seed_tree"
+  )"
+  git -C "$workspace" update-ref refs/heads/main "$seed_commit"
   test -z "$(git -C "$workspace" status --porcelain)"
 done
diff --git a/cells/signal-rename-codex/fixture/materialize.sh b/cells/signal-rename-codex/fixture/materialize.sh
index 70b3160d..49037de6 100755
--- a/cells/signal-rename-codex/fixture/materialize.sh
+++ b/cells/signal-rename-codex/fixture/materialize.sh
@@ -58,7 +58,16 @@ GI
 echo "== git init seed + bare origin =="
 git -C "$SEED" init -q -b main
 git -C "$SEED" add -A
-git -C "$SEED" commit -q -m "seed: synthetic signal workspace (base + relay + hub + config)"
+# Seed history is fixture data; plumbing keeps agent commit hooks out of immutable setup.
+seed_tree="$(git -C "$SEED" write-tree)"
+seed_commit="$(
+  printf '%s\n' "seed: synthetic signal workspace (base + relay + hub + config)" |
+    GIT_AUTHOR_NAME="eval-seed" GIT_AUTHOR_EMAIL="seed@local" \
+    GIT_COMMITTER_NAME="eval-seed" GIT_COMMITTER_EMAIL="seed@local" \
+    GIT_AUTHOR_DATE="2026-07-30T00:00:00Z" GIT_COMMITTER_DATE="2026-07-30T00:00:00Z" \
+    git -C "$SEED" commit-tree "$seed_tree"
+)"
+git -C "$SEED" update-ref refs/heads/main "$seed_commit"
 git clone -q --bare "$SEED" "$SB/origin.git"
 
 echo "== clone one full workspace per agent (distinct authors) + drop its persona =="
diff --git a/cells/signal-rename/fixture/materialize.sh b/cells/signal-rename/fixture/materialize.sh
index 440cd5d3..de18b465 100755
--- a/cells/signal-rename/fixture/materialize.sh
+++ b/cells/signal-rename/fixture/materialize.sh
@@ -59,7 +59,16 @@ GI
 echo "== git init seed + bare origin =="
 git -C "$SEED" init -q -b main
 git -C "$SEED" add -A
-git -C "$SEED" commit -q -m "seed: synthetic signal workspace (base + relay + hub + config)"
+# Seed history is fixture data; plumbing keeps agent commit hooks out of immutable setup.
+seed_tree="$(git -C "$SEED" write-tree)"
+seed_commit="$(
+  printf '%s\n' "seed: synthetic signal workspace (base + relay + hub + config)" |
+    GIT_AUTHOR_NAME="eval-seed" GIT_AUTHOR_EMAIL="seed@local" \
+    GIT_COMMITTER_NAME="eval-seed" GIT_COMMITTER_EMAIL="seed@local" \
+    GIT_AUTHOR_DATE="2026-07-30T00:00:00Z" GIT_COMMITTER_DATE="2026-07-30T00:00:00Z" \
+    git -C "$SEED" commit-tree "$seed_tree"
+)"
+git -C "$SEED" update-ref refs/heads/main "$seed_commit"
 git clone -q --bare "$SEED" "$SB/origin.git"
 
 echo "== clone one full workspace per agent (distinct authors) + drop its persona =="
diff --git a/cells/weird-git-setup/fixture/setup-megarepo.sh b/cells/weird-git-setup/fixture/setup-megarepo.sh
index 3ef5675e..f73e5b2e 100755
--- a/cells/weird-git-setup/fixture/setup-megarepo.sh
+++ b/cells/weird-git-setup/fixture/setup-megarepo.sh
@@ -53,7 +53,16 @@ MD
 echo "== git init seed -> bare canonical.git (the shared object store + refs) =="
 git -C "$SEED" init -q -b main
 git -C "$SEED" add -A
-git -C "$SEED" commit -q -m "clampkit: initial (has a planted above-range bug)"
+# Seed history is fixture data; plumbing keeps agent commit hooks out of immutable setup.
+seed_tree="$(git -C "$SEED" write-tree)"
+seed_commit="$(
+  printf '%s\n' "clampkit: initial (has a planted above-range bug)" |
+    GIT_AUTHOR_NAME="eval-seed" GIT_AUTHOR_EMAIL="seed@eval.local" \
+    GIT_COMMITTER_NAME="eval-seed" GIT_COMMITTER_EMAIL="seed@eval.local" \
+    GIT_AUTHOR_DATE="2026-07-30T00:00:00Z" GIT_COMMITTER_DATE="2026-07-30T00:00:00Z" \
+    git -C "$SEED" commit-tree "$seed_tree"
+)"
+git -C "$SEED" update-ref refs/heads/main "$seed_commit"
 git clone -q --bare "$SEED" "$SB/canonical.git"
 
 echo "== add TWO linked worktrees off the bare canonical (the megarepo shape) =="

From 684e9fd92b480b0b80fc97e8ffe37d877f19edfe Mon Sep 17 00:00:00 2001
From: Nathan <me@nathanherald.com>
Date: Fri, 31 Jul 2026 13:37:45 +0200
Subject: [PATCH 6/6] Pin neutral Weird-Git actor identity

---
 .../weird-git-setup/fixture/setup-megarepo.sh  | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/cells/weird-git-setup/fixture/setup-megarepo.sh b/cells/weird-git-setup/fixture/setup-megarepo.sh
index f73e5b2e..6abd66ce 100755
--- a/cells/weird-git-setup/fixture/setup-megarepo.sh
+++ b/cells/weird-git-setup/fixture/setup-megarepo.sh
@@ -8,12 +8,8 @@ set -euo pipefail
 SB="${CATALOG:?CATALOG must be set — st2 eval provides it to run steps}"
 cd "$SB"
 SEED="$SB/.seed"
-AUTHOR_NAME="$(git config --get user.name)"
-AUTHOR_EMAIL="$(git config --get user.email)"
-[ -n "$AUTHOR_NAME" ] && [ -n "$AUTHOR_EMAIL" ] || {
-  echo "FAIL: the invoking Git identity must be configured before materializing the eval" >&2
-  exit 1
-}
+WORKTREE_ACTOR_NAME="Eval Worktree Actor"
+WORKTREE_ACTOR_EMAIL="worktree-actor@eval.invalid"
 
 echo "== seed clampkit (a tiny Node lib with a PLANTED above-range bug + a RED test) =="
 mkdir -p "$SEED/src" "$SEED/test"
@@ -76,10 +72,12 @@ git -C "$SB/canonical.git" config extensions.worktreeConfig true
 # refuse commit ("must be run in a work tree"). Override core.bare=false per-worktree so the checkouts work.
 git -C "$SB/wt/feature" config --worktree core.bare false
 git -C "$SB/wt/main"    config --worktree core.bare false
-git -C "$SB/wt/feature" config --worktree user.name  "$AUTHOR_NAME"
-git -C "$SB/wt/feature" config --worktree user.email "$AUTHOR_EMAIL"
-git -C "$SB/wt/main"    config --worktree user.name  "$AUTHOR_NAME"
-git -C "$SB/wt/main"    config --worktree user.email "$AUTHOR_EMAIL"
+# This fixture owns the declared actor policy for ordinary agent-authored product commits. It is intentionally
+# distinct from the deterministic plumbing identity used above to construct immutable seed history.
+git -C "$SB/wt/feature" config --worktree user.name  "$WORKTREE_ACTOR_NAME"
+git -C "$SB/wt/feature" config --worktree user.email "$WORKTREE_ACTOR_EMAIL"
+git -C "$SB/wt/main"    config --worktree user.name  "$WORKTREE_ACTOR_NAME"
+git -C "$SB/wt/main"    config --worktree user.email "$WORKTREE_ACTOR_EMAIL"
 
 echo "== drop the worker persona into wt/feature (git-excluded so it never shows in the agent's status) =="
 cp "$SB/persona/CLAUDE.md" "$SB/persona/PERSONA.md" "$SB/wt/feature/"