Superseded: builder lineage prototype and recovery evidence

.github/workflows/code-mower-gate.yml

@@ -286,10 +286,13 @@ jobs:
                   attested_non_current_audit_heads,
                   audit_run_in_flight_detail_for_lane,
                   audit_verdict_newer_than_in_flight,
+                  episodes_from_comment_body,
+                  flatten_paginated_comments,
                   flatten_paginated_items,
                   github_actions_comment_attested,
                   latest_current_audit_verdict,
                   latest_current_audit_verdict_detail,
+                  resolve_builder_lineage,
               )
           except ImportError:  # pragma: no cover - unit-test/package fallback
               from code_mower.context_review import required_for_checkout
@@ -298,12 +301,17 @@ jobs:
                   attested_non_current_audit_heads,
                   audit_run_in_flight_detail_for_lane,
                   audit_verdict_newer_than_in_flight,
+                  episodes_from_comment_body,
+                  flatten_paginated_comments,
                   flatten_paginated_items,
                   github_actions_comment_attested,
                   latest_current_audit_verdict,
                   latest_current_audit_verdict_detail,
+                  resolve_builder_lineage,
               )
 
+          LINEAGE_MARKER = "CODE_MOWER_BUILDER_LINEAGE"
+
           # github_actions_comment_attested verifies the hidden CODE_MOWER_AUDIT_RUN marker
           # and requires comment_id/body_sha256 to match the issue comment being evaluated.
           def emit(state, description):
@@ -342,7 +350,26 @@ jobs:
               if isinstance(item, dict)
           }
           lanes = [lane for lane in lanes if isinstance(lane, dict)]
-          comments = flatten_paginated_items(comments_payload)
+          # Comment pages are validated under the shared record contract
+          # *before* anything flattens, filters or stringifies them. The
+          # generic flattener drops members it cannot use -- right for a mixed
+          # timeline, wrong for a comment history, where a dropped comment is a
+          # dropped marker -- and the `str(... or "")` below would turn a
+          # present non-string body into plausible text. A history nobody could
+          # read would otherwise reach the gate looking ordinary. Timeline
+          # events keep the generic flattener: they are not comments and are
+          # never read for lineage.
+          comment_history_readable = True
+          comment_history_problem = ""
+          try:
+              comments = flatten_paginated_comments(comments_payload)
+          except Exception as exc:
+              comment_history_readable = False
+              comment_history_problem = str(exc)
+              # The gate is already failing on this. Salvaging the readable
+              # members would hand records nobody could validate to every other
+              # consumer below, so nothing downstream sees this history at all.
+              comments = []
           events = flatten_paginated_items(events_payload)
           audit_runs = audit_runs_payload if isinstance(audit_runs_payload, list) else []
           configured_decision_authorities = (
@@ -432,16 +459,43 @@ jobs:
                   context_required=context_required,
               )
 
-          builder_matches = []
-          if isinstance(exclusion, dict) and exclusion.get("enabled"):
-              label_map = mapping("labels")
-              for label in labels:
-                  if label in label_map:
-                      builder_matches.append(str(label_map[label]))
-              author_map = {str(k).lower(): str(v) for k, v in mapping("authors").items()}
-              if pr_author.lower() in author_map:
-                  builder_matches.append(author_map[pr_author.lower()])
-          builder_matches = list(dict.fromkeys(builder_matches))
+          # Contribution lineage, not one label and one author. The hidden
+          # marker is a transport and never an authorization, so episodes are
+          # read only from the repository's configured decision authorities --
+          # the same trust contract the publisher, both labelers and every
+          # reviewer wrapper apply. Permission to post an audit verdict is not
+          # takeover authority, so reviewer bot authors are deliberately not
+          # consulted here. An unconfigured checkout trusts nobody, reads no
+          # episodes, and falls back to the ordinary single-builder answer.
+          lineage_authorities = {
+              item.strip().lower().lstrip("@")
+              for item in decision_authorities
+              if item.strip()
+          }
+          lineage_episodes = []
+          lineage_readable = comment_history_readable
+          for comment in comments:
+              comment_body = str(comment.get("body") or "")
+              if LINEAGE_MARKER not in comment_body:
+                  continue
+              comment_author = str(((comment.get("user") or {}).get("login")) or "")
+              if comment_author.strip().lower().lstrip("@") not in lineage_authorities:
+                  continue
+              try:
+                  lineage_episodes.extend(episodes_from_comment_body(comment_body))
+              except Exception:
+                  lineage_readable = False
+          builder_lineage = resolve_builder_lineage(
+              labels=sorted(labels),
+              author=pr_author,
+              config=exclusion if isinstance(exclusion, dict) else {"enabled": False},
+              repo=os.environ.get("GITHUB_REPOSITORY", ""),
+              pr_number=pr_number,
+              branch=str(((pr_payload.get("head") or {}).get("ref")) or ""),
+              head_sha=head_sha,
+              episodes=lineage_episodes,
+          )
+          builder_matches = list(builder_lineage.contributors)
 
           def lane_display(lane):
               return str(lane.get("display_name") or lane.get("id") or lane.get("done") or "")
@@ -531,8 +585,16 @@ jobs:
               )
           )
 
-          if len(builder_matches) > 1:
-              emit("failure", "conflicting Code Mower builder identity")
+          if not lineage_readable:
+              emit(
+                  "failure",
+                  "Code Mower builder contribution evidence is unreadable"
+                  + (": " + comment_history_problem if comment_history_problem else ""),
+              )
+          elif builder_lineage.status == "conflict":
+              emit("failure", "conflicting Code Mower builder identity: " + builder_lineage.owner_action)
+          elif builder_lineage.status == "waiting":
+              emit("pending", "waiting for builder lineage: " + builder_lineage.owner_action)
           elif owner_label in labels:
               emit("pending", owner_label + ": waiting on owner")
           elif owner_sitting_label and owner_sitting_label in labels:
@@ -548,11 +610,13 @@ jobs:
           elif blocked:
               emit("failure", "blocked audit: " + ", ".join(blocked))
           else:
-              excluded_builder = builder_matches[0] if builder_matches else ""
+              # Every verified contributor to this head is excluded, not just
+              # the one the active label happens to name.
+              excluded_builders = set(builder_matches)
               required = [
                   lane
                   for lane in lanes
-                  if str(lane.get("author_lane") or lane.get("id") or "") != excluded_builder
+                  if str(lane.get("author_lane") or lane.get("id") or "") not in excluded_builders
               ]
               in_flight = in_flight_lanes(required)
               missing = [
@@ -562,7 +626,7 @@ jobs:
                   or latest_current_verdict(lane) != "done"
               ]
               if not required:
-                  if excluded_builder:
+                  if excluded_builders:
                       emit("failure", "no independent Code Mower audit lane remains")
                   else:
                       emit("failure", "no Code Mower merge-authority lanes configured")

code-mower-package-manifest.json

@@ -372,6 +372,11 @@
       "source": "src/code_mower/builder_experiment.py",
       "target": "src/code_mower/builder_experiment.py"
     },
+    {
+      "kind": "core",
+      "source": "tools/builder_lineage.py",
+      "target": "src/code_mower/builder_lineage.py"
+    },
     {
       "kind": "core",
       "source": "src/code_mower/builder_runs.py",
@@ -1372,6 +1377,11 @@
       "source": "src/code_mower/provider_runners/github_pr.py",
       "target": "src/code_mower/provider_runners/github_pr.py"
     },
+    {
+      "kind": "reviewer",
+      "source": "src/code_mower/provider_runners/lineage.py",
+      "target": "src/code_mower/provider_runners/lineage.py"
+    },
     {
       "kind": "reviewer",
       "source": "src/code_mower/provider_runners/pr_worktree.py",