@runeditrun/rer 0.1.1 → 0.2.1

package/scripts/publish-check/README.md

@@ -8,32 +8,42 @@ blob reads to system Git (`rev-parse`, `rev-list`, `ls-tree`, `cat-file --batch`
 its report private until translating it into the value-free v3 envelope.
 Hexadecimal credential assignments also use a Gitleaks rule without generic
 entropy or English stopword filters. Both assignment rules go through the same
-location-bound Source/module identity proof; provider and environment findings
+location-bound Source/module identity classification; provider and environment findings
 remain independent.
 `tree_scan.py` applies the kept text and licence policy. `history_scan.py`
 assigns release, working-tree and historical scopes. The Node entry point bounds
 the whole operation and stops its private process group on timeout/cancellation.
 
+Git message records carry their kind explicitly. Only commit records enable the
+bounded public coauthor address rule described in the command guide; a file named
+`@commit-message` has no special status. `public_hygiene.py` matches complete raw
+`Co-Authored-By` lines in the final trailer paragraph case-insensitively and
+masks only the accepted address for email inspection, leaving names, other
+addresses and every other rule intact.
+
 Binary metadata decoding, Git protocol/object/ref modelling, frozen comparison,
 resumable inspection and their tests have been removed. Tests live in `tests.py`
 and `coverage_tests.py` and construct disposable repositories with actual Git.
 
-`content_identities.py` classifies only exact generic-api-key occurrences at
-proved Source key locations. It requires same-tree edition/lock selections,
-manifest and archive hashes, valid retained file records, and exact native match
-bytes. Retained archive bytes must hash to the maintained Source serializer's
-`hash(json(saved))` as well as the selected pin. `source_hashes.mjs` reuses that
-serializer. Duplicate JSON fields, non-JSON constants (including ignored fields),
-incorrect types, missing preimages, mismatched pins and unrecognized locations keep
-the native finding. Each selection's complete dependency closure must have valid
-archive and pin proofs before any location in that graph is allowed; unrelated
-coherent selections remain eligible. Normal origin repositories obey the maintained
-Source schema, including rejection of strings starting with `-`.
-Original/private keys and arbitrary copies of a known digest
-are not proofs. Provider and environment findings are unaffected. Native git/dir
-matches are held only in the private temporary report and memory for this proof;
-matched values are never added to the public report. This classification does not
-replace or relax the edition-authoring check.
+`content_identities.py` binds generic-api-key and hex-api-key occurrences to
+exact JSON value locations. `source_metadata.py` enumerates digest fields in the
+formats emitted by `edition-authoring/cli.mjs` and `sources.mjs`: lock manifest,
+toolchain, parent/baseline pins and file SHA-256 values; retained archive keys,
+content digests and dependency pins; and the source origins' revision or
+projection identities. These are format classifications independent of selected
+graphs, canonical serialization, archive preimages and authoring freshness.
+`source_shapes.py` first checks the documented local record types, immutable
+origin identity, source selections and file/pin records. A malformed archive or
+lock grants no identity roles; unknown extra fields never gain a role.
+`provenance_pins.py` keeps the existing module revision classification.
+
+`json_identity.py` rejects duplicate members and non-JSON constants and binds
+native findings to exact string byte spans. Only documented structural fields
+with the declared digest length qualify. An extra credential field, arbitrary
+nested field or copy of the digest on the same minified line remains a finding.
+Provider and known environment findings are independent. Native git/dir matches
+stay in the private temporary report and memory; values are never added to the
+public report. Authoring's integrity checks remain unchanged.
 
 `copy_identities.py` proves the maintained `base-copies.json` and portable
 `base/PROVENANCE.json` copy-inventory SHA-256 values

package/scripts/publish-check/content_identities.py

@@ -1,249 +1,30 @@
-"""Classify module Git pins and prove Source keys at specific JSON locations.
-
-This is classification, not Source authoring validation. A stale lock still
-fails the authoring check. Missing original preimages remain ordinary findings.
-"""
-import base64
-import hashlib
-import re
-import json
-from pathlib import Path
-import subprocess
-from json_identity import Document, HEX
+"""Classify documented JSON identities at exact native-match locations."""
+from json_identity import Document
 from provenance_pins import module_pins
 from copy_identities import copy_pointers
-
-ARCHIVE = re.compile(r'\.edition/sources/([a-f0-9]{64})\.json\Z')
+from source_metadata import ARCHIVE, source_pointers
 
 
 def candidate(path):
     return path in ('edition.json', 'sources.lock.json', 'base-copies.json', 'base/PROVENANCE.json') or bool(ARCHIVE.fullmatch(path))
 
 
-def safe_path(value):
-    return (isinstance(value, str) and value and not re.search(r'[\\\x00-\x1f\x7f]', value)
-            and all(part not in ('', '.', '..', '.git') for part in value.split('/')))
-
-
-def valid_files(files):
-    if not isinstance(files, dict) or not files:
-        return False
-    for name, file in files.items():
-        if (not safe_path(name) or not isinstance(file, dict) or not isinstance(file.get('data'), str)
-                or type(file.get('executable')) is not bool):
-            return False
-        try:
-            if base64.b64encode(base64.b64decode(file['data'], validate=True)).decode() != file['data']:
-                return False
-        except ValueError:
-            return False
-    return True
-
-
-def same_json(left, right):
-    # Python equates booleans and numbers; Source JSON identities do not.
-    return json.dumps(left, sort_keys=True) == json.dumps(right, sort_keys=True)
-
-
 class ContentIdentities:
     def __init__(self, files, read_regular=None):
-        self.documents, self.allowed, self.archives, self.hashes = {}, {}, {}, {}
+        self.documents, self.allowed = {}, {}
         for path, data in files.items():
-            if candidate(path):
-                try:
-                    self.documents[path] = Document(data)
-                except (ValueError, TypeError, IndexError, RecursionError, UnicodeError):
-                    pass
-        if not self.documents:
-            return
-        for path, document in self.documents.items():
-            for pointer in module_pins(path, document.value):
-                self.allow(path, pointer)
-            if path in ('base-copies.json', 'base/PROVENANCE.json') and read_regular is not None:
-                for pointer in copy_pointers(document.value, read_regular):
-                    self.allow(path, pointer)
-        recipe = self.document('edition.json')
-        origins = [self.origin(recipe.get('parent'), True)]
-        components = recipe.get('components', [])
-        if isinstance(components, list):
-            for component in components:
-                source = component.get('source') if isinstance(component, dict) else None
-                if isinstance(source, dict):
-                    origins.append(self.origin(source if source.get('kind') == 'git' else source.get('origin')))
-        values = [recipe, *(v for v in origins if v is not None)]
-        for path, document in self.documents.items():
-            saved = document.value
-            if ARCHIVE.fullmatch(path) and isinstance(saved, dict):
-                values.extend([saved, saved.get('origin'), saved.get('files')])
-        self.hashes = {}
-        if values:
-            try:
-                result = subprocess.run(['node', str(Path(__file__).with_name('source_hashes.mjs'))],
-                                        input=json.dumps(values).encode(), capture_output=True, timeout=60, check=True)
-                hashes = json.loads(result.stdout)
-                if len(hashes) != len(values) or not all(isinstance(h, str) and HEX.fullmatch(h) for h in hashes):
-                    return
-                self.hashes = {json.dumps(v): h for v, h in zip(values, hashes)}
-            except (OSError, ValueError, subprocess.SubprocessError):
-                return
-        # Authoring pins hash(json(saved)); a raw-byte pin alone cannot prove a
-        # differently encoded retained archive, even when its fields agree.
-        for path, document in self.documents.items():
-            saved, match = document.value, ARCHIVE.fullmatch(path)
-            if (match and isinstance(saved, dict) and saved.get('key') == match[1]
-                    and isinstance(saved.get('origin'), dict) and saved['origin']
-                    and valid_files(saved.get('files'))
-                    and isinstance(saved.get('dependencies', []), list)
-                    and saved['key'] == self.digest(saved['origin'])
-                    and saved.get('digest') == self.digest(saved['files'])
-                    and hashlib.sha256(document.data).hexdigest() == self.digest(saved)):
-                self.archives[saved['key']] = (saved, hashlib.sha256(document.data).hexdigest())
-        self.references()
-
-    def digest(self, value):
-        return self.hashes.get(json.dumps(value))
-
-    def allow(self, path, pointer):
-        self.allowed.setdefault(path, set()).add(pointer)
-
-    def document(self, path):
-        doc = self.documents.get(path)
-        return doc.value if doc and isinstance(doc.value, dict) else {}
-
-    def pin(self, pin, key):
-        if not isinstance(pin, dict) or not isinstance(key, str) or key not in self.archives:
-            return False
-        archive, raw_sha = self.archives[key]
-        return (pin.get('key') == key and pin.get('digest') == archive['digest']
-                and pin.get('sha256') == raw_sha)
-
-    def reference(self, ref, parent=False):
-        if not isinstance(ref, dict):
-            return None
-        if not self.valid_selection(ref):
-            return None
-        selection = dict(path=ref.get('path') or '.', paths=ref.get('paths') or None,
-                         excludeSnapshots=True if parent else bool(ref.get('excludeSnapshots')))
-        projection = ref.get('projection')
-        if isinstance(projection, dict) and set(projection) == {'key', 'sha256'}:
-            key = projection['key']
-            if not isinstance(key, str) or key not in self.archives:
-                return None
-            saved, raw_sha = self.archives[key]
-            if (projection['sha256'] == raw_sha and same_json(saved['origin'].get('selection'), selection)):
-                return key
-            return None
-        origin = self.origin(ref, parent)
-        key = self.digest(origin)
-        if key in self.archives and same_json(self.archives[key][0]['origin'], origin):
-            return key
-        return None
-
-    @staticmethod
-    def valid_selection(ref):
-        return (ref.get('path', '.') == '.' or safe_path(ref.get('path'))) and (
-            ref.get('paths') is None or isinstance(ref['paths'], list) and bool(ref['paths'])
-            and all(safe_path(p) for p in ref['paths'])) and (
-            'excludeSnapshots' not in ref or type(ref['excludeSnapshots']) is bool)
-
-    @staticmethod
-    def origin(ref, parent=False):
-        if not isinstance(ref, dict) or not ContentIdentities.valid_selection(ref):
-            return None
-        projection = ref.get('projection')
-        if (not isinstance(ref.get('repository'), str) or not ref['repository']
-                or ref['repository'].startswith('-')):
-            return None
-        if 'projection' in ref:
-            if ('revision' in ref or not isinstance(projection, dict) or set(projection) != {'schemaVersion', 'originalSha256', 'recipeSha256'}
-                    or type(projection['schemaVersion']) is not int or projection['schemaVersion'] != 1
-                    or not all(isinstance(projection[k], str) and HEX.fullmatch(projection[k])
-                               for k in ('originalSha256', 'recipeSha256'))):
-                return None
-            identity = dict(projection=projection)
-        elif isinstance(ref.get('revision'), str) and re.fullmatch(r'[a-f0-9]{40}', ref['revision']):
-            identity = dict(revision=ref['revision'])
-        else:
-            return None
-        return dict(repository=ref['repository'], **identity, path=ref.get('path') or '.',
-                    paths=ref.get('paths') or None,
-                    excludeSnapshots=True if parent else bool(ref.get('excludeSnapshots')))
-
-    def dependency_locations(self, key):
-        # Stage the entire selected closure before granting any of its locations.
-        # An unresolved later edge must not leave the root or earlier edges allowed.
-        pending, visited, locations = [key], set(), []
-        while pending:
-            key = pending.pop()
-            if key in visited:
+            if not candidate(path):
                 continue
-            visited.add(key)
-            saved, _ = self.archives[key]
-            path = '.edition/sources/' + key + '.json'
-            locations.append((path, ('key',)))
-            for i, pin in enumerate(saved.get('dependencies', [])):
-                if not isinstance(pin, dict) or not self.pin(pin, pin.get('key')):
-                    return None
-                locations.append((path, ('dependencies', i, 'key')))
-                pending.append(pin['key'])
-        return locations
-
-    def references(self):
-        recipe = self.document('edition.json')
-        lock = self.document('sources.lock.json')
-        if type(recipe.get('schemaVersion')) is not int or recipe['schemaVersion'] != 1 or not isinstance(recipe.get('components'), list):
-            return
-        components = lock.get('components')
-        locked = (type(lock.get('schemaVersion')) is int and lock['schemaVersion'] == 1
-                  and isinstance(recipe.get('id'), str) and lock.get('edition') == recipe['id']
-                  and lock.get('manifest') == self.digest(recipe) and isinstance(components, list))
-        if not locked:
-            return
-        def identifiers(entries):
-            ids = [entry.get('id') for entry in entries if isinstance(entry, dict)]
-            return (len(ids) == len(entries) and all(isinstance(i, str) and i for i in ids)
-                    and len(set(ids)) == len(ids))
-        if not identifiers(recipe['components']) or not identifiers(components):
-            return
-        by_id = {c['id']: c for c in components}
-        if (len(components) != len(recipe['components']) or any(
-                c['id'] not in by_id or not same_json(c.get('source'), by_id[c['id']].get('source'))
-                for c in recipe['components'])):
-            return
-        selected = []
-        key = self.reference(recipe.get('parent'), parent=True)
-        if key and locked and self.pin(lock.get('parent'), key):
-            selected.append((key, [
-                ('edition.json', ('parent', 'projection', 'key')),
-                ('sources.lock.json', ('parent', 'key')),
-            ]))
-        for index, component in enumerate(recipe['components']):
-            if not isinstance(component, dict):
-                continue
-            source = component.get('source')
-            if not isinstance(source, dict):
-                continue
-            suffix = () if source.get('kind') == 'git' else ('origin',) if source.get('kind') == 'local' else None
-            if suffix is None:
-                continue
-            key = self.reference(source if not suffix else source.get('origin'))
-            if not key:
+            try:
+                document = Document(data)
+            except (ValueError, TypeError, IndexError, RecursionError, UnicodeError):
                 continue
-            for i, entry in enumerate(components):
-                if (isinstance(entry, dict) and entry.get('id') == component.get('id')
-                        and same_json(entry.get('source'), source) and self.pin(entry.get('baseline'), key)):
-                    selected.append((key, [
-                        ('edition.json', ('components', index, 'source', *suffix, 'projection', 'key')),
-                        ('sources.lock.json', ('components', i, 'baseline', 'key')),
-                        ('sources.lock.json', ('components', i, 'source', *suffix, 'projection', 'key')),
-                    ]))
-        # Validate each selection independently: unselected archives and unrelated
-        # coherent selections cannot invalidate this graph's proof.
-        for key, locations in selected:
-            dependencies = self.dependency_locations(key)
-            if dependencies is not None:
-                for path, pointer in locations + dependencies:
-                    self.allow(path, pointer)
+            self.documents[path] = document
+            pointers = set(module_pins(path, document.value))
+            pointers.update(source_pointers(path, document.value))
+            if path in ('base-copies.json', 'base/PROVENANCE.json') and read_regular is not None:
+                pointers.update(copy_pointers(document.value, read_regular))
+            self.allowed[path] = pointers
 
     def matches(self, path, hit):
         document = self.documents.get(path)

package/scripts/publish-check/git_history.py

@@ -96,12 +96,12 @@ class History:
         records = self.run('log', '-z', '--format=%H%x00%B', *self.revisions).split(b'\0')
         for index in range(0, len(records) - 1, 2):
             if records[index]:
-                yield '@commit-message', records[index].decode().strip(), records[index + 1]
+                yield 'commit', records[index].decode().strip(), records[index + 1]
         for record in self.run('for-each-ref', '--format=%(objecttype) %(objectname)', 'refs/tags').splitlines():
             kind, oid = record.decode().split()
             if kind == 'tag':
                 raw = self.run('cat-file', 'tag', oid)
-                yield '@tag-message', oid, raw.partition(b'\n\n')[2]
+                yield 'tag', oid, raw.partition(b'\n\n')[2]
 
     def close(self):
         if self.reader:

package/scripts/publish-check/github_refs.py

@@ -51,6 +51,10 @@ CONTEXT_URL = re.compile(r'(?i)(?<![A-Za-z])(?:' + REPOSITORY_CONTEXT + r')'
                          + r'''[`*_~\[\]\s"']*(?:''' + URL.pattern.replace('(?i)', '') + ')')
 LINK_URL = re.compile(r'(?i)\[(?P<label>[^]\n]+)\]\(\s*(?P<url>' + URL.pattern.replace('(?i)', '') + ')')
 REPOSITORY_LABEL = re.compile(r'(?i)\b(?:' + REPOSITORY_CONTEXT + r')\b')
+# Words that make a nearby `owner/name` a repository rather than an identifier.
+# A bare "source" is not one: "source commit/tree" is ordinary prose.
+NEARBY_CONTEXT = re.compile(r'(?i)\b(?:github|repositor(?:y|ies)|repos?|forks?|forked|clones?|cloned|upstream|downstream|origin|submodules?)\b')
+CONTEXT_WINDOW = 60
 
 
 def explicit_references(text, path):
@@ -76,6 +80,20 @@ class RepositoryObject(dict):
 
 
 def references(text, path, local_paths=frozenset(), project_identity=None):
+    stated, ambiguous = reference_sets(text, path, local_paths, project_identity)
+    return stated | ambiguous
+
+
+def reference_sets(text, path, local_paths=frozenset(), project_identity=None):
+    """Split `owner/name` tokens into stated repositories and ambiguous ones.
+
+    A stated reference has GitHub context: a URL, a repository field, a labelled
+    or commanded mention, a repository route. An ambiguous token is a bare
+    word/word in prose (`commit/tree`, `rer-delegation/1`, `dmsans/v17`): it is
+    a repository only if one answers to that name privately, never because none
+    does.
+    """
+    ambiguous = set()
     repository_text = SERVICE_URL.sub('', text)
     found = {normalize(m.group(1)) for m in URL.finditer(repository_text)
              if not SPONSORS_URL.match(repository_text, m.start())}
@@ -106,8 +124,16 @@ def references(text, path, local_paths=frozenset(), project_identity=None):
             # A plain multi-segment path is ambiguous; GitHub's repository
             # routes, a labeled field or a GitHub command disambiguate it.
             labeled = explicit and (re.search(r'[:=|]', match['separator']) or re.match(r'(?i)github|gh\s', match['label']))
-            if not suffix or REPOSITORY_ROUTE.match(suffix) or labeled:
+            if REPOSITORY_ROUTE.match(suffix) or labeled:
                 found.add(normalize(repository))
+            elif not suffix:
+                if explicit:
+                    weak = re.fullmatch(r'(?i)source', match['label']) and not re.search(r'(?i)repository|repo', markdown[match.start():match.start('reference')])
+                else:
+                    line_start = markdown.rfind('\n', 0, match.start()) + 1
+                    around = markdown[max(line_start, match.start() - CONTEXT_WINDOW):match.end() + CONTEXT_WINDOW].split('\n', 1)[0]
+                    weak = not NEARBY_CONTEXT.search(around)
+                (ambiguous if weak else found).add(normalize(repository))
     elif METADATA.search(path) or SOURCE.search(path):
         if path.lower().endswith('.json'):
             try:
@@ -146,7 +172,7 @@ def references(text, path, local_paths=frozenset(), project_identity=None):
             found.update(normalize(m.group(1)) for m in TYPED_REPOSITORY.finditer(text))
             for declaration in declarations(text):
                 found.update(normalize(m.group(1)) for m in DECLARED_SHORTHAND.finditer(declaration))
-    return found
+    return found, ambiguous - found
 
 
 def local_dependencies(data, path):

package/scripts/publish-check/gitleaks.toml

@@ -29,7 +29,7 @@ regexes = ['''\.(?:test|fixture|fake|example|dummy|placeholder|synthetic)[_-][a-
 
 # SHA-shaped credentials must not disappear because their random bytes contain
 # an English stopword (for example dead/feed) or fall below generic entropy.
-# Source/module identities still require the location-bound proof in Python.
+# Source/module identities still require exact structural JSON locations in Python.
 [[rules]]
 id = "hex-api-key"
 description = "Hexadecimal credential assignment"

package/scripts/publish-check/history_scan.py

@@ -128,7 +128,7 @@ def scan(repo, ref='HEAD', public_base=None, env_file=None, project=None, reposi
                         if identities[identity_scope].matches(path, hit):
                             continue
                     else:
-                        # Content-identity documents keep their own stricter proof.
+                        # Identity documents use their own exact structural locations.
                         held = working_regular(Path(history.repo), path) if mode == 'dir' else read_regular(path)
                         if held and checksums[identity_scope].matches(held[0], hit):
                             continue
@@ -146,9 +146,11 @@ def scan(repo, ref='HEAD', public_base=None, env_file=None, project=None, reposi
             scope = 'working-tree' if path in working_paths else 'pre-existing' if commit in history.public_commits else 'newly-public'
             lines.append((count, count + length, path, commit, scope))
             count += length
-        for path, commit, data in history.messages():
-            report['history']['tagMessages' if path == '@tag-message' else 'commitMessages'] += 1
-            rules, _ = text_rules(data, path, selected_context, resolver, hashes)
+        for message_type, commit, data in history.messages():
+            path = '@' + message_type + '-message'
+            report['history']['tagMessages' if message_type == 'tag' else 'commitMessages'] += 1
+            rules, _ = text_rules(data, path, selected_context, resolver, hashes,
+                                  commit_message=message_type == 'commit')
             scope = 'release-tree' if commit == history.commit else 'pre-existing' if commit in history.public_commits else 'newly-public'
             for rule in rules:
                 add(rule, path, commit, scope=scope)

package/scripts/publish-check/hygiene_config.py

@@ -9,7 +9,9 @@ LOCAL_PATH = re.compile(r'''(?x)(?<![^\s("'`=:\[<>{|])(?:[*_]|~~)*(?:(?:(?i:(?a:
 CONFIG = '.publish-check/config.json'
 # An alphabetic top-level label ends before a following digit, such as the DER
 # tag after a certificate's email value; other labels keep the full extent.
-EMAIL = re.compile(r"(?<![A-Za-z0-9_.+%-])[A-Za-z0-9_][A-Za-z0-9_.+%'-]{0,63}@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)*[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.(?:[A-Za-z]{2,63}(?![A-Za-z.-])|[A-Za-z][A-Za-z0-9-]{1,62}(?![A-Za-z0-9.-]))|(?<![A-Za-z0-9_.+%-])[A-Za-z0-9_][A-Za-z0-9_.+%'-]{0,63}@(?:example|test|invalid)(?![A-Za-z0-9.-])", re.I)
+# A period is punctuation unless it starts another host label; never shorten
+# a suffixed host into a reserved/public domain.
+EMAIL = re.compile(r"(?<![A-Za-z0-9_.+%-])[A-Za-z0-9_][A-Za-z0-9_.+%'-]{0,63}@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)*[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.(?:[A-Za-z]{2,63}(?![A-Za-z-]|\.[A-Za-z0-9-])|[A-Za-z][A-Za-z0-9-]{1,62}(?![A-Za-z0-9-]|\.[A-Za-z0-9-]))|(?<![A-Za-z0-9_.+%-])[A-Za-z0-9_][A-Za-z0-9_.+%'-]{0,63}@(?:example|test|invalid)(?![A-Za-z0-9-]|\.[A-Za-z0-9-])", re.I)
 RULES = {'hygiene.local-path', 'hygiene.github-private', 'hygiene.github-missing',
          'hygiene.email', 'hygiene.internal-reference'}
 

package/scripts/publish-check/public_hygiene.py

@@ -1,7 +1,7 @@
 """Public-tree and message hygiene; findings never include matched values."""
 from collections import Counter
 import re
-from github_refs import REPOSITORY_HOSTS, references
+from github_refs import REPOSITORY_HOSTS, reference_sets
 from destination import RULE as PENDING_DESTINATION
 from hygiene_text import decoded_text
 from provenance import provenance_text
@@ -9,6 +9,29 @@ from hygiene_config import EMAIL, LOCAL_PATH, public_email
 from font_licence import without_required_notices
 from trust_bundle import anchor_values
 URI_AUTHORITY = re.compile(r'''(?i)(?a:(?P<scheme>[a-z][a-z0-9+.-]*:))?//(?P<authority>[^/?#\s<>"']+)''')
+# Match raw, complete commit trailer lines; decoded or embedded prose cannot
+# acquire trailer privileges. Only the address span is omitted from email checks.
+COAUTHOR = re.compile(
+    rb'^Co-Authored-By:[ \t]+[^<>\r\n]*[^<>\s][ \t]+<(?P<address>'
+    rb'noreply@(?:anthropic|github)\.com|'
+    rb'[0-9]+\+[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,38}@users\.noreply\.github\.com'
+    rb')>[ \t]*\r?$', re.I | re.M)
+
+
+def without_public_coauthor_addresses(data):
+    # A trailer block is the final paragraph and contains only trailer lines.
+    # A quoted attribution followed by ordinary prose stays ordinary body text.
+    tail = data.rstrip(b' \t\r\n')
+    block = re.split(rb'\r?\n[ \t]*\r?\n', tail)[-1]
+    if not all(re.fullmatch(rb'[A-Za-z0-9-]+:[ \t]+[^\r\n]+\r?', line)
+               for line in block.split(b'\n')):
+        return data
+    offset = len(tail) - len(block)
+    result = bytearray(data)
+    for match in COAUTHOR.finditer(block):
+        start, end = match.span('address')
+        result[offset + start:offset + end] = b' ' * (end - start)
+    return bytes(result)
 
 
 def email_userinfo(match):
@@ -25,12 +48,35 @@ def private_emails(text, config):
     # URL paths, queries and fragments remain visible to email inspection.
     email_text = URI_AUTHORITY.sub(email_userinfo, without_required_notices(text))
     email_text = re.sub(r'(?i)\b(?a:git@github\.com:)(?=[A-Za-z0-9])', '', email_text)
-    version = r'(?:v?[0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9-]+)?|[a-f0-9]{40})(?![A-Za-z0-9_.-])'
+    # A package manager's patch filename joins the name and version with an at sign.
+    version = r'(?:v?[0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9-]+)?|[a-f0-9]{40})(?:\.patch)?(?![A-Za-z0-9_.-])'
     email_text = re.sub(r'(?m)^\s*-?\s*uses:\s*[\"\']?[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+@[^\s\"\']+', '', email_text)
     email_text = re.sub(r'(?<![A-Za-z0-9])(?:@[A-Za-z0-9_.-]+/)?[A-Za-z0-9_.-]+(?:/[A-Za-z0-9_.-]+)?@' + version, '', email_text)
     return [match.group() for match in EMAIL.finditer(email_text) if not public_email(match.group(), config)]
 
 
+# A stored host name is lower case, upper case or capitalised, label by label.
+# Bytes that merely decode to text, such as compressed pixels, rarely are.
+HOST_LABEL = re.compile(r'(?:[a-z0-9-]+|[A-Z0-9-]+|[A-Z][a-z0-9-]*)')
+
+
+# Control bytes that no text encoding uses (tab, newline, form feed and carriage
+# return are text). Legacy 8-bit text such as latin-1 or Windows-1252 has none,
+# while compressed or packed data is about one byte in nine.
+NON_TEXT = re.compile(rb'[\x01-\x08\x0b\x0e-\x1f\x7f]')
+BINARY_SHARE = 0.05
+
+
+def binary(data):
+    # NULs are not counted: UTF-16 and UTF-32 text carries them between letters.
+    text = data.replace(b'\0', b'')
+    return bool(text) and len(NON_TEXT.findall(text)) / len(text) > BINARY_SHARE
+
+
+def stored_host(address):
+    return all(HOST_LABEL.fullmatch(label) for label in address.rsplit('@', 1)[1].split('.'))
+
+
 def certificate_metadata(data, bundle, emails, config):
     # Every match lies inside a verified trust-anchor subject value: none
     # remains once those values are blanked, and each is one of theirs.
@@ -46,11 +92,11 @@ def certificate_metadata(data, bundle, emails, config):
     return not Counter(emails) - inside
 
 
-def inspect(data, path, config, resolver):
-    return inspect_text(data, path, config, resolver)
+def inspect(data, path, config, resolver, *, commit_message=False):
+    return inspect_text(data, path, config, resolver, commit_message=commit_message)
 
 
-def inspect_text(data, path, config, resolver):
+def inspect_text(data, path, config, resolver, *, commit_message=False):
     # NUL removal covers UTF-16/32 ASCII content, matching the secret scanner.
     text = decoded_text(data)
     rules = set()
@@ -59,18 +105,27 @@ def inspect_text(data, path, config, resolver):
     if any(pattern.search(text) for pattern in config['internalReferencePatterns']):
         rules.add('hygiene.internal-reference')
     if '@' in text:
-        emails = private_emails(text, config)
+        email_text = decoded_text(without_public_coauthor_addresses(data)) if commit_message else text
+        emails = private_emails(email_text, config)
         bundle = config.get('trustBundles', {}).get(path)
         if emails and not (bundle and certificate_metadata(data, bundle, emails, config)):
-            rules.add('hygiene.email')
+            # Inside binary data a mailbox is judged by its own shape: a host
+            # name with mixed-case letters inside a label is not one.
+            if not binary(data) or any(stored_host(email) for email in emails):
+                rules.add('hygiene.email')
     ref_text, provenance = provenance_text(text, path, config.get('declaredSources', frozenset()))
-    for repository in references(ref_text, path, config.get('localPaths', frozenset()), config.get('projectIdentity')):
+    stated, ambiguous = reference_sets(ref_text, path, config.get('localPaths', frozenset()), config.get('projectIdentity'))
+    for repository in sorted(stated | ambiguous):
         # A future source identity does not assert current GitHub visibility.
         # Explicit release destinations still take the strict visibility path.
         if (repository in config.get('intendedPublicRepositories', frozenset()) and
                 repository != config.get('pendingDestination')):
             continue
         state = resolver.resolve(repository)
+        # A bare word/word with no GitHub context names a repository only when
+        # one exists privately; that no repository answers to it proves nothing.
+        if state == 'missing' and repository in ambiguous and repository != config.get('pendingDestination'):
+            continue
         if state == 'missing' and repository == config.get('pendingDestination'):
             rules.add(PENDING_DESTINATION)
         elif state in ('private', 'missing'):

package/scripts/publish-check/publication-config.json

@@ -7,6 +7,21 @@
     { "repository": "just-every/lamp", "reason": "Owner-declared public identity; created by clean-history export at the first public tag." },
     { "repository": "just-every/dial", "reason": "Owner-declared public identity; created by clean-history export at the first public tag." },
     { "repository": "just-every/orbit", "reason": "Owner-declared public identity; created by clean-history export at the first public tag." },
-    { "repository": "just-every/uptime-monitor", "reason": "Owner-declared public identity; created by clean-history export at the first public tag." }
+    { "repository": "just-every/uptime-monitor", "reason": "Owner-declared public identity; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-slate", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-pencil", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-lamp", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-uptime", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-cradle", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-vector", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-mango", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-dial", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-penny", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-nook", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-orbit", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-oncall", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-spool", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-happytohelp", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-auth", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." }
   ]
 }