bigpowers 2.76.2 → 2.76.3

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.76.2",
+  "version": "2.76.3",
   "description": "77 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/.pi/prompts/commit-message.md

@@ -37,6 +37,7 @@ description: "Reviews working-tree changes, then drafts a Conventional Commits t
 - [ ] **Scope** is a short noun in parentheses if it helps (e.g. `fix(api): …`).
 - [ ] Breaking changes are explicit (`!` and/or `BREAKING CHANGE:` in the body/footer).
 - [ ] Description is imperative, lowercase start after the prefix, no trailing period in the title line.
+- [ ] **NO `Co-authored-by` or `Co-Authored-By` footers** — P1 rule (CONVENTIONS.md § Git Attribution). All commits must appear as if authored solely by the human user. The git hook and `land-branch.sh` both block these.
 
 ## When not to invent a bump
 

package/.pi/prompts/release-branch.md

@@ -40,9 +40,12 @@ If unsure, prefer **solo-local**.
 ```bash
 <full test command> && <typecheck command> && <lint command>
 git log main...HEAD --oneline | grep -vE "^[a-f0-9]+ (feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?!?: .+$" && echo "❌ Non-conventional commits found" || echo "✅ Commits verified"
+# Block AI agent attribution (P1)
+git log main...HEAD --format="%B" | grep -qiE 'co[- ]authored[- ]by' && echo "❌ Co-authored-by footer found — blocked" || echo "✅ No AI attribution"
 ```
 
 - [ ] All tests pass, no type errors, no lint violations, all commits follow Conventional Commits
+- [ ] **NO `Co-authored-by` or `Co-Authored-By`** in any commit body — P1 rule (CONVENTIONS.md § Git Attribution). `land-branch.sh` blocks the merge if found.
 
 ### 2. Coverage check
 

package/.pi/skills/commit-message/SKILL.md

@@ -38,6 +38,7 @@ description: "Reviews working-tree changes, then drafts a Conventional Commits t
 - [ ] **Scope** is a short noun in parentheses if it helps (e.g. `fix(api): …`).
 - [ ] Breaking changes are explicit (`!` and/or `BREAKING CHANGE:` in the body/footer).
 - [ ] Description is imperative, lowercase start after the prefix, no trailing period in the title line.
+- [ ] **NO `Co-authored-by` or `Co-Authored-By` footers** — P1 rule (CONVENTIONS.md § Git Attribution). All commits must appear as if authored solely by the human user. The git hook and `land-branch.sh` both block these.
 
 ## When not to invent a bump
 

package/.pi/skills/release-branch/SKILL.md

@@ -41,9 +41,12 @@ If unsure, prefer **solo-local**.
 ```bash
 <full test command> && <typecheck command> && <lint command>
 git log main...HEAD --oneline | grep -vE "^[a-f0-9]+ (feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?!?: .+$" && echo "❌ Non-conventional commits found" || echo "✅ Commits verified"
+# Block AI agent attribution (P1)
+git log main...HEAD --format="%B" | grep -qiE 'co[- ]authored[- ]by' && echo "❌ Co-authored-by footer found — blocked" || echo "✅ No AI attribution"
 ```
 
 - [ ] All tests pass, no type errors, no lint violations, all commits follow Conventional Commits
+- [ ] **NO `Co-authored-by` or `Co-Authored-By`** in any commit body — P1 rule (CONVENTIONS.md § Git Attribution). `land-branch.sh` blocks the merge if found.
 
 ### 2. Coverage check
 

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [2.76.3](https://github.com/danielvm-git/bigpowers/compare/v2.76.2...v2.76.3) (2026-07-11)
+
+
+### Bug Fixes
+
+* **scripts:** move Co-authored-by feature branch scan after DEFAULT_BRANCH is set ([842dfb3](https://github.com/danielvm-git/bigpowers/commit/842dfb3c8caf710f75b1bc234f3178596d2e78df))
+* **security:** enforce Co-authored-by ban across all commit paths ([b8610cd](https://github.com/danielvm-git/bigpowers/commit/b8610cdb060faebf94b614354c80c052d985c40d))
+
 ## [2.76.2](https://github.com/danielvm-git/bigpowers/compare/v2.76.1...v2.76.2) (2026-07-09)
 
 

package/hooks/pre-tool-use.sh

@@ -107,6 +107,11 @@ if [[ "$COMMAND" =~ git[[:space:]]+commit ]] || [[ "$COMMAND" =~ git[[:space:]]+
       if [ ${#SUBJECT} -gt 72 ]; then
         deny "BLOCKED: Commit subject line must be 72 characters or less."
       fi
+
+      # Block AI agent attribution (P1 — NEVER Co-authored-by:)
+      if echo "$MSG" | grep -qiE '^co[- ]authored[- ]by:' || echo "$MSG" | grep -qiE '\nco[- ]authored[- ]by:'; then
+        deny "BLOCKED: Commit must not include Co-authored-by: footer. All commits must appear as if authored solely by the human user (CONVENTIONS.md § Git Attribution)."
+      fi
     fi
 
     # Block direct commits to main unless land script is active

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.76.2",
+  "version": "2.76.3",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/land-branch.sh

@@ -41,6 +41,11 @@ if [ ${#COMMIT_MSG} -gt 72 ]; then
   land_branch_deny "Commit subject line must be 72 characters or less"
 fi
 
+# Block AI agent attribution (P1 — CONVENTIONS.md § Git Attribution)
+if echo "$COMMIT_MSG" | grep -qiE '^co[- ]authored[- ]by:' || echo "$COMMIT_MSG" | grep -qiE '\nco[- ]authored[- ]by:'; then
+  land_branch_deny "Commit must not include Co-authored-by: footer. All commits must appear as if authored solely by the human user."
+fi
+
 # Primary worktree only (.git is a directory, not a gitdir pointer file)
 if [ -f .git ]; then
   land_branch_deny "Run from the primary repository root, not a linked worktree (cd to main repo first)"
@@ -72,6 +77,11 @@ if ! git show-ref --verify --quiet "refs/heads/$FEATURE_BRANCH"; then
   land_branch_deny "Feature branch '$FEATURE_BRANCH' does not exist"
 fi
 
+# Scan all commits in feature branch for Co-authored-by: footers
+if git log "$DEFAULT_BRANCH..$FEATURE_BRANCH" --format="%B" 2>/dev/null | grep -qiE '^co[- ]authored[- ]by:'; then
+  land_branch_deny "Feature branch '$FEATURE_BRANCH' contains Co-authored-by: footer(s). Amend commits to remove all AI agent attribution before landing."
+fi
+
 for protected in main master; do
   if [ "$FEATURE_BRANCH" = "$protected" ]; then
     land_branch_deny "Cannot land protected branch '$FEATURE_BRANCH'"

package/skills/commit-message/SKILL.md

@@ -39,6 +39,7 @@ description: Reviews working-tree changes, then drafts a Conventional Commits ti
 - [ ] **Scope** is a short noun in parentheses if it helps (e.g. `fix(api): …`).
 - [ ] Breaking changes are explicit (`!` and/or `BREAKING CHANGE:` in the body/footer).
 - [ ] Description is imperative, lowercase start after the prefix, no trailing period in the title line.
+- [ ] **NO `Co-authored-by` or `Co-Authored-By` footers** — P1 rule (CONVENTIONS.md § Git Attribution). All commits must appear as if authored solely by the human user. The git hook and `land-branch.sh` both block these.
 
 ## When not to invent a bump
 

package/skills/release-branch/SKILL.md

@@ -43,9 +43,12 @@ If unsure, prefer **solo-local**.
 ```bash
 <full test command> && <typecheck command> && <lint command>
 git log main...HEAD --oneline | grep -vE "^[a-f0-9]+ (feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?!?: .+$" && echo "❌ Non-conventional commits found" || echo "✅ Commits verified"
+# Block AI agent attribution (P1)
+git log main...HEAD --format="%B" | grep -qiE 'co[- ]authored[- ]by' && echo "❌ Co-authored-by footer found — blocked" || echo "✅ No AI attribution"
 ```
 
 - [ ] All tests pass, no type errors, no lint violations, all commits follow Conventional Commits
+- [ ] **NO `Co-authored-by` or `Co-Authored-By`** in any commit body — P1 rule (CONVENTIONS.md § Git Attribution). `land-branch.sh` blocks the merge if found.
 
 ### 2. Coverage check
 

package/skills-lock.json

@@ -33,7 +33,7 @@
     },
     "commit-message": {
       "description": "Reviews working-tree changes, then drafts a Conventional Commits title/body and states the semantic-release version bump a single such commit would imply. Also notes which defensive-code categories were touched. Use when the user wants to commit recent work, prepare a Conventional Commits message, or asks for semantic-release / semver-consistent messaging before git commit.",
-      "sha256": "61d7f45ea8ccd085",
+      "sha256": "1ed4ef65d813a84d",
       "path": "skills/commit-messageSKILL.md"
     },
     "compose-workflow": {
@@ -238,7 +238,7 @@
     },
     "release-branch": {
       "description": "Make the merge/PR/keep/discard decision for a feature branch, verify coverage gates, create the PR with gh, and clean up the worktree. Use when a feature is done and ready to ship, or when user says \"release\", \"merge\", or \"open a PR\".",
-      "sha256": "5da46a5b7aa7403f",
+      "sha256": "7e94a540b1dc75c1",
       "path": "skills/release-branchSKILL.md"
     },
     "request-review": {