the "Filed by an agent" provenance marker is a cross-system wire format with no shared pin

[usirin]

Summary

Filed by an agent is a literal string that fabrika's report file writes into every issue footer, and that v1's triage reads to decide whether an issue was agent-filed (auto-closable) or hand-typed by a human (structurally protected, never swept). Nothing pins one side's bytes against the other's expectation — fabrika's tests pin only its own output, and triage states its expectation as prose in a SKILL.md. A reword on either side leaves both sides green while the seam silently breaks, and the breakage looks exactly like a healthy backlog.

What I was doing

Reviewing the /report producer/consumer seam after PR #4757 (feat(fabrika-cli): the three /report verbs — dedup, file, note, from #4748) landed the fabrika-side footer composition, and tracing what actually carries provenance between fabrika and v1 triage.

What I observed

The marker is a wire format, not prose. It is ADR 0159's never-auto-close signal, and the only usable provenance signal between two independently-versioned systems.

Producer — packages/fabrika-cli/src/report/compose.ts:98, where the literal is hardcoded as the first element of the footer's parts array and joined with · inside ---\n<sub>…</sub> (render at :104):

const parts = [
	"Filed by an agent",
	fields.session === null ? null : `session \`${fields.session}\``,
	…
].filter((p): p is string => p !== null);
return `---\n<sub>${parts.join(" · ")}</sub>`;

Consumer — claude-plugins/kampus-pipeline/skills/triage/SKILL.md (the provenance block, ~L460–493), which matches <sub>Filed by an agent · …</sub> and calls the literal marker the signal.

The semantics it carries:

• marker present ⇒ agent-filed ⇒ eligible for auto-close after confirmation
• marker absent ⇒ hand-typed by a human ⇒ structurally protected, never closed by a sweep

Authorship cannot serve this role: every pipeline-filed issue goes through one shared login, so GitHub's author field is constant across both humans and agents. The literal string is all there is.

The defect: nothing pins the producer's bytes against the consumer's expectation.

• packages/fabrika-cli/src/report/compose.unit.test.ts pins fabrika's own output string — including a test explicitly named for never dropping the marker, and a sparse-footer case proving it survives when every optional field is absent. Good tests. They pin one side.
• Triage states its expectation in prose in a SKILL.md. There is no executable assertion.

So a reword on either side leaves both sides green independently while the seam silently breaks. No test fails, no guard reds, no CI job notices.

Why the failure is invisible rather than loud. If the marker drifts, triage reclassifies every fabrika-filed issue as human-typed. That direction fails safe — over-protection, not data loss; nothing gets wrongly closed. That is exactly what makes it dangerous to operate: the symptom is kill sweeps quietly finding nothing to close, which looks identical to a healthy backlog with no stale agent-filed issues. There is no error state to notice. The system degrades into permanent over-protection and reports success the whole way.

This is the same defect class this campaign has catalogued repeatedly (#4520, #4700, #4666, #4752, #4754): a check that cannot see what it is looking for, failing as a plausible value rather than as an error. Here the "check" is triage's provenance test, and the plausible value is "human-typed."

What is already right — a fix must not regress it:

• The producer treats the marker as unconditional, not a droppable field — first element of the parts array, outside the null-filter that removes absent optional fields.
• packages/fabrika-cli/src/report/file-verb.ts:81 performs a read-back assertion: after creating the issue it re-reads the body and refuses if the marker is absent (the body is missing the \Filed by an agent` marker`), so a composition regression fails loudly at file time rather than silently producing an unmarked issue.
• report note deliberately does not emit the marker, and a test asserts its absence. That is correct — a note is a comment, not an issue, and issue provenance does not belong on it. A naive "make everything emit the marker" fix would be wrong.
• Triage's five-section fingerprint is a soft recognizer that explicitly leans on the marker and tolerates missing best-effort fields. A sparse footer is still a footer. The marker is the invariant; the rest is not.

Why it matters

The two protections that exist both sit on the producer's side of the seam: fabrika's unit tests and its read-back assertion both catch fabrika drifting from itself. Neither can see the consumer. If triage's matcher is reworded — or if a future producer change alters the surrounding <sub>/· envelope that triage's pattern depends on — every fabrika-filed issue silently becomes "human-typed" and permanently exempt from auto-close.

The operational cost is not a wrong close; it is a sweep that reports success while doing nothing, indistinguishable from a clean backlog. Backlog hygiene degrades with no signal that it has stopped working, and the degradation is only discoverable by someone independently noticing that agent-filed issues never get closed anymore.

Pointers

• packages/fabrika-cli/src/report/compose.ts — the producer (marker at :98, footer render at :104)
• packages/fabrika-cli/src/report/compose.unit.test.ts — the one-sided pin
• packages/fabrika-cli/src/report/file-verb.ts — the read-back assertion at :81
• claude-plugins/kampus-pipeline/skills/triage/SKILL.md — the consumer's provenance block (~L460–493)
• ADR 0159 — the never-auto-close signal
• ADR 0238 — fabrika re-implements v1 rather than calling it (why a shared import is not available)
• PRs feat(fabrika-cli): the three /report verbs — dedup, file, note (#4748) #4757 / Implement the three /report fabrika verbs — the merged contract has no implementation ticket #4748 — where the producer landed
• Same defect class: verdict gate: a repeated --require flag keeps only ONE namespace, reports enqueueable past a live FAIL #4520, review-code's glossary-freshness detector never compiles — its awk regex is malformed, so the check reads as a clean skip #4700, Skill fence exits 127 with empty stdout when the hook-planted .claude/.pipeline link is absent — "never ran" can read as "said no" #4666, spec defect: report dedup reports "none" over a nonexistent --label — a proven negative on zero scope #4752, banking a §CP PR does not arm the approval-watcher — an approved PR can strand indefinitely with no error #4754

Suggested next step (non-binding)

Guesses only; triage owns the decision.

• A single shared constant both sides import, so a reword is a compile error rather than a silent divergence. Complicated by the fact that one side is a skill's markdown and the other is TypeScript — and by ADR 0238, which forbids fabrika-cli importing anything from packages/pipeline-cli/ or claude-plugins/kampus-pipeline/. A fix must not create a tether; that constraint is load-bearing and a naive shared-import fix violates it.
• Or an executable conformance check that reads the marker out of the consumer's stated contract and asserts the producer emits it — a test that fails if either side moves, owned by neither.
• Worth recording either way: two systems deliberately forbidden from calling each other still share a wire format, and that seam needs a pin that is not a call.

---

_{Filed by an agent · session fcd74bd3-8872-4023-b100-a81ac870eb43 · branch main · 2026-08-02T19:09:46Z}

[usirin]

Triage

type:decision · p2 · homed in the fabrika campaign milestone (#44).

Verification — what I checked in source myself

Every source claim in the report was re-grounded against origin/main (the local main checkout
predates packages/fabrika-cli/, so all reads below are against origin/main). All of them hold:

• Producer — packages/fabrika-cli/src/report/compose.ts:98: "Filed by an agent" is the first
  element of renderFooter's parts array, outside the .filter((p): p is string => p !== null)
  that drops absent optional fields, rendered at :104 as `---\n<sub>${parts.join(" · ")}</sub>`.
  Unconditional, as described.
• Read-back assertion — packages/fabrika-cli/src/report/file-verb.ts:81-82:
  if (!issue.body.includes("Filed by an agent")) return "the body is missing the \Filed by an agent` marker"`.
  Confirmed.
• One-sided pin — packages/fabrika-cli/src/report/compose.unit.test.ts:73, :86, and :90
  (the named never-drops-the-marker case asserting the sparse footer
  ---\n<sub>Filed by an agent · 2026-08-01T14:22:07Z</sub>). Confirmed: these pin fabrika's output
  against fabrika's own expectation only.
• report note omits it deliberately — packages/fabrika-cli/src/report/note-verb.unit.test.ts:108
  asserts not.toContain("Filed by an agent"). Confirmed; the report's warning that a naive
  "make everything emit it" fix would be wrong is correct.
• Consumer is prose — claude-plugins/kampus-pipeline/skills/triage/SKILL.md:466, :478-479,
  :493, backed by claude-plugins/kampus-pipeline/skills/gh-issue-intake-formats.md:1072-1073
  (§4.5). Confirmed: no executable assertion on the consumer side.
• ADR 0238 — read in full. It bans a fabrika skill or verb invoking pipeline-cli or anything
  under claude-plugins/kampus-pipeline/, and bans relay-only wrapper verbs. The report's summary of
  it is accurate.

Triage note — three corrections/extensions to the framing

1. The consumer is not a matcher — it is a model reading a skill's markdown. A grep over
   origin/main for the literal, agent-filed, and filedByAgent across
   packages/pipeline-cli/src/ returns no programmatic consumer of the marker (the only hits are a
   prose string in homing-guard.ts and two fixtures in pitch-guard.unit.test.ts). So the seam is
   not code-to-code. That sharpens the question: there is no consumer-side artifact to pin against
   today — a pin would have to assert the producer emits the literal that the stated contract
   (gh-issue-intake-formats.md §4.5 / ADR 0159) names, with the contract doc as the authority.

2. There are two producers, not one. claude-plugins/kampus-pipeline/skills/report/footer.sh:11
   hardcodes the same literal (parts=("Filed by an agent")) for v1's own report skill, and
   claude-plugins/kampus-pipeline/skills/wayfinder/SKILL.md:497 instructs its emitted issues to
   carry the same footer. Any pin that only covers fabrika-cli leaves those two unpinned.

3. Both obvious fixes collide with ADR 0238's deletion test, not just its import ban. A shared
   constant is blocked outright. But a conformance test living in packages/fabrika-cli/ that reads
   claude-plugins/kampus-pipeline/skills/triage/SKILL.md as a fixture is also a live tether: it
   makes deleting v1 break fabrika's suite, which is the exact property 0238 exists to protect. A
   pin owned by neither side — e.g. a CI guard that reads the literal out of the contract doc and
   asserts every producer emits it — is the only shape that obviously survives the constraint, and
   whether it is worth the surface is the open call.

Why type:decision and not type:bug

Nothing currently diverges — I verified both producers and the stated contract carry byte-identical
literals right now, so there is no violated "supposed to" and no behavior to repair. The deliverable
here is a recorded choice (pin it and how, without a tether — or accept the drift risk and say so),
which is one question with an ADR-shaped output. Per the skill's decision-vs-epic and bug-vs-chore
boundaries that lands on decision. If the ruling is "add the guard," the implementation is a
follow-up child, not this issue.

Why p2

Priced on merit, not on campaign membership (ADR 0219). The failure requires a future reword that has
not happened, fails safe when it does (over-protection, never a wrong close), and the seam is
inherently transitional — it disappears when fabrika ships its own triage consumer. Real, actionable,
worth doing; not work I would argue for pulling ahead of the rest of the backlog. p2 is the default
band for exactly that (ADR 0202 §1 pricing, p0 reserved for ship-work and fires).

Relationship to #4760 — distinct, not a duplicate

Kept as two issues. They rhyme at the level of "provenance asserted inside a body rather than carried
by a trustworthy channel," but they share no surface, no failure mode, and no fix:

	#4759	#4760
Surface	packages/fabrika-cli/src/report/, claude-plugins/kampus-pipeline/skills/	packages/pipeline-crew-mcp/, claude-plugins/pipeline-crew/
Signal	issue-provenance literal in a filed issue body	sender identity on inter-seat relayed text
State today	both sides agree; the gap is an absent pin	the field does not exist on the operator-relay path at all
Failure	fails safe (over-protection)	fails open (a mis-attributed instruction gets acted on)
Deliverable	a ruling on how to pin a cross-system literal without a tether	a rule for signing/attributing relayed text

Folding them would produce one issue no single agent could finish. A cross-link is the right amount
of coupling.

Acceptance criteria (seed — a review-* gate may append)

• An ADR records whether the Filed by an agent marker gets an executable pin, and if so which
  artifact owns it — explicitly reconciled against ADR 0238's ban on fabrika calling v1 and
  against the deletion test (a fixture read is a tether too).
• The ruling states which producers are in scope — at minimum packages/fabrika-cli/src/report/compose.ts
  and claude-plugins/kampus-pipeline/skills/report/footer.sh — or records why a partial pin is
  acceptable.
• The ruling names the authority the pin asserts against (the gh-issue-intake-formats.md §4.5 /
  ADR 0159 contract, not either implementation).
• report note's deliberate omission of the marker is preserved by whatever is decided.
• If the ruling is "add a guard," a follow-up implementation issue is filed; if it is "accept the
  risk," ADR 0159 is amended to say so out loud.

Not applied (out of this run's authorization)

This run was scoped to labels, milestone, and this comment on #4759 only. Two things follow from that:

• The body was not rewritten. Under the skill's Step 4 the corrections above would normally be
  promoted into the body over a <details>-preserved original. They live here instead — a
  write-code or ADR-authoring agent should read this comment as part of the spec.
• No cross-link comment was posted on Operator-relayed text has no sender; a typed role sign-off is indistinguishable from a real send #4760. Recommended, not done: a related to #4759 /
  related to #4760 pair, since the distinct-vs-fold call above is only recorded on this side.

[usirin]

Ruled (founder-delegated judgment, standing trust ruling 2026-08-09, chief-of-staff, ~93%; founder live, veto open): same ruling as #4892, same owner — the 'Filed by an agent' footer is a wire format owned by fabrika's wire group. One pinned byte-level spec + golden fixture in wire's contract; report file (the writer) and every reader (fabrika triage, and v1 triage until retirement) test against that one fixture. A reword on either side reds a fixture test instead of silently flipping agent-filed issues into human-protected ones. Note the #4619 provenance ruling layers ABOVE this (operator-set authorship counts as agent-reported regardless of footer) — the footer format is the mechanical layer, #4619 is the policy layer; pinning one does not weaken the other. Flipping ready-for:agent.