Reject provenance hidden in PR comments

Authored-By: Codex (GPT-5) <noreply@openai.com>

check.sh

@@ -11,6 +11,37 @@ BODY="${PR_BODY:-}"
 BASE="${BASE_SHA:-}"
 HEAD="${HEAD_SHA:-}"
 
+# Gitea renders HTML comments as hidden. Validate the visible body so required
+# tracking and attribution cannot exist only in comment source.
+VISIBLE_BODY=$(printf '%s\n' "${BODY}" | awk '
+  {
+    line=$0
+    while (line != "") {
+      if (in_comment) {
+        end=index(line, "-->")
+        if (end == 0) {
+          line=""
+          break
+        }
+        line=substr(line, end + 3)
+        in_comment=0
+      }
+      start=index(line, "<!--")
+      if (start == 0) break
+      before=substr(line, 1, start - 1)
+      rest=substr(line, start + 4)
+      end=index(rest, "-->")
+      if (end == 0) {
+        line=before
+        in_comment=1
+        break
+      }
+      line=before substr(rest, end + 3)
+    }
+    print line
+  }
+')
+
 # Break-glass: dfritz is exempt from all naming checks.
 if [ "${AUTHOR}" = "dfritz" ]; then
   echo "check-naming: dfritz break-glass — exempt"
@@ -53,7 +84,7 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then
     FAILED=1
   fi
 
-  tracking=$(printf '%s\n' "${BODY}" | awk '
+  tracking=$(printf '%s\n' "${VISIBLE_BODY}" | awk '
     /^## Tracking[[:space:]]*$/ { in_section=1; next }
     /^## / && in_section { exit }
     in_section { print }
@@ -72,7 +103,7 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then
     fi
   fi
 
-  attribution=$(printf '%s\n' "${BODY}" | awk '
+  attribution=$(printf '%s\n' "${VISIBLE_BODY}" | awk '
     /^## Attribution[[:space:]]*$/ { in_section=1; next }
     /^## / && in_section { exit }
     in_section { print }

tests/run

@@ -104,6 +104,9 @@ check_contract "tracking rejects wrong Bug URL" \
 check_contract "attribution must be in its own section" \
   $'## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
   "$BASE" "$GOOD_HEAD" "## Attribution must contain"
+check_contract "hidden provenance does not satisfy the visible contract" \
+  $'<!--\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
 
 git -C "${FIXTURES}" commit --allow-empty -q -m "unwatermarked change"
 BAD_HEAD=$(git -C "${FIXTURES}" rev-parse HEAD)