Merge pull request '[bug-yhg8dqypwmar] fix(check-naming): reject hidden provenance' (#4) from architect/bug-yhg8dqypwmar/reject-hidden-provenance into main

README.md

@@ -37,6 +37,8 @@ jobs:
           pr-title: ${{ github.event.pull_request.title }}
           pr-author: ${{ github.event.pull_request.user.login }}
           pr-body: ${{ github.event.pull_request.body }}
+          server-url: ${{ github.server_url }}
+          token: ${{ github.token }}
           base-sha: ${{ github.event.pull_request.base.sha }}
           head-sha: ${{ github.event.pull_request.head.sha }}
 ```
@@ -52,12 +54,14 @@ job — the step still fails, but the job cannot block the PR.
 | `pr-title` | yes | PR title — `github.event.pull_request.title` |
 | `pr-author` | no | PR author login — `github.event.pull_request.user.login`; `dfritz` is exempt |
 | `pr-body` | yes | PR description — `github.event.pull_request.body` |
+| `server-url` | yes | Gitea server URL — `github.server_url` |
+| `token` | yes | Gitea Actions token — `github.token` |
 | `base-sha` | yes | Base commit — `github.event.pull_request.base.sha` |
 | `head-sha` | yes | Head commit — `github.event.pull_request.head.sha` |
 
 ## Behavior
 
-The check validates four things for a Bug-backed Agent PR:
+The check validates four things for every non-break-glass Agent PR:
 
 1. **Branch form** — must be `<role>/bug-<id>/<kebab>` or `chore/<kebab>`.
    Unknown roles, missing `bug-` segment, uppercase bug-ids, and empty
@@ -67,12 +71,17 @@ The check validates four things for a Bug-backed Agent PR:
    `[bug-<id>] `. For a `chore` branch the title must have no `[bug-id]`
    prefix. If both carry a bug-id they must match.
 
-3. **Tracking and attribution** — `## Tracking` contains both the literal
+3. **Tracking and attribution** — on Bug-backed work, `## Tracking` contains both the literal
    `Fixes bug-<id>` automation token and the matching navigable
-   `https://agenthub.fritzlab.net/bug-<id>` URL. A separate `## Attribution`
+   `https://agenthub.fritzlab.net/bug-<id>` URL. Every PR has a separate
-   section contains the canonical `Authored-By` product/model watermark.
+   `## Attribution` section containing the canonical `Authored-By`
+   product/model watermark. The action asks Gitea to render the body with a
+   bounded 5-second connection and 15-second total wait, then checks visible
+   `<h2>` sections outside collapsed `<details>` content. Fenced, commented,
+   scripted, or collapsed copies do not satisfy the visible provenance contract.
 
-4. **Commit attribution** — every commit in `base-sha..head-sha` ends with
+4. **Commit attribution** — every commit in `base-sha..head-sha`, including
+   commits on `chore/` branches, ends with
    the canonical `Authored-By` trailer, separated from the message body by a
    blank line. The naming job must check out full history before this action.
 

action.yaml

@@ -29,6 +29,12 @@ inputs:
   pr-body:
     description: PR description — github.event.pull_request.body.
     required: true
+  server-url:
+    description: Gitea server URL — github.server_url.
+    required: true
+  token:
+    description: Gitea Actions token — github.token.
+    required: true
   base-sha:
     description: Base commit SHA — github.event.pull_request.base.sha.
     required: true
@@ -46,6 +52,8 @@ runs:
         PR_TITLE: ${{ inputs.pr-title }}
         PR_AUTHOR: ${{ inputs.pr-author }}
         PR_BODY: ${{ inputs.pr-body }}
+        GITEA_SERVER_URL: ${{ inputs.server-url }}
+        GITEA_TOKEN: ${{ inputs.token }}
         BASE_SHA: ${{ inputs.base-sha }}
         HEAD_SHA: ${{ inputs.head-sha }}
       run: bash "${{ github.action_path }}/check.sh"

check.sh

@@ -10,6 +10,8 @@ AUTHOR="${PR_AUTHOR:-}"
 BODY="${PR_BODY:-}"
 BASE="${BASE_SHA:-}"
 HEAD="${HEAD_SHA:-}"
+SERVER_URL="${GITEA_SERVER_URL:-}"
+TOKEN="${GITEA_TOKEN:-}"
 
 # Break-glass: dfritz is exempt from all naming checks.
 if [ "${AUTHOR}" = "dfritz" ]; then
@@ -21,6 +23,64 @@ FAILED=0
 BRANCH_KIND="invalid"
 BRANCH_BUG=""
 
+# Gitea's renderer is the visibility contract. Validate its output instead of
+# maintaining a second Markdown parser in this action.
+RENDERED_BODY=""
+if [ -z "${SERVER_URL}" ] || [ -z "${TOKEN}" ]; then
+  echo "FAIL[check-naming]: server-url and token are required to render the PR body"
+  FAILED=1
+elif ! RENDERED_BODY=$(printf '%s' "${BODY}" |
+  jq -Rs '{Text: ., Mode: "gfm"}' |
+  curl --fail --silent --show-error \
+    --connect-timeout 5 \
+    --max-time 15 \
+    --header "Authorization: token ${TOKEN}" \
+    --header "Content-Type: application/json" \
+    --data-binary @- "${SERVER_URL%/}/api/v1/markdown"); then
+  echo "FAIL[check-naming]: Gitea could not render the PR body"
+  FAILED=1
+fi
+
+# A collapsed disclosure is valid supporting content, but provenance inside one
+# is not visible by default. Remove only collapsed details subtrees; an open
+# disclosure remains visible unless one of its ancestors is collapsed.
+VISIBLE_BODY=$(printf '%s\n' "${RENDERED_BODY}" |
+  awk '
+    {
+      line=$0 "\n"
+      for (i=1; i<=length(line); i++) {
+        char=substr(line, i, 1)
+        if (in_tag) {
+          tag=tag char
+          if (char == ">") {
+            lower=tolower(tag)
+            if (lower ~ /^<details([[:space:]>])/) {
+              attributes=lower
+              gsub(/"[^"]*"/, "", attributes)
+              parent_hidden=(details_depth > 0 && hidden[details_depth])
+              details_depth++
+              hidden[details_depth]=(parent_hidden || attributes !~ /[[:space:]]open([[:space:]=>]|$)/)
+            }
+            else if (lower ~ /^<\/details([[:space:]>])/) {
+              if (details_depth > 0) {
+                delete hidden[details_depth]
+                details_depth--
+              }
+            }
+            else if (!hidden[details_depth]) printf "%s", tag
+            in_tag=0
+            tag=""
+          }
+        }
+        else if (char == "<") {
+          in_tag=1
+          tag=char
+        }
+        else if (!hidden[details_depth]) printf "%s", char
+      }
+    }
+  ')
+
 # ---- branch form ----
 # <role>/bug-<id>/<kebab>
 if echo "${BRANCH}" | grep -qE "^(dev|ux|ops|security|perf|architect|support)/bug-[a-z0-9]+/[a-z0-9][a-z0-9-]*$"; then
@@ -53,16 +113,16 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then
     FAILED=1
   fi
 
-  tracking=$(printf '%s\n' "${BODY}" | awk '
+  tracking=$(printf '%s\n' "${VISIBLE_BODY}" | awk '
-    /^## Tracking[[:space:]]*$/ { in_section=1; next }
+    /<h2[^>]*>Tracking<\/h2>/ { in_section=1; next }
-    /^## / && in_section { exit }
+    /<h2[^>]*>/ && in_section { exit }
     in_section { print }
   ')
   if [ -z "${tracking}" ]; then
     echo "FAIL[check-naming]: PR body must contain a non-empty ## Tracking section"
     FAILED=1
   else
-    if ! printf '%s\n' "${tracking}" | grep -qE "(^|[[:space:]])Fixes[[:space:]]+${BRANCH_BUG}([^a-z0-9]|$)"; then
+    if ! printf '%s\n' "${tracking}" | grep -qE "(^|[[:space:]>])Fixes[[:space:]]+${BRANCH_BUG}([^a-z0-9]|$)"; then
       echo "FAIL[check-naming]: ## Tracking must contain the literal token 'Fixes ${BRANCH_BUG}'"
       FAILED=1
     fi
@@ -72,12 +132,18 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then
     fi
   fi
 
-  attribution=$(printf '%s\n' "${BODY}" | awk '
+elif [ "${BRANCH_KIND}" = "chore" ] && [ -n "${TITLE_BUG}" ]; then
-    /^## Attribution[[:space:]]*$/ { in_section=1; next }
+  echo "FAIL[check-naming]: chore branch should not carry a [bug-id] title prefix"
-    /^## / && in_section { exit }
+  FAILED=1
+fi
+
+if [ "${BRANCH_KIND}" != "invalid" ]; then
+  attribution=$(printf '%s\n' "${VISIBLE_BODY}" | awk '
+    /<h2[^>]*>Attribution<\/h2>/ { in_section=1; next }
+    /<h2[^>]*>/ && in_section { exit }
     in_section { print }
   ')
-  watermark_re='^[-*]?[[:space:]]*Authored-By: .+ \(.+\) <noreply@[[:alnum:].-]+>$'
+  watermark_re='Authored-By: .+ \(.+\) <a href="mailto:noreply@[[:alnum:].-]+"[^>]*>noreply@[[:alnum:].-]+</a>'
   if ! printf '%s\n' "${attribution}" | grep -qE "${watermark_re}"; then
     echo "FAIL[check-naming]: ## Attribution must contain an Authored-By product/model watermark"
     FAILED=1
@@ -118,9 +184,6 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then
     echo "FAIL[check-naming]: base-sha and head-sha must be lowercase hexadecimal commit SHAs"
     FAILED=1
   fi
-elif [ "${BRANCH_KIND}" = "chore" ] && [ -n "${TITLE_BUG}" ]; then
-  echo "FAIL[check-naming]: chore branch should not carry a [bug-id] title prefix"
-  FAILED=1
 fi
 
 if [ "${FAILED}" -eq 0 ]; then

tests/bin/curl

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# Deterministic Gitea Markdown renderer stub for check.sh contract tests.
+set -euo pipefail
+
+connect_timeout=0
+total_timeout=0
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --connect-timeout)
+      [ "${2:-}" = "5" ] || exit 2
+      connect_timeout=1
+      shift 2
+      ;;
+    --max-time)
+      [ "${2:-}" = "15" ] || exit 2
+      total_timeout=1
+      shift 2
+      ;;
+    *) shift ;;
+  esac
+done
+[ "${connect_timeout}" -eq 1 ] && [ "${total_timeout}" -eq 1 ] || exit 2
+
+if printf '%s\n' "${PR_BODY}" | grep -Fq '[[stall-renderer]]'; then
+  exit 28
+fi
+
+if printf '%s\n' "${PR_BODY}" | grep -Fq '<!--'; then
+  exit 0
+fi
+
+printf '%s\n' "${PR_BODY}" | awk '
+  {
+    line=$0
+    lower=tolower(line)
+    pos=1
+    while (pos <= 4 && substr(line, pos, 1) == " ") pos++
+    char=substr(line, pos, 1)
+    run=0
+    if (char == "`" || char == "~") while (substr(line, pos + run, 1) == char) run++
+    rest=substr(line, pos + run)
+    if (in_fence) {
+      if (pos <= 4 && char == fence_char && run >= fence_run && rest ~ /^[[:blank:]]*$/) in_fence=0
+      next
+    }
+    if (in_script) {
+      if (lower ~ /<\/script[[:blank:]]*>/) in_script=0
+      next
+    }
+    if (pos <= 4 && run >= 3 && (char == "~" || index(rest, "`") == 0)) {
+      in_fence=1
+      fence_char=char
+      fence_run=run
+      next
+    }
+    if (lower ~ /^[ ]{0,3}<script([[:blank:]>])/) {
+      in_script=1
+      next
+    }
+    if (lower ~ /^[ ]{0,3}<\/details([[:blank:]>])/) {
+      print "</details>"
+      next
+    }
+    if (lower ~ /^[ ]{0,3}<details([[:blank:]>])/) {
+      attributes=lower
+      gsub(/"[^"]*"/, "", attributes)
+      if (attributes ~ /[[:blank:]]open([[:blank:]=>]|$)/) sub(/<details open>/, "<details open=\"\">", line)
+      print line
+      next
+    }
+    if (line ~ /^## Tracking[[:space:]]*$/) print "<h2>Tracking</h2>"
+    else if (line ~ /^## Attribution[[:space:]]*$/) print "<h2>Attribution</h2>"
+    else if (line ~ /^- Fixes[[:space:]]/) print "<li>" substr(line, 3) "</li>"
+    else if (line ~ /Authored-By:.*<noreply@[[:alnum:].-]+>/) {
+      email=line
+      sub(/^.*</, "", email)
+      sub(/>.*/, "", email)
+      sub(/ <noreply@[[:alnum:].-]+>.*/, "", line)
+      print line " <a href=\"mailto:" email "\">" email "</a>"
+    }
+    else {
+      gsub(/</, "\\&lt;", line)
+      gsub(/>/, "\\&gt;", line)
+      print line
+    }
+  }
+'

tests/run

@@ -3,6 +3,7 @@
 set -euo pipefail
 
 SCRIPT="$(cd "$(dirname "$0")/.." && pwd)/check.sh"
+TEST_BIN="$(cd "$(dirname "$0")" && pwd)/bin"
 PASS=0
 FAIL=0
 FIXTURES=$(mktemp -d)
@@ -28,7 +29,8 @@ check() {
   body=$(canonical_body "${bug:-bug-test}")
   local out rc=0
   out=$(cd "${FIXTURES}" && HEAD_BRANCH="$branch" PR_TITLE="$title" PR_AUTHOR="$author" \
-    PR_BODY="$body" BASE_SHA="$BASE" HEAD_SHA="$GOOD_HEAD" bash "$SCRIPT" 2>&1) || rc=$?
+    PR_BODY="$body" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" PATH="${TEST_BIN}:$PATH" \
+    BASE_SHA="$BASE" HEAD_SHA="$GOOD_HEAD" bash "$SCRIPT" 2>&1) || rc=$?
   local got_lines=0
   echo "$out" | grep -qE "^FAIL" && got_lines=1 || true
   if [ "$rc" -eq "$want_fail" ] && [ "$got_lines" -eq "$want_fail" ]; then
@@ -46,7 +48,42 @@ check_contract() {
   local out rc=0
   out=$(cd "${FIXTURES}" && HEAD_BRANCH="architect/bug-x7k2m9/contract" \
     PR_TITLE="[bug-x7k2m9] Enforce contract" PR_AUTHOR="architect" \
-    PR_BODY="$body" BASE_SHA="$base" HEAD_SHA="$head" bash "$SCRIPT" 2>&1) || rc=$?
+    PR_BODY="$body" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" PATH="${TEST_BIN}:$PATH" \
+    BASE_SHA="$base" HEAD_SHA="$head" bash "$SCRIPT" 2>&1) || rc=$?
+  if [ "$rc" -eq 1 ] && printf '%s\n' "$out" | grep -Fq "$diagnostic"; then
+    echo "PASS [$desc]"
+    PASS=$((PASS + 1))
+  else
+    echo "FAIL [$desc]: expected exit=1 and diagnostic '$diagnostic', got exit=$rc"
+    echo "  output: $out"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+check_contract_pass() {
+  local desc="$1" body="$2" base="$3" head="$4"
+  local out rc=0
+  out=$(cd "${FIXTURES}" && HEAD_BRANCH="architect/bug-x7k2m9/contract" \
+    PR_TITLE="[bug-x7k2m9] Enforce contract" PR_AUTHOR="architect" \
+    PR_BODY="$body" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" PATH="${TEST_BIN}:$PATH" \
+    BASE_SHA="$base" HEAD_SHA="$head" bash "$SCRIPT" 2>&1) || rc=$?
+  if [ "$rc" -eq 0 ] && printf '%s\n' "$out" | grep -Fq "check-naming: ok"; then
+    echo "PASS [$desc]"
+    PASS=$((PASS + 1))
+  else
+    echo "FAIL [$desc]: expected exit=0 and check-naming: ok, got exit=$rc"
+    echo "  output: $out"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+check_chore_contract() {
+  local desc="$1" body="$2" base="$3" head="$4" diagnostic="$5"
+  local out rc=0
+  out=$(cd "${FIXTURES}" && HEAD_BRANCH="chore/contract" \
+    PR_TITLE="Improve delivery contract" PR_AUTHOR="dev" \
+    PR_BODY="$body" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" PATH="${TEST_BIN}:$PATH" \
+    BASE_SHA="$base" HEAD_SHA="$head" bash "$SCRIPT" 2>&1) || rc=$?
   if [ "$rc" -eq 1 ] && printf '%s\n' "$out" | grep -Fq "$diagnostic"; then
     echo "PASS [$desc]"
     PASS=$((PASS + 1))
@@ -82,6 +119,8 @@ check "bug-id mismatch"                 1 "dev/bug-x7k2m9/fix-resize"     "[bug-
 
 # fail: chore branch with [bug-id] title prefix
 check "chore with bug-id title"         1 "chore/bump-deps"                "[bug-abc123] Bump deps"      "dev"
+check "role/bug Conventional title"     0 "dev/bug-x7k2m9/fix-resize"     "[bug-x7k2m9] fix(hub): fix resize" "dev"
+check "chore Conventional title"        0 "chore/bump-deps"                "chore(deps): bump deps"      "dev"
 
 # fail: invalid branch forms
 check "invalid — no role prefix"        1 "feature/foo-bar"                "Add feature"                 "dev"
@@ -104,10 +143,66 @@ check_contract "tracking rejects wrong Bug URL" \
 check_contract "attribution must be in its own section" \
   $'## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
   "$BASE" "$GOOD_HEAD" "## Attribution must contain"
+check_contract "hidden provenance does not satisfy the visible contract" \
+  $'<!--\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract "comment removal cannot synthesize section headings" \
+  $'<!-- hidden -->## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n<!-- hidden -->## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract "four-space indented backticks do not expose comments" \
+  $'    ````\n<!--\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract "unequal backtick runs do not expose comments" \
+  $'`<!--``\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract "invalid backtick fence info does not expose comments" \
+  $'```html`oops\n<!--\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract "invalid fence closer does not expose comments" \
+  $'```html\n```oops\n```\n<!--\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract "fences inside comments do not expose provenance" \
+  $'<!--\n```html\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract "escaped backticks do not hide a comment opener" \
+  $'\\`<!--\\`\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract "fenced provenance does not satisfy the visible contract" \
+  $'```\n```oops\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract "indented fence closer does not expose provenance" \
+  $'```\n    ```\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n```' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract_pass "fenced code examples remain available" \
+  $'```html\n<script>example only</script>\n```\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
+  "$BASE" "$GOOD_HEAD"
+check_contract "details cannot collapse provenance" \
+  $'<details><summary>Release notes</summary>\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n</details>' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract_pass "open details preserve visible provenance" \
+  $'<details open><summary>Release notes</summary>\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n</details>' \
+  "$BASE" "$GOOD_HEAD"
+check_contract "open details inside collapsed details remain hidden" \
+  $'<details><summary>Release notes</summary>\n<details open><summary>Visible only after expansion</summary>\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n</details>\n</details>' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract "open text in another details attribute remains collapsed" \
+  $'<details title="x open y"><summary>Release notes</summary>\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n</details>' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract_pass "unrelated collapsed details remain available" \
+  $'<details><summary>Logs</summary>\n\nSupporting output\n</details>\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
+  "$BASE" "$GOOD_HEAD"
+check_contract "script cannot suppress provenance" \
+  $'<script>\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n</script>' \
+  "$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
+check_contract "stalled renderer fails closed at the curl timeout" \
+  "$(canonical_body bug-x7k2m9)"$'\n[[stall-renderer]]' \
+  "$BASE" "$GOOD_HEAD" "Gitea could not render the PR body"
 
 git -C "${FIXTURES}" commit --allow-empty -q -m "unwatermarked change"
 BAD_HEAD=$(git -C "${FIXTURES}" rev-parse HEAD)
 check_contract "agenthub 779 commits reject missing watermark" "$BODY" "$GOOD_HEAD" "$BAD_HEAD" "must end with an Authored-By"
+check_chore_contract "chore requires PR attribution" "" "$BASE" "$GOOD_HEAD" "## Attribution must contain"
+check_chore_contract "chore commits require watermark" "$(canonical_body bug-unused)" "$GOOD_HEAD" "$BAD_HEAD" "must end with an Authored-By"
 
 git -C "${FIXTURES}" commit --allow-empty -q -m $'misplaced trailer\nAuthored-By: Codex (GPT-5) <noreply@openai.com>'
 MISPLACED_HEAD=$(git -C "${FIXTURES}" rev-parse HEAD)