fix(check-naming): enforce tracking attribution

Authored-By: Codex (GPT-5.6) <noreply@openai.com>

README.md

@@ -1,8 +1,8 @@
 # action/check-naming
 
-Composite Gitea Action that validates a pull request's head branch name
-and title against the fritzlab naming standard. `@v2` fails (exits 1) on
-any violation; `@v1` is the legacy warn-only release that never fails
+Composite Gitea Action that validates a pull request's branch, title, Bug
+tracking, and AI authorship against the fritzlab Git standard. The current
+action fails (exits 1) on any violation; `@v1` is the legacy warn-only release
 (Bugs program: see
 [fritzlab/agenthub#557](https://code.fritzlab.net/fritzlab/agenthub/issues/557)).
 
@@ -28,11 +28,17 @@ jobs:
     runs-on: fritzlab
     timeout-minutes: 5
     steps:
-      - uses: https://code.fritzlab.net/action/check-naming@v2
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: https://code.fritzlab.net/action/check-naming@<commit-sha>
         with:
           head-branch: ${{ github.head_ref }}
           pr-title: ${{ github.event.pull_request.title }}
           pr-author: ${{ github.event.pull_request.user.login }}
+          pr-body: ${{ github.event.pull_request.body }}
+          base-sha: ${{ github.event.pull_request.base.sha }}
+          head-sha: ${{ github.event.pull_request.head.sha }}
 ```
 
 To wire a new repo warn-only first, add `continue-on-error: true` to the
@@ -45,10 +51,13 @@ job — the step still fails, but the job cannot block the PR.
 | `head-branch` | yes | Head branch name — `github.head_ref` |
 | `pr-title` | yes | PR title — `github.event.pull_request.title` |
 | `pr-author` | no | PR author login — `github.event.pull_request.user.login`; `dfritz` is exempt |
+| `pr-body` | yes | PR description — `github.event.pull_request.body` |
+| `base-sha` | yes | Base commit — `github.event.pull_request.base.sha` |
+| `head-sha` | yes | Head commit — `github.event.pull_request.head.sha` |
 
 ## Behavior
 
-The check validates two things:
+The check validates four things for a Bug-backed Agent PR:
 
 1. **Branch form** — must be `<role>/bug-<id>/<kebab>` or `chore/<kebab>`.
    Unknown roles, missing `bug-` segment, uppercase bug-ids, and empty
@@ -58,6 +67,15 @@ The check validates two things:
    `[bug-<id>] `. For a `chore` branch the title must have no `[bug-id]`
    prefix. If both carry a bug-id they must match.
 
+3. **Tracking and attribution** — `## Tracking` contains both the literal
+   `Fixes bug-<id>` automation token and the matching navigable
+   `https://agenthub.fritzlab.net/bug-<id>` URL. A separate `## Attribution`
+   section contains the canonical `Authored-By` product/model watermark.
+
+4. **Commit attribution** — every commit in `base-sha..head-sha` ends with
+   the canonical `Authored-By` trailer, separated from the message body by a
+   blank line. The naming job must check out full history before this action.
+
 Every violation prints a `FAIL[check-naming]: ...` line and the step
 exits 1. To make the check required on a repo: drop any
 `continue-on-error: true` from the consuming workflow and add the job's
@@ -65,7 +83,8 @@ context to the repo's `status_check_contexts` in agenthub `hub/hub.yaml`.
 
 ## Versions
 
-- `v2` — enforcing: exits 1 on violation (current).
+- unreleased — adds Bug tracking plus PR and commit attribution enforcement.
+- `v2` — enforces branch and title naming.
 - `v1` — legacy warn-only: logs `WARN` lines, always exits 0.
 
 ## Tests