Enforce provenance on every agent change

Authored-By: Codex (GPT-5) <noreply@openai.com>

check.sh

@@ -17,7 +17,7 @@ VISIBLE_BODY=$(printf '%s\n' "${BODY}" | awk '
   {
     line=$0
     fence_pos=1
-    while (fence_pos <= 4 && substr(line, fence_pos, 1) == " ") fence_pos++
+    while (fence_pos <= 3 && substr(line, fence_pos, 1) == " ") fence_pos++
     fence_char=substr(line, fence_pos, 1)
     fence_run=0
     if (fence_char == "`" || fence_char == "~") {
@@ -58,7 +58,8 @@ VISIBLE_BODY=$(printf '%s\n' "${BODY}" | awk '
         close_pos=pos + ticks
         found_close=0
         while (close_pos <= length(line)) {
-          if (substr(line, close_pos, ticks) == substr(line, pos, ticks) &&
+          if (substr(line, close_pos - 1, 1) != "`" &&
+              substr(line, close_pos, ticks) == substr(line, pos, ticks) &&
               substr(line, close_pos + ticks, 1) != "`") {
             found_close=1
             break
@@ -116,6 +117,12 @@ if echo "${TITLE}" | grep -qE "^\[bug-[a-z0-9]+\] ."; then
   TITLE_BUG=$(echo "${TITLE}" | sed -E 's|^\[(bug-[a-z0-9]+)\].*|\1|')
 fi
 
+PLAIN_TITLE=$(printf '%s\n' "${TITLE}" | sed -E 's/^\[bug-[a-z0-9]+\][[:space:]]+//')
+if printf '%s\n' "${PLAIN_TITLE}" | grep -qE '^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([^)]*\))?!?:[[:space:]]'; then
+  echo "FAIL[check-naming]: title must be a plain-language imperative without Conventional Commit syntax"
+  FAILED=1
+fi
+
 if [ "${BRANCH_KIND}" = "role-bug" ]; then
   if [ -z "${TITLE_BUG}" ]; then
     echo "FAIL[check-naming]: title must lead with [${BRANCH_BUG}]"
@@ -146,6 +153,12 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then
     fi
   fi
 
+elif [ "${BRANCH_KIND}" = "chore" ] && [ -n "${TITLE_BUG}" ]; then
+  echo "FAIL[check-naming]: chore branch should not carry a [bug-id] title prefix"
+  FAILED=1
+fi
+
+if [ "${BRANCH_KIND}" != "invalid" ]; then
   attribution=$(printf '%s\n' "${VISIBLE_BODY}" | awk '
     /^## Attribution[[:space:]]*$/ { in_section=1; next }
     /^## / && in_section { exit }
@@ -192,9 +205,6 @@ if [ "${BRANCH_KIND}" = "role-bug" ]; then
     echo "FAIL[check-naming]: base-sha and head-sha must be lowercase hexadecimal commit SHAs"
     FAILED=1
   fi
-elif [ "${BRANCH_KIND}" = "chore" ] && [ -n "${TITLE_BUG}" ]; then
-  echo "FAIL[check-naming]: chore branch should not carry a [bug-id] title prefix"
-  FAILED=1
 fi
 
 if [ "${FAILED}" -eq 0 ]; then