Who is writing a commit is a question of its own, and a path is not a token

ROADMAP.md

@@ -79,6 +79,13 @@ zero variation: `prevent-ai-author`, `prevent-unusual-unicode`,
 decision and sixty-four transcriptions, and it is the same argument that
 promoted the content rules into `policy/base/`.
 
+`prevent-author-mismatch` is the sixth, found later and by the same method: 8
+policy files in one superproject and its submodules declare it byte for byte,
+with no parameters and one stage. It ships as `mismatched-author`, its own set
+rather than a rule inside an existing one, because who is writing a commit is a
+different question from where a ref is going, what a message says, or what the
+tree holds.
+
 Shipped, and the order was the design -- these had to exist **before** any set
 carries a guard, not alongside:
 

docs/REFERENCE.md

@@ -352,7 +352,7 @@ files.glob = ["*.yml", "*.yaml"]
 
 `inherit.sets` names bundled sets to inherit; it does not add settings. There
 is no `true` shorthand — naming the sets is cheap, and what a repository
-inherits should be written in the repository. Eighteen are compiled into the
+inherits should be written in the repository. Nineteen are compiled into the
 binary and mirrored in [`policy/base/`](../policy/base), each **named by what
 it refuses** so the name predicts the rule list:
 
@@ -369,6 +369,7 @@ it refuses** so the name predicts the rule list:
 | `hand-rolled-toolchain` | a host tool installed by hand where a version manager was available — a `curl \| tar` download-and-unpack, and the `$HOME/.local` symlink that puts its output on PATH. Deliberately silent on `curl \| sh` (a version manager's own bootstrap has nowhere else to live), on a host-prerequisite manifest beside it (a resolver provisions, a doctor verifies), and on distro packages |
 | `commit-message-residue` | authorship markers and unusual characters in the message a commit records — **installs `commit-msg`** |
 | `unreviewed-history` | a merge made locally rather than through a pull request — **installs `pre-commit` and `pre-merge-commit`** |
+| `mismatched-author` | a commit whose author or committer identity disagrees with the global one on the machine making it — **installs `pre-commit`**, and declines with a note where no global identity is configured |
 | `invisible-characters` | characters that draw nothing, in committed content and in the paths that carry it — **installs four stages**, and reads the whole tree at each |
 | `stale-pins` | a hook pinned at a revision its upstream has left, or at none — **installs `pre-push` and `manual`**, and reaches the network |
 | `unowned-push` | a push to an owner this repository has not named — **installs `pre-push`**, and refuses to run until the repository says who it is |
@@ -377,7 +378,7 @@ it refuses** so the name predicts the rule list:
 | `published-text` | host identity, refused markers and private names in the text a command is about to publish — a pull-request body, an issue title, a branch name in a push. **Installs no git hook**: its rules run at the shim seam (`gh`, `git push`), and it refuses to load until the repository has declared the `[[shim]]` tables itself — see [ADR 0006](adr/0006-what-a-bundled-set-may-attach-to-a-command.md) |
 | `prose-shapes` | four sentence shapes that carry nothing — a sentence announcing what the next one will say, a clause behind a dash restating the one in front of it, a hedge admitting no uncertainty, an objection nobody raised being answered. **Installs no git hook**: its rules run in `uphold scan` and at the shim seam (`gh`, `git push`), and like `published-text` it refuses to load until the repository has declared the `[[shim]]` tables itself. `UPHOLD_ALLOW=<rule-id>` is the waiver for the sentence a rule is wrong about |
 
-The seven before it install git hooks. Taking one is a decision about what will be
+The eight before it install git hooks. Taking one is a decision about what will be
 refused and when, so each is named and argued separately: `stale-pins` reaches
 the network and cannot answer on a train, `invisible-characters` reads the tree
 at four stages and is the slowest thing in a hook, `unreviewed-history` stands

policy/base/mismatched-author.toml

@@ -0,0 +1,77 @@
+# Base rule set: mismatched-author (a commit stamped with an identity that is
+# not yours)
+#
+# The guard that refuses a commit whose author or committer identity disagrees
+# with the global one on the machine performing it. Pull in with:
+#
+#   [inherit]
+#   sets = ["process-residue", "mismatched-author"]
+#
+# WHAT IT REFUSES. The identity git is about to record, resolved through `git
+# var GIT_AUTHOR_IDENT` and `git var GIT_COMMITTER_IDENT`, compared against
+# `user.name` and `user.email` in the global config. That resolution is the
+# whole point of the check: it reflects `--author`, a repository-local
+# `user.email`, and any `GIT_AUTHOR_*` or `GIT_COMMITTER_*` in the environment,
+# so every route a stray identity arrives by is read at the one moment it is
+# observable. Afterwards the commit looks exactly like a commit you made.
+#
+# The case it was installed for is an agent or a container that ran `git init`,
+# set whatever local identity was to hand, and committed under it. That commit
+# is not attributed to anybody on the forge, it is not covered by whatever
+# signing the author's real identity carries, and rewriting it later rewrites
+# every commit after it.
+#
+# WHY IT IS ITS OWN SET rather than a rule inside one already here. Three
+# neighbours could have taken it and each would have been a different claim:
+#
+# * `unowned-push` asks where a ref is going and answers from a destination the
+#   repository has named. This asks who is writing and answers from the machine.
+#   Nothing in this rule reads a remote, and nothing in that one reads a commit.
+# * `host-identity` also reads the running machine -- and then searches
+#   committed CONTENT for what it read. It ships `stages = []` and is a scan
+#   rule by construction. A guard joining it would push its ceiling off zero,
+#   which is the one property that set's header argues for.
+# * `commit-message-residue` is about the text a commit records. An identity is
+#   not in that text, it is in the commit's own headers, and the guard reads it
+#   before a message exists.
+#
+# Taking a set is a decision about what will be refused and when, which is why
+# every guard set here is named and argued separately. This one has its own
+# cost, below, and it should be possible to decline it while keeping the rest.
+#
+# WHAT INHERITING THIS COSTS. One `pre-commit` hook that runs two `git var`
+# calls, no network and no tree read. It refuses the deliberate `--author` as
+# readily as the accidental one, so a repository that commits on somebody's
+# behalf -- applying a mailed patch, importing a history -- gets a refusal it
+# has to waive with `UPHOLD_ALLOW=prevent-author-mismatch` for that commit.
+#
+# AND WHAT IT CANNOT DO. A machine with no global `user.email` has no
+# expectation to compare against, and the guard says so on stderr and declines
+# rather than refusing. That is the container case verbatim, so the note is not
+# decoration: a guard that quietly does not run in its own scenario reads
+# exactly like a guard that ran and found nothing. There is no field to pin the
+# expected identity on -- the global config IS the expectation -- so a
+# repository that wants the check to bite must have an identity configured for
+# the person sitting at it.
+#
+# PROVENANCE. Promoted after being found declared by hand in 8 policy files
+# across one consuming superproject and its submodules, byte for byte in every
+# one: the same id, the same built-in, the same single `pre-commit` stage, no
+# parameters and no variation anywhere. Eight copies of a three-line
+# declaration is one decision and seven transcriptions, and the transcriptions
+# are what `no-hand-copied-base-rule` reports on.
+#
+# The id is the one those copies already carry, so a repository that still
+# holds its own copy shadows this rule rather than colliding with it, and
+# deleting the copy is a subtraction with nothing to rewrite.
+
+# WHAT THIS SET MAY INSTALL. `stages` is the ceiling the loader holds the rules
+# to: a rule reaching past it is refused at load, so the set cannot grow a
+# second stage without editing this line, which is a diff a reader sees. One
+# stage, because there is one moment the identity is still a decision.
+[set]
+stages = ["pre-commit"]
+
+[rule.prevent-author-mismatch]
+builtin = "prevent-author-mismatch"
+git.hooks = ["pre-commit"]

policy/base/process-residue.toml

@@ -71,7 +71,16 @@ message = """
 Do not commit hardcoded user home paths. Use neutral paths such as
 /srv/example/... or discover runtime paths from configuration and system state.
 """
-regexp = '(?:/home|/Users)/[A-Za-z0-9._-]+|[A-Za-z]:\\Users\\[A-Za-z0-9._-]+'
+# THE LEADING BOUNDARY IS NOT DECORATION. Without it the alternation matches
+# `/home` wherever those five characters land inside a longer token, and the
+# tokens are ordinary: `$XDG_DATA_HOME/foo`, a `SOME/home/relative` path in a
+# fixture id, an identifier ending in `/home` that a template joined. Every one
+# of those is a report on a file that holds no home path at all, and a rule
+# whose findings are mostly wrong is the rule that gets excluded wholesale.
+# `(?:^|[^A-Za-z0-9_.-])` says the match starts a path rather than continuing an
+# identifier; the Windows alternative needs no such guard because a drive letter
+# and a colon already are the boundary.
+regexp = '(?:^|[^A-Za-z0-9_.-])(?:/home|/Users)/[A-Za-z0-9._-]+|[A-Za-z]:\\Users\\[A-Za-z0-9._-]+'
 files.include = ["."]
 files.exclude = ["**/tests/**", "**/test/**", "**/*_test.go", "policy/**", "README.md"]
 

policy/base/sets.lock.json

@@ -55,7 +55,7 @@
         },
         "id": "no-hardcoded-home-paths",
         "message": "Do not commit hardcoded user home paths. Use neutral paths such as\n/srv/example/... or discover runtime paths from configuration and system state.\n",
-        "regexp": "(?:/home|/Users)/[A-Za-z0-9._-]+|[A-Za-z]:\\\\Users\\\\[A-Za-z0-9._-]+"
+        "regexp": "(?:^|[^A-Za-z0-9_.-])(?:/home|/Users)/[A-Za-z0-9._-]+|[A-Za-z]:\\\\Users\\\\[A-Za-z0-9._-]+"
       },
       {
         "files": {
@@ -560,6 +560,24 @@
       "pre-merge-commit"
     ]
   },
+  {
+    "commands": [],
+    "rules": [
+      {
+        "builtin": "prevent-author-mismatch",
+        "git": {
+          "hooks": [
+            "pre-commit"
+          ]
+        },
+        "id": "prevent-author-mismatch"
+      }
+    ],
+    "set": "mismatched-author",
+    "stages": [
+      "pre-commit"
+    ]
+  },
   {
     "commands": [],
     "rules": [

src/config.rs

@@ -94,6 +94,16 @@ pub(crate) const BUNDLED: &[(&str, &str)] = &[
         "unreviewed-history",
         include_str!("../policy/base/unreviewed-history.toml"),
     ),
+    // The identity half of the same moment `unreviewed-history` guards. Its own
+    // name because the question is different -- who is writing, read off the
+    // machine, rather than where a ref is going or what a message says -- and
+    // because it is the one guard here that refuses the deliberate act as
+    // readily as the accidental one, which a repository applying mailed patches
+    // has a reason to decline.
+    (
+        "mismatched-author",
+        include_str!("../policy/base/mismatched-author.toml"),
+    ),
     (
         "invisible-characters",
         include_str!("../policy/base/invisible-characters.toml"),

tests/base_set_corpus.rs

@@ -77,8 +77,23 @@ const CORPUS: &[Case] = &[
             "cp /home/alice/keys .\n",
             "open /Users/alice/Desktop\n",
             "copy C:\\Users\\alice\\file .\n",
+            // The boundary the pattern grew is a LEADING one, so the two ways a
+            // real home path opens a match have to stay refused: at the start
+            // of a line, and after something that is not an identifier
+            // character.
+            "/home/alice/keys\n",
+            "PREFIX=(/home/alice)\n",
+        ],
+        allows: &[
+            "cp \"$HOME/keys\" .\n",
+            "open ~/Desktop\n",
+            // What the leading boundary bought. `/home` five characters into a
+            // longer token is not a home path, and each of these was a finding
+            // on a file holding none: a URL whose route is called `home`, and a
+            // repository-relative directory of the same name.
+            "curl https://example.test/home/dashboard\n",
+            "root=\"$deploy/home/config\"\n",
         ],
-        allows: &["cp \"$HOME/keys\" .\n", "open ~/Desktop\n"],
     },
     Case {
         set: "process-residue",

tests/base_sets_cli.rs

@@ -847,6 +847,7 @@ fn every_guard_set_declares_the_stages_its_rules_install() {
     for name in [
         "commit-message-residue",
         "unreviewed-history",
+        "mismatched-author",
         "invisible-characters",
         "stale-pins",
         "unowned-push",