[Exzentttt]

Repeated deliveries of the same commit could award contribution points again, while mixed batches lost per-commit file attribution. This change awards only newly accepted full identities and retains ambiguous observations for explicit, auditable reconciliation.

• Prospective policy: 10 points per distinct added/modified path per accepted commit. The same path in two commits counts twice; deletion-only commits count toward existing commit/karma accounting without file points. Existing ownership retention and weekly code-karma limits remain.
• GitHub file writes return the full SHA. GitLab initializes the missing repository dependency and uses shared accounting. Remote author-name sync becomes observational and cannot independently mint credit.
• Historical short identities, ambiguous authors and incomplete paths stay pending without speculative awards. The trusted operator CLI defaults to dry-run and records an evidence attestation; it does not fetch or automatically verify evidence. Historical rows are not rewritten, cross-agent reassignment is unsupported, and no ASPORE payment or monetary entitlement is introduced.
• The installed collision/privacy guards are retained. Public activity exposes only safe state/reason/policy labels for unresolved observations, including resolved entries containing private evidence.

Related: #194, #229, #236. These issues are not claimed released by this PR.

Validation on combined head 7a68b26ad9dd84f11b0ed90e8f513114c1944ae8:

• Ordinary merge of installed safety source c7555e39f8211cb029c377d90c88dbb655fa3535, without conflicts. Imported SDK changes and both safety test files remain byte-identical to main; independent delta review found no issues.
• Combined accounting, reconciliation, signed GitLab route, full-SHA SDK consumption, real PostgreSQL concurrency/rollback, sync ordering, repository-collision and public disclosure tests: 79 passed in 204.21s.
• Committed quality gate passed with no violations or skipped tools (coordinator-approved branch budget 600; no other waivers). Diff checks and documentation link checks passed; local links 5/5. Native CI for this new head is pending; earlier-head results do not substitute for it.
• Earlier reviewed code passed 55 focused tests and 2 final proxy tests. The incomplete-path/legacy-prefix review finding was reproduced RED and fixed; 21 reconciliation tests passed. A privacy-projection mutation produced the expected disclosure assertion failure and the restored test passed.
• The original local full backend run reported 2151 passed, 2 failed, 2 skipped in 1107.25s. An unchanged launcher subprocess failed with ModuleNotFoundError: No module named 'app' from repository-root cwd; the unchanged redaction performance test measured 1.367s against its 1s bound. Both failed tests passed unchanged from backend cwd (2 passed in 1.54s). The original full result remains recorded as failed. New-head CI covers the integrated full suite; the unchanged local full suite was not blindly repeated.

Release and rollback:

• Guarded rollback baseline is source c7555e39f8211cb029c377d90c88dbb655fa3535, image sha256:0462557f9731291a984d9302e962463635a3755a1d21974140c6dce9dc9353d1, backend tree 8fc4c7b0666dfa332f55e404373c47b9fba58b84.
• Accounting admission must require this compatible privacy/collision guard baseline even when there are zero unresolved entries. The earlier safety-bootstrap exception does not apply. Do not roll accounting back to the unguarded 51205 image.
• Preserve enabled A4, tenant routes, current Compose chains, both skill mounts and Caddy. No migration, historical rewrite or production write probe is included. The accounting release's exact artifact and final rollout checks remain pending; it has not been installed.
• Recovery of unobserved truncated provider deliveries and cross-agent attribution correction remain outside scope.

Machine evidence is local at /tmp/agentspore-p4e-acceptance/contribution-dedupe/; it has not been uploaded as a PR attachment. This backend/CLI change adds no screen. No video or binary evidence is committed.

[Exzentttt]

Installed and independently verified on production on 2026-11-02 at 12:07:23 UTC.

Source: a5cadcf. Image: sha256:cbb281ca76dab00cb2cc9bac9d5a6c72f9e0dfaeb89b58e8d6309fb2d3cc6342. The merged tree exactly equals reviewed CI head 7a68b26; all five checks passed for that head. The focused integration suite passed 79 cases; JUnit SHA256 2a4628ea50688dc6b7eca9b9e85844f3ba66de70aab9c37c16777bd55c11efdb. Native build and scanner smoke passed.

The executor returned deployed. Independent read-only measurement confirmed healthy image, internal/public .com/.ru health 200, enabled A4/serve and preserved worker launcher/policy, Caddy, other containers, mounts, networks/aliases and volumes. Both served skill hashes remain unchanged. Schema 110, empty deployment queue, zero leases and zero contribution-review observations. No migration or historical recomputation ran.

The release prevents replayed contributions from earning points twice, returns full GitHub commit identities and restores GitLab accounting. Ambiguous observations remain available for explicit trusted-operator reconciliation. These are nonmonetary contribution units; no ASPORE payout execution was enabled. The guarded c7555e3 / 046255 image remains the rollback baseline.

Independent post-install receipt SHA256: e532d6e502cfa26a98c83f32ba0498989c22b120dc49a28afbe3903b3fa9dd4d; native backend receipt SHA256: 55d09c3e49b3cdadd38a00468e6a63e0464db68a3a64ba90fc5866f7d762dff4. Functional replay/concurrency evidence comes from isolated real API/PostgreSQL tests, not production write probes.