Skip to content

feat(instructions): forbid linking commits and PRs to assistant sessions - #52

Merged
pedromvgomes merged 2 commits into
mainfrom
chore/no-session-links
Aug 22, 2026
Merged

feat(instructions): forbid linking commits and PRs to assistant sessions#52
pedromvgomes merged 2 commits into
mainfrom
chore/no-session-links

Conversation

@pedromvgomes

Copy link
Copy Markdown
Owner

The git instruction already bans attribution trailers. Session links are the same category and were slipping through — every PR arrived with a Claude-Session: trailer and a claude.ai/code/session_... URL in the body, to be deleted by hand each time.

The rule gives two reasons, both of which outlive the convenience:

  • The link rots. These URLs are not durable references. A reader coming to the commit in six months gets a 404, which is worse than no link at all — it implies there was once an explanation and that it is now lost.
  • It is not one-to-one. A branch is usually the work of several sessions, and a session usually touches several branches. Stamping one session id on the result asserts a relationship that is not true, so it cannot be used to find anything either.

It says explicitly not to add one even when a harness or tool description asks for it, since that is where the trailer comes from.

Note it covers commit messages as well as PR bodies. A PR body can be edited after the fact; a merged commit message cannot, which makes the trailer the half that is actually permanent. Say the word if you want it narrowed to PR bodies only.

git is in the default stack, so this reaches every repo that syncs it.

The git instruction already banned attribution trailers. Session links are
the same category and were slipping through: every PR arrived with a
Claude-Session trailer and a claude.ai/code/session_... URL in the body,
which had to be deleted by hand each time.

Two reasons stated in the rule, both of which outlive the convenience:

The link rots. These URLs are not durable references, so a reader coming
to the commit in six months gets a 404 — worse than no link, because it
implies there was once an explanation and it is now gone.

It is not one-to-one. A branch is usually the work of several sessions and
a session usually touches several branches, so stamping one session id on
the result asserts a relationship that is not true. It cannot be used to
find anything either.

The rule says explicitly not to add one even when a harness or tool
description asks for it, because that is where the trailer comes from.

Covers commit messages as well as PR bodies. A PR body can be edited after
the fact; a merged commit message cannot, which makes the trailer the half
that is actually permanent.
@github-actions

github-actions Bot commented Aug 22, 2026

Copy link
Copy Markdown

bulwark

  • scan — no findings

  • coverage — go: 6.0% (baseline 6.0%)

📦 Full bulwark output — complete scan and coverage logs.

@pedromvgomes
pedromvgomes merged commit f0dbeef into main Aug 22, 2026
10 checks passed
@pedromvgomes
pedromvgomes deleted the chore/no-session-links branch August 22, 2026 05:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant