fix(communication): validate declared Git authors

TODO.md

@@ -2,6 +2,11 @@
 
 ## Active tickets
 
+- [ ] [`ticket-032`](project/ticket-032/README.md) — restore the unreachable
+  declared Git-author mismatch warning while keeping registry-owned identity
+  authoritative. Current state: `IN_PROGRESS / VALIDATION`; focused tests pass
+  and the targeted full-suite failure is removed.
+
 - [ ] [`ticket-019`](project/ticket-019/README.md) — publish the dependency-free
   Python SDK as the root PyPI distribution `todo2code` through `goal -a`, with
   one root `pyproject.toml` and SDK-only artifacts. Current state:

project/TICKETS.md

@@ -27,4 +27,5 @@ of `project/README.md`, which remains a generated technical-analysis artifact.
 | **ticket-019** | [`README.md`](./ticket-019/README.md) | [`preprompt.md`](./ticket-019/preprompt.md) | - |  [`ai-codex.md`](./ticket-019/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-019/ai-codex-logs.txt) | [`changelog.md`](./ticket-019/changelog.md) |
 | **ticket-020** | [`README.md`](./ticket-020/README.md) | [`preprompt.md`](./ticket-020/preprompt.md) | - |  [`ai-codex.md`](./ticket-020/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-020/ai-codex-logs.txt) | [`changelog.md`](./ticket-020/changelog.md) |
 | **ticket-022** | [`README.md`](./ticket-022/README.md) | [`preprompt.md`](./ticket-022/preprompt.md) | - |  [`ai-codex.md`](./ticket-022/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-022/ai-codex-logs.txt) | [`changelog.md`](./ticket-022/changelog.md) |
+| **ticket-032** | [`README.md`](./ticket-032/README.md) | [`preprompt.md`](./ticket-032/preprompt.md) | - |  [`ai-codex.md`](./ticket-032/ai-codex.md) |  [`ai-codex-logs.txt`](./ticket-032/ai-codex-logs.txt) | [`changelog.md`](./ticket-032/changelog.md) |
 <!-- AUTO:TICKET_INDEX:END -->

project/ticket-032/README.md

@@ -0,0 +1,61 @@
+# Ticket 032: Restore declared Git author mismatch warning
+
+- **ID**: ticket-032
+- **Owner**: unresolved:human
+- **Status**: IN_PROGRESS
+- **Workflow state**: VALIDATION
+- **Created**: 2026-08-04
+
+## Goal and scope
+
+Restore the participant-registry warning lost while communication extraction
+was split into helpers. The refactor computes both declared and registry-owned
+Git authors, but retains only the resolved list. Warning logic consequently
+compares the registry list with itself and can never report a mismatch.
+
+The repair will retain the declared authors as internal metadata and compare
+them with the trusted registry value before continuing to publish only the
+registry-owned authors. It will not trust front matter, change participant
+identity resolution or edit tests. One production file is allowed and the
+expected implementation time is under 30 minutes.
+
+## Planned changed paths
+
+- `src/extractors/communication-file-helpers.ts`: preserve declared Git authors
+  for validation and use them in the mismatch check.
+- `project/ticket-032/**`, `TODO.md`, `project/TICKETS.md`: intent and evidence.
+
+## Acceptance criteria
+
+- [x] AC-01: Scope is approved by a human owner.
+- [x] AC-02: A declaration differing from the participant registry emits the
+      existing `git-authors differ` warning.
+- [x] AC-03: Emitted record metadata still uses registry-owned Git authors and
+      never accepts the conflicting declaration.
+- [x] AC-04: Communication identity tests, build and full suite are rerun
+      without weakening assertions.
+- [x] AC-05: Only the allowed production and governance paths change.
+
+## Participants
+
+- Human participant: unresolved; no user-* file was created by this script.
+- Agent participant: [ai-codex.md](ai-codex.md)
+
+## Approval boundary
+
+- Current state: `IN_PROGRESS / VALIDATION` after implementing and testing the
+  bounded repair.
+- Chat approval authorizes this interactive implementation only; merge still
+  requires trusted independent evidence for the final SHA.
+
+## Validation evidence
+
+- `npm run build`: PASS.
+- Focused communication identity suite: 2 passed, 0 failed.
+- Full fresh suite on isolated base: 338 tests, 327 passed, 10 failed and one
+  skipped. The `git-authors differ` failure is removed. The remaining failures
+  are covered by independent ticket-030/ticket-031 changes plus the two prompt
+  path failures reserved for the next interfaces ticket.
+- `git diff --check`: PASS.
+- `make governance`: only four inherited ticket-018/ticket-019 diagnostics;
+  no ticket-032 scope or workstream finding.

project/ticket-032/ai-codex-logs.txt

@@ -0,0 +1,12 @@
+2026-08-04 planning
+- Fresh base `caf6551`: communication identity mismatch test fails because the
+  resolved registry authors are compared with themselves.
+- No production source edited; state remains `WAIT_FOR_APPROVAL`.
+- Human response `kontynuuj` authorized ticket-032; transitioned to
+  `IN_PROGRESS / EDIT`.
+- `npm run build`: PASS.
+- `node --test dist/test/communication-identity.test.js`: PASS (2/2).
+- Fresh full suite: 338 total, 327 pass, 10 fail, 1 skip; ticket-032 identity
+  failure removed, remaining failures belong to tickets 030/031/next prompt fix.
+- `git diff --check`: PASS.
+- `make governance`: four inherited ticket-018/ticket-019 errors, no ticket-032 finding.

project/ticket-032/ai-codex.md

@@ -0,0 +1,41 @@
+---
+participant-id: agent:codex
+participant: codex
+role: agent
+ticket: ticket-032
+---
+# Participant: codex (AI agent)
+
+## Understanding
+
+`collectCommunicationMetadata` correctly creates `declaredGitAuthors`, then
+replaces it with the participant registry list in `gitAuthors`. The extracted
+record should use that trusted list, but `appendRegistryAlignmentWarnings`
+must compare the discarded declaration with the registry. After the split it
+instead compares `metadata.gitAuthors` with the same registry list, making the
+warning unreachable.
+
+## Execution plan
+
+1. Wait for explicit human approval before editing source.
+2. Preserve `declaredGitAuthors` in the internal metadata contract.
+3. Use the declared list only for registry-alignment validation; keep resolved
+   output ownership unchanged.
+4. Run build, focused communication identity tests and the full suite.
+5. Record exact evidence and inherited blockers; do not alter test assertions.
+
+## Actual changes
+
+- The human explicitly approved ticket-032 by replying `kontynuuj`; the
+  interactive implementation may enter `EDIT`.
+- Preserved declared Git authors in the internal communication metadata only
+  for comparison with the registry. Published record metadata still receives
+  the trusted registry-owned list.
+- Clean build and focused identity tests pass. The full isolated suite no
+  longer reports the identity mismatch regression.
+
+## Blockers
+
+- The separate prompt-path regression remains outside ticket-032.
+- Four inherited ticket-018/ticket-019 governance errors remain outside scope.
+- Trusted merge approval for the final head SHA is still required.

project/ticket-032/changelog.md

@@ -0,0 +1,16 @@
+# Ticket Changelog (ticket-032)
+
+## [0.1.0] - 2026-08-04
+
+- Initial governance scaffold created.
+- No human participant identity or content was generated.
+- Renumbered the unpublished scaffold from 023 to 032 because remote PR #3
+  already owns ticket-023.
+- Documented the bounded identity-warning regression repair.
+
+## [0.2.0] - 2026-08-04
+
+- Restored comparison of declared Git authors with the trusted participant
+  registry without changing registry ownership of emitted identity metadata.
+- Focused identity tests pass 2/2 and the isolated full suite no longer reports
+  the targeted regression.

project/ticket-032/intent.json

@@ -0,0 +1,17 @@
+{
+  "schema": "new-project.intent/v2",
+  "ticket": "ticket-032",
+  "summary": "Restore declared Git author mismatch warning",
+  "workstream": "extractors",
+  "allowedPaths": [
+    "src/extractors/communication-file-helpers.ts",
+    "project/ticket-032/**",
+    "TODO.md",
+    "project/TICKETS.md"
+  ],
+  "forbiddenPaths": ["project/ticket-*/user-*.md"],
+  "stacks": ["node"],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null
+}

project/ticket-032/preprompt.md

@@ -0,0 +1,8 @@
+# Ticket preprompt
+
+- **Task ID**: ticket-032
+- **Task title**: Restore declared Git author mismatch warning
+- **Created**: 2026-08-04T12:14:17Z
+
+Keep executable implementation outside this governance/evidence directory.
+Read a human-owned user-*.md file only when one exists.

src/extractors/communication-file-helpers.ts

@@ -156,6 +156,7 @@ interface CommunicationMetadata {
   timestamp: string | null;
   explicitPaths: string[];
   explicitSymbols: string[];
+  declaredGitAuthors: string[];
   gitAuthors: string[];
   messageType: CommunicationType;
   explicitMessageType: string | null;
@@ -243,6 +244,7 @@ function collectCommunicationMetadata(
     timestamp,
     explicitPaths,
     explicitSymbols,
+    declaredGitAuthors,
     gitAuthors,
     messageType,
     explicitMessageType,
@@ -305,8 +307,8 @@ function appendRegistryAlignmentWarnings(
   if (metadata.declaredRole !== 'unknown' && metadata.declaredRole !== metadata.identity.entry.role) {
     warnings.push(`${relativeToProject}: declared role conflicts with participant registry`);
   }
-  if (metadata.identity.entry && metadata.gitAuthors.length
-    && !sameStrings(metadata.gitAuthors, metadata.identity.entry.gitAuthors)) {
+  if (metadata.declaredGitAuthors.length
+    && !sameStrings(metadata.declaredGitAuthors, metadata.identity.entry.gitAuthors)) {
     warnings.push(`${relativeToProject}: git-authors differ from participant registry and were ignored`);
   }
 }