#1043 mechanized the seat identity that decides who acts (MOSAIC_GIT_IDENTITY → the
credential helper → which token authenticates the push). It did not cover the identity that decides who the commit says wrote it — user.name / user.email on the commit object. Those are
different config keys, set by different code paths, and fixing the first left the second silently
wrong.
#1043 predicted this shape exactly, in its own words:
Seats operate in linked worktrees sharing one .git […] git config mosaic.gitIdentity
therefore writes the shared config, so one seat's identity contaminates every co-tenant
worktree (chimera identity).
That is the realized state of /src/mosaic-stack today, for the authorship keys.
Evidence — measured on web1, 2026-08-13
The shared repo config carries one seat's identity:
That repository has 74 linked worktrees, and 2 of them carry a config.worktree override:
$ git worktree list | wc -l
74
$ ls /src/mosaic-stack/.git/worktrees/*/config.worktree | wc -l
2
So 72 worktrees — belonging to be-coder-06, coder4, f10-coder, fleet-enhance, rev-974, the rm-0x
lane and others — author every commit as coder-mos1 <[email protected]>, whatever
seat is actually working in them.
This was found by walking into it: a commit on feat/workspace-hygiene-tool-enforcement (PR #1174)
came out authored coder-mos1 on a branch whose entire history is Hermes Agent <[email protected]>. git config --show-origin located the cause in the shared config. The
commit was amended under a worktree-scoped identity; the shared config was deliberately not
edited, because 72 other worktrees are live against it.
Why it is silent
Nothing reports it. The push succeeds — the token is correct, because #1043 fixed that half — so
the provider accepts the write and attributes the PR to the right account. Only the commit object
carries the wrong name, and no gate reads the commit object's author. The two halves disagree and
every check passes:
selects
set by
fixed by
MOSAIC_GIT_IDENTITY
which token authenticates — who acts
seat env (#1043)
yes
GITEA_LOGIN
which tea login prints — who it says it is
wrapper env
partly
user.name / user.email
who the commit says wrote it
git config
no
useConfigOnly = true makes this worse in a specific way: it stops git from guessing an identity,
which is correct, but it means the shared value is not a fallback for seats that forgot to set one —
it is the only value they will ever get, applied confidently and silently.
#1043 reasoned under extensions.worktreeConfig being off, which is why it concluded per-repo
git config could not be the fix and the identity had to be a per-process env var. That extension is
now on for this repo, so git config --worktree user.name gives a worktree its own authorship
without touching co-tenants. The tool that was missing when #1043 was written now exists.
Ask
Seat bring-up sets worktree-scopeduser.name / user.email alongside MOSAIC_GIT_IDENTITY, so the three identities are wired in one place and cannot drift apart.
extensions.worktreeConfig is asserted on any repo the fleet creates worktrees in, since the
scoped write silently becomes a shared write when it is off — the contamination path #1043
described.
Something reads the commit object. A gate that verifies the token is correct while never looking
at what the commit says is checking one of the two identities and reporting on both. The
write-differential check from #1043 is the natural home.
The existing [user] block in /src/mosaic-stack/.git/config is not to be removed casually:
with useConfigOnly = true and no scoped override, deleting it does not restore correct
authorship, it makes git commit fail for 72 live worktrees. Backfill the scoped identities
first, then remove the shared one.
Not done here
No shared config was edited, no seat's checkout was touched, and nothing was rewritten. Commits
already authored under the wrong name are history and stay that way.
## Problem
`#1043` mechanized the seat identity that decides **who acts** (`MOSAIC_GIT_IDENTITY` → the
credential helper → which token authenticates the push). It did not cover the identity that decides
**who the commit says wrote it** — `user.name` / `user.email` on the commit object. Those are
different config keys, set by different code paths, and fixing the first left the second silently
wrong.
`#1043` predicted this shape exactly, in its own words:
> Seats operate in **linked worktrees** sharing one `.git` […] `git config mosaic.gitIdentity`
> therefore writes the **shared** config, so one seat's identity contaminates every co-tenant
> worktree (chimera identity).
That is the realized state of `/src/mosaic-stack` today, for the authorship keys.
## Evidence — measured on web1, 2026-08-13
The shared repo config carries one seat's identity:
```
$ grep -A3 '^\[user\]' /src/mosaic-stack/.git/config
[user]
email = [email protected]
name = coder-mos1
useConfigOnly = true
```
That repository has **74 linked worktrees**, and **2** of them carry a `config.worktree` override:
```
$ git worktree list | wc -l
74
$ ls /src/mosaic-stack/.git/worktrees/*/config.worktree | wc -l
2
```
So 72 worktrees — belonging to be-coder-06, coder4, f10-coder, fleet-enhance, rev-974, the rm-0x
lane and others — author every commit as `coder-mos1 <[email protected]>`, whatever
seat is actually working in them.
This was found by walking into it: a commit on `feat/workspace-hygiene-tool-enforcement` (PR #1174)
came out authored `coder-mos1` on a branch whose entire history is `Hermes Agent
<[email protected]>`. `git config --show-origin` located the cause in the shared config. The
commit was amended under a worktree-scoped identity; the shared config was deliberately **not**
edited, because 72 other worktrees are live against it.
## Why it is silent
Nothing reports it. The push succeeds — the *token* is correct, because `#1043` fixed that half — so
the provider accepts the write and attributes the PR to the right account. Only the commit object
carries the wrong name, and no gate reads the commit object's author. The two halves disagree and
every check passes:
| | selects | set by | fixed by |
|---|---|---|---|
| `MOSAIC_GIT_IDENTITY` | which token authenticates — **who acts** | seat env (`#1043`) | yes |
| `GITEA_LOGIN` | which `tea` login prints — **who it says it is** | wrapper env | partly |
| `user.name` / `user.email` | **who the commit says wrote it** | git config | **no** |
`useConfigOnly = true` makes this worse in a specific way: it stops git from guessing an identity,
which is correct, but it means the shared value is not a fallback for seats that forgot to set one —
it is the *only* value they will ever get, applied confidently and silently.
## What has changed since #1043
`#1043` reasoned under `extensions.worktreeConfig` being **off**, which is why it concluded per-repo
git config could not be the fix and the identity had to be a per-process env var. That extension is
now **on** for this repo, so `git config --worktree user.name` gives a worktree its own authorship
without touching co-tenants. The tool that was missing when `#1043` was written now exists.
## Ask
1. Seat bring-up sets **worktree-scoped** `user.name` / `user.email` alongside
`MOSAIC_GIT_IDENTITY`, so the three identities are wired in one place and cannot drift apart.
2. `extensions.worktreeConfig` is asserted on any repo the fleet creates worktrees in, since the
scoped write silently becomes a *shared* write when it is off — the contamination path `#1043`
described.
3. Something reads the commit object. A gate that verifies the token is correct while never looking
at what the commit says is checking one of the two identities and reporting on both. The
write-differential check from `#1043` is the natural home.
4. The existing `[user]` block in `/src/mosaic-stack/.git/config` is **not** to be removed casually:
with `useConfigOnly = true` and no scoped override, deleting it does not restore correct
authorship, it makes `git commit` fail for 72 live worktrees. Backfill the scoped identities
first, then remove the shared one.
## Not done here
No shared config was edited, no seat's checkout was touched, and nothing was rewritten. Commits
already authored under the wrong name are history and stay that way.
Refs #1043.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
#1043mechanized the seat identity that decides who acts (MOSAIC_GIT_IDENTITY→ thecredential helper → which token authenticates the push). It did not cover the identity that decides
who the commit says wrote it —
user.name/user.emailon the commit object. Those aredifferent config keys, set by different code paths, and fixing the first left the second silently
wrong.
#1043predicted this shape exactly, in its own words:That is the realized state of
/src/mosaic-stacktoday, for the authorship keys.Evidence — measured on web1, 2026-08-13
The shared repo config carries one seat's identity:
That repository has 74 linked worktrees, and 2 of them carry a
config.worktreeoverride:So 72 worktrees — belonging to be-coder-06, coder4, f10-coder, fleet-enhance, rev-974, the rm-0x
lane and others — author every commit as
coder-mos1 <[email protected]>, whateverseat is actually working in them.
This was found by walking into it: a commit on
feat/workspace-hygiene-tool-enforcement(PR #1174)came out authored
coder-mos1on a branch whose entire history isHermes Agent <[email protected]>.git config --show-originlocated the cause in the shared config. Thecommit was amended under a worktree-scoped identity; the shared config was deliberately not
edited, because 72 other worktrees are live against it.
Why it is silent
Nothing reports it. The push succeeds — the token is correct, because
#1043fixed that half — sothe provider accepts the write and attributes the PR to the right account. Only the commit object
carries the wrong name, and no gate reads the commit object's author. The two halves disagree and
every check passes:
MOSAIC_GIT_IDENTITY#1043)GITEA_LOGINtealogin prints — who it says it isuser.name/user.emailuseConfigOnly = truemakes this worse in a specific way: it stops git from guessing an identity,which is correct, but it means the shared value is not a fallback for seats that forgot to set one —
it is the only value they will ever get, applied confidently and silently.
What has changed since #1043
#1043reasoned underextensions.worktreeConfigbeing off, which is why it concluded per-repogit config could not be the fix and the identity had to be a per-process env var. That extension is
now on for this repo, so
git config --worktree user.namegives a worktree its own authorshipwithout touching co-tenants. The tool that was missing when
#1043was written now exists.Ask
user.name/user.emailalongsideMOSAIC_GIT_IDENTITY, so the three identities are wired in one place and cannot drift apart.extensions.worktreeConfigis asserted on any repo the fleet creates worktrees in, since thescoped write silently becomes a shared write when it is off — the contamination path
#1043described.
at what the commit says is checking one of the two identities and reporting on both. The
write-differential check from
#1043is the natural home.[user]block in/src/mosaic-stack/.git/configis not to be removed casually:with
useConfigOnly = trueand no scoped override, deleting it does not restore correctauthorship, it makes
git commitfail for 72 live worktrees. Backfill the scoped identitiesfirst, then remove the shared one.
Not done here
No shared config was edited, no seat's checkout was touched, and nothing was rewritten. Commits
already authored under the wrong name are history and stay that way.
Refs #1043.