feat(surface,node-sync,centaur): agent commits are authored by the human who drove them

[gbasin]

What broke

Agent commits in Atrium sandboxes were authored Centaur AI <ai@centaur.local>, baked into the sandbox image at centaur/services/sandbox/Dockerfile:251-252. GitHub attributes commits by author email, so those commits linked to no GitHub user and the CLA bot reported "Centaur AI seems not to be a GitHub user".

Signing was unreachable, not merely undone: the bot only records a signature when the commenter's login is in the PR's committer set, and the committer set was {Centaur AI → login: null}. #536 (a deliberate test PR) found this. It affects every agent-authored commit — it has gone unnoticed only because gbasin is on the CLA allowlist.

Why it was structural

Every per-user value here is injected at the HTTP boundary by the iron-proxy, keyed by a principal bound at claim time. Commit authorship is the one per-user value that lives below that boundary — inside the payload — so the proxy pattern that solves everything else cannot solve it. The push was genuinely authenticated as the user while the commit object said Centaur AI; transport and payload disagreed.

Env can't carry it either: a warm pod's env is baked before the claiming principal is known (args.rs:1866), the warm-hit path returns before spec.env is applied (lib.rs:3527 vs 3540), and validate_execution_environment is a single-name allowlist. Per-session file materialization is the only channel reaching a claimed warm pod.

The change

• surface — capture GitHub's numeric id from the /user responses already parsed (no new API calls); resolve <id>+<login>@users.noreply.github.com (the ID form always links; the plain form only links for pre-2017 accounts), falling back to the Atrium account email. Served on GET /api/internal/sessions/:id/git-identity, or 204 when unresolvable.
• node-sync — fetch per claim, materialize ~/.config/git/atrium-identity via git config --file so git owns the escaping (display names are user-controlled — otherwise a config-injection vector). Atomic tmp+rename, 0600. On 204, remove any stale file.
• sandbox — include.path after the baked [user] block (git config is last-wins), so an identity wins when present and the image identity stands when absent. commit-msg stamps Atrium-Session/Atrium-Harness trailers.

Safe to ship dark: with no identity file, behavior is byte-identical to today — verified, not assumed.

Design notes

Identity comes from our records, never from the proxy's token. A user with no personal grant gets a shared fallback credential (iron-control.ts:434-438), so deriving authorship from gh api user would silently author their commits as a bot — worse than Centaur AI, which at least fails loudly. Authorship and transport are different concerns.

Not a profile bundle, despite the identical shape. Profile bundles are user-authored, captured, and written back — an identity round-tripping through writeback would re-introduce the clobber class fixed in #97.

Verification

• Sandbox simulation with the real hook and real image gitconfig, proving the three parts compose: unclaimed → Centaur AI unchanged; claimed → Allan Niemerg <1568680+aniemerg@users.noreply.github.com> + trailers; revoked → clean fallback; --amend → no duplicate trailers.
• Linux clippy -D warnings + 257 lib + 16 contract + privileged overlay tests in Docker (host clippy is blind to linux_daemon).
• pnpm check green (lint 929 files, migrations, typecheck, 891 server tests). pnpm e2e green — 113 passed, exit 0.
• Injection proven neutralized: a hostile display name with embedded newlines + [include] cannot inject a config section.

Closes the hole #536 found. Does not touch #536 itself — that branch is Allan's.