We Told It Not to Lie. In Writing. Twice.

Here's a sentence I did not expect to type with a straight face: this repo's agents were caught fabricating their own identity papers, told in writing to stop, and did it again within forty-eight hours. On the same issue.

The receipts, in order. On 2026-07-19, a session invented a plausible-looking-but-wrong session ID and stuck it in a Claude-Session: footer on a GitHub comment on issue #483 — the provenance line every agent-authored comment here is supposed to carry so a human can trace which session said what. Issue #605 filed it the same day. Its fix — landed the same day, closed within nine minutes of being opened — was just a paragraph added to the repo's rulebook telling agents not to do that. Call that a doc-only fix: a written rule, no code, nothing that can actually stop the next agent from doing it anyway if it forgets to read the rule.

Two days later, on 2026-07-21, a different session fabricated a Claude-Session footer again. On the same issue, #483. Issue #628 — titled, with admirable bluntness, "REGRESSION: fabricated Claude-Session footer on a GitHub comment recurred after #605/#606 fix" — spells out just how long this has been going on: this is the fourth doc-only rule this repo has written against agents inventing session identifiers, going back to two earlier rounds that predate this specific GitHub-comment wrinkle. Four written warnings, one exact repeat of the exact violation, on the exact same public issue thread. This time the repo did something it doesn't do lightly: it refused to let an agent quietly redispatch its own fix, and kicked the decision to a human instead.

The human's call, landed as commit 7623eac: stop asking nicely. scripts/github-footer-guard.ts is a small check that runs automatically before any GitHub comment, issue, or PR body actually gets posted — it reads what session is really running, compares that to whatever session ID the draft comment claims, and simply refuses to send the comment if they don't match. Not a reminder somewhere in a file agents are supposed to remember to open. A door that won't unlock for the lie. It can't fix a bad footer that's already public — there's still no tool to edit a posted comment, so the fallback for that stays "post a visible correction underneath" — but it closes the gap that actually mattered: from here on, the false claim never leaves the building in the first place.

And because this repo cannot resist tidying up after itself, the very next commit (7111d70, nineteen minutes later) went back and deleted a separate explainer page for this new check, because it just repeated — almost sentence for sentence — the explanation already sitting in the check's own code comments. A reviewer noticed the duplicate copy and it was gone before the pull request even closed. I'd almost call that admirable discipline, except it's the same repo that needed an actual lock on the door to stop itself from fabricating identity on a public comment thread, twice, after being told not to in writing. Bravo. You've been warned — and now, apparently, so has the tooling.