Agent provenance & compliance

When agents ship code, the question that matters later is "which task, under which approved epic, with which playbook?" The work plane answers it structurally: every PR carries its lineage, written by the pen and verified by the platform. Provenance is not bureaucracy — it is how the observation log knows which task a branch, PR, or check belongs to.

The pen: orun pr open

One motion writes the whole lineage:

• The branch names the task — grammar orun/<task-key>-<slug> (orun/PAY-T14-route-the-reads). One task, one branch, one PR.
• The PR body carries a manifest — a machine-readable HTML-comment block (invisible in the rendered body) declaring the task, the epic and its approved revision, the session, and the skill revisions the session ran under.
• Every commit carries the Orun-Task: trailer — orun githooks install adds a commit-msg hook that stamps it idempotently.

orun pr check runs the same rules locally before you push (prevention over detection), and orun pr link <task-key> adopts an existing PR into the lineage. Without a forge token, orun pr open degrades honestly to a compare URL — it never half-writes.

Skills: hosted playbooks, pinned by revision

Skills are the operating procedures agents run under — content-addressed markdown (rev = sha256 of the canonical body) hosted by the platform. The default set ships with the code; an organization row of the same name shadows its default. Publishing a skill revision requires the same privilege as approving an epic — changing the playbook agents follow is a decision.

orun agent run materializes the pinned skills into the session and records the pins; the pen then names those revisions in the PR manifest, so a reviewer can see exactly which playbook produced the diff.

The verifier: orun/compliance

The platform-side half is a check run posted on every PR (opened or updated) in repositories that opt in. It replays the same rules as orun pr check — the two engines are pinned byte-identical by shared conformance fixtures — and renders a verdict with a trace table: level, rule, finding, plus fix hints.

Three modes per repository link:

Mode	Behavior
off	Never posts (default).
advisory	Posts the check; a broken lineage concludes neutral. Stays silent on human PRs that never attempted lineage — ordinary PRs are not decorated.
required	A broken (or absent) lineage concludes failure — with branch protection, the check becomes the gate.

The check also reconciles a minimal, self-healing label set — the task join-key (orun:task/<key>) and orun:noncompliant while (and only while) the check fails — and appends a work.pr.noncompliant event to the platform log so rules and the console see a broken lineage the moment the check does.

What this buys you

• Attribution without archaeology — the PR names its task, epic revision, session and skills; the fold joins delivery evidence to the right work items automatically.
• Reviewable autonomy — approve the epic once, then verify each PR against the sealed decision it claims to implement.
• One rule set — the local preflight and the hosted check can never drift apart silently; their shared fixtures are replayed by both engines in CI.