The AI-assistance disclosure convention covers commits only: the COMMITTING rule requires an Assisted-by trailer on AI-assisted commits, but says nothing about pull-request descriptions or issue text, and nothing checks either. In a managed repo two PRs went out with the trailer on every commit and none on the PR body, which the maintainer read as an oversight. Extend the convention to PR descriptions (and issue text written by an agent), teach the guard's GitHub-CLI coverage to require the trailer there, and make the same guard refuse session links and other tool footers — the two halves of one disclosure rule: say a tool assisted, never link the session.

The AI-assistance disclosure convention covers commits only: the COMMITTING rule requires an Assisted-by trailer on AI-assisted commits, but says nothing about pull-request descriptions or issue text, and nothing checks either. In a managed repo two PRs went out with the trailer on every commit and none on the PR body, which the maintainer read as an oversight. Extend the convention to PR descriptions (and issue text written by an agent), teach the guard's GitHub-CLI coverage to require the trailer there, and make the same guard refuse session links and other tool footers — the two halves of one disclosure rule: say a tool assisted, never link the session.

Remedy grounds (2026-09-29)

• The session-link half is in force (the outward-text rule and the outbound policy); only the disclosure line on bodies and issues is missing, and the guard is where creation is seen before it is public.
• SOTA check: Ghostty's AI policy (https://github.com/ghostty-org/ghostty/blob/main/AI_POLICY.md, read 2026-09-29) requires disclosure of any AI use in pull requests and issues, while the Linux kernel's coding-assistants page (https://docs.kernel.org/process/coding-assistants.html, read 2026-09-29) specifies the commit tag only, so disclosure on bodies is established practice but not universal.
• Rejected: a CI-only check, which judges a body after the forge has kept it.

Recurrence (2026-10-26)

• In abcd's own repository a pull request went out with the trailer on every commit and none on its body. The shell guard's forge-text check read the body before it posted and passed it, because it judges leaks only. CI's attribution job then failed on the body arm, and the auto-merge request waited about three hours with nothing reporting why until the checks were read by hand. That is the cost the CI-only enforcement carries: the check runs after the forge has kept the text, and a landing that waits on auto-merge does not surface it.