chore(attribution): migrate provenance consumers after the rename (#4590 merged)

[kyle-sexton]

Problem

PR #4590 ("feat(attribution)!: rename the provenance plugin to attribution") implements the rename and closes #4589 when it merges. The consumers that live outside this repository are not covered. #4589's triage marks them "out of scope here (owner)", and #4590's Related section lists them as USER-RESERVED. Once #4590 merges, #4589 closes and nothing tracks them. The PR itself also has not been merge-gated: its Verification section still reads PENDING.

Evidence

The rename itself is settled: the operator decided on 2026-09-11 to rename provenance@melodic-software to attribution@melodic-software. The reasons: the plugin's one rule is that restated prose must be attributed, and "provenance" also means an origin note to delete in code-tidying and docs-hygiene.

Verified this pass (2026-09-27):

• feat(attribution)!: rename the provenance plugin to attribution #4590 is open and not a draft, mergeable, with head c6e962623 and a CI run in progress on that head. The head d1ba6d1a5 named in the handoff is stale: a later commit landed.
• feat(attribution)!: rename the provenance plugin to attribution #4590 moves plugins/provenance/ to plugins/attribution/ at 0.6.0. It keeps plugins/provenance/ 0.6.0 as a one-release deprecation shim, with stub skills set to disable-model-invocation: true. Other changes:
  • Rule ids become attribution/audit/rule-*, the config file becomes .claude/attribution.json, and the findings file becomes <ts>-attribution.md.
  • A leftover provenance*.json prints a warning and is never read.
  • renames in marketplace.json is unchanged.
• Commit 1bc1c2584 on the branch records the one-release shim in docs/migration-playbook.md. That resolves the conflict the PR body flags (the playbook previously said a rename is a clean break with no tombstone).
• Commit e84d5d72b on the branch enables attribution in this repository's .claude/settings.json "until the fleet list names it". That is a temporary line to revert later.
• Out-of-repo consumers (read-only checks):
  • melodic-software/standards components/cloud-environment/fleet-plugins.json:68 has "provenance@melodic-software": true.
  • melodic-software/dotfiles .chezmoidata/claude.json:600 has "provenance@melodic-software": false, so there is a decision to make about whether attribution should be enabled there.
• Plugin data directory: no file under plugins/attribution/ or plugins/provenance/ on the PR head references CLAUDE_PLUGIN_DATA or plugins/data (git grep at d1ba6d1a5). The plugin keeps its config in .claude/attribution.json layers, not the data directory. So there is probably nothing to move. Verify on each machine that ~/.claude/plugins/data/provenance-melodic-software/ is absent or empty before deleting it.

Not verified: the result of the CI run on c6e962623; whether the review lanes ran on it.

Proposed approach

1. Gate feat(attribution)!: rename the provenance plugin to attribution #4590: run /source-control:pull-request ready (merge the base, security review, fresh-context verify). Fill in the Verification section; it currently says PENDING. Merge once ci-status is green.
2. Decide the user-reserved items:
   • Whether to add a renames entry provenance -> attribution. Upstream calls the map append-only, and the repo's frozen-map doctrine argues against it. The shim covers the one-release window without it.
   • Whether dotfiles should enable attribution (today provenance is false there).
3. Migrate consumers, each in its own repository under that repository's identity:
   • standards fleet-plugins.json: replace the provenance row with "attribution@melodic-software": true.
   • dotfiles .chezmoidata/claude.json: rename the row and apply the decision from step 2.
   • Each machine's ~/.claude/settings.json enabledPlugins: enable attribution, disable provenance after the update lands.
   • Any ~/.claude/provenance.json or repo .claude/provenance*.json: rename to attribution*.json (/attribution:setup reports leftovers).
   • Data directory: remove ~/.claude/plugins/data/provenance-melodic-software/ only if the per-machine check finds it absent or empty.
4. In this repository, after the fleet list names attribution: revert e84d5d72b's settings line.
5. Next release: remove the provenance shim, meaning its directory, its marketplace entry, the cheat-sheet exclusion, and the owner row in scripts/skill-leaf-name-registry.txt.

Acceptance criteria

• feat(attribution)!: rename the provenance plugin to attribution #4590 is merged with a filled-in Verification section and a green ci-status.
• The renames decision and the dotfiles enablement decision are recorded in this issue.
• The standards fleet-plugins.json names attribution@melodic-software, not provenance@melodic-software.
• The dotfiles claude.json names attribution@melodic-software per the recorded decision.
• Every fleet machine's enabledPlugins has attribution in the intended state, and no machine still enables only provenance.
• This repository's temporary .claude/settings.json line from e84d5d72b is gone once the fleet list carries attribution.
• A later release removes the provenance shim (tracked here or in a follow-up).

Constraints and gotchas

• Writes to standards and dotfiles belong to those repositories and their own PRs. Do not edit them from this repository's session.
• Removing the shim before machines update would reintroduce Plugin "provenance" not found in marketplace for anyone still enabling it.
• Keep docs/specs/provenance-* and past CHANGELOG sections as history. "Provenance" in the sense of origin stays.

Context

Source: local handoff item 20260911-232631-rename-provenance-plugin-to-attribution.md, which this issue retires. Related: #4589 (closed by #4590 on merge), #4590, #3232 (a precedent hard rename, bug-report to bugs).

[kyle-sexton]

Update: #4590 merged on 2026-09-27 at 21:05 UTC without the separate merge gate this issue called for. What remains is the consumer migration checklist below, plus a post-merge review of the rename if anything regresses.

[kyle-sexton]

This was generated by AI (Claude Code audit-fix run, 2026-09-29).

Reopened. This comes from the 2026-09-29 audit of the unattended Cursor run. PR #4840 closed this as completed with a 13-line playbook note, but this is the only tracker for out-of-repo consumers. Label status: needs-decision stays. No per-repo issues are opened; the remaining steps are here.

Remaining steps (operator / other-repo)

• standards fleet-plugins.json names attribution.
• dotfiles claude.json names attribution and the enablement decision.
• Every machine's enabledPlugins is updated.
• Only then, revert the temporary .claude/settings.json:35 line (still enables attribution@melodic-software).
• A later release removes the provenance shim (plugins/provenance still exists).
• Decisions recorded in this issue.

Decisions for the owner

D1. Renames map. The agent recorded "do not add provenance to attribution to the frozen renames map" in the playbook. It matches baseline 7acaf08 docs/migration-playbook.md (about line 505, "nothing new is added to it"). Options: ratify, or add the key. Recommendation: ratify. Basis: that baseline text.

D2. Dotfiles enablement of attribution. Never decided (dotfiles .chezmoidata/claude.json:600 has provenance false). Options: enable, or leave disabled. No recommendation; owner-reserved and cross-repo.

Unblocks: the remaining checklist. The playbook paragraph is being cut through a core-docs request.

[kyle-sexton]

Owner decision (2026-09-29): D1 ratified: nothing is added to the marketplace renames map; the one-release provenance shim covers the window. D2: dotfiles enables attribution (rename the seed row from provenance to attribution, keep true). Next: an agent renames the standards and dotfiles rows, each in its own repo and PR, then reverts the temporary .claude/settings.json:35 line. Still owner actions: update each machine's enabledPlugins, and check ~/.claude/plugins/data/provenance-melodic-software/ is empty before deleting it. The provenance shim stays until machines update; its removal is a later release.

[kyle-sexton]

Owner decision (2026-10-01): approved the recommendation ("go with recommended", the owner's reply to the batch decision page that listed this question and its recommendation).

Question: approve an agent to finish and merge the three draft PRs that rename provenance to attribution (standards#654, then dotfiles#963, then plugins#5430), leaving this issue open for the owner machine steps?

Chosen: A. An agent fixes plugin-seed-drift on standards#654, readies and merges it when CI is green; readies and merges dotfiles#963 without running chezmoi apply; fixes lint-2 and the missing issue link on plugins#5430 (body opens with "Refs #4668"), rebases, readies and merges it after standards#654 is published. It then comments status here and leaves the issue open.

Next: an agent picks up the PR work (label agent-ready). Owner-only steps stay open: each machine's enabledPlugins update, checking the provenance data dir is empty, and the later shim removal.