[BUG] includeCoAuthoredBy: false / attribution.commit: "" only remove the instruction: Co-Authored-By: Claude is still written to commits with no attribution text anywhere in context

Preflight Checklist

• [x] I have searched existing issues. Closest: #101634 (2026-10-12, open: with attribution.commit: "" the model wrote Co-Authored-By: Claude into 5 commits with no attribution text in its context; intermittent, no transcript evidence), #9224 (closed as duplicate in 2025: the setting is not enforced when the commit is made through the Bash tool), #79909 (trailer comes back because the model relies on conversational memory rather than an enforced setting; closed as inactive with "open a new issue if this is still relevant"). The rest are about an attribution instruction that the setting fails to suppress: #4287 / #7543 / #14241 / #6848 (setting not respected), #65657 / #45137 / #53259 (the system prompt's own trailer instruction wins; closed), #96113 (reminder intermittently emits the trailer mid-session), #91546 (Claude-Session: trailer with the setting off), #91829 / #92169 / #94325 (remote_session_change or the reminder overriding CLAUDE.md), #89164 (Agent SDK never injects the attribution settings). This report is the #101634 / #9224 case with transcript evidence: the settings suppressed every instruction, the context contained no attribution text at all, and the trailer was still written, after an automatic context compaction in a session whose earlier commits had none.
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code (2.1.300; the affected session ran 2.1.296, and the attribution wording in the system prompt is identical in both)

What's Wrong?

With includeCoAuthoredBy: false and attribution: { commit: "", pr: "", sessionUrl: false } in ~/.claude/settings.json, commits got Co-Authored-By: Claude <noreply@anthropic.com> appended. GitHub maps that address to the claude account, so it now lists Claude as a contributor on the repository.

All of them come from one interactive CLI session (2.1.296, native install, macOS). What the transcript of that session shows:

• The setting was honoured on the prompt side. Four prompt_snapshot records exist for the session; none contains Co-Authored, includeCoAuthoredBy or noreply@anthropic.com. The only attribution text in the system prompt is the generic line End git commit messages and PR bodies with the attribution lines given in the conversation's system-reminder, when one is present.
• No attribution system-reminder was ever delivered: no remote_session_change attachment, no Attribution for git commits ... reminder, nothing. (So this is not #91829, which does fire in my sdk-py sessions but did not fire here.)
• Nothing I control says anything about attribution either way: ~/.claude/CLAUDE.md, ~/.claude/AGENTS.md, the project's AGENTS.md and .claude/*.md contain no co-authored, attribution or trailer, and a grep over the rest of ~/.claude (skills, commands, agents, plans, excluding transcripts) finds no such rule either.
• Nothing in the session's own context mentioned a Co-Authored-By trailer before the model wrote the first one: no tool result, no git log output, no user message.

Same session, same binary, same settings, same prompt: the commits made before an automatic context compaction have no trailer, every commit made after it has one. The compaction summary itself contains no attribution, trailer or Co-Authored text, so the summary did not carry the behaviour over; the model started adding the trailer on its own once the fresh context had nothing that said not to.

The practical problem is what the setting actually does. includeCoAuthoredBy: false / attribution.commit: "" only remove the instruction to attribute. They do not add an instruction not to attribute, and nothing checks the commit message that the model then writes. The model's default, absent any instruction, is evidently to write the trailer anyway, so the opt-out holds only as long as the model happens not to fall back to that default. A compaction is exactly the point where it does, and also exactly the point where nobody is watching the session.

What Should Happen?

When attribution is disabled, no Co-Authored-By: Claude ... trailer should reach git, regardless of context compaction. Either of these would do it:

1. Treat the opt-out as a positive instruction: when includeCoAuthoredBy is false or attribution.commit is empty, put an explicit "do not add Co-Authored-By or any other attribution trailer to commit messages" line into the system prompt, and re-assert it after compaction the same way other post-compaction reminders are re-delivered.
2. Enforce it at the git layer: when attribution is disabled and a Bash tool call runs git commit, strip or reject a Co-Authored-By: Claude* / Claude-Session: trailer in the message, the same way the setting is supposed to stop Claude Code's own trailer.

(1) is cheap and would already have covered this case. (2) is the only one that actually guarantees the setting.

Error Messages/Logs

No error. Nothing in the session indicated that a trailer had been added. The commits were made with git commit -F - and a heredoc message whose last line was the trailer.

Steps to Reproduce

I have no deterministic reproduction; this is a report from transcripts.

1. ~/.claude/settings.json with "includeCoAuthoredBy": false and "attribution": { "commit": "", "pr": "", "sessionUrl": false }. No CLAUDE.md rule about attribution.
2. A long interactive session that makes several commits through the Bash tool, hits an automatic context compaction, then keeps committing.
3. Compare git log --format=%B before and after the compact_boundary record in ~/.claude/projects/<slug>/<session-id>.jsonl.
4. Confirm with the same transcript that no prompt_snapshot and no attachment of the session contains Co-Authored or remote_session_change.

Claude Model

Other: claude-fable-5-1 (interactive session; the trailer was written by the main thread, not by a subagent)

Is this a regression?

I don't know

Last Working Version

Unknown. Commits made earlier in the same 2.1.296 session had no trailer, and no earlier commit in the same repository had one.

Claude Code Version

2.1.296 in the affected session; 2.1.300 installed now, with the identical system prompt wording

Platform

Anthropic (claude.ai account login)

Operating System

macOS 27.0 (Darwin 27.0.0), Apple Silicon

Terminal/Shell

zsh, third-party terminal emulator

Additional Information

• Native install (~/.local/share/claude/versions/2.1.296, symlinked from ~/.local/bin/claude). No managed settings (/Library/Application Support/ClaudeCode absent), no CLAUDE_CONFIG_DIR.
• ~/.claude/settings.json is version-controlled. includeCoAuthoredBy: false has been in it since 2025-12-13 and the attribution block since 2026-09-19, both unchanged since; no setting changed between the clean and the affected commits.
• Related but separate: sessions launched through the Agent SDK (entrypoint: "sdk-py") on this machine do receive the remote_session_change attachment with "commit": "Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>", worded as replacing earlier guidance, with the same includeCoAuthoredBy: false in place. That is #91829 and is not what happened in the session above. I mention it because both paths show the same thing: the setting is read when the prompt is composed and is never consulted again.