[Bug] Public 6.6.0 release notes still thank Copilot as a human contributor #7674

Before submitting

• I searched the open and closed issues for a related report.
• I removed credentials, tokens, private paths, and sensitive target data.

Area

Documentation

Observed behavior

The retained 6.6.0 release notes include Thanks @Copilot in their ADB entry. A fresh read of the public GitHub release shows the same automation-account credit. Checking that section with the current release-note checker produces:

Release notes failed: Unverified human credit @copilot

This command exits 1:

node scripts/release-notes.mjs check \
  --manifest docs/releases/6.6.0.contributions.json \
  --notes <(sed -n '/^## \[6\.6\.0\]/,/^## \[6\.5\.0\]/p' CHANGELOG.md | sed '$d')

Reproduction

1. At the baseline below, use Node 24.22.1 and the installed locked dependencies. Run the command above from the repository root in Bash or Zsh. It extracts the existing 6.6.0 section without changing files.
2. Observe the diagnostic above and exit status 1. The failure reproduced on all four verification invocations.
3. Read the public record with gh release view rea-agents-6.6.0 -R morluto/rea --json body,isDraft,tagName. The non-draft body includes the same Copilot thanks.

I also checked extracted 6.5.0, 6.7.0 and 6.8.0 sections against their matching saved manifests; each exited 0. A scratch copy of 6.6.0 with only @Copilot, removed also exited 0.

Expected behavior

Public contributor thanks should credit verified humans and exclude known automation accounts while retaining complete source authorship in the contribution inventory. Correct the outdated Copilot thanks in the public 6.6.0 prose while preserving its human contributors and original provenance. The release-note authoring policy explicitly excludes Copilot, and the current checker implements that exclusion.

This is a correction to retained public wording. The normal release workflow validates its selected candidate; it does not promise that every older section passes every later checker revision.

Impact and scope

P3: the public 6.6.0 contributor wording incorrectly includes an automation identity in its human thanks. No REA runtime failure or current release-publication failure was established. Human handles remain present in the affected bullet.

The checker bundled at the 6.6.0 tag accepts this section with its saved inventory: I executed that historical library's verifyReleaseNotes function and obtained a successful result. The original exclusion list did not yet include Copilot. Therefore the present diagnostic does not establish that the original release bypassed validation.

The observed public artifact is the GitHub release. npm publication was not independently queried; the later changelog says 6.6.0 was tagged without being published to npm. A prose correction requires no retagging or package republication.

REA version

Exact output from node scripts/rea.mjs --version: 6.8.0.
Source baseline: 65f1c447344a423fa2785847dbcea1e9a9e2454a.

Runtime and platform

Node v24.22.1; macOS 27.0.1; arm64.

Interface

Other

Earliest failure stage

Unknown

Relevant output or evidence

• The check command above exits 1 with Release notes failed: Unverified human credit @copilot.
• CHANGELOG.md:162 contains the 6.6.0 ADB bullet's Copilot thanks; the public GitHub release contains the same wording, confirmed with the read-only release command above.
• .agents/skills/rea-changelog-update/SKILL.md:65–74 requires verified human credit and explicitly excludes Copilot. The same skill at the 6.6.0 tag already requires human authors and excludes bots/known agents, though its examples omit Copilot.
• docs/releasing.md:127–149 describes contributor-aware notes and offline credit validation. Its lines 158–166 describe checks before creating the selected release, rather than a historical-section gate.
• scripts/lib/release-notes.mjs:105–116 excludes Copilot from eligible human credit; lines 308–310 reject a thanked handle outside that eligible set. The explicit rejection is covered by tests/boundary/filesystem/releaseNotes.test.ts:346.
• docs/releases/6.6.0.contributions.json retains Copilot's source identity for commit 509d4c8f56b0e5f65346259b2aeccbb5a8e9ba72. Successful full checks after the scratch-only prose correction report 571 commits and 236 PRs, so this is not evidence of a malformed manifest.

Analysis or suspected cause

Source history shows that commit 8e6a95788688439baeeec8e54c9b3e845226f79d added Copilot to the human-credit exclusion list and updated its regression test and instructions. That change did not update the retained 6.6.0 prose. The stale attribution remains visible even though current tooling correctly rejects generating or accepting that credit.

Additional context

Read-only duplicate searches covered open and closed issues, all PR states including merged, and issue comments using Copilot/credit, the exact diagnostic, and release-note/check terms. No report of this same public Copilot credit was found. Related records inspected included #7517 (inventory archival), #6939 (notes export), #7355 (different historical provenance corrections), and the original #3476 release PR; they address different outcomes or merely contain the affected prose.

Triage assessment

• Impact level: P3
• Assessment status: supported
• Impact basis: The retained changelog and public GitHub release contain incorrect contributor wording; verification established no runtime behavior change or blocked current release workflow.
• Workaround status: available
• Workaround basis: Readers can identify the automation account from the explicit credit policy and preserved inventory; the scratch-only removal of its thanks also passed the current offline checker without changing source history or human credits.