Name the authorization the corpus rests on, and the gap it leaves

[MongLong0214]

CDEB-10 lists privacy authorization among the things that must exist before the corpus is sealed, and §3.3 requires ownership and authorship to be disclosed. This is that record; each repository's freeze entry (§6.1 source_authorization_id) points at it.

A public repository is not consent to be studied. Visibility and authorization are different things, and the second has to be named by the person who holds it rather than inferred from the first. This was raised by another session working in one of the source repositories, and it was the right challenge — the owner has now granted both the use of the source data and transparent publication of the result.

Two boundaries written down rather than discovered later

Upstream commits are not the owner's to authorize. One repository is a fork whose recent history is mostly other people's commits — 1,052 in one recent week. A task drawn from it has to rest on a record the owner authored, checked per record in the candidate registry rather than assumed.

The CommitLore repository stays excluded whatever the authorization says. That exclusion is methodological — the product's own decisions are not independent of the product being measured — so permission does not touch it.

Tier B, stated in the document

Every authorized repository is operated by the same person who authored the benchmark and the product. That is §3.3's Tier B, and the attached rule is not optional: the result must read "author-operated repositories" and must not describe itself as independent external validation.

The arithmetic, stated instead of deferred

§3.3 wants five repositories. The exclusion leaves four authorized. §3.2 rule 5 already says what may not be done about a shortfall — the study stops rather than lowering the bar or creating records to fill it.

Measured today, Ruled-out trailer counts across the authorized repositories are 49, 6, 6 and 0, against six tasks required per repository. The corpus is not ready, and no amendment to §3.3 fixes that — changing the composition rule while looking at which shape fits the available data is precisely the move rule 5 exists to prevent. The answer is accumulation, and the next step is a candidate registry that reports eligibility continuously so the moment it becomes reachable is a number rather than a guess.

Both bench verifiers pass; package typecheck clean. Documentation only — no code path changes.

[github-actions]

CommitLore — record lint

Trailers: clean — 1 commit in origin/dev..5ec7413c38689d37ed0b09ba04cbf9fbb7e46c63
Active constraints: 1 limits · 1 ruled-out · 0 warnings — from 1 record over 1 changed path

Limits (1)

• r-cdebauth1 5ec7413 — this records that authorization was granted, not that every candidate drawn under it was authored by the grantor -- the candidate registry checks that per record, and nothing here substitutes for it

Ruled out (1)

• r-cdebauth1 5ec7413 — treating public visibility as consent to study | a repository being readable says nothing about whether its owner agreed to be measured and named

the index is unavailable (the index has no baseline commit); answering with a full scan

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}