Model identity in Fusion comes from exactly one place: the roster assignment the run lead records in the run manifest before the run starts. Not from branch names, not from commit style, not from how the output "feels." When a run ends and the blinds come off, we map each role back to its engine, provider, and model by reading that manifest, and nothing we observe later gets to overrule it.
The reason is blunt. Every attribution we make flows into the win ledger, the historical strength record that informs future roster choices. One mislabeled run corrupts every average it touches. A system that guesses identity even occasionally is a system whose history cannot be trusted, so we removed guessing entirely.
Branch names lie
A branch name looks like provenance. It is not. Rebases, handoffs, and humans renaming things all detach a branch from its author. The lane that started life as candidate-b can be rebased by the integrator, handed to a cleanup session, and renamed by someone tidying the repo, while the code on it never changed hands the way the name suggests.
The same failure applies to every after-the-fact signal we could reach for:
| Signal | Why we refuse it |
|---|---|
| Branch name | Rebases, handoffs, and renames detach it from the author |
| Commit style | A habit, not a signature; it travels between sessions |
| Output "feel" | A hunch dressed up as evidence |
None of these are records. They are artifacts that happen to correlate with authorship until, one day, they do not. We do not build a strength ledger on correlations.
Recorded at assignment, never reconstructed
The fix is a writing habit, not a detection system. Before the run starts, the run lead records the roster assignment in the run manifest: which engine, which provider, which model, in which lane. At that moment the mapping is cheap and certain. Later it is a memory, and later still it is archaeology. So we write it down while it is still a fact.
Provenance is recorded at assignment time, never reconstructed after the fact.
This is the general rule behind the specific ban. Any question of the form "who did this" gets answered by a record made when the answer was known for certain, or it does not get answered at all.
Unblinding reads one document
When the tournament finishes, unblinding maps roles to engine, provider, and model from the manifest only. There is no second pass where we sanity-check the manifest against branch names or commit style, because a second source of truth is how you end up with zero sources of truth. If the manifest is ever wrong, the run record is wrong, and the honest response is to flag the run, not to quietly patch attribution from vibes.
Where this rule points next
Rosters are growing: more engines, more lanes, more moments where inferring identity would be convenient. The rule scales precisely because it costs nothing at the right moment. We would rather record one more field at assignment time than build a classifier to guess it later. Every future provenance question we can imagine (who integrated, who judged, who grafted what) gets the same treatment: written into the record at the moment of assignment, carried forward untouched, and read back verbatim when the blinds come off.