docs: log commit-identity incident dfd052d; mark Tier 1/2 entries pending reconciliation

docs/GLOSSARY.md

@@ -228,6 +228,8 @@ A prescriptive classification of how urgently an action should be taken. Lives i
 
 ## Tier 1 — Verified
 
+> **⚠️ PENDING RECONCILIATION (2026-08-06)** — See `## Evidence Model` above. That pre-existing section states Findings produced by `llm_sample` or any other non-deterministic method are "Indicative by definition" and "Cannot be upgraded to Verified without additional concrete evidence." This entry distinguishes audit-run facts (Tier 1-eligible via stored artifacts) from Findings (Tier 2). Until the side-by-side extraction is done and Tony resolves it, this entry is not fully authoritative; when the two sections appear to disagree, the pre-existing Evidence Model rule governs (ambiguous findings default to Indicative).
+
 A fact verified by the appropriate authority. Verification authority differs by fact class:
 - Business-entity facts (name, phone, address, hours, services, categories): requires owner confirmation or owner-access verification.
 - Audit-run facts (prompt executed, engine captured, timestamp, raw output stored): requires stored filesystem/git/database evidence. Verifies the audit *event* occurred, not that a business fact inside it is true.

docs/operations/task-reliability-ledger.md

@@ -35,6 +35,22 @@ Until a task type has documented runs, human approval remains required before an
 
 ## Process log (first real client)
 
+### 2026-08-06 — Commit identity incident (dfd052d)
+
+**What happened**
+1. Commit `dfd052d` (AI Visibility Unified Framework v1, Artifact A/B templates, GLOSSARY additions) was authored and committed as `Ty <tybala@outlook.com>` by Leonard.
+2. The repo's established agent convention is `Leonard <leonard@hermes.local>` (51 prior commits, author + committer, July 25 – Aug 2). The commit should have used that identity.
+3. Root cause: I matched the last 5 commits' visible author (all Ty-drafted that day) instead of the durable 51-commit convention. The identity was set explicitly (repo-local `git config`), so this was a deliberate wrong choice, not passive inheritance — the shared vpsadmin config is `Epictetus` and the sandboxed HOME has no identity at all.
+4. Consequence: git blame on `dfd052d` reads as human-authored, erasing the human/agent distinction for that commit.
+
+**Decision (Tony, 2026-08-06):** Leave `dfd052d` as-is — do NOT force-push/rewrite. The two-branch workflow was retired specifically to avoid git complexity; a force-push reintroduces it and launders the record. The honest move is to keep the misattributed commit in history and document the correction, which is what this entry does.
+
+**Going-forward rule:** Every Leonard commit uses `Leonard <leonard@hermes.local>`, set per-repo, every time. Never commit agent work under a human identity — it destroys the git-blame audit trail that the "verify against git state, don't trust self-reports" principle depends on.
+
+**Last updated:** 2026-08-06
+
+---
+
 ### 2026-08-03 — Overcome Fitness (first real non-Phoenix cold audit)
 
 **What happened**