[WenJing95]

Summary

A valid scan owner hint can be reported as unsupported when Git history contains email spellings that differ only by case. The matcher previously selected the first case-insensitive identity before checking whether its evidence supports the cited commit.

Select the first matching identity that also has evidence for that commit, preserving the original Git identity and citation.

Changes

• Include commit support in the identity search and reuse the same predicate when collecting citations.
• Add a regression using real Git history with two email spellings.

Testing

• bun test --timeout 30000 tests-ts/suggest-owners.test.ts tests-ts/scan-owner-suggestions.test.ts: 67 passed, 214 assertions, zero failures.
• SDK node --run build, pnpm run types, and pnpm run format: passed.
• Seven synthetic cases through the built public SDK passed, including mixed-case hints, unsupported-commit controls, and abstention.
• Actual post-scan owner-artifact generation wrote the expected result without model calls; canonical manifest, findings, and coverage bytes remained unchanged.

Risk and rollout

This fixes an error in an optional owner-report row. Owner selection still requires matching Git evidence. The security scan and canonical findings are unaffected, and there is no public CLI change.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

Thank you for fixing this real owner-hint failure. I reproduced valid mixed-case hints failing on the parent revision and succeeding here, while unsupported hints still fail. The identity search stays tied to the cited Git commit, and the small predicate reuse is appropriate.

Verification passed: 67 focused tests, build/type/format checks, and seven cases through the built public SDK and actual post-scan owner-artifact path. Current-main integration passed too; canonical scan data stayed unchanged and no model calls were made. No remaining correctness issues found. Required hosted CI is running separately before merge.