refactor(resolver): remove unused trustedAccountMappings extension point

- Remove speculative trustedAccountMappings plumbing from identity resolver and orchestrator
- Keep noreply commit authors strictly unresolved for award recipients while preserving DCO attribution
- Update noreply tests to verify unresolvable recipient without dead mapping code

Signed-off-by: Parth Gartan <parthgartan26feb@gmail.com>

Author: PARTH-TUSSLE

utils/award-orchestrator.js

@@ -265,10 +265,9 @@ function getSanitizedReport(internalResult) {
  * @param {Object} options.prMetadata PR metadata object or file content
  * @param {Array<string|{name: string}>} [options.existingLabels] Existing labels on PR
  * @param {string} [options.repoOverride] Explicit repository override
- * @param {Object|Map|Function} [options.trustedAccountMappings] Trusted account mappings for noreply authors
  * @returns {Object} Structured evaluation result
  */
-function orchestrateAwards({ prMetadata = {}, existingLabels = [], repoOverride = '', trustedAccountMappings = null }) {
+function orchestrateAwards({ prMetadata = {}, existingLabels = [], repoOverride = '' }) {
   // Extract repository
   const repo = (
     repoOverride ||
@@ -350,7 +349,7 @@ function orchestrateAwards({ prMetadata = {}, existingLabels = [], repoOverride
   });
 
   // Resolve identity and DCO strictly to PR author
-  const identity = resolveIdentity(prAuthor, dedupedCommits, { trustedAccountMappings });
+  const identity = resolveIdentity(prAuthor, dedupedCommits);
   const maskedRecipientEmail = maskEmail(identity.resolvedEmail);
 
   // Extract existing tracking labels with deduplication

utils/identity-resolver.js

@@ -98,29 +98,6 @@ function isTrailerAttributableToAuthor(trailer, gitAuthor) {
   return false;
 }
 
-function getTrustedRecipientEmail(prAuthor, options) {
-  if (!options || !prAuthor) return null;
-  const mappings = options.trustedAccountMappings || (
-    typeof options.get === 'function' || typeof options === 'function' || (typeof options === 'object' && !options.prMetadata) ? options : null
-  );
-  if (!mappings) return null;
-
-  const normalized = prAuthor.trim().toLowerCase();
-  let val = null;
-  if (typeof mappings.get === 'function') {
-    val = mappings.get(normalized) || mappings.get(prAuthor);
-  } else if (typeof mappings === 'function') {
-    val = mappings(normalized) || mappings(prAuthor);
-  } else if (typeof mappings === 'object') {
-    val = mappings[normalized] || mappings[prAuthor];
-  }
-
-  if (val && typeof val === 'string' && isValidEmail(val)) {
-    return val.trim().toLowerCase();
-  }
-  return null;
-}
-
 /**
  * Resolves contributor identity and strictly verifies DCO compliance against commit history.
  *
@@ -134,18 +111,16 @@ function getTrustedRecipientEmail(prAuthor, options) {
  * When a commit author uses a GitHub noreply email (@users.noreply.github.com),
  * a real recipient email is NEVER resolved solely from matching contributor-controlled names.
  * Exact noreply DCO attribution is preserved (dcoVerified: true), but resolvedEmail
- * remains null unless an authoritative trustedAccountMapping is provided.
+ * remains null.
  *
  * Privacy Invariant:
  * The returned reason string NEVER contains plaintext contributor email addresses.
  *
  * @param {string} prAuthor PR author's GitHub login handle
  * @param {Array<Object>} commits List of commit objects (from GitHub API pulls/commits)
- * @param {Object} [options] Optional configuration or trusted mappings
- * @param {Object|Map|Function} [options.trustedAccountMappings] Trusted account mapping from login to verified email
  * @returns {{ resolvedEmail: string|null, dcoVerified: boolean, reason: string }}
  */
-function resolveIdentity(prAuthor, commits, options = {}) {
+function resolveIdentity(prAuthor, commits) {
   if (!prAuthor || typeof prAuthor !== 'string') {
     return {
       resolvedEmail: null,
@@ -239,21 +214,12 @@ function resolveIdentity(prAuthor, commits, options = {}) {
   }
 
   const verifiedEmail = distinctEmails[0];
-  const trustedEmail = getTrustedRecipientEmail(prAuthor, options);
 
   // If the commit author used a GitHub noreply address (@users.noreply.github.com),
   // never resolve a real recipient email solely from contributor-controlled names.
   // Exact noreply DCO attribution is preserved (dcoVerified: true), but recipient
-  // remains unresolved (resolvedEmail: null) unless a trusted account mapping exists.
+  // remains unresolved (resolvedEmail: null).
   if (hasNoreplyAuthor || verifiedEmail.endsWith('@users.noreply.github.com')) {
-    if (trustedEmail) {
-      return {
-        resolvedEmail: trustedEmail,
-        dcoVerified: true,
-        reason: `Verified ${authorCommits.length} commit(s) by @${prAuthor} with DCO Signed-off-by trailer; recipient resolved via trusted account mapping`
-      };
-    }
-
     if (verifiedEmail.endsWith('@users.noreply.github.com')) {
       return {
         resolvedEmail: null,
@@ -265,7 +231,7 @@ function resolveIdentity(prAuthor, commits, options = {}) {
     return {
       resolvedEmail: null,
       dcoVerified: true,
-      reason: `Verified ${authorCommits.length} commit(s) by @${prAuthor} with DCO Signed-off-by trailer, but commit author uses a GitHub noreply address (@users.noreply.github.com); recipient cannot be resolved from contributor-controlled name without a trusted account mapping`
+      reason: `Verified ${authorCommits.length} commit(s) by @${prAuthor} with DCO Signed-off-by trailer, but commit author uses a GitHub noreply address (@users.noreply.github.com); recipient cannot be resolved from contributor-controlled names`
     };
   }
 

utils/identity-resolver.test.js

@@ -144,7 +144,7 @@ test('resolveIdentity: normal author + matching sign-off', () => {
   assert.equal(result.resolvedEmail, 'lee@layer5.io');
 });
 
-test('resolveIdentity: GitHub noreply commit author with matching trailer name preserves DCO but keeps recipient unresolved without trusted mapping', () => {
+test('resolveIdentity: GitHub noreply commit author with matching trailer name preserves DCO but keeps recipient unresolved', () => {
   const commits = [
     {
       sha: 'noreply12345678',
@@ -156,18 +156,10 @@ test('resolveIdentity: GitHub noreply commit author with matching trailer name p
     }
   ];
 
-  // Without trusted account mapping: DCO is verified, but recipient cannot be resolved from contributor-controlled names
   const result = resolveIdentity('octocat', commits);
   assert.equal(result.dcoVerified, true, 'DCO attribution is preserved for matching trailer name');
   assert.equal(result.resolvedEmail, null, 'Must never resolve recipient email solely from matching contributor-controlled name on noreply author');
-  assert.ok(result.reason.includes('cannot be resolved from contributor-controlled name without a trusted account mapping'));
-
-  // With trusted account mapping: recipient resolves to the authoritative mapped email
-  const mappedResult = resolveIdentity('octocat', commits, {
-    trustedAccountMappings: { octocat: 'trusted-octocat@example.com' }
-  });
-  assert.equal(mappedResult.dcoVerified, true);
-  assert.equal(mappedResult.resolvedEmail, 'trusted-octocat@example.com');
+  assert.ok(result.reason.includes('cannot be resolved from contributor-controlled names'));
 });
 
 test('resolveIdentity: spoofing regression - attacker using noreply author cannot claim victim email via matching trailer name', () => {
@@ -187,15 +179,8 @@ test('resolveIdentity: spoofing regression - attacker using noreply author canno
   const result = resolveIdentity('attacker', commits);
   assert.equal(result.resolvedEmail, null, 'Must never resolve spoofed victim email from noreply commit author');
   assert.equal(result.dcoVerified, true, 'DCO trailer name match preserves DCO attribution');
-  assert.ok(result.reason.includes('cannot be resolved from contributor-controlled name without a trusted account mapping'));
+  assert.ok(result.reason.includes('cannot be resolved from contributor-controlled names'));
   assert.equal(result.reason.includes(victimEmail), false, 'Reason must not leak victim email');
-
-  // Even with attacker account mapping, recipient resolves to attacker trusted email, NEVER the spoofed victim email
-  const mappedResult = resolveIdentity('attacker', commits, {
-    trustedAccountMappings: { attacker: 'attacker-verified@domain.com' }
-  });
-  assert.equal(mappedResult.resolvedEmail, 'attacker-verified@domain.com');
-  assert.notEqual(mappedResult.resolvedEmail, victimEmail);
 });
 
 test('resolveIdentity: GitHub noreply commit author who signs off with noreply address (CASE B)', () => {