feat(contributor-growth): ask the maintainer for the addresses people post from

docs/contributor-growth/README.md

@@ -126,7 +126,7 @@ says which file is missing.
 
 | File | What it carries | Read by |
 |---|---|---|
-| [`contributor-identities.md`](../../plugins/magpie-setup/templates/contributor-identities.md) | The project's community channels, and confirmed mappings from each contributor's GitHub handle to their Slack, Discord, mailing-list, and social-media handles. Written by `contributor-identity-map` after a maintainer confirms each one. | `committer-onboarding`, `identity-map` |
+| [`contributor-identities.md`](../../plugins/magpie-setup/templates/contributor-identities.md) | The project's community channels, and confirmed mappings from each contributor's GitHub handle to their Slack, Discord, mailing-list, and social-media handles. Written by `contributor-identity-map` after a maintainer confirms each one. | `committer-onboarding`, `identity-map`, `nomination` |
 | [`issue-tracker-config.md`](../../plugins/magpie-setup/templates/issue-tracker-config.md) | Tracker URL, project key, auth model, default query templates. | `activity-sweep`, `calibrate`, `contributor-to-committer`, `nomination`, `sentiment` |
 | [`pmc-roster.md`](../../plugins/magpie-setup/templates/pmc-roster.md) | Who is binding. Read wherever a vote is counted or a PMC-only action is gated. | `candidate-screen`, `nomination` |
 

plugins/magpie-contributor-growth/skills/candidate-screen/SKILL.md

@@ -23,7 +23,7 @@ argument-hint: "[target:committer|pmc|both] [window:6m] [end:YYYY-MM-DD]"
 capability: capability:stats
 surface_hash: sha256:a1767d466ee963d1
 license: Apache-2.0
-measured_tokens: 3994
+measured_tokens: 4042
 ---
 
 <!-- SPDX-License-Identifier: Apache-2.0
@@ -196,7 +196,7 @@ For each person who survived the pre-filter:
 1. Run `contributor-metrics fetch` and `score` exactly as [`contributor-to-committer` Step 2 and Step 2a](../contributor-to-committer/SKILL.md#step-2--fetch-contributor-activity) do, confirming pushback candidates on meaning.
    `score` computes adjusted counts — data about the person's own activity, not a score of the person.
 2. A metric fed by a stream in `caps_hit` is a minimum; the report says so.
-3. Collect community signals per [`community-signals.md`](../nomination/community-signals.md) and resolve the person's name per [`real-names.md`](../nomination/real-names.md).
+3. Collect community signals per [`community-signals.md`](../nomination/community-signals.md), including its step that asks the maintainer for the addresses people post from ([Ask the maintainer for addresses](../nomination/community-signals.md#ask-the-maintainer-for-addresses)) — ask once for everyone, after measuring — and resolve the person's name per [`real-names.md`](../nomination/real-names.md).
 
 Everyone measured goes into the report.
 Do not compare anyone's counts with the floors, count floors met or missed, or select a subset: the pre-filter in Step 2 is the only place the floors are used.

plugins/magpie-contributor-growth/skills/identity-map/sources.md

@@ -146,6 +146,10 @@ identities:
         grade: self-declared
       discord:
         status: ask-contributor    # confirmed channel, handle not yet shared
+      mailing_list:
+        addresses: ["priya@example.org"]   # posting addresses not seen on her commits
+        source: maintainer
+        grade: maintainer-confirmed
     confirmed_by: jmclean
     confirmed_on: 2026-09-28
 ```

plugins/magpie-contributor-growth/skills/nomination/SKILL.md

@@ -23,7 +23,7 @@ when_to_use: |
   assess a contributor.
 argument-hint: "<github-handle> [window:Nm] [target:committer|pmc]"
 capability: capability:stats
-surface_hash: sha256:d78eb556cf43aa79
+surface_hash: sha256:d088479a32dcc0cf
 license: Apache-2.0
 measured_tokens: 5318
 ---

plugins/magpie-contributor-growth/skills/nomination/community-signals.md

@@ -35,10 +35,28 @@ A mailing-list address, chat account, or social account counts as the contributo
 1. the address appears as an author email on the contributor's own commits to `<upstream>`;
 2. the organization's people directory ties it to the contributor (ASF: `mcp__apache-projects__get_person`);
 3. the account is linked from the contributor's own GitHub profile **and** links back to that GitHub profile — a one-way link proves only that the contributor pointed at the account, not that it is theirs;
-4. the maintainer running the skill confirms it.
+4. the maintainer running the skill confirms it — in this run (see [Ask the maintainer for addresses](#ask-the-maintainer-for-addresses)), or earlier, as a channel recorded with `confirmed_by` in `<project-config>/contributor-identities.md` in the personal layer.
 
 A chat or social profile that names the contributor's GitHub handle is that account's own claim — anyone can write it — so on its own it is not a confirmation (`tools/chat` `resolve_user` → `confirmed_by: "profile"` means exactly that claim).
-It, and anything else — a similar display name, a matching first name, a guess from an email address — goes into a *possible match, not used* list shown to the maintainer, and contributes nothing.
+It, and anything else — a similar display name, a matching first name, a guess from an email address — goes into a *possible match, not used* list shown to the maintainer, and contributes nothing until the maintainer confirms it.
+
+### Ask the maintainer for addresses
+
+Contributors often post from an address they never commit with — a work address, or one whose `From` header the list rewrites (`Name via <list>`).
+Before collecting list signals, read `contributor-identities.md` from the personal layer and add every `mailing_list` address recorded there with `confirmed_by`.
+Then, for each contributor with no confirmed address, or whose confirmed addresses have no messages in the window:
+
+1. Find *possible matches* in both directions:
+   - search `<dev-list>` and `<users-list>` in the window for senders whose display name matches a name the contributor uses (profile name, commit author name, directory name);
+   - for contributors still without a match, list every distinct sender in the window and make best guesses — name order and transliteration variants, initials, an address local part resembling the handle or name, a domain matching the company on their profile — graded *strong*, *plausible* or *weak*, leaving out senders already confirmed for someone else.
+   Each possible match shows its address (or *rewritten*, when the list hid it), the display name, the number of messages, one example link, and why it was proposed.
+2. Show the possible matches to the maintainer, one table per contributor, every row defaulting to **reject**, and ask them to accept or reject each and to add any address they know.
+   Never accept a row on the maintainer's behalf, and never attribute a message from an unaccepted address.
+3. Propose the diff to `contributor-identities.md` in the personal layer — one `mailing_list` channel per accepted address, with `source: maintainer`, `grade: maintainer-confirmed`, `confirmed_by` and `confirmed_on` — in the [identity-file format](../identity-map/sources.md#identity-file-format).
+   Write it only after the maintainer confirms the diff; never to `.apache-magpie-overrides/`.
+4. Collect list signals for the accepted addresses as for any confirmed one.
+
+A later run reads the recorded addresses and asks again only about contributors who still have none.
 
 ---