AI Code Provenance — Commit Attribution & CI Enforcement

A minimal, end-to-end provenance system for AI-assisted code: a Git hook that detects and records AI authorship at commit time, an append-only ledger, and a CI validator that fails the build if AI-attributed commits are missing their provenance record.

This is the practical answer to "prove which of your commits were written with AI assistance" — an emerging requirement under the EU AI Act (Art. 12 logging, Art. 11 technical documentation) and software-supply-chain integrity programs.

---

How it works

 developer commits  ──►  commit-msg hook  ──►  .ai-provenance/ledger.jsonl
 (with AI marker)         (detects marker,       (append-only audit record)
                           appends trailer)
                                │
                                ▼
                     AI-Provenance-Record: <uuid>  trailer in the commit
                                │
                                ▼
        CI runs validate_provenance.py  ──►  PASS / FAIL per commit

1. hooks/commit-msg — on every commit, scans the message for AI attribution markers (Co-authored-by: GitHub Copilot|Claude|Codex|Gemini| Cursor, Generated-by-AI:, AI-Assisted: true). If found, it generates a UUID provenance record, appends it to .ai-provenance/ledger.jsonl (with reviewer_required and sast_elevated flags), and stamps an AI-Provenance-Record: <uuid> trailer into the commit message.

2. validate_provenance.py — a CI gate (the logic a GitHub Actions step would run). For a commit range it asserts that every AI-attributed commit carries a provenance trailer and that the trailer's UUID exists in the ledger. Exits non-zero on any violation.

---

Try it

# 1. clone, then install the hook into this repo's .git/hooks
./install-hook.sh           # macOS/Linux
#  or
pwsh ./install-hook.ps1     # Windows

# 2. make an AI-attributed commit
echo "v3" > app.py
git add app.py
git commit -m "Update app

Co-authored-by: Claude <noreply@anthropic.com>"

# 3. inspect the trailer + ledger
git log -1                          # shows AI-Provenance-Record trailer
cat .ai-provenance/ledger.jsonl     # shows the recorded entry

# 4. run the CI validator over a range
python validate_provenance.py HEAD~5 HEAD

.ai-provenance/ledger.jsonl ships with one example record so you can see the shape before running anything.

---

Why it matters

AI-assisted code is now the default, but most teams cannot answer basic governance questions: which commits used AI, which tool, and were they reviewed with elevated scrutiny. This POC turns that from a policy statement into an enforced, tamper-evident control wired into the developer workflow and the CI pipeline — provenance by construction, not by spreadsheet.

---

Files

File	Role
hooks/commit-msg	The provenance hook (tracked so it can be installed/reviewed)
install-hook.sh / install-hook.ps1	Copy the hook into .git/hooks/
validate_provenance.py	CI validator over a commit range
.ai-provenance/ledger.jsonl	Append-only provenance ledger (example record included)
app.py	Trivial file to edit when demoing a commit

---

Skills demonstrated

AI Provenance · Software Supply-Chain Security · Git Hooks · CI/CD Policy Gates · EU AI Act Art. 12 Logging · DevSecOps · Audit Trails · Python

---

License

MIT — see LICENSE.