AI attribution

How much of this codebase did coding agents write, and how sure can we be? Repowise labels every commit agent, human_attested or unknown from evidence the repository already holds, and reports every AI share beside its coverage: the fraction of commits whose source is known. Below 30% coverage the share is withheld.

This is provenance, not a quality judgment. Repowise does not compare defect rates or any other outcome by label.

What is read by default#

With no configuration, indexing reads public markers from local git history. No network calls, no model, no prompts.

Every pattern is anchored to a service identity (a bot login, a service email, an exact footer phrase), never a bare name, so a contributor who shares a name with an agent stays unlabelled. Add your own bot or footer under agent_provenance: in .repowise/config.yaml:

agent_provenance:
  service_emails:
    mybot@example.com: {agent: mybot, tier: 1}
  footer_patterns:
    - {pattern: "Generated by MyBot", agent: mybot}

Coverage and the share#

Coverage is the fraction of commits with a known source (agent plus human_attested). The AI share is the agent fraction of those covered commits, always printed with its coverage, for example "at least 40% of covered commits, coverage 62%". Below 30% coverage only the count is shown. Shares are reported per file, component and repository.

Edit-time capture (opt-in)#

Capture records which lines an agent wrote as it writes them, so a commit carries a label even when nothing in its message says so. It is off until both the repository config and your user config turn it on.

The hook stores line hashes, the repo-relative path, an opaque session id, the tool and the model in .repowise/attribution/events.jsonl. It never stores prompts, code or identities. repowise update (which the post-commit hook runs) matches those hashes to the lines new commits added and labels a matched commit with the agent. An unmatched commit stays unknown.

A note holds file paths, line ranges, the tool name, the model and a hashed session id. It never holds prompts, code, conversation ids or a person's identity. A commit that already has a note keeps it.

repowise attribution backfill --agent claude-code,codex binds past commits from the transcripts these agents keep on this machine, under the same consent. It keeps line hashes only and binds an edit to a commit made within 14 days after it.

Turning it on and off#

# .repowise/config.yaml and ~/.repowise/config.yaml
attribution:
  enabled: true      # read public markers
  capture: off       # off, local or notes
  agents: []         # agent target ids, e.g. claude-code, codex, cursor

The stricter value wins per key across the repository and user files:

• enabled: false in either file means nothing about AI is stored or shown on any surface: API, CLI, MCP, web or wiki.
• capture takes the lower of the two levels; an unset key counts as off.
• agents is the set both files list.
• DO_NOT_TRACK=1 keeps capture off, and init --yes never turns it on.

Where it shows#

Limits#

• Squash merges that drop trailers lose those markers. PR-level signals (bot PR author, branch names, PR body) need forge APIs and are outside the local reader.
• Capture labels a commit only when a run of at least two consecutive substantive lines from one agent matches. One-line edits, lines repeated three or more times in a file, and lines two agents both claim stay unmatched.
• Pending capture events expire after 14 days, and each update binds at most 50 new commits, resuming where it stopped.
• Capture sees edits made on this machine. Teammates' work reaches you through their own capture or through notes they push.