Commit and PR attribution

An agent that works through a person's GitHub account shows up as that person on every issue, comment and commit it writes. GitHub can't tell the two apart, so attribution, the mark that says an agent wrote it, has to travel in the content. Terrarium's fix is to put a link to the session that wrote it on each agent post and commit.

Know git hooks and trailers already? Skip to In Terrarium.

In Terrarium

Agents post to GitHub through the owner's own connection, and author_association reads OWNER on every agent write (Author trust). Each write names its sessionOne continuous Claude Code working session on the repository, known by its Claude session id. It writes a session log of its work when it closes.GLOSSARY.md instead, in one shape per surface, and ADR-0017 (docs/adr/0017-provenance-footer-on-agent-authored-content.md) is the rule.

On a GitHub body, such as an issue, a PR description, a comment or a review, the first line is a header. scripts/lib/provenance-header.ts builds it:

30export function provenanceHeader(label: string, sessionUrl: string): string {
31  return `${BOT_ICON} [${label}](${sessionUrl})`
32}

It renders as a robot icon and a link such as 🤖 [Claude](https://claude.ai/code/session_…). A cloud session's link ends in session_<id>; a local session has no web page, and its link carries the raw session id in that place.

On a commit, the message ends with two trailers, built by scripts/session/commit-trailer.ts:

132export function provenanceFooter(modelName: string, sessionUrl: string): string {
133  return [coAuthorLine(modelName), sessionLine(sessionUrl)].join('\n')
134}

The first is a Co-Authored-By: line naming the model at noreply@anthropic.com, the second a Claude-Session: line holding the session's link.

Posts are checked before they go. scripts/hooks/github-provenance-guard.ts is a guard, Terrarium's name for a blocking hook: a PreToolUse hook on each GitHub write tool, listed by name in .claude/settings.json, and on Bash calls that run gh api or curl to GitHub's REST API. It finds this session's id from the session's environment or transcript, reads the one place the mark belongs (line one of a body, or the last Claude-Session: trailer of a commit made through the GitHub tools), and judges it:

108function adjudicate(
109  slotId: string | undefined,
110  text: string,
111  truth: string,
112  tool: string,
113  surface: ProvenanceSurface,
114): ProvenanceFinding | null {
115  if (slotId !== undefined) {
116    return slotId === truth ? null : { kind: 'mismatch', tool, surface, found: slotId, expected: truth }
117  }
118  const ids = sessionIdsIn(text)
119  if (ids.length === 0) return { kind: 'missing', tool, surface, expected: truth }
120  if (ids.includes(truth)) return { kind: 'malformed', tool, surface, expected: truth }
121  return { kind: 'mismatch', tool, surface, found: ids.at(-1)!, expected: truth }
122}

A mark naming another session is a mismatch, this session's link anywhere but its slot is malformed, and no link at all is missing. The guard also denies the call when it can't find this session's id, or can't read a shell command's body. When the guard knows this session's id, its refusal holds the exact line to paste; when it can't find the id, the refusal says to report that instead of typing an id. A call that may carry no text, such as a label change or a bare approval, passes.

Local commits are repaired, not checked. pnpm install runs git config core.hooksPath .githooks from package.json's postinstall, and .githooks/commit-msg hands the message file to commit-trailer.ts:

15root=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0
⋯# …
20common_dir=$(git rev-parse --git-common-dir 2>/dev/null) || exit 0
21main_root=$(cd "$(dirname "$common_dir")" && pwd) || exit 0
22"$main_root/node_modules/.bin/tsx" "$root/scripts/session/commit-trailer.ts" "$1" >/dev/null 2>&1 || exit 0
23exit 0

The hook runs the script from the main checkout's node_modules, which a git worktree lacks. The script finds the session from its environment or its transcript. It appends whichever trailer is missing, rewrites a Claude-Session: line that names another session or a Co-Authored-By: line whose model name it doesn't know, and leaves the message alone when it finds no session, as on a person's own commit. Every path through the hook ends in exit 0.

Reading the mark back. Code that asks whether an agent wrote a post calls hasAuthorshipMarker:

73export function hasAuthorshipMarker(text: string): boolean {
74  return PROVENANCE_HEADER.test(text) || LEGACY_PROVENANCE_FOOTER.test(text) || HARNESS_FOOTER.test(text)
75}

It accepts the header only at the very start of the text, the older Co-Authored-By footer anywhere, and the "Generated with Claude Code" line that Claude Code adds itself; a session link elsewhere in the prose doesn't count. scripts/github/check-triage-drift.ts wraps it as isAiAuthored, which, for example, the guest pipeline's scan uses to skip its own earlier replies. The merge script asks a narrower question: verdictRefusal in scripts/github/merge-pr.ts looks for a verdict whose header names this very session (Pull requests).

#!/bin/sh
[ -n "$AGENT_SESSION_URL" ] || exit 0
git interpret-trailers --in-place --if-exists=doNothing \
  --trailer "Agent-Session: $AGENT_SESSION_URL" "$1" || exit 0

Where next

• LessonAuthor trust
• LessonClaude Code hooks
• LessonPull requests
• LessonMCP servers
• JournalThe best stories so far