The broker holds the token. Every push says who wrote it.
a41c09e
5d2e7f3
3f9a2c1Add retry to webhook clientagentchecks passed91d04beFix test fixturehuman-consolec2e88f0Commit made on a laptopunattributed7be0d13Validate card numbersagent
Git broker
holds the GitHub App key
$ git push origin feature/dev01/validation
broker: tip 7be0d13 · author_class agent
broker: ai_activity 14 model requests since the last push
gate off (the default) · the push is not validated · allowed
push.authorship written to the audit chain · HMAC under this host's key
Add commits, turn the gate on, push. The broker labels the tip commit only; with the gate on, a tip without a passing verdict is refused and the broker takes the stamp.
Under the default profile, git needs no credential inside the workspace. Every push the broker allows is recorded with its author, and the label never guesses "human".
Identity is the socket, not a claim
The broker is a smart-HTTP proxy on your host. Each workspace reaches it through its own unix socket, so a workspace cannot claim to be another. The broker mints a short-lived, per-repository installation token from your GitHub App and parses the push to authorise it.
- Onboard without tokens.
git clone,git pushandopen-prwork normally, with no token prompt. - Tokens last about an hour and are scoped per repository. The key is root-owned on the host.
- GitHub only through the broker, in every egress mode. Direct GitHub is refused while file transfer is below
both.
Limit: under the open and metered profiles the token is mounted in the container. No credential in the workspace holds under guarded, the default.
acme/dev01dev01.sockacme/agentagent.sockacme/reviewreview.sock
token · acme/payments · expires in about 1 h
"We don't know" is an honest answer
It is the one most tools cannot give: they round it to "human".
The host recorded the commit being made by an agent, in the console.
The host recorded a person making the commit in the console.
The host has no record of the commit being made. Guessing "human" would make the record flattering and wrong.
The host records each commit's origin when it is made. At push, the broker writes a push.authorship audit record: the tip commit's author class, plus the AI activity since the last push (model requests by model, AI API connections). It is signed with HMAC-SHA256 using a key held on the host.
Limit: the authorship record proves what this host saw, not what happened on someone's laptop. It is keyed on your host: an auditor verifies it there, and host root could forge it.
How the record worksStop untested pushes without trusting the laptop
An optional validation gate refuses a push unless the exact commit has passed your checks.
The gate reads a verdict your host produced, bound to the commit and the repository. A check run on a developer's machine does not count. The gate is built and deployed, and it is off until an admin turns it on for the organisation. It has not yet been seen on a live GitHub push.
- Validation gate
- off until an admin turns it on
- Branch-pattern rule
- enforced under
strict; defaultfeature/{user}/* - Agent git tools
- push and PR off by profile until enabled
- Pull-requests pane
- inert until the GitHub App is granted PR and Issues read
What ships, what it defaults to, where it stops
| Capability | Default | Limit |
|---|---|---|
| No GitHub credential in the container | on under guarded | The open and metered profiles mount the token |
| GitHub only through the broker | on in every egress mode | GitHub only; no GitLab or Bitbucket |
| Authorship record on every push | on | HMAC on your host, not publicly verifiable; no live GitHub push recorded yet |
| Validation gate | off | Not yet seen on a live push |
| Branch-pattern push rule | enforced under strict | No separate protected-branch list |
| Pull-requests pane (list, files, reviews, issues, open PR) | inert until granted | Needs the GitHub App's PR and Issues read permissions |
| Agent git tools | push and PR off | n/a |
Two pushes, two labels
# the agent commits in Build mode; the host records it
commit_origins 7be0d13 agent
$ git push
# the broker writes the audit record
push.authorship agent model requests since last push: 14# committed on a laptop, pushed from the workspace
commit_origins c2e88f0 (no record)
$ git push
# no record, so no guess
push.authorship unattributedQuestions
Is this SLSA or Sigstore provenance?
No. It is a record signed on your host. Publicly verifiable provenance is planned, not built.
Why "unattributed" and not "human"?
Because the host did not see it being written. Guessing "human" would make the record flattering and wrong.
GitLab?
Not today. Git hosting is GitHub only.
Where are my GitHub credentials?
On your host, in the broker. Under the default profile, the container holds none.
What it does not do yet
- Third-party-verifiable signatures. The record is an HMAC under a key on the same host.
- GitLab, Bitbucket, Azure DevOps.
- A recorded live push through the gate.
- A separate protected-branch list.
- A hosted version. The broker runs on your host; it is self-hosted only.
See what one push records
The author class, the AI activity since the last push, and the key it is signed with.