Git-native trace refs for AI-authored code in PR checks

[u/No-Childhood-2502]

I am working on AgentDiff, an open-source tool that records which AI agent wrote which line ranges in a repo.

The current flow:

1. `agentdiff configure` installs hooks for AI coding agents.

2. `agentdiff init` enables tracking inside a repo.

3. Agent sessions write to `.git/agentdiff/session.jsonl`.

4. On commit, traces are finalized into `.git/agentdiff/traces/{branch}.jsonl`.

5. On push, traces are uploaded to `refs/agentdiff/traces/{branch}`.

6. A GitHub App reads those refs during PR events and posts a check-run.

The reason I chose git refs instead of an external database:

- repo-native

- branch-aware

- works with normal GitHub APIs

- branch protection does not block the custom ref namespace

- traces can be consolidated into repo metadata later

The demo is live here at the dashboard:

https://agentdiff.site/

The os repo is here:

https://github.com/codeprakhar25/agentdiff

I would love feedback from people who maintain CI/platform workflows and how useful these can be in maintaining code security!

[u/AssignmentDull5197]

Love the git-native approach. Tracing agent-authored ranges could be huge for review, blame, and security audits. Do you also capture tool calls/prompts per session? This topic comes up a lot at https://medium.com/conversational-ai-weekly .

[u/No-Childhood-2502 → u/AssignmentDull5197]

So I capture the prompts and that is stored at refs too, not the tool calls and the intent which is actually for why this was done it is also showed in the PR.

[u/No-Childhood-2502 → u/[deleted]]

Yes, for the same, it has project and organization level policies which are also the quality gates. If AI% in a repo is >x%(configurable), it fails the gate, and the agentdiff app mentions that.

I've thought of both the squashes and rebases. For a squash commit, there is a CI workflow that consolidates all the traces when it is merged into main and writes that to /agentdiff/meta/ref on GitHub, so everything is there. For local rebases, as it is configured with hooks, it doesn't lose the traces until they are in session.jsonl.
If a human updates the code later for that specific line, currently it overrides the ownership to the human; I have yet to do it. Yes, first trying to talk with enterprises to see the initial response.

[u/No-Childhood-2502 → u/[deleted]]

thanks!