Evidence receipts for AI-generated code changes

A portable record of what an agent changed, and what was actually run against it before merge. Committed with the change, verifiable by anyone, tied to no vendor.

The problem, in one diff

An agent is asked to add discount codes to a shopping cart. It writes src/discount.ts, adds a test for it, and edits src/cart.ts. Then it runs the suite. Everything is green.

 7  export function total(items: Item[], code: string): number {
 8    const shipping = subtotal(items) > 5000 ? 0 : 499;
 9    return subtotal(items) + shipping;
10  }

The discount code is never applied. The tests the agent wrote pass. The suite is green. Nothing executed those three lines — and six months from now, nobody can tell you which parts of the service an agent wrote, from what task, or what ran against them.

GitHub can answer that for Copilot, inside GitHub. GitLab can answer it for Duo, inside GitLab. Across three vendors and a self-hosted runner, nobody can answer it at all.

What a receipt is

An in-toto Statement carrying a Provene predicate, bound to a set of changes by content digest and committed in-tree alongside them. It records the agent and model as reported by the tool, which files changed and which the agent was observed to touch, which commands ran and what their outcomes were, and who attested to all of it at what assurance tier.

$ provene check --base origin/main --coverage lcov.info
1/1 receipt(s) well formed (T0)
3 changed path(s); 3 carry agent attribution from this change
4/9 executable changed lines executed by the test run
  src/cart.ts: 3 of 3 executable changed lines unverified
  src/discount.ts: 2 of 4 executable changed lines unverified

Those last lines are the product. Not "an AI wrote this" — these specific changed lines had nothing run against them.

What it does not prove

A receipt does not assert that an agent authored a change, that code is correct, secure or well-designed, or that unattributed regions of a diff were written by a human. Absence of attribution means unobserved, never human.

Forged authorship is an explicit non-goal: no format can distinguish typing from generating. What CI counter-signing does close is forged test evidence — a claim that a suite passed when it did not. The threat model names what is and is not defended, including the parts that aren't.

Assurance tiers

Tier	Observed by	Worth
`T0`	your machine, unsigned	local visibility; satisfies no policy
`T1`	your machine, your identity	attribution among people who already trust each other. Specified; no emitter produces it
`T2`	CI, on a runner you do not control	verification evidence, independently observed
`T3`	the execution environment or the agent vendor	authorship. Reserved; nothing produces it yet

A locally observed test run satisfies no policy on its own. It is a self-attestation by the party who wants the change merged, and the tool says so in its own output rather than leaving you to work it out.

Try it

npm install -g proveneio
provene init                    # Claude Code
provene init --agent gemini     # Gemini CLI
provene doctor

Every other agent integrates through two commands and no fork — see the emitter contract, which also records what has been verified by running each agent and what is only documented.

Specification

The code-change predicate — what a receipt claims, field by field
The code-change-aggregate predicate — what CI signs
Receipt JSON Schema · Aggregate · Policy
RFC 0001 — the normative document