Skip to content

Commit 0287bb7

Browse files
shenxianpengshenxianpeng
committed
chore: add AI attribution governance blog post and projects page
- New blog post: AI Attribution Governance (v2.11.0) - New Projects page showcasing all three repos with versions - Home page: add Ecosystem module for quick project discovery - Navigation: add Projects tab
1 parent 932f8b0 commit 0287bb7

4 files changed

Lines changed: 316 additions & 0 deletions

File tree

‎docs/blog/posts/ai-attribution-governance.md‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
---
2+
date:
3+
created: 2026-07-06
4+
readtime: 7
5+
categories:
6+
- UPDATES
7+
tags:
8+
- commit-check
9+
- ai
10+
- governance
11+
- compliance
12+
authors:
13+
- shenxianpeng
14+
---
15+
16+
# AI Attribution Governance: Enforcing AI Disclosure Policies at the CI Level
17+
18+
The open-source ecosystem is converging on a hard question: **when a commit is
19+
written with AI assistance, how do we know — and how do we enforce the
20+
disclosure policy?**
21+
22+
Python's discourse, Linux kernel's `Assisted-by` trailer, Fedora's AI policy,
23+
Apache's disclosure guidelines — every major project is grappling with this.
24+
But until now, there has been **no tool at the CI level** to enforce whatever
25+
policy a project chooses.
26+
27+
Commit Check v2.11.0 introduces **AI Attribution Governance** — a
28+
first-of-its-kind feature that detects known AI tool signatures in commit
29+
messages and lets projects decide whether to forbid them outright.
30+
31+
<!-- more -->
32+
33+
## The industry need
34+
35+
The conversation around AI disclosure is no longer theoretical:
36+
37+
- The **Linux kernel** standardized on the `Assisted-by:` trailer format
38+
- The **Python community** [is actively discussing](https://discuss.python.org/t/should-claude-codes-usage-be-described-in-the-code-docs-somewhere/107969) whether Claude Code usage should be documented
39+
- **VS Code** [issue #313962](https://github.com/microsoft/vscode/issues/313962) proposes replacing `Co-authored-by` with `Assisted-by` for AI agents
40+
- **Fedora, Apache, OpenTelemetry, Rocky Linux, QEMU, Gentoo** each have different AI contribution policies
41+
42+
But nobody had built a neutral enforcement layer that works in CI — until now.
43+
44+
## Configuration: a single toggle
45+
46+
Commit Check keeps it simple. One configuration value, three ways to set it:
47+
48+
=== "TOML (cchk.toml)"
49+
50+
```toml
51+
[commit]
52+
ai_attribution = "forbid"
53+
```
54+
55+
=== "CLI"
56+
57+
```bash
58+
commit-check --message --ai-attribution=forbid
59+
```
60+
61+
=== "Environment Variable"
62+
63+
```bash
64+
CCHK_AI_ATTRIBUTION=forbid commit-check --message
65+
```
66+
67+
Two modes:
68+
69+
| Mode | Behavior |
70+
|------|----------|
71+
| `"ignore"` | No validation (default, backward compatible) |
72+
| `"forbid"` | Rejects any commit containing known AI tool signatures |
73+
74+
There is no `require` mode or `ai_trailer_style` option — the signature
75+
database recognizes all known formats automatically, and the policy is simply
76+
whether you allow them or not.
77+
78+
## Detected AI tool signatures
79+
80+
Commit Check ships with a curated database of known AI tool markers. The
81+
detection covers multiple signature formats per tool — `Co-authored-by`,
82+
`Assisted-by`, body markers, and model names:
83+
84+
| AI Tool | What gets detected |
85+
|---------|-------------------|
86+
| **Claude Code** | `Co-authored-by: Claude`, `Assisted-by: Claude:<model>`, emoji markers, `Claude-Session:`, `Claude-Workflow:` |
87+
| **GitHub Copilot** | `Co-authored-by: Copilot` |
88+
| **OpenAI Codex** | `Co-authored-by: Codex` |
89+
| **Gemini** | `Co-authored-by: Gemini` |
90+
| **Cursor** | `Co-authored-by: Cursor` |
91+
| **Devin** | `Co-authored-by: Devin` |
92+
| **Aider** | `Co-authored-by: Aider`, `Co-authored-by: ... (aider)` |
93+
| **Windsurf** | `Co-authored-by: Windsurf` |
94+
| **Tabby** | `Co-authored-by: Tabby` |
95+
| **Generic AI** | `Assisted-by: <tool>:<model> [tools]`, model names like `claude-sonnet-4`, `gpt-4-turbo` |
96+
97+
## Built-in false positive prevention
98+
99+
A `Co-authored-by: Claude` could theoretically be a human named Claude — but
100+
in practice, AI tools use known noreply email addresses. Commit Check anchors
101+
its detection to these, so:
102+
103+
✅ `Co-authored-by: Claude <noreply@anthropic.com>` — flagged
104+
✅ `Assisted-by: Claude:claude-sonnet-4-20250514 [tools]` — flagged
105+
❌ `Co-authored-by: Claude Monet <monet@impressionism.fr>` — **not flagged**
106+
❌ `Co-authored-by: Jane Doe <jane@example.com>` — **not flagged**
107+
108+
The kernel-style `Assisted-by:` format also handles optional trailing tool
109+
lists correctly:
110+
111+
```text
112+
Assisted-by: Claude:claude-sonnet-4-20250514 coccinelle sparse
113+
```
114+
115+
Only the AI tool marker is matched — the tool list is preserved as-is.
116+
117+
## See it in action
118+
119+
With a config file containing `ai_attribution = "forbid"`:
120+
121+
```bash
122+
# This commit message would be REJECTED
123+
echo "fix: resolve race condition
124+
125+
Co-authored-by: Claude <noreply@anthropic.com>" | commit-check -m
126+
```
127+
128+
```text
129+
[FAIL] ai-attribution: Commit message contains known AI tool signature: Claude
130+
```
131+
132+
```bash
133+
# This commit message passes cleanly
134+
echo "fix: resolve race condition
135+
136+
Co-authored-by: Jane Doe <jane@example.com>" | commit-check -m
137+
```
138+
139+
```text
140+
[PASS] commit message is valid
141+
```
142+
143+
## Integration across the ecosystem
144+
145+
The feature is available across every surface of Commit Check:
146+
147+
- **CLI**: `--ai-attribution=forbid`
148+
- **TOML config**: `[commit] ai_attribution = "forbid"`
149+
- **Environment variables**: `CCHK_AI_ATTRIBUTION=forbid`
150+
- **Python API**: `validate_message()` returns AI attribution results
151+
- **`--format json`**: AI check status included in structured output
152+
- **MCP Server** ([commit-check-mcp](https://github.com/commit-check/commit-check-mcp)): synced in v0.1.7
153+
- **GitHub Action** ([commit-check-action](https://github.com/commit-check/commit-check-action)): available once the underlying dependency is updated
154+
155+
## What's next
156+
157+
AI attribution governance in v2.11.0 is the foundation. Future work includes:
158+
159+
1. **PR summaries** — show AI disclosure status per commit in pull requests
160+
2. **MCP improvements** — AI agents query `describe_validation_rules` to
161+
auto-comply before writing a commit
162+
3. **Richer JSON metadata** — structured AI signature data for SBOM and audit
163+
tooling
164+
165+
## Try it today
166+
167+
```bash
168+
pip install commit-check==2.11.0
169+
echo "feat: add streaming support" | commit-check -m --ai-attribution=forbid
170+
```
171+
172+
Or add it to your `cchk.toml`:
173+
174+
```toml
175+
[commit]
176+
ai_attribution = "forbid"
177+
```
178+
179+
And let CI enforce your AI disclosure policy — automatically, on every commit.
180+
181+
---
182+
183+
*Clean commits. Clear standards. Transparent AI contributions.*

‎docs/index.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,48 @@ title: Commit Check
136136

137137
</div>
138138

139+
## Ecosystem
140+
141+
Commit Check is a family of three projects — one engine, multiple surfaces.
142+
Write your policy **once** in a `cchk.toml`, enforce it **everywhere**.
143+
144+
<div class="grid cards" markdown>
145+
146+
- :fontawesome-brands-python: __commit-check__ `v2.11.0`
147+
148+
---
149+
150+
**Core engine** — Python CLI, library & pre-commit hooks.
151+
152+
:material-star: AI attribution governance, message patterns, JSON output
153+
154+
[:octicons-arrow-right-24: Repo](https://github.com/commit-check/commit-check)
155+
[:octicons-arrow-right-24: Docs](https://commit-check.github.io/commit-check/)
156+
157+
- :material-github: __commit-check-action__ `v2.10.0`
158+
159+
---
160+
161+
**GitHub Action** — seamless CI integration with PR comments.
162+
163+
:material-star: Windows runner, PR title validation
164+
165+
[:octicons-arrow-right-24: Repo](https://github.com/commit-check/commit-check-action)
166+
167+
- :material-robot: __commit-check-mcp__ `v0.1.7`
168+
169+
---
170+
171+
**MCP Server** — structured tools for AI coding agents.
172+
173+
:material-star: AI attribution governance, message patterns
174+
175+
[:octicons-arrow-right-24: Repo](https://github.com/commit-check/commit-check-mcp)
176+
177+
</div>
178+
179+
[See all projects →](projects.md){ .md-button }
180+
139181
## Quick Start
140182

141183
=== "GitHub Actions"

‎docs/projects.md‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
---
2+
hide:
3+
- toc
4+
---
5+
6+
# Projects
7+
8+
The Commit Check ecosystem consists of three open-source projects that work
9+
together to enforce commit quality standards across your entire workflow.
10+
11+
<div class="grid cards" markdown>
12+
13+
- :fontawesome-brands-python: __commit-check__
14+
15+
---
16+
17+
**The core engine.** A Python CLI and library for validating commit
18+
messages, branch names, author identity, sign-off trailers, push safety,
19+
and AI attribution.
20+
21+
- Latest release: **v2.11.0**
22+
- Highlights: AI attribution governance, message patterns, JSON output,
23+
Python API
24+
- Works as: CLI tool, pre-commit hooks, importable library
25+
26+
[:octicons-arrow-right-24: GitHub](https://github.com/commit-check/commit-check)
27+
[:octicons-arrow-right-24: Docs](https://commit-check.github.io/commit-check/)
28+
29+
- :material-github: __commit-check-action__
30+
31+
---
32+
33+
**GitHub Action** that wraps the core engine into a seamless CI step.
34+
Validates PR commits and posts results as check runs, job summaries, and
35+
PR comments.
36+
37+
- Latest release: **v2.10.0**
38+
- Highlights: Windows runner support, PR title validation, PR comments
39+
- Works as: GitHub Action in your workflows
40+
41+
[:octicons-arrow-right-24: GitHub](https://github.com/commit-check/commit-check-action)
42+
[:octicons-arrow-right-24: Docs](https://github.com/commit-check/commit-check-action?tab=readme-ov-file#usage)
43+
44+
- :material-robot: __commit-check-mcp__
45+
46+
---
47+
48+
**MCP Server** that exposes commit-check validations as structured tools
49+
for AI coding agents like Claude Code, Cursor, and Copilot.
50+
51+
- Latest release: **v0.1.7**
52+
- Highlights: AI attribution governance sync, message pattern support,
53+
push safety validation, MCP Registry published
54+
- Works as: MCP server in your AI agent's config
55+
56+
[:octicons-arrow-right-24: GitHub](https://github.com/commit-check/commit-check-mcp)
57+
[:octicons-arrow-right-24: MCP Registry](https://registry.mcpx.dev)
58+
59+
</div>
60+
61+
## How they fit together
62+
63+
```mermaid
64+
graph LR
65+
A[commit-check<br/>Python Core] --> B[commit-check-action<br/>GitHub Action]
66+
A --> C[commit-check-mcp<br/>MCP Server]
67+
B --> D[CI Pipeline]
68+
C --> E[AI Coding Agent]
69+
```
70+
71+
The same `cchk.toml` policy file drives **all three** — write it once, enforce
72+
it everywhere.
73+
74+
## Release history
75+
76+
| Project | Latest | Recent updates |
77+
|---------|--------|----------------|
78+
| commit-check | v2.11.0 | AI attribution governance, message patterns, JSON output |
79+
| commit-check-action | v2.10.0 | Windows runner, PR title validation |
80+
| commit-check-mcp | v0.1.7 | AI attribution sync, message patterns, MCP Registry |
81+
82+
## Quick links
83+
84+
| What do you need? | Use this |
85+
|-------------------|----------|
86+
| Validate commits in CI | [commit-check-action](https://github.com/commit-check/commit-check-action) |
87+
| Validate commits locally | [commit-check CLI](https://github.com/commit-check/commit-check) |
88+
| Validate commits via pre-commit | [commit-check hooks](https://commit-check.github.io/commit-check/example.html#running-as-pre-commit-hook) |
89+
| Let AI agents auto-comply | [commit-check-mcp](https://github.com/commit-check/commit-check-mcp) |
90+
| Configure policy once | [`cchk.toml` reference](https://commit-check.github.io/commit-check/configuration.html) |

‎mkdocs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ copyright: "© Copyright 2022 - 2026, shenxianpeng."
88
nav:
99
- Home: index.md
1010
- Getting Started: getting-started.md
11+
- Projects: projects.md
1112
- Blog:
1213
- blog/index.md
1314
# exclude_docs: |

0 commit comments

Comments
 (0)