AI-written code, tied to the pull request

One record per merged PR with prompt hash, session and reviewer. Find it later by PR ref.

Who this is for

Engineering teams, dev platforms and coding-agent vendors.

The problem

Two years after a merge, an auditor asks which model wrote a function and who reviewed it. Commit messages are editable and tools change. A record per merged PR fixes the answer at merge time.

How it works

• On merge, CI hashes the merged diff and posts a provenance record with a code block.
• code carries prompt_hash, session_id, pr_ref, reviewer and the agent version ids.
• Anyone finds the records later with /v1/records?ref={pr_ref}.

Routes it uses

• POST /v1/records: append a signed record; the answer carries its digest and inclusion proof.
• GET /v1/records?ref={ref}: every record carrying a handle such as a PR, incident or case id.

Set it up

Step 1. Hash the merged change

Hash the merged diff or the merge commit's tree in a fixed, documented way.

Check: Re-running the hash on the merge commit gives the same digest.

Step 2. Publish on merge

From a CI step on the default branch, post the record with code: { prompt_hash, session_id, pr_ref, reviewer }. reviewer is a handle, never a name or email.

BODY='{ ...record }'
SIG=$(printf %s "$BODY" | ./sign-ed25519)   # base64url signature over these exact bytes
curl -s -X POST 'https://aisourceoftruth.com/v1/records' \
  -H "Authorization: Bearer $AISOT_TOKEN" \
  -H "X-AISOT-Key-Id: $AISOT_KEY_ID" \
  -H "X-AISOT-Signature: $SIG" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H 'Content-Type: application/vnd.aisot.record+json' \
  --data-binary "$BODY"

Check: The CI step fails if the registry refuses the record.

Step 3. Find it later

Query by PR ref to list every record for that PR.

curl -s -H 'Accept: application/json' 'https://aisourceoftruth.com/v1/records?ref={ref}'

Check: The PR's records come back by ref.

Publishing needs a publisher key and a token. The one-time setup is on /agents and in the plan's design.md.

Wire it into your agent

A post-merge CI job holds the publisher key as a secret. Keep prompts private: send only their hash.

MCP: add https://aisourceoftruth.com/mcp to the agent's MCP servers. Tools used: publish_record, search_records. Read tools need no token.

With the PromptReports products, or alone

• RepoOps: RepoOps records agent sessions and agent version ids (agv_ ids) for each repo, which fill the code block without extra work.
• Alone: every step above uses only AI Source of Truth.

Expected outcomes

• Every merged AI-assisted PR has a record with model, session and reviewer.
• An audit question about a PR is answered with a URL.

What it does not prove

• The record shows what CI stated at merge time. It does not show the code is correct or safe.

The OpenSpec plan for your agent

Your coding agent fetches the plan and writes it into your repo as openspec/changes/integrate-aisot-pr-provenance/:

curl -H 'Accept: application/json' 'https://aisourceoftruth.com/use-cases/ai-code-to-pr/openspec?lang=python&with=repoops'

• proposal.md: why, what changes in your product, impact.
• design.md: where the calls sit in your agent, with code for each call.
• tasks.md: checkable tasks, each step paired with a check against the live registry.
• specs/pr-provenance/spec.md: the requirements and scenarios.

Read it here: OpenSpec plan. Back to all use cases or the documentation library.