How do I verify the provenance of commits made by AI coding agents like Copilot and Claude Code?

Verify the signature and the trailers together. Copilot cloud agent signs its commits, but Claude Code's attribution behavior is unverified here.

I could not check Claude Code's own documentation or repository in this session, so the Claude Code steps below use general Git and GitHub rules only.

Copilot cloud agent

GitHub documents three provenance signals for Copilot cloud agent commits:

• The commits are authored by Copilot. The developer who assigned the task is marked as co-author.
• The commits are signed, so they show as "Verified" on GitHub.
• The commit message links to the agent session logs. (Risks and mitigations)

To check a commit:

1. Open the commit on GitHub. Confirm the "Verified" badge.
2. Hover over the badge to see the verification timestamp. The REST API returns this as verified_at. (About commit signature verification)
3. Open the session link in the commit message. Compare the logged work with the diff.
4. Check the Co-authored-by line. It names the human who started the task.

Rebase and merge breaks the signature. GitHub creates a new commit and does not sign it. (About commit signature verification) If you need the trail, use a merge commit or squash with a signed commit.

Trailer conventions

Git reads trailers from the end of a commit message. Use git interpret-trailers --parse to list them. (git-interpret-trailers)

The Linux kernel uses a different convention for AI tools:

• AI agents must not add Signed-off-by. Only a human can certify the Developer Certificate of Origin.
• Add an Assisted-by: LLM [TOOL...] trailer. For example: Assisted-by: LLM coccinelle sparse. (Linux kernel AI coding assistants guide)

GitHub uses Co-authored-by for human co-authors. A co-author counts on the contribution graph only if the email is linked to their GitHub account. (GitHub docs)

Claude Code

I could not verify how Claude Code writes author, signature, or trailer data. Check its current documentation, then inspect a real commit it made. Run git log --format=fuller and git interpret-trailers --parse on that commit.

Recommendation

• For Copilot cloud agent commits: rely on the "Verified" badge, the co-author line, and the session log link.
• For any other agent: require a signed commit or an Assisted-by trailer. Then confirm the human reviewer sign-off in the pull request.

If you run several agents and need each one to show as its own actor, githug gives each agent its own key and short-lived tokens. Its commits carry trailers that name the agent, the run, and the accountable human. This is live now, in beta and free.