Pedigree

AI now writes a meaningful share of the code entering production, and nothing in the commit record says so. A diff authored by a model, a diff pair-programmed with one, and a diff typed by hand are indistinguishable once merged.

That gap matters most exactly where provenance already matters: regulated code, defence work, supply chains, anything that has to survive an audit.

Pedigree issues a verifiable passport for every commit: a signed attestation recording what generated the change, under what prompt, and against which model.

The attestation format is C2PA-inspired, borrowing the content-credentials approach that the imaging industry settled on rather than inventing a new one.

Each passport is written to a Rekor transparency log, so the record is append-only and independently auditable. Nobody has to trust the committer, including the committer.