Track AI Code Contributions in Git with Line-Level Fidelity

Written by: Mark Hull, Co-Founder and CEO, Exceeds AI | Last updated: July 9, 2026

What You Will Get From This Guide

• Standard Git metadata cannot distinguish AI-generated code from human-written lines, so leaders lack reliable ROI data when boards ask about AI investments.
• Client-level capture with Exceeds Ink records actual tool usage on the developer machine and writes structured, machine-readable provenance into Git Notes for audit-grade attribution.
• Exceeds Ink supports five first-class adapters for Claude Code, Cursor, Codex, GitHub Copilot, and Windsurf plus lighter detection for up to 50 additional tools, which delivers multi-tool line-level fidelity that single-vendor analytics cannot match.
• Attribution survives merges, rebases, and squash operations through post-rewrite hooks and working-tree materializers, so ROI calculations stay consistent across the full commit lifecycle.
• Exceeds AI combines portable Git Notes provenance, deterministic attribution timing, and enterprise-grade security to give leaders confident answers about AI ROI — start your free pilot today.

Prerequisites and Time Expectations

Set up moves quickly when a few basics are in place.

Before you begin, confirm:

• Access to GitHub, GitLab, or Azure DevOps (ADO) with permission to configure repository hooks
• Per-repo opt-in authority for the repositories to be instrumented
• A baseline of at least two weeks of commit history for meaningful outcome comparisons
• Engineering manager buy-in for the coaching surfaces that follow from attribution data

Time expectations are materially shorter than competing platforms. GitHub or GitLab OAuth authorization takes roughly five minutes. Repo scoping takes fifteen. First insights appear within sixty minutes of completing the Exceeds Ink install. Complete historical analysis across twelve months of commits finishes within four hours. Real-time updates follow within five minutes of new commits. With those prerequisites confirmed and time expectations set, the next step is enabling the provenance layer that makes attribution possible.

Start my free pilot and see first insights in under an hour

Step 1: Enable Per-Repo Git Notes AI Provenance

Engineering leaders need a reliable way to prove which lines of code came from AI tools when boards ask about ROI. Exceeds Ink solves this by writing its attestation as a Git Note at refs/notes/exceeds-ink. Git Notes are a native Git mechanism that solves three critical problems for attribution. First, they attach structured metadata to commits without rewriting history, so attribution data never corrupts the commit graph. Second, they travel across forks and mirrors, which means attribution survives when repositories are cloned or moved between organizations. Third, they are readable by any Git client with access to the repo, so you are never locked into a proprietary tool to access your own provenance data.

The schema (authorship/3.0.0) is machine-readable JSON, which makes it auditable by legal counsel, auditors, and regulators who need answers that metadata tools cannot provide. The required inputs for this step are repository access and the Exceeds AI GitHub or GitLab OAuth authorization. The success indicator is a refs/notes/exceeds-ink reference appearing in the repository after the first instrumented commit.

Common mistakes and privacy considerations: Ink operates on a per-repo opt-in basis and makes no global Git configuration changes. It does not modify commit messages; the Git Note is the sole provenance record. Git Notes store session hash references rather than inline transcripts, which limits the personally identifiable information attached to Git history. Different teams in the same organization can run at different privacy rungs, from local-only (nothing leaves the machine) to full identified replay (verbatim, by explicit approval).

Step 2: Install Exceeds Ink Client-Level Capture

Exceeds Ink runs as a lightweight, predictable component in your toolchain. It is a single approximately 10 MB Rust binary with no Node or npm runtime dependency, which means installation is a simple file copy without package manager conflicts. It captures everything locally first, so every event lands in a SQLite database on the developer’s machine before any optional remote delivery. This design keeps engineers in control of what data leaves their machines.

Ink is never in the request path between engineers and their AI vendors and makes no calls to Anthropic, OpenAI, Microsoft, or any AI provider. Tools keep working exactly as they do today even if Ink stops collecting. Capture is invoked from standard Git hooks (prepare-commit-msg, post-commit, post-rewrite). Finalization runs through a spawned post-commit subprocess, so git commit returns immediately and attribution work stays off the developer’s path. The success indicator is a local CLI confirmation from exceeds-ink stats showing captured sessions for the instrumented repository.

Pro tip: Ink privacy is dialable along four rungs without reinstalling. Start with aggregate-only mode during security review, then expand to abstracted or full replay once your CISO has reviewed the capture code, which is code-visible and auditable in an afternoon.

Step 3: Configure Adapters for Claude Code, Cursor, Codex, GitHub Copilot, and Windsurf

Adapter configuration turns raw capture into precise, per-line attribution for each AI assistant your teams use. Exceeds Ink ships five first-class adapters with dedicated per-tool checkpoint materializers. Each materializer resolves edit evidence against the actual working tree at commit finalization, so multi-edit Cursor sessions correctly retain human-typed lines and Claude Code rewrites are attributed to Claude rather than the committing engineer.

Each adapter requires specific configuration inputs to capture the tool’s interaction patterns and cost data. The required inputs for each adapter are:

• Claude Code: Hook into Claude Code’s native session data; the materializer reads interaction mode (plan, ask, agent, edit, headless) and token cost per session.
• Cursor: Billing data is read from Cursor’s own state database for exact cost accuracy; Tab and Composer modes are distinguished.
• Codex (OpenAI): Adapter covers batch tasks and headless workflows where no human is in the loop.
• GitHub Copilot: Inline autocomplete and function-level suggestions are captured via native hooks.
• Windsurf: Adapter covers specialized workflows and captures the underlying model identifier.

The success indicator is exceeds-ink blame returning per-line tool attribution on a recent commit, with interaction mode and model identifier populated for each AI-touched line. Beyond the five adapters detailed above, Ink’s lighter-weight detection extends coverage across the rest of your toolchain.

The multi-tool reality of 2026 is clear. Ninety percent of professional developers regularly use at least one AI tool at work, with Claude Code adoption reaching 18% globally by January 2026, tying Cursor for second place in work usage. Single-vendor analytics cannot aggregate across this landscape. Exceeds Ink can.

Connect my repo and start my free pilot — see multi-tool attribution in your first hour

Step 4: Validate Line-Level Attribution Across Merges

Validation confirms that attribution survives real-world Git workflows. After the adapters are configured, check for these observable indicators:

• Consistent attribution on merge commits: Git Notes travel with the commit object and are not lost during fast-forward or squash merges when notes are fetched correctly.
• Reproducible ROI calculations: the same commit produces the same per-line tool breakdown on repeated exceeds-ink blame calls.
• Manager adoption of coaching surfaces: the Exceeds platform surfaces interaction-mode breakdowns, such as agent mode without a plan phase, that managers can act on within two sprints.
• Unknown lines recorded explicitly: lines Ink cannot confidently attribute appear as unknown_lines rather than being silently rolled into human or AI totals, which preserves the integrity of ROI calculations.

A 2026 empirical study analyzing ~302,600 verified AI-authored commits across ~6,299 GitHub repositories found that more than 15% of commits from every major AI coding assistant introduced at least one code quality issue, and ~24% of those issues persisted to the latest repository version. Line-level attribution is the prerequisite for identifying which specific lines carry that risk.

The four steps above give you commit-time attribution. The sections that follow show how to extend that foundation into longitudinal tracking, policy enforcement, and competitive positioning.

From Attribution to Governance: Longitudinal Tracking and Policy Enforcement

Commit-level attribution becomes governance infrastructure when paired with outcome tracking over time. Exceeds AI monitors AI-touched code for thirty or more days after merge and correlates Ink’s per-commit attestation with incident rates, follow-on edit frequency, test coverage changes, and rework patterns. This combination answers a key question that metadata tools cannot address: whether AI-assisted code that passes review today causes problems sixty or ninety days later.

GitClear’s 211M-line study (2020-2024) found code duplication increased 4x while code churn rose 39% (3.1% to 5.7%). These findings show that AI code is driving measurable quality problems. Without line-level attribution anchored to Git history, there is no way to identify which teams or tools are driving that churn, and no way to target remediation.

Policy enforcement becomes expressible once the attestation is structured JSON in the repository. Examples include blocking deploys when AI authorship exceeds a defined threshold in sensitive paths, or requiring additional review on commits where Cursor agent mode produced more than a specified percentage of the diff. These policies are enforceable through standard OPA integrations and IDP scorecards because the attestation lives in the repo, not in a proprietary cloud.

Skill transfer follows the same pattern. When one team develops effective AI prompting patterns, captured in Ink’s interaction-mode and session-level data, the ink-prompting-coach skill distributes that pattern as a versioned SKILL.md and slash command directly into other engineers’ Claude Code or Cursor agents. Adoption is tracked centrally, and rollback is a single command.

How Exceeds Ink Compares to Git AI

Git AI is the closest architectural peer to Exceeds Ink in terms of producing line-level AI authorship via Git Notes. Both tools write attestations to Git Notes and support Claude Code, Cursor, Copilot, and Windsurf. The architectural differences create very different operational and security profiles.

Git AI runs a long-lived per-user daemon and installs a PATH-shimmed git binary. On Windows, git.exe is literally a copy of git-ai.exe, which causes EDR and AppLocker checks to see the wrong binary. It also destructively overwrites trace2.eventTarget globally, which silently clobbers any existing Trace2 tooling. Its daemon reconciles attribution asynchronously after the commit, so a fast git push can race ahead of attribution. Its secret redaction is entropy-only, which is weak on low-entropy short tokens and prefixed PATs embedded in URLs.

Exceeds Ink runs no long-lived daemon and uses short-lived hook processes only. It leaves the real git binary untouched, makes no global Git configuration changes, and resolves attribution deterministically at commit finalization via per-tool checkpoint materializers, so the note is written before the commit is reachable for push. HMAC-SHA256-signed remote ingest with revocable per-machine tokens and LLM-based prompt redaction provide a stronger security posture than Git AI’s OSS local model.

Both tools use Git Notes, but Exceeds Ink avoids the daemon and PATH shim that create operational drag in Git AI. It delivers line-level AI provenance plus deterministic attribution timing, HMAC-signed ingest, LLM-based redaction, a self-host option, and the ink-prompting-coach behavior-change layer, without the always-on daemon or global Git configuration mutation.

Frequently Asked Questions

Does Exceeds Ink aggregate attribution across all AI tools, or only the five first-class adapters?

The five first-class adapters described in Step 3 provide deep per-tool fidelity through checkpoint materializers. Beyond those five, Ink delivers lighter-weight detection across up to approximately 50 AI tools using multi-signal methods including code patterns, commit message analysis, and optional telemetry integration. Lines that cannot be confidently attributed to any tool are recorded as unknown lines rather than silently assigned to human or AI totals, which preserves the integrity of ROI calculations across the full toolchain.

How does Exceeds AI handle security reviews and enterprise compliance requirements?

Exceeds AI is designed to pass enterprise security review. Code exists on servers for seconds and is permanently deleted after analysis; only commit metadata and snippet information persists. Data is encrypted at rest and in transit. HMAC-SHA256-signed remote ingest uses revocable per-machine tokens. LLM-based prompt redaction runs before any prompt content is persisted in the dashboard. An aggregate-only mode keeps transcripts off the wire entirely through a single environment variable. SSO and SAML are supported. Audit logs are available. An in-SCM deployment option supports customers that require analysis within their own infrastructure with no external data transfer. Exceeds AI has passed enterprise security reviews including a Fortune 500 retailer’s formal two-month evaluation process and is working toward SOC 2 Type II compliance.

How is Exceeds Ink different from heuristic or daemon-based alternatives?

Heuristic tools, including watermark scanning, large-paste detection, and commit message keyword matching, top out around 20–25% accuracy by Exceeds AI’s own assessment. They cannot capture interaction mode, token cost, or the distinction between a human-edited AI suggestion and a fully agent-generated file. Daemon-based alternatives like Git AI run a long-lived per-user supervisor process and a PATH-shimmed git binary, which creates operational drag, EDR compatibility issues on Windows, and an async attribution race window between commit and push. Exceeds Ink uses short-lived hook processes only, fires deterministically at commit finalization, and writes a structured JSON attestation to Git Notes before the commit is reachable for push.

Does Git Notes AI provenance survive rebases or squash merges?

Git Notes attach to commit objects by SHA. A rebase or squash merge produces new commit SHAs, so notes attached to the original commits do not automatically transfer to the rewritten commits. Exceeds Ink addresses this through the post-rewrite hook, which fires after rebase and amend operations and allows the provenance layer to re-attach or update notes on the new commit objects. For squash merges, the materializer resolves attribution against the working tree at the point of the squash commit, so the resulting note reflects the aggregate AI contribution across all squashed changes. Teams using force-push workflows should confirm that their Git host is configured to fetch and push refs/notes/exceeds-ink alongside standard refs.

Conclusion: Authoritative Provenance for Confident Governance

Standard Git metadata cannot distinguish AI-generated lines from human-written ones, heuristic tools guess, and single-vendor analytics go dark when engineers switch tools. The four steps above, which include enabling per-repo Git Notes provenance, installing Exceeds Ink client-level capture, configuring adapters for Claude Code, Cursor, Codex, GitHub Copilot, and Windsurf, and validating line-level attribution across merges, deliver an authoritative, portable, audit-grade record that lets engineering leaders answer board questions about AI ROI with confidence.

The quality risks identified in the 2026 empirical study cited earlier are not hypothetical. A 2026 Carnegie Mellon study found that repositories adopting Cursor AI experienced persistent quality degradation, as static-analysis warnings rose approximately 30% and code complexity rose approximately 41%, even when velocity gains faded, and explicitly called for provenance tracking and human oversight to prevent accumulating complexity debt. Microsoft’s ICSE 2008 study found organizational-complexity metrics including team size and management span to be among the strongest predictors of defect-proneness. As manager-to-IC ratios stretch toward 1:8 or higher, the coaching surfaces Exceeds Ink enables become the practical substitute for the code review bandwidth that no longer exists.

Exceeds AI delivers commit and PR-level attribution across Claude Code, Cursor, Codex, GitHub Copilot, and Windsurf, anchored by the Git Notes attestation described in Step 1. Setup takes hours. First insights appear in minutes. Board-ready ROI reports follow in weeks.

Get board-ready ROI reports in weeks — start your free pilot now