Causari

∵ causari

AI-written code has no author. It has causes. Causari records them.

How many lines from AI-tagged commits are still alive in your repo? One command, any git repo, no setup. A count, not a grade.

re audit counts lines introduced by commits whose git metadata matched an AI-detection rule, and how many of those lines git blame still attributes to those commits at HEAD. That count is survival: a count, not a grade. AI-tagged means the metadata matched. It does not prove a model wrote the line. UNKNOWN (no such metadata) is not human.

Causari also keeps a local ledger of what an agent runtime declared (prompt, model, files) and exposes it over MCP (re mcp). A Seal authenticates that a key signed these bytes for this commit and method. It does not authenticate that the numbers, or the attribution, are true.

Method and limits: causari.dev/method. The same limits, for an agent, in one file: causari.dev/llms.txt (full specification and schemas: causari.dev/llms-full.txt; agent discovery card: causari.dev/.well-known/agent.json).

curl -fsSL https://causari.dev/install.sh | shre audit

causari.dev  ·  Weekly Survival Report  ·  Method  ·  Manifesto  ·  Roadmap  ·  Releases

[CI] [License] [Platform] [AI code survival, measured by this tool on its own repository]

_{Causari by Crovia Trust: the causari / re binary, the causari package on npm, PyPI and crates.io, the MCP server io.github.croviatrust/causari. Not related to causari.ai, the GitHub organisation causari or the npm scope @causari (a causal knowledge graph by another team).}

re audit vercel/next.js     # any public repo, cloned to a temp dir and removed after

$ re audit∵ causari · AI code survival───────────────────────────────────────────────────  216 commits analyzed (git metadata only, no setup required)
AI-tagged (metadata matched): 14 commits, 6267 introduced, 5185 survived  survival 82.7% line-weighted · 82.7% capped · median 92.8%  Of the lines introduced by metadata-matched commits, this percentage is the share `git blame -w -M -C` still attributes to those commits. It is not the share of the repository and it is not a quality score. Metadata matched does not prove who wrote each line. UNKNOWN and untagged are commits with no such signal; they are not a finding that a human wrote them.  Age-matched gap: +2.9 percentage points (AI-tagged 85.6% minus untagged 82.7% in the matched age windows). Positive means the metadata-matched lines have the higher line-weighted survival in those windows, over 1 matched age window holding 75% of the AI-tagged lines. Lines outside those windows are not in this gap.Probable AI-assisted: none detectedBy agent (metadata matched only)  agent                commits introduced  survived  line-wt   capped   median  cursor                    14       6267      5185    82.7%    82.7%    92.8%
Baseline: untagged lines of the same repository  untagged: 202 commits, 95759 introduced, 76085 survived · 79.5% line-weighted · 92.1% median    line age                AI-tagged                 untagged      0-30 d       85.6% (13 commits)      82.7% (142 commits)     30-90 d                        —       75.8% (23 commits)   (below floor on one side)    90-180 d         73.9% (1 commit)       62.6% (37 commits)   (below floor on one side)  Age-matched gap: +2.9 percentage points (AI-tagged 85.6% minus untagged 82.7% in the matched age windows). Positive means the metadata-matched lines have the higher line-weighted survival in those windows, over 1 matched age window holding 75% of the AI-tagged lines. Lines outside those windows are not in this gap.
Confidence notes  · JSON field `verified` = metadata matched (trailers, bot author, …), not authorship proved  · PROBABLE = weak heuristic; may include human-assisted commits  · UNKNOWN commits are excluded from headline numbers; they form    the untagged baseline (human, inline-completed and untagged-agent code alike)  · Only lines from AI-tagged commits are measured; inline completions    (Copilot, Cursor Tab, …) leave no git trace and are invisible here  · A measurement, not a grade: method v4 at https://causari.dev/method
Reading and export  · The age-matched gap above is the comparison. An agent row marked below floor is not comparable.    Meeting the floor is not a reliability guarantee.  · Export: `re audit <target> --json`, `--summary`, `--seal`, `--badge`, `--card`    `re report` reads the local ledger. It does not export this audit.

The percentage is how many lines git blame still attributes to commits this method tagged. It is not code quality, developer productivity, total AI usage, proof a model wrote the line, security, correctness, or a causal effect of AI. An agent row under 5 commits is marked below floor; 5 commits is the comparability floor, not a reliability guarantee.

A git-ai note counts only when it names a non-empty tool (method v4). A schema-only note, a human-only note, and an empty tool do not. Method v3 counted any git-ai note. Survival Reports #1 and #2 stay method v2. Reports #3 and #4, and any audit from the 0.3.0 release, stay method v3. Report #4 is 10.5281/zenodo.23196011. Reports #5 and #6 stay method v4, measured with causari 0.4.1 (commit d4c4949, 2026-10-08). The published binary 0.5.0 (2026-10-21) is method v6, the method this source computes: surviving reads the same paths as introduced, so a binary blob (a PDF, an image) adds lines to neither count and a symlink adds one line to both; coverage.binary_files says how many blobs were left out. No binary shipped method v5. Published reports are not recomputed.

Fifteen minutes

curl -fsSL https://causari.dev/install.sh | shcd /path/to/a/git/repore audit

Read three lines of the output. AI-tagged (metadata matched) is the cohort whose commit metadata matched a rule. Baseline is every other commit: untagged, not "human". The survival percentage is the line-weighted persistence of the tagged cohort. It does not prove who typed the code. The rules and the limits are at causari.dev/method.

The ledger is a second path, local and gitignored, used only if you record:

git history → re audit → survival countshooks or proxy → .causari/ → re why / trace / lens

A seal signs the audit bytes. It does not connect the two paths.

Everyone argues about how much code AI writes. Nobody can check the numbers. re audit reads plain git history — Co-Authored-By trailers, bot authors, agent markers — finds the commits whose metadata matched, and asks git blame how many of their lines are still at HEAD. Metadata matched is not proof a model wrote the line. No model, no estimate, no survey. --json stores the counts, repository.head, repository.root_commits, the method, the blame and numstat flags (coverage.blame_flags, coverage.numstat_flags), coverage.ignore_revs_sha256 and coverage.notes_oid (the target OID of refs/notes/ai when present). It does not store the note payloads of refs/notes/ai: that ref is not part of the commit object, and changing it changes coverage.notes_oid and can change the counts while the commit SHA stays the same. A repository that has moved has a different commit.

• --json the exact bytes behind any published row (the published rows themselves: causari.dev/reports/survival, also as a dataset at CroviaResearch/causari-survival)
• --summary Markdown for CI; --badge / --card one-colour SVGs
• --diff <before> <after> compare two audit JSONs or .seal.json bundles along one axis (repository_diff, method_diff, indeterminate_method_diff, metadata_diff, or identical_inputs), refusing multi-axis diffs and unrelated repositories
• --save append a snapshot to track your own trend

Compared with what: since method v3 every audit puts the repository's own untagged lines next to the AI-tagged ones, by line age, and states the age-matched gap: AI-tagged survival minus untagged survival inside the matched age windows of the same repository, not a comparison of identical timestamps. It also names the oldest line still at HEAD and how many commits predate it: a repository that was cleared or rewritten shows there, and its ratio is read accordingly.

What it cannot see: code from inline completions (Copilot, Cursor Tab, Windsurf, …) leaves no git trace, so it is in the untagged baseline. Untagged is not a finding that a human wrote it. Commits without a trailer are UNKNOWN. An agent that needs the same limits in one file should read causari.dev/llms.txt. A formatter pass or a moved function counts as a death under method v1. One bulk commit can dominate a line-weighted ratio; ratios under 5 AI-tagged commits are flagged. All of this is written out at causari.dev/method, with how to contest a number. The questions people ask, answered with the command and the limit: causari.dev/faq; how this differs from git blame, vendor dashboards and churn reports: causari.dev/compare.

The weekly Survival Report runs re audit on up to 100 open-source repositories: a hand-picked list plus the most-starred public repositories (at least 100 stars) where GitHub commit search finds at least five commits carrying the same AI authorship metadata, selected every week, the day before the report, by scripts/survival_discover.py under a rule stated on the method page; rows stay alphabetical, and one line in .github/survival-optout.txt removes a repository.

In CI: a count on every pull request

# .github/workflows/causari.ymlon: pull_requestpermissions: { contents: read, pull-requests: write }jobs:  audit:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4        with: { fetch-depth: 0 }      # the audit reads every commit; shallow clones are wrong      - uses: croviatrust/causari@v1

The Action downloads the prebuilt Linux binary (a few seconds), runs re audit --summary, writes it to the job summary and posts one sticky comment per PR. No cloud, no account. A live example.

The ledger: from "which commit" to "which prompt"

The audit works on any history. If you also want to know why a line exists — the prompt, the model, the files the agent read — Causari records agent actions as they happen into a local, append-only ledger (.causari/, gitignored), with a snapshot of the tree before and after each one.

re init                       # create .causari/ (added to .gitignore)re hook claude-code           # record every Claude Code prompt and edit, exactlyre hook cursor                # same for Cursor, via its hooks.json (prompt, edit, model)re proxy                      # local LLM proxy: prompts, models, tokens, costre watch                      # attribute file changes to captured completions
re why    src/auth.ts:42      # which recorded event introduced this linere trace  src/auth.ts:42      # upstream: events that fed into it through reads/writesre impact <event-id>          # downstream: what later events depended on itre lens   src/auth.ts         # the file annotated line by line with its eventre find   "the JWT refactor"  # search prompts, messages, reasoningre bisect --test "npm test"   # first recorded event that breaks a testre revert <id>                # restore the pre-state, with a preview of what else you undore fork / re sessions / re switch / re log --all / re diff a..b

What each agent actually gives you today

Claims about "any agent" are cheap. This table is derived from the code and is kept current; if a cell is wrong, open an issue.

Two evidence classes, and every output says which one it is:

• Declared (hooks, MCP, re record): the agent stated what it did. Exact prompt and path. If a human edits a file between two hook events, the hook snapshot absorbs that edit into the next agent event — a known limit being fixed in Phase 1.
• Correlated (proxy + watch): the lines you inserted are searched inside completions captured moments before. A score, not a fact. The adversarial harness in examples/real-session/ gives measured numbers: 100 % on a clean write, 50 % after a formatter pass, wrong per-line attribution when two prompts touch one file in the same window.

Everything stays on your machine. re proxy and the hooks store prompts, completions and commands in clear under .causari/ (gitignored); credentials in recognisable formats — sk-… keys, GitHub/GitLab/Slack/npm/PyPI/Hugging Face tokens, AWS and Google keys, bearer values, JWTs, PEM private keys — are replaced by [redacted:<kind>] before writing, and the record says how many. Anything else you paste is kept as typed. Snapshots store every non-ignored file (.env*, node_modules, target, dist, build, .git and a few others are excluded by default). Treat .causari/ as sensitive. What is stored, what is not, and what the tool does and does not defend against: SECURITY.md and docs/threat-model.md.

Receipts you can verify without us

Crovia Seals. re proxy --seal issues a crovia.seal.v1 receipt for every completion: Ed25519-signed, hash-chained, committing to SHA-256 hashes of the exact request and response bytes (content never leaves the machine). Each recorded exchange carries its seal_id and the same hashes, so a receipt can be matched to the completion it covers. The implementation passes the reference conformance vectors; seals verify under the Python reference implementation and vice versa.

re proxy --seal          # issue a receipt per completionre seal verify           # every signature, whole chain, offlinere seal issuer           # your issuer id and public key (read-only)

PNX — Proof of Non-Exfiltration. re proxy --pnx makes the proxy an egress witness for the TACET profile crovia.pnx.v1: every request body is fingerprinted (salted winnowing, k-gram 32, window 16) and committed to a sparse Merkle map before it is forwarded; Ctrl-C signs a run sheet carrying the root. re pnx prove then shows, for a set of protected assets, that none shared a substring of 47 bytes or more with that traffic — or records which did. Sheet and proof contain no traffic bytes and no asset bytes, and verify offline with re pnx verify or with the Python reference tacet-pnx, in both directions, same verdicts and exit codes. The sheet also states where the run connected — every upstream the proxy forwarded to, with its outcome under an egress policy bound by hash (the reach record, PNX §4a); a destination outside the policy is refused before the body leaves. What a proof does and does not say: docs/pnx.md.

re proxy --pnx --pnx-policy egress-policy.json    # witness a session; upstreams outside the policy are refused; Ctrl-C signs the sheetre pnx prove --asset api_key=.env --assets-dir src/secret/re pnx verify .causari/pnx/<run>/proof.json --asset api_key=.env --assets-dir src/secret/ --policy egress-policy.json

Audit seals. re audit --seal writes the audit result as the same kind of receipt: a crovia.seal.v1 over the exact bytes of re audit --json, bound to the audited commit and the method version, hash-chained with the proxy's completion seals under one issuer key per repository. re seal verify FILE checks it offline; so does the static page causari.dev/verify, which makes no network request. A valid seal proves that this key signed these numbers for this commit and that they were not altered since. It does not prove the numbers are true: rerun re audit on the commit and compare. (re proof is retired in favour of this; it exits 2 and names the replacement.)

re audit --seal --output audit.seal.jsonre seal verify audit.seal.jsonre audit --diff before.seal.json after.seal.json --summary

Experimental

These commands exist, work in the demos, and are not yet held to the standard above. They are out of the proof and out of the front page until they are.

• re skill distill / verify / export / import / pull / trust: signed units of past work. Ed25519 detects a later edit; the signature does not certify the content. verified is a declared signal frozen at distill (a caller-supplied exit code 0, or declared write paths still at the tip), not an observed success. A 2× rank weight is that declared signal, not measured reliability. proven is not awarded. A legacy recall count is not an execution.
• re brief: a Markdown briefing of past work for a model's context.
• re guard: substring rules over recent changes; gates a build only when asked (--fail-on alert|warning); --json for machines.
• re churn, re report: survival measured over the ledger instead of git, with cost extrapolated from a static price table; re churn --json, and --fail-below <percent> when a team wants a floor of its own choosing.
• re mcp: stdio MCP server with causari_record, causari_recall, causari_why; re mcp --install prints the client config.

Install

# Linux / macOScurl -fsSL https://causari.dev/install.sh | sh
# Windows (PowerShell)irm https://causari.dev/install.ps1 | iex
# Homebrew (macOS, Linux)brew install croviatrust/tap/causari
# Scoop (Windows)scoop bucket add causari https://github.com/croviatrust/scoop-bucket && scoop install causari
# crates.io (Rust 1.85+)cargo install causari --locked
# no install: launchers that fetch the verified binary on first runnpx causari auditpipx run causari audit
# from sourcecargo install --git https://github.com/croviatrust/causari --locked

One program under two names: causari is the binary, re is the short alias every example uses. Both are in every archive and both are installed. One static binary, about 5 MB, for Linux (x86_64, aarch64), macOS (x86_64, Apple silicon) and Windows (x86_64), installed to ~/.local/bin (or %LOCALAPPDATA%\Programs\causari). The installer checks the archive's SHA-256 against the SHA256SUMS.txt published with each release and refuses to install on a mismatch. From v0.2.0, every archive and the sums file carry a signed SLSA build-provenance attestation from the release workflow:

gh attestation verify causari-v0.5.0-x86_64-unknown-linux-gnu.tar.gz --repo croviatrust/causari

By hand:

VERSION=$(curl -fsSL https://api.github.com/repos/croviatrust/causari/releases/latest | sed -n 's/.*"tag_name": *"\([^"]*\)".*/\1/p')TARGET=x86_64-unknown-linux-gnubase="https://github.com/croviatrust/causari/releases/download/$VERSION"curl -fsSLO "$base/causari-$VERSION-$TARGET.tar.gz" && curl -fsSLO "$base/SHA256SUMS.txt"sha256sum --ignore-missing -c SHA256SUMS.txt && tar -xzf "causari-$VERSION-$TARGET.tar.gz" && install -m755 causari re ~/.local/bin/

The Homebrew tap and the Scoop bucket render their manifests from each release's SHA256SUMS.txt and re-render every six hours. The crate is published from the release tag through crates.io Trusted Publishing (.github/workflows/publish-crate.yml): no long-lived token exists.

As an MCP server

re mcp speaks MCP over stdio and exposes causari_record, causari_recall and causari_why; re mcp --install prints the configuration block for Claude Desktop, Cursor, Windsurf and Cline. The server is listed in the MCP Registry from server.json:

• MCP Registry name: mcp-name: io.github.croviatrust/causari
• One-click for Cursor: Add causari to Cursor (registers re mcp; the binary must be on PATH)

In Cursor

re hook cursor merges seven command hooks into the project's .cursor/hooks.json (commit it: teammates and Cursor cloud agents run it from the repository root); --user merges ~/.cursor/hooks.json instead for one machine, --dry-run prints the result. Hooks other people wrote in the same file are kept. Each hook runs re hook-event cursor:<event>, so re must be on PATH for the Cursor process (the same caveat as the Claude Code hooks); without it, or in a project without re init, every hook answers with a neutral JSON object and nothing is recorded. What lands in the ledger: the prompt with its attachments and model (beforeSubmitPrompt), a snapshot before each shell or write tool (preToolUse), one event per written file (afterFileEdit) and per command that changed the tree (afterShellExecution), the agent's answer next to its prompt (afterAgentResponse), and the experience briefing as context at sessionStart.

As a Claude Code plugin

The repository is also a plugin marketplace. Inside Claude Code:

/plugin marketplace add croviatrust/causari/plugin install causari@croviatrust

The plugin installs the four hooks that re hook claude-code writes by hand (prompt, pre-state, post-state, session briefing), the MCP server, and a skill that tells the model when why, trace, recall and record are the right tool. It needs the re binary on PATH; without it, or in a project without re init, every hook is a silent no-op.

Demos: scripts/demo*.sh|ps1 (mock LLM included), examples/real-session/ (the adversarial harness), scripts/recovery_lab.py (revert/bisect stress lab).

How it works, in one paragraph

Every recorded event is a content-addressed object (BLAKE3) with the tree before, the tree after, the agent, model and tool, the prompt, declared reads and writes, tokens and cost, and a parent. Sessions are refs; forks are implicit. re why finds the first event on the current chain whose before/after diff inserted the line; re trace follows reads and writes backwards from there; re impact forwards. Unchanged files share blobs between snapshots. The full design, and its current limits, are in docs/review-2026-09-20/.

Where this is going

Causari does not compete with provenance trackers (Agent Trace, git-ai, Assisted-by: trailers, Entire checkpoints). It reads the metadata they leave, measures with a public method, and signs the result so a third party can verify it offline.

Done in the published binary 0.5.0, method v6 (2026-10-21), and in this source: git blame -w -M -C, the per-commit cap, the v4 git-ai rule, the audit seal, the HEAD-tree reading and git log --numstat -M -z of v5, coverage.copy_capped_lines, signed coverage.notes_oid and coverage.ignore_revs_sha256, re audit --diff on one axis, and the v6 rule that blames only the paths numstat counted, so binary blobs are in neither count. Done in the proxy: a PNX witness mode. For the request bodies it saw, a proof can show that named assets shared no 47-byte substring with that traffic. It does not prove the session made no other connection.

Next: an Agent Trace reader, and a release whose package version and method are the same pair.

Phases and exit criteria: ROADMAP.md.

Family

Causari is part of Crovia, one grammar in three tenses: TACET proves that a model's public card carried no training-data disclosure in the hours it was observed, PNX shows that named assets shared no long substring with request bodies a witness saw (not that the job made no other connection), Causari records what a runtime declared and measures whether lines from AI-tagged commits are still at HEAD. Same rules everywhere: reproducible numbers, no verdicts, verification without our servers, limits stated first.

Role in the Crovia canon — Sibling product: a git-metadata audit and a local ledger. A Seal authenticates bytes for a commit and a method; it does not authenticate truth or who typed a line. Seal issuer for agent completions and audit results.

License

Apache-2.0 (see LICENSE). "Causari" is a trademark of Crovia Trust; the license does not grant trademark rights (see NOTICE). Contributing: see CONTRIBUTING.md.