causari

<h1 align="center">∵ causari</h1>

<p align="center"><strong>AI-written code has no author. It has causes. Causari proves them.</strong></p>
<p align="center"><em>How many lines from AI-tagged commits are still alive in your repo? One command, any git repo, no setup. A count, not a grade.</em></p>

<p align="center">
  <a href="https://causari.dev"><strong>causari.dev</strong></a>
  &nbsp;·&nbsp;
  <a href="https://causari.dev/reports/survival/">Weekly Survival Report</a>
  &nbsp;·&nbsp;
  <a href="https://causari.dev/method">Method</a>
  &nbsp;·&nbsp;
  <a href="MANIFESTO.md">Manifesto</a>
  &nbsp;·&nbsp;
  <a href="ROADMAP.md">Roadmap</a>
  &nbsp;·&nbsp;
  <a href="https://github.com/croviatrust/causari/releases">Releases</a>
</p>

<p align="center">
  <img alt="CI" src="https://github.com/croviatrust/causari/actions/workflows/ci.yml/badge.svg?branch=main">
  <img alt="License" src="https://img.shields.io/badge/license-Apache--2.0-3b4252">
  <img alt="Platform" src="https://img.shields.io/badge/linux%20%7C%20macOS%20%7C%20windows-3b4252">
</p>

---

```bash
curl -fsSL https://causari.dev/install.sh | sh     # Linux / macOS (Windows below)

re audit                    # the repo you are in
re audit vercel/next.js     # any public repo, cloned to a temp dir and removed after
```

```console
$ re audit
∵ causari · AI code survival
───────────────────────────────────────────────────
  36 commits analyzed (git metadata only, no setup required)

Verified AI-authored: 3 commits, 1773 introduced, 1773 survived (100.0%)
Probable AI-assisted: none detected
By agent (verified only)
  cursor                 1773 lines,   1773 survived (100.0%)

Confidence notes
  · VERIFIED = explicit metadata (trailers, bot author, etc.)
  · PROBABLE = weak heuristic; may include human-assisted commits
  · UNKNOWN commits are excluded from headline numbers
  · Only lines from AI-tagged commits are measured; inline completions
    (Copilot, Cursor Tab, …) leave no git trace and are invisible here
  · A measurement, not a grade: method at https://causari.dev/method
```

Everyone argues about how much code AI writes. Nobody can check the numbers.
`re audit` reads plain git history — `Co-Authored-By` trailers, bot authors,
agent markers — finds the commits that carry machine-readable AI authorship,
and asks `git blame` how many of their lines are still at HEAD. No model, no
estimate, no survey. Anyone re-runs it and gets the same bytes.

- `--json` the exact bytes behind any published row
- `--summary` Markdown for CI; `--badge` / `--card` one-colour SVGs
- `--save` append a snapshot to track your own trend

**What it cannot see**: code from inline completions (Copilot, Cursor Tab,
Windsurf, …) leaves no git trace and counts as human. Commits without a
trailer are UNKNOWN. A formatter pass or a moved function counts as a death
under method v1. One bulk commit can dominate a line-weighted ratio; ratios
under 5 AI-tagged commits are flagged. All of this is written out at
[causari.dev/method](https://causari.dev/method), with how to contest a number.

## In CI: a count on every pull request

```yaml
# .github/workflows/causari.yml
on: pull_request
permissions: { contents: read, pull-requests: write }
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }      # the audit reads every commit; shallow clones are wrong
      - uses: croviatrust/causari@v1
```

The [Action](https://github.com/marketplace/actions/causari-survival-audit)
downloads the prebuilt Linux binary (a few seconds), runs `re audit --summary`,
writes it to the job summary and posts one sticky comment per PR. No cloud,
no account. A [live example](https://github.com/croviatrust/causari-audit-demo/pull/1).

## The ledger: from "which commit" to "which prompt"

The audit works on any history. If you also want to know *why* a line exists
— the prompt, the model, the files the agent read — Causari records agent
actions as they happen into a local, append-only ledger (`.causari/`,
gitignored), with a snapshot of the tree before and after each one.

```bash
re init                       # create .causari/ (added to .gitignore)
re hook claude-code           # record every Claude Code prompt and edit, exactly
re proxy                      # local LLM proxy: prompts, models, tokens, cost
re watch                      # attribute file changes to captured completions

re why    src/auth.ts:42      # which recorded event introduced this line
re trace  src/auth.ts:42      # upstream: events that fed into it through reads/writes
re impact <event-id>          # downstream: what later events depended on it
re lens   src/auth.ts         # the file annotated line by line with its event
re find   "the JWT refactor"  # search prompts, messages, reasoning
re bisect --test "npm test"   # first recorded event that breaks a test
re revert <id>                # restore the pre-state, with a preview of what else you undo
re fork / re sessions / re switch / re log --all / re diff a..b
```

### What each agent actually gives you today

Claims about "any agent" are cheap. This table is derived from the code and
is kept current; if a cell is wrong, open an issue.

| Agent | Prompt + file, exact | Model, tokens, cost | How |
|---|---|---|---|
| **Claude Code** | yes, via lifecycle hooks | not yet (edits travel as `tool_use`, which the proxy does not join to files yet) | `re hook claude-code` |
| **Aider** | heuristic join, measured | yes | `OPENAI_API_BASE` / `ANTHROPIC_API_BASE` → `re proxy` + `re watch` |
| **Codex CLI**, OpenAI Agents SDK | not yet (Responses API output not parsed) | yes | `OPENAI_BASE_URL` → `re proxy` |
| **Cursor**, **Windsurf**, **Copilot** | only what the agent self-reports via MCP | no | `re mcp` |
| **Cline / Roo**, custom scripts, curl | heuristic join when the completion carries the code as text | yes | base URL → `re proxy` + `re watch` |

Two evidence classes, and every output says which one it is:

- **Declared** (hooks, MCP, `re record`): the agent stated what it did. Exact
  prompt and path. If a human edits a file between two hook events, the hook
  snapshot absorbs that edit into the next agent event — a known limit being
  fixed in [Phase 1](ROADMAP.md).
- **Correlated** (proxy + watch): the lines you inserted are searched inside
  completions captured moments before. A score, not a fact. The adversarial
  harness in [`examples/real-session/`](examples/real-session/RESULTS.md)
  gives measured numbers: 100 % on a clean write, 50 % after a formatter pass,
  wrong per-line attribution when two prompts touch one file in the same
  window.

Everything stays on your machine. `re proxy` stores prompts and completions
verbatim; snapshots store every non-ignored file (`.env*`, `node_modules`,
`target`, `dist`, `build`, `.git` and a few others are excluded by default).
Treat `.causari/` as sensitive.

## Receipts you can verify without us

**Crovia Seals.** `re proxy --seal` issues a
[crovia.seal.v1](https://github.com/croviatrust/crovia-seal) receipt for every
completion: Ed25519-signed, hash-chained, committing to SHA-256 hashes of the
exact request and response bytes (content never leaves the machine). Each
recorded exchange carries its `seal_id` and the same hashes, so a receipt can
be matched to the completion it covers. The implementation passes the
reference conformance vectors; seals verify under the Python reference
implementation and vice versa.

```bash
re proxy --seal          # issue a receipt per completion
re seal verify           # every signature, whole chain, offline
re seal issuer           # your issuer id and public key (read-only)
```

**PNX — Proof of Non-Exfiltration.** `re proxy --pnx` makes the proxy an
egress witness for the TACET profile
[`crovia.pnx.v1`](https://croviatrust.com/registry/tacet/pnx/): every request
body is fingerprinted (salted winnowing, k-gram 32, window 16) and committed
to a sparse Merkle map *before* it is forwarded; Ctrl-C signs a run sheet
carrying the root. `re pnx prove` then shows, for a set of protected assets,
that none shared a substring of 47 bytes or more with that traffic — or
records which did. Sheet and proof contain no traffic bytes and no asset
bytes, and verify offline with `re pnx verify` or with the Python reference
`tacet-pnx`, in both directions, same verdicts and exit codes. What a proof
does and does not say: [`docs/pnx.md`](docs/pnx.md).

```bash
re proxy --pnx                                    # witness a session; Ctrl-C signs the sheet
re pnx prove --asset api_key=.env --assets-dir src/secret/
re pnx verify .causari/pnx/<run>/proof.json --asset api_key=.env --assets-dir src/secret/
```

**Audit seals.** `re audit --seal` writes the audit result as the same kind of
receipt: a `crovia.seal.v1` over the exact bytes of `re audit --json`, bound to
the audited commit and the method version, hash-chained with the proxy's
completion seals under one issuer key per repository. `re seal verify FILE`
checks it offline; so does the static page
[causari.dev/verify](https://causari.dev/verify), which makes no network
request. A valid seal proves that this key signed these numbers for this
commit and that they were not altered since. It does not prove the numbers
are true: rerun `re audit` on the commit and compare. (`re proof` is retired
in favour of this; it exits 2 and names the replacement.)

```bash
re audit --seal --output audit.seal.json
re seal verify audit.seal.json
```

## Experimental

These commands exist, work in the demos, and are not yet held to the standard
above. They are out of the proof and out of the front page until they are.

- `re skill distill / verify / export / import / pull / trust`: signed units
  of past work; the trust ladder (recorded → verified → proven) currently
  measures file existence and recall counts, not correctness.
- `re brief`: a Markdown briefing of past work for a model's context.
- `re guard`: substring rules ove