100K+ commits tracked with AI code provenance

Origin needed to capture activity from 8 different AI coding agents, each exposing prompts, sessions, models, token usage, and code changes through different hooks, transcript files, or local databases. All of that data had to be normalized into one consistent provenance format without disrupting developers’ existing workflows.

Line-level AI attribution had to remain accurate even after developers rebased, squashed, amended, or cherry-picked commits. Because those operations can change commit hashes and repository history, Origin needed a reliable way to preserve provenance across real-world Git workflows.

‍

Origin stores prompts, session metadata, and code provenance inside Git-based workflows. This created a security challenge: sensitive information and secrets had to remain protected across repositories, clones, and forks while keeping provenance portable and useful for governance.

Every pull request runs GitHub Actions with ESLint, type checking, around 6,400 Vitest tests, dependency audits, secret scanning, and Docker builds. Staging deploys automatically to Fly.io, while production releases use manual approval, rolling deployment, health checks, and traceable versioning tied to Git SHA.

Origin was built around a local TypeScript/Node.js CLI with hooks for 8 AI coding agents, Git-native storage, a local SQLite index, an MCP server, and an optional hosted dashboard. This architecture captures prompts, diffs, models, tokens, costs, snapshots, and line-level attribution without forcing developers to change their existing workflows.

Better Stack centralizes logs, Sentry tracks application errors, and Fly.io Prometheus metrics feed Grafana dashboards for latency, error rate, CPU, and memory. Uptime checks, Slack alerts, budget alerts, health commands, and rolling deployments help the team detect and recover from issues quickly.

Origin applies 19 automatic redaction rules before data leaves the developer’s machine and scans commits against 41 secret patterns. Metadata-only Git notes, AES-256-GCM encrypted prompts, scoped API keys, workspace roles, audit logs, rate limiting, and hardened web headers protect sensitive code and prompt data.

‍