The Chat Approved It. Git Still Has No Receipt

Описание и применение

Частичная автоматизация с ИИ приводит к отсутствию проверки изменений в Git. Внедрение явных сообщений коммитов, очистки и хеширования запросов, подтверждения изменений lockfile и проверки политик в коде восстанавливает аудит и безопасность.

Задача

Cheap AI inference leads to missing human review gates, causing undocumented changes, secret leaks, lockfile tampering, and policy bypasses in Git workflows.

Результат

Adopting explicit commit documentation, prompt redaction, lockfile ACKs, and code‑based policy enforcement restores auditability, prevents secret leakage, and ensures human review in AI‑augmented Git workflows.

Рабочий процесс

• 1. Draft commit message with trade‑off and decision text. 2. Append chat transcript as appendix only. 3. Redact and hash prompt files before sending to LLM. 4. Run lockfile ACK script to ensure any lockfile changes are reviewed. 5. Enforce policy checks in code (e.g., denylist hostnames) before executing tools.

Доказательства

I put the tradeoff in the commit body. I link the chat only as appendix, never as proof.

Источник

I redact the raw prompt first, without exceptions. I hash the cleaned prompt file second.

Источник

I require an explicit ACK file in the pull request. No ACK means the CI job fails closed.

Источник