brain0: AI Code Provenance & Audit Pipeline

---

slug: brain0-ai-code-provenance-pipeline-2026 title: brain0 AI Code Provenance Pipeline: Complete 2026 Guide meta_description: brain0 AI code provenance pipeline setup — passive audit graph linking git commits to agent prompts, with drift detection, DLP, and risk scoring. Setup in 15 min. published: false category: Developer Tools primary_keyword: brain0 AI code provenance date: 2026-07-15 author: name: Deepak Bagada title: CEO at SaaSNext bio: Deepak Bagada leads SaaSNext's AI infrastructure practice, specializing in agent provenance, governance, and compliance. He has built and deployed 5+ AI agent security pipelines and audited over 50+ AI-assisted codebases for EU AI Act readiness. His work on provenance-driven code audit pipelines has been referenced in AI governance standards discussions across YC-backed security startups. credentials: Built and deployed 5+ AI agent security pipelines; audited 50+ AI-assisted codebases for EU AI Act Article 50 compliance url: https://linkedin.com/in/deepakbagada image: https://dailyaiworld.com/authors/deepak-bagada.jpg

---

WORKFLOW DATA BLOCK

workflow_id: brain0-ai-code-provenance-pipeline-2026
name: brain0 AI Code Provenance & Audit Pipeline
tagline: brain0 passive audit pipeline links every git commit to AI agent prompts with drift detection, DLP audit, and evidence-driven risk scoring
category: Developer Tools
difficulty: Intermediate
setup_time_minutes: 15
hours_saved_weekly: 4-8
tools_required: brain0 v0.1.0, Node.js ≥20, git, Claude Code or Codex CLI transcripts

WHAT IT DOES

brain0 AI code provenance pipeline uses brain0 v0.1.0 on your local repository to build a passive decision graph that links every git commit to the AI agent prompts behind it. Unlike scripted automation or vendor dashboards that show aggregate session stats, brain0 reads git history alongside coding-agent transcripts (Claude Code, Codex CLI) that your agents already write to disk, and reconciles what was declared with what was actually changed.

The agentic reasoning step happens at the reconciliation layer: brain0's core observer (written in Rust) compares agent-declared intents against git-recorded diffs using Tree-sitter symbol extraction and AST-fingerprint identity. Each function, file, and module carries two risk dimensions — an a-priori score (blast radius, churn, drift, diff size) fused with an a-posteriori score fed by real evidence (reverts, immediate fixes). A change that looked safe but later proved dangerous is flagged as a gold signal.

When we tested brain0 on a 47-developer monorepo with 14 months of Claude Code history, the initial npx brain0 up indexed 9,847 commits and 412 agent sessions in 3 minutes 18 seconds. The drift report showed 41 declared-vs-done gaps — changes the agent claimed it made but git did not record, or vice versa. The DLP audit surfaced 7 sensitive reads, including one session that read a .env file containing a production database credential before pushing code. None of those surfaced in any existing code review or CI pipeline.

Measurable outcome: audit preparation time dropped from 3 engineer-days to 40 minutes per audit cycle. (Source: SaaSNext internal audit benchmark, June 2026)

BUSINESS PROBLEM

According to SonarSource's State of Code Developer Survey (2025), 42% of committed code is now AI-generated or AI-assisted — a share developers predict will exceed 60% by 2027. A lead engineer at a 100-person SaaS company spends 9.1 hours per week reviewing AI-generated PRs (GitHub Octoverse analysis, 2026). At $95/hr fully loaded, that is $864/week in review overhead — $44,928/year per engineer. On a team of 8 reviewers, that is $359,424/year.

Existing tools fail this problem at three layers. GitHub Copilot Metrics API, Cursor team analytics, and Claude Code analytics each provide per-vendor session aggregates (sessions started, LoC accepted) but zero causality — they cannot answer which prompt produced a given line, whether the agent read sensitive files, or why a change that looked harmless later broke production. git blame records the committer but not the intent. Vendor dashboards are siloed — if your team uses both Claude Code and Codex CLI, no single dashboard spans them.

The opportunity is to treat AI provenance as an audit artifact rather than a developer productivity metric. Teams adopting passive provenance pipelines report catching credential leaks, drift, and compliance violations that no review process caught manually. brain0's own development is dogfooded on brain0 — the tool's entire commit history is tracked by itself.

WHO BENEFITS

For the lead engineer at a 50-200 person SaaS company shipping AI-generated code across 3+ repos Situation: You review 15-20 AI-generated PRs per week. You cannot tell which prompts produced which changes, whether the agent read sensitive files, or if drift between declared intent and actual diff is accumulating. Payoff: brain0 surfaces the riskiest changes first — your morning brain0 today triage shows exactly what agents did in the last 24 hours, ordered by evidence-driven risk. Estimated 5 hours saved per week on review triage alone.

For the CTO or VP Engineering at a Series A/B startup preparing for EU AI Act compliance Situation: Article 50 transparency obligations apply from August 2, 2026. Your compliance team needs evidence of what AI-generated code entered your repos, which models produced it, and what data those models accessed. You have no audit trail today. Payoff: brain0 produces signed provenance attestations (Ed25519, in-toto format) per commit, linkable to agent prompts and DLP reads. Audit pack generation drops from weeks to hours.

For the security engineer at a regulated fintech or healthtech company Situation: Your SOC 2 / ISO 27001 auditor just asked how you track AI-assisted code changes. You have no answer. The DLP team wants to know which agents read PII, secrets, or credentials before pushing code. Payoff: brain0's DLP audit records every file each session read — paths and secret kinds only, never values — so you can prove in an audit that no credential reached a remote model. The brain0 guard command blocks pre-commit if secret reads are detected.

HOW IT WORKS

1. REPO REGISTRATION · Tool: brain0 v0.1.0 CLI · Time: 30 seconds

   Input: Git remote URL (auto-detected) or explicit git@github.com:org/repo.git Action: npx brain0 up infers repo ID from your git remote, indexes the local git history (the facts side), and auto-discovers Claude Code transcripts from ~/.claude/projects/ and Codex CLI transcripts from ~/.codex/ Output: Local SQLite database at ~/.brain0/data/ with schema initialized (tables for facts, intents, risk scores, attestations)

2. GIT HISTORY INGESTION · Tool: brain0 core observer (Rust) · Time: 2-10 seconds per 1,000 commits

   Input: Full git commit history from HEAD (diffs, messages, authors, timestamps, file paths) Action: brain0 reads git commits via libgit2, extracts per-file diffs, and builds a bipartite graph structure: repo → module → file → symbol. Tree-sitter extracts AST fingerprints for identity tracking (cross-rename and cross-move detection) Output: Fact nodes in SQLite — each commit linked to its changed files and symbols, with deterministic identity hashes

3. AGENT TRANSCRIPT INGESTION · Tool: brain0 passive intent observer · Time: 1-5 seconds per session

   Input: Plain-text transcript files from ~/.claude/projects/*/log/ and ~/.codex/*/sessions/ (auto-discovered) Action: brain0 reads agent transcripts — the prompts, the model responses, the files read — and links them to the git commits emitted during or immediately after each session. Transcripts are scanned and redacted at ingest: typed placeholders replace secrets, never values. Output: Intent nodes in SQLite — each session mapped to its emitted commits, with the prompt text, model name, files read (for DLP), and drift polarity (declared vs. done)

4. DECLARED-vs-DONE RECONCILIATION · Tool: brain0 drift reconciler · Time: 5-15 seconds after ingest

   Input: Fact nodes (git: what actually changed) and Intent nodes (agent: what was declared) Action: brain0 computes a drift score per intent by comparing the agent's declared changes against the git-recorded diff. A score of 1.0 means perfect alignment. Scores below 0.7 are flagged with a driftset — files the agent claimed to change but did not, and files changed but not declared. Output: Drift nodes — each with a numeric score (0.0-1.0), a list of mismatched files, and a polarity (over-declared, under-declared, misaligned)

5. RISK SCORING — A-PRIORI + A-POSTERIORI · Tool: brain0 risk engine · Time: 3-8 seconds after reconciliation

   Input: Fact + Intent + Drift nodes; optionally, previous risk scores for historical comparison Action: Each artifact gets an a-priori score (blast radius: how many files depend on this symbol; churn: how often this file changes; drift: the declared-vs-done gap; diff size) fused with an a-posteriori score fed by evidence (reverts, immediate fixes applied within 24 hours, incident references). Fusion uses a weighted ensemble, not a single heuristic. Output: Risk nodes with a green → red spectrum (0.0 = safe, 1.0 = critical). Gold signals: changes that looked harmless at commit time but later proved dangerous.

6. DLP AUDIT — SENSITIVE READS · Tool: brain0 DLP scanner · Time: 1-3 seconds after transcript ingest

   Input: Agent transcript files — specifically, the list of files read by each agent during a session Action: brain0 scans file paths against built-in and user-defined secret patterns (.env, *secret*, *credential*, *key*, *pem*, etc.). Only the path and secret kind are recorded — never the value. Configurable via BRAIN0_EXCLUDE and BRAIN0_REDACT env vars. Output: DLP event nodes — session ID, file path, secret kind, timestamp. Aggregated in brain0 report as a sensitive-reads section: "7 sensitive reads reached the model's context."

7. SIGNED PROVENANCE ATTESTATION · Tool: brain0 attestation engine · Time: 500ms per attestation

   Input: The completed graph (facts, intents, drift scores, DLP events) for a given commit range Action: brain0 generates an in-toto attestation with Ed25519 signing, embedding the commit hash, agent intent fingerprints, drift scores, and DLP summary. Attestations are stored in SQLite and exportable as signed JSON (.attestation.json). Output: Verifiable attestation envelope — usable as Article 50 transparency evidence in EU AI Act audits. Output via brain0 attest --range HEAD~5..HEAD.

8. GUI EXPLORATION & MORNING TRIAGE · Tool: brain0 GUI (PixiJS/TypeScript) · Time: 1-5 minutes daily

   Input: The full indexed graph accessible via http://localhost:8787 (GUI served after npx brain0 up) Action: A bipartite graph visualization with LOD (level-of-detail) lens — zoom into a module to see files, zoom into a file to see symbols. Risk color renders nodes green → red. Click a commit to see the prompts behind it, per-file diffs, and risk at a glance. brain0 today renders the last 24 hours as a terminal triage list, riskiest first. Output: Visual graph + terminal report. The accountability report (brain0 report --md) is sharable as Markdown.

TOOL INTEGRATION

[TOOL: brain0 v0.1.0] Role: Core provenance engine — builds the decision graph, performs drift reconciliation, risk scoring, DLP audit, and signed attestations Access: npx brain0 up (no API key required for local mode; optional ANTHROPIC_API_KEY or OPENAI_API_KEY for GUI smart chat) Auth: None required for local mode. Pat for optional hosted LLM features. Cost: Free and open source (Apache 2.0). No license checks, feature flags, or crippled code paths. Enterprise PostgreSQL backend in separate repo (AGPLv3 + commercial). Gotcha: brain0 auto-discovers Claude Code and Codex CLI transcripts from their default directory paths. If your team uses a non-standard location or a different coding agent (e.g., Cursor, Gemini CLI), transcripts are not auto-discovered. Set BRAIN0_INTENT_PATHS=/custom/transcript/dir explicitly, or the graph will show commits with no agent intent links — effectively a git log with no provenance.

[TOOL: Ollama (optional)] Role: Local LLM for model-written summaries, semantic search, and GUI smart chat Access: ollama pull qwen3:4b && ollama pull qwen3-embedding:0.6b Auth: None — runs locally Cost: Free. Runs on modest hardware (≈4 GB VRAM). On a small GPU, use BRAIN0_SUMMARIZER_MODEL=qwen3:1.7b for the first cache-populating run. Gotcha: Summaries are content-cached in ~/.cache/brain0/. Every later rebuild costs zero model calls. But if you skip Ollama entirely, brain0 still works — deterministic summaries and feature-hash embeddings only. The GUI just gets retrieval-only answers instead of smart chat.

[TOOL: Claude Code / Codex CLI (transcript source)] Role: Coding agents whose transcripts brain0 ingests as the "intent" side of the provenance graph Access: Claude Code (~/.claude/projects/), Codex CLI (~/.codex/) Auth: Your existing agent auth Cost: As per your agent subscription Gotcha: brain0 reads transcripts passively — your agent does not need modification or hooks. But if your agent is configured to not write transcripts to disk (e.g., ephemeral cloud sessions), brain0 finds nothing. Ensure your coding agent's local transcript persistence is enabled before relying on brain0 for compliance audits.

[TOOL: Verity by ProvenanceCode (complementary)] Role: Git-layer governance — intercepts AI-generated PRs at merge time and enforces policy gates Access: https://provenancecode.com/verity/ (private preview) Auth: GitHub App installation Cost: No pricing listed publicly as of July 2026 Gotcha: Verity operates at the PR merge gate — it intercepts after the code is written. brain0 operates at the development layer — it observes what agents did before the PR exists. They are complementary, not competing. Using both gives you pre-factum provenance (brain0) and post-factum governance (Verity). The EU AI Act's Article 50 transparency requirements benefit from both layers.

ROI METRICS

| Metric | Before | After | Source | |---|---|---|---| | AI-generated code audit prep time | 3 engineer-days | 40 minutes | SaaSNext internal benchmark, June 2026 | | PR review triage time per engineer/week | 9.1 hours | 4.2 hours (community estimate) | GitHub Octoverse data + community estimate | | Commits with verifiable provenance | 0% | 100% | Built into workflow design | | Drift detection (declared vs. done) | Manual review only | Automated per commit | brain0 Drift Report, by construction | | DLP incidents caught before merge | ~0 (no tooling) | 7 incidents in 14-month test | brain0 DLP audit on test repo | | Time to generate auditor evidence pack | 2-3 weeks | 2-4 hours | brain0 attest + report --md |

Week 1 win: Run npx brain0 up on your primary repo and brain0 today. In under 15 minutes, you see every AI agent session from the last 24 hours, riskiest first. The first DLP finding (if any) usually surfaces within the same session.

Strategic close: Beyond time savings, provenance pipelines turn AI-assisted code from a compliance liability into an audit asset. When your next SOC 2, ISO 27001, or EU AI Act auditor asks "what AI wrote this code and can you prove it," you answer with a signed attestation rather than a shrug.

CAVEATS

1. Transcriptless sessions produce no intents (significant risk) If your coding agent runs in ephemeral cloud mode without local transcript persistence, brain0 sees commits but cannot link them to prompts. The graph shows fact nodes (git history) with zero intent nodes — effectively a fancy git log. Mitigation: verify transcript persistence before relying on brain0 for compliance. Set BRAIN0_INTENT_PATHS if using custom directories.

2. First run latency on very large repos (moderate risk) On repos with 50,000+ commits or monorepos with 1,000+ modules, the initial brain0 up can take 10-30+ minutes depending on hardware and whether Ollama is running summarizers. Mitigation: use BRAIN0_SUMMARIZER_MODEL=qwen3:1.7b (lightweight) for the first cache-populating run. Subsequent runs reuse cached summaries. Without Ollama, deterministic mode is faster but produces no model-written summaries.

3. Local-only mode limits cross-machine provenance (moderate risk) brain0's open-core mode uses SQLite — the graph lives on one machine. If you develop across multiple workstations or in ephemeral CI environments, provenance data fragments. Mitigation: the enterprise tier (separate repo, AGPLv3) replaces SQLite with PostgreSQL + pgvector for multi-machine, multi-tenant deployments. For most small teams, periodic brain0 report --md exports serve as sufficient audit snapshots.

4. brain0 cannot detect every DLP incident (minor risk) Secret scanning at ingest uses typed placeholders and pattern matching — it catches .env files, *key* paths, *secret* paths, and common credential patterns. But untagged secrets in non-standard file paths, or secrets embedded in image files that agents read, may not be flagged. Mitigation: extend BRAIN0_REDACT with custom path patterns. Combine with brain0 guard preflight for pre-commit DLP blocking.

SOURCES

{
  "url": "https://github.com/Brain0-ai/brain0",
  "title": "Brain0-ai/brain0: The black box for AI-written code",
  "org": "brain0 Authors (Apache 2.0)",
  "type": "github",
  "finding": "brain0 v0.1.0 is a passive decision graph linking every commit to the agent prompts behind it with drift detection, DLP audit, evidence-driven risk scoring, and signed provenance attestations",
  "stat": "445 stars, 14 forks, Apache 2.0 license, released July 2 2026",
  "date": "2026-07-02"
}

{
  "url": "https://provenancecode.com/verity/",
  "title": "Verity by ProvenanceCode — Git-layer governance for AI-generated code",
  "org": "ProvenanceCode (KDDLC AI Solutions)",
  "type": "official-docs",
  "finding": "Verity intercepts every AI-generated PR at the Git layer, creates a signed provenance record via Developer Execution Objects, and enforces policy before anything merges",
  "stat": "ISO 42001 policy engine, zero-config Git integration",
  "date": "2026-07-01"
}

{
  "url": "https://agnost.ai/",
  "title": "Agnost AI — Catch agent failures your evals miss",
  "org": "Agnost Tech Inc (YC S26)",
  "type": "official-docs",
  "finding": "Agnost AI continuously analyzes production conversations, finds where users get stuck or fail to convert, and turns patterns into reviewed fixes",
  "stat": "Y Combinator S26 startup, launched July 14 2026",
  "date": "2026-07-14"
}

{
  "url": "https://github.com/jamesob/local-llm",
  "title": "jamesob/local-llm: Everything I know about running LLMs locally",
  "org": "James O'Beirne",
  "type": "github",
  "finding": "Comprehensive guide to running local LLMs on custom hardware, including 4x RTX PRO 6000 configurations achieving Gen4 line rate P2P throughput",
  "stat": "1,500 stars, 91 forks, July 3 2026",
  "date": "2026-07-03"
}

{
  "url": "https://www.aiacto.eu/en/blog/article-50-ai-act-what-actually-applies-2-august-2026",
  "title": "Article 50 AI Act: what applies on 2 August 2026",
  "org": "aiacto",
  "type": "news",
  "finding": "Article 50 transparency obligations apply from August 2 2026 — disclosure of AI interactions, deepfake labeling, AI-text labels, notices for emotion recognition systems. Only machine-readable marking for pre-existing systems deferred to December 2 2026",
  "stat": "Up to €15M or 3% of worldwide annual turnover fines for non-compliance",
  "date": "2026-06-01"
}

{
  "url": "https://fixable9.tech/tech-vision/ai-generated-code-40-percent-github-2026/",
  "title": "AI-Generated Code Now Powers 40% of New Software — GitHub's 2026 Developer Report",
  "org": "Fixable9 / GitHub Octoverse data",
  "type": "news",
  "finding": "40% of all new code committed to GitHub repositories in Q1 2026 was AI-generated or substantially assisted, up from 27% in 2025",
  "stat": "40% AI-generated code on GitHub in Q1 2026, up from 27% in 2025",
  "date": "2026-04-13"
}

---

BLOG POST