Rejecting Agent PRs That Lack Upstream Source Attribution

An agent opens a pull request with 400 lines of clean, idiomatic TypeScript. The unit tests pass. The linter reports zero warnings. The change cleanly implements the ticket: a custom sliding-window rate limiter with memory-efficient bucket pruning.

Nobody on your team wrote it, and nobody can verify where the logic originated.

Did the model synthesize this implementation strictly from your internal interfaces? Did it adapt an internal pattern already vetted for your concurrency model? Or did it regurgitate an AGPL-licensed snippet memorised from public repositories during training?

If a human cannot answer that question within thirty seconds, the pull request should not enter review. Merging unverified logic introduces silent copyright liability, subtle licensing contamination, and architectural drift. Reviewers cannot audit provenance by reading a diff.

The Reviewer Bottleneck

Most teams attempting agent governance treat AI coding agents like very fast junior developers. They rely on standard code review automation—CI pipelines, static analysis, and manual peer review.

This posture breaks at scale. Human code review relies on an implicit social contract: the author understands the origin of their code, evaluated trade-offs, and chose specific dependencies on purpose.

Generative agents have no such context. When an agent constructs a complex algorithm, it selects tokens based on statistical likelihood, not architectural provenance. When reviewers are handed hundreds of lines of plausible code with zero source trail, they face two bad options:

1. Spend hours reverse-engineering the origin of every non-trivial function to ensure it does not infringe third-party licenses or bypass internal patterns.
2. Skim the syntax, verify that CI turns green, and hit merge.

Most teams default to the second option. That turns your repository into a sink for untracked upstream logic.

Provenance Must Be Machine-Checkable

You cannot solve this problem by asking the agent to explain itself in the PR description. Natural-language self-reporting from a model is unstructured and unfalsifiable.

Source attribution must be machine-checkable before a write is permitted. That requires an explicit intent manifest submitted to a build gate before code ever reaches your main review queue.

If an agent writes logic, it must declare one of three origins for every non-trivial block:

1. Derived internal logic: Computed directly against internal AST symbols and explicit invariant constraints.
2. Third-party dependency usage: Built using approved external packages declared in your package manifest, referencing specific public interfaces.
3. Verified capability imports: Sourced directly from known, model-independent components with verifiable archive checksums.

If the agent claims an algorithm is purely synthesized, it must provide the dependency graph of internal symbols used to construct it. If it cannot prove the provenance of a raw 400-line routine, the build gate rejects the proposal outright.

{
  "intent_id": "intent_8f29c41a",
  "target_path": "src/middleware/rate_limiter.ts",
  "provenance": {
    "strategy": "internal_derivation",
    "upstream_symbols": [
      "src/types/http.ts:RequestContext",
      "src/storage/redis.ts:RedisClusterClient"
    ],
    "external_dependencies": [],
    "reproducibility_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  }
}

If the manifest contains missing references, unapproved external source signatures, or unresolvable derivation paths, the intent gate halts. The PR is never created.

What to Enforce on Monday

You do not need to replace your entire deployment toolchain to start rejecting unattributed agent code. You can establish baseline controls in your existing CI:

1. Require an attribution header or sidecar file for automated commits. Configure your agent runner to output a .provenance.json metadata block alongside every proposed diff.
2. Enforce manifest validation in CI. Block PR creation or fail the review status check if a diff contains logic that lacks corresponding entry points in the provenance manifest.
3. Hard-fail untracked external patterns. If an agent injects novel algorithmic implementations that cannot be traced to an existing internal module or an explicitly allowed library, route the PR to a quarantine queue rather than standard code review.

If your reviewers cannot prove where an agent's code came from, they are not reviewing software—they are signing blind contracts. Put the gate in front of the write.