[FEATURE] Provider-signed session receipts: verifiable "made by model X, unedited" for commits and PRs

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Claude Code marks its work with a Co-Authored-By trailer. Anyone can type that line. A squash drops it. A hand edit after the session leaves no trace.

So a reviewer, a merge rule, or a downstream agent cannot verify a claim such as "this PR is the unmodified output of Claude Fable 5.1 at high effort." That claim is a useful quality prior, and today it rests on an unverifiable string.

The new Claude text watermark does not cover this. It is detect-only, limited to eligible parties, weak on short code, and not tied to a model tier. This request is for the positive case: "did this model, with these settings, produce exactly this?"

Proposed Solution

Have Claude Code write a provider-signed session receipt next to each commit it makes.

1. API side. Each response carries a receipt_hash: a hash chain over the step's inputs (user text, system prompt, tool results), the output bytes, the model spec (model ID, snapshot, effort, tools), and a timestamp. At session end Anthropic signs the chain head plus a closed marker. Public keys live at a well-known JWKS URL so anyone can verify offline.
2. Claude Code side. Append the chain to the session log. On commit, write the receipt as a git note or a Receipt: trailer that points to a receipt file. Put the base commit hash into the first input, so a verifier can replay the tool calls over that base and compare the result to the PR tree. A hand edit after the session breaks the match.
3. Overlap score. A valid chain proves integrity, not authorship. A person can write a PR by hand and ask the model to "output this verbatim." Anthropic computes the fraction of final-output tokens that also appear in session inputs and signs it inside the spec. A high score is a cue to ask for the transcript.
4. GitHub check (later). A check that shows model, effort, turns, overlap score, and replay match.

The receipt holds only hashes. The author reveals the transcript on request, so private prompts stay private.

Full proposal (2 pages): https://github.com/scsnake/notes/blob/main/provider_signed_session_receipts.md
Design notes, threat model, prior art: https://github.com/scsnake/notes/blob/main/certified_ai_generated_work_design_notes.md

Alternative Solutions

• Co-Authored-By and a Model: trailer: free text, unverifiable, lost on squash.
• Claude GitHub App signed commits: proves the app pushed it, not which model or session.
• Third-party attestations (agent-attest, agentattest with in-toto and Sigstore): the runner signs, so the model claim cannot be verified. Only the provider knows which weights ran.
• Text watermark: detect-only, not per tier, not robust on short code.

Related standards work: IETF draft-mw-spice-inference-chain, IETF draft-ietf-webbotauth-httpsig-protocol, C2PA 2.4 c2pa.ai-disclosure.

Priority

Medium - Would be very helpful

Feature Category

Other

---

Drafted with Claude Fable 5.1 from my idea.