Git commit attribution

Centrail maps the tokens an agent spent to the commits they helped produce — entirely on your machine.

The idea

Every usage event has a timestamp. Every commit has one too. Centrail attributes each event to the earliest commit at or after it — the change that work landed in. Events newer than your latest commit are treated as work-in-progress and left unattributed.

How it runs

• The CLI reads git log --numstat for each repo.
• Events are matched to commits by timestamp.
• Only the attribution rows are sent — never diffs or messages.

git log --numstat --pretty=format:%H%x1f%cI

Re-syncing the same history changes nothing — attribution is idempotent. Your git history never leaves your machine.

Ship status

Every attributed commit also gets a fate, so your dashboard can show spend by what actually shipped:

• Shipped — the commit reached your repo's default branch. Squash merges count: a commit whose patch is squash-equivalent to one on the default branch is shipped too.
• In flight — not shipped yet, but some branch containing it has a tip commit newer than 14 days.
• Unshipped — not shipped, and no containing branch has been active in the last 14 days (dormant or deleted). It's a bucket, not a judgment.

Fates are recomputed on every sync, so an in-flight commit that later merges self-heals to shipped. Commits synced by an older CLI show as a fourth honest bucket, "unchecked".

The CLI computes fates locally with plain git commands:

git log --all --since="90 days"        # recent shas + dates
git merge-base --is-ancestor <sha> <default>
git cherry <default> <branch-tip>      # squash-merge detection
git branch -a --contains <sha>         # which branches carry it

What leaves your machine for this: shas and branch names only — never diffs, messages, or paths.

GitHub-verified merges

Everything above is computed on your machine, so on its own it is your word. If your organization installs the Centrail GitHub App and you link your GitHub account on your Profile, GitHub itself tells Centrail which commits reached which repository, who pushed them, and which pull requests merged. Then:

• Shipped work counts your GitHub-verified merges: merged pull requests that carried work of yours — a commit you pushed, or one in a pull request you opened that GitHub does not attribute to someone else.
• A commit's spend reads "matched to forge commits" when GitHub saw you push it (or merge it through your pull request) on the same branch, after the agent work it is matched to. The spend itself is still an estimate.

Linking reads your numeric GitHub id once and keeps no token. From GitHub, Centrail keeps ids, commit hashes, branch and repository names, and push and merge times — never code, diffs, commit messages, or anyone's email.