How to connect it, read it, and build on it.

Reading the numbers

Four values appear across most screens. Knowing exactly what each one counts is the difference between using them and arguing with them.

Untraced is its own answer

Where no signal is found, Diffport reports untraced. It is not a claim that a person wrote it, and it is never quietly upgraded to human to make a dashboard look complete. Anything you build on this data should treat it as a third case rather than folding it into human.

A pull request that reads forty percent untraced is telling you something specific and useful: a tool your team uses is not being recognised. That is actionable in a way that ninety percent human is not. The reasoning is set out at length in Untraced is not human.

Confidence is the floor

When several signals contribute, the confidence reported is the weakest of them, not the strongest. A conclusion is exactly as sound as the worst step used to reach it. A commit with no signal carries no confidence at all rather than a low one — there is nothing to be confident about.

Machine-written is not scored as risky

Authorship does not raise the risk number. It changes how much review a change has to earn. Those are different claims and the product keeps them apart deliberately, which is why you will see high-AI, low-risk pull requests and the reverse.

Agents

The catalog is data, not a ranking. Adding a tool to it is a fact about detection and never an endorsement, and nobody can pay for a place in it.

Registering an identity

Under Settings → Provenance you can add an identity so Diffport recognises a tool your team uses. An identity is one of three things: a bot login that authors commits, an author email address, or a commit trailer line.

Trust scores

Each agent gets a score built from two counted things: the share of its merged work that was reverted, and the share that was reviewed at all. It is a function of those two numbers and nothing else — there is no model behind it and no judgement about the vendor.

An agent with no merged work says so rather than showing a zero, because a zero would read as a score rather than an absence.

When a tool is not detected

Send us the tool's name and one commit message it left, through Support. That is usually everything needed to add it to the catalog for every workspace.

Alerts

A rule is a set of conditions, a severity, and the channels it goes to. Every firing carries the evidence that produced it rather than a severity badge on its own.

Conditions

Each clause is a field, a comparison and a value. A rule fires when all of its clauses are true, or any, depending on the mode you pick.

Comparisons are =, !=, >, >=, < and <=.

Where they go

Email reaches every member of the workspace who has alert emails switched on. Slack and webhook go to the destinations set up under Settings → Integrations, and a rule that asks for a channel with no destination configured simply sends nothing.

Personal settings

Under Settings → Notifications each person controls their own alert, report and scan emails, a minimum severity, and a daily or weekly digest. Those are per person and do not affect anyone else. Quiet hours hold anything that fires inside your window and deliver it when the window closes, read in your own time zone — nothing is discarded, and a held alert arrives saying why it is late.

Reports

A report is generated once, stored, and served back byte for byte. The hash printed on it matches the file for as long as the file exists.

Verifying one

Every report carries a SHA-256. Hash what you were given and compare — if they match, nothing has been altered since it was issued. That is the whole claim of a signed attestation and it is checkable in one line.

shasum -a 256 report.json
# compare against the SHA-256 shown beside the report,
# or the X-Diffport-SHA256 header if you pulled it from the API

Formats

JSON, CSV and PDF, all three signed the same way. The PDF is laid out here rather than by a library — the same commits, the same summary, the same hash, in a form you can hand to somebody who is never going to open a CSV.

Schedules

Daily, weekly or monthly, at an hour you choose, over a window you choose, for one repository or all of them. Due schedules are picked up by the same five minute job that reads your repositories, so a run can land up to five minutes past its hour.

When a run fails the reason is recorded and shown beside the schedule — a window with no commits reports nothing to attest to rather than producing an empty report. It then waits for its normal turn instead of retrying in a loop.

API and webhooks

A read-only HTTP API over everything Diffport knows, and signed outbound webhooks for everything it decides.

Tokens

Issue one under Settings → Integrations → API. It is shown once and stored as a SHA-256 of itself, so if it is lost the only way forward is to revoke and reissue. Ten live tokens per workspace, and 600 requests an hour each.

curl -H "Authorization: Bearer dp_..." \
     https://api.diffport.com/v1/me

Verifying a webhook we send you

Each destination gets its own signing secret, shown once when you add it. Every delivery carries X-Diffport-Signature as sha256=… computed over timestamp + "." + body, with the timestamp in X-Diffport-Timestamp.

Check it. A webhook URL can leak — a signature cannot be forged without the secret, and an endpoint that accepts anything arriving at the right address is an endpoint anyone can write to.