Untraced is not human

Every provenance tool arrives at the same fork within about a week of existing. You have scanned a repository. Most commits gave you something to work with — a trailer, a bot account, a pattern you recognise. And then there is a remainder. Commits that carry no signal at all.

You have to decide what that remainder is.

The obvious answer is that it is human. Nobody wrote it with an agent, or the agent would have left a mark, so a person must have written it. It feels less like a choice than an inference. And it is enormously convenient: your coverage jumps to a hundred percent, your dashboard has no holes in it, and the number you show a customer looks like a measurement rather than a partial one.

It is also wrong, and it gets more wrong every month.

The absence of a signal is not a signal

A commit with no provenance marker tells you exactly one thing: that no marker was found. It does not tell you a person typed it. There are at least four ordinary reasons a machine-written commit arrives clean.

Someone used a tool that does not write a trailer. Someone amended or squashed and the trailer went with it. Someone pasted from a chat window into their editor, which leaves no trace anywhere by design. Or the agent is new enough that nothing in the catalog recognises it yet — and that last one is not a rare edge, it is the normal state of a field where a new tool appears every few weeks.

So the inference is not no agent touched this. The inference is no agent touched this in a way I can see. Those are different claims, and only one of them is supported by what you actually have.

The cost is not the error, it is the direction of it

Every measurement has error. That is not the problem. The problem is that this particular error only ever points one way.

Unattributed code is disproportionately code where the tooling failed to leave a mark, and tooling fails to leave a mark most often for the newest tools, the least conventional workflows, and the fastest-moving teams. Which means the commits you are most likely to misclassify are precisely the ones you would most want to know about.

Round them up to human and you do not get a slightly noisy number. You get a number that is reliably wrong in the same direction, understating machine authorship exactly where machine authorship is growing fastest. It looks stable while quietly drifting.

What it does to the person reading it

There is a second cost, and it is worse than the arithmetic.

If unattributed code becomes human code, then the gap disappears from the interface entirely. There is no screen showing you what the tool could not see, because as far as the tool is concerned there is nothing it could not see. You have removed the one thing that would have told you to go and look.

Keep the gap and it does work for you. A pull request that is forty percent untraced is not a failure of the report — it is the report telling you something true and specific: that your team is using a tool nobody has taught this system to recognise. That is actionable. Ninety percent human is not actionable, because it is not information, it is a default wearing the costume of a finding.

The part that costs us something

This position is not free, and it would be dishonest to present it as pure principle.

Diffport's coverage numbers are lower than they would otherwise be. Some screens have to say nothing here carries a signal where a competitor shows a confident figure. A buyer comparing two products side by side will see one that appears to know everything and one that admits to gaps, and the honest one looks worse in the meeting.

We take that trade because the alternative fails at exactly the moment the tool matters. Provenance gets used seriously twice: during an audit, and after an incident. Both are adversarial. Both involve someone asking how do you know that — and a number built on a comfortable default has no answer, because the honest answer is we assumed.

One conversation like that ends the tool's usefulness permanently. Not just for the number that was wrong. For every number it has ever produced.

The rule, stated plainly

When Diffport has no signal for a commit, it reports untraced. Not human, not probably-human, not a shaded guess. It will never quietly upgrade that value to fill a gap, and it will not average untraced code into a percentage as though it were known.

Untraced is a real state with a real meaning: we looked, and there was nothing there to find. It is the least satisfying thing a tool can say and the most useful thing it can be trusted about.

If that makes a number look worse than a competitor's, the number was always going to look worse. We would just have found out later, in front of somebody who was checking.