Abstract
<jats:p>The proliferation of AI-generated code in software development introduces a critical challenge for distributed version control systems (DVCS): establishing irrefutable provenance and behavioral commit integrity. While cryptographic signatures (e.g., GPG) provide robust authentication of a committer's identity, they fail to anchor the intent or context of a commit, particularly distinguishing between human-authored and AI-generated contributions. This paper presents a comparative analysis of two architectural paradigms for establishing "session anchors"—tamper-evident metadata bindings that link a commit to the specific development environment and workflow that produced it. We contrast a Cryptographic Session Anchor (CSA) , which employs a hybrid key-signing scheme (e.g., using ephemeral session keys or hardware security modules) to sign a comprehensive commit manifest, against a Heuristic Session Anchor (HSA) , which generates a probabilistic fingerprint of the development session based on a composite of behavioral telemetry (e.g., IDE activity, keystroke dynamics, clipboard history, and AI tool invocation patterns). Our methodology evaluates both anchors against a matrix of security properties (non-repudiation, collision resistance), performance overhead, resilience to replay attacks, and, crucially, their efficacy in AI commit provenance. Through empirical analysis on a corpus of mixed human and AI-generated commits, we find that while the CSA offers superior cryptographic guarantees and non-repudiation, the HSA provides a more granular, contextual layer of evidence, effectively capturing the nuance of AI interaction that pure cryptography obscures. We further demonstrate that a hybrid, tiered approach—using the CSA for definitive integrity and the HSA for forensic explainability—significantly enhances the trustworthiness of the commit history. Our findings provide a foundational framework for next-generation DVCS protocols that not only secure who committed the code, but also how and with what assistance it was created, offering a path toward verifiable and auditable AI-assisted software engineering.</jats:p>