madeby 0.2.1 → 0.3.0

package/dist/madeby.mjs

@@ -760,9 +760,41 @@ function hasHumanAttestation(message) {
   HUMAN_ATTEST_RE.lastIndex = 0;
   return HUMAN_ATTEST_RE.test(message);
 }
+var AI_AUTHOR_RE = /^[ \t]*Authored-by-ai[ \t]*:[ \t]*(.+?)[ \t]*$/gim;
+function hasAiAuthorship(message) {
+  AI_AUTHOR_RE.lastIndex = 0;
+  return AI_AUTHOR_RE.test(message);
+}
+var SPDX_AI_DISCLOSURE_RE = /SPDX-AI-Disclosure[ \t]*:[ \t]*(none|ai-assisted|ai-generated|autonomous)\b/gi;
+var AI_DISCLOSURE_DEFAULT_RE = /^[ \t]*disclosure-default[ \t]*:[ \t]*(none|ai-assisted|ai-generated|autonomous)\b/im;
+function spdxAiDisclosureCategory(value) {
+  switch (value.toLowerCase()) {
+    case "none":
+      return "human";
+    case "ai-assisted":
+      return "with_ai";
+    case "ai-generated":
+    case "autonomous":
+      return "ai";
+    default:
+      return "unknown";
+  }
+}
+function recognizeSpdxAiDisclosures(text) {
+  const out = [];
+  for (const m of text.matchAll(SPDX_AI_DISCLOSURE_RE)) {
+    const value = m[1].toLowerCase();
+    out.push({ kind: "spdx-ai-disclosure", evidence: `SPDX-AI-Disclosure: ${value}`, tier: "asserted", subjectRef: value });
+  }
+  return out;
+}
+function aiDisclosureDefault(md) {
+  const m = AI_DISCLOSURE_DEFAULT_RE.exec(md);
+  return m ? m[1].toLowerCase() : null;
+}
 function commitDisclosureKinds(commit) {
   const kinds = [];
-  if (hasAiTrailer(commit.message)) kinds.push("ai-trailer");
+  if (hasAiTrailer(commit.message) || hasAiAuthorship(commit.message)) kinds.push("ai-trailer");
   if (hasHumanAttestation(commit.message)) kinds.push("human-attestation");
   if (hasDcoSignoff(commit.message)) kinds.push("dco-signoff");
   if (commit.signed === true) kinds.push("commit-signature");
@@ -886,6 +918,8 @@ function evaluateRepoDisclosure(root, opts = {}) {
 
 // ../analyzer/src/path-provenance.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
+import { readFileSync as readFileSync4, existsSync as existsSync2 } from "node:fs";
+import { join as join3 } from "node:path";
 
 // ../analyzer/src/provenance.ts
 import { readdirSync, readFileSync as readFileSync3 } from "node:fs";
@@ -973,6 +1007,26 @@ function provenanceOf(root, path, opts = {}) {
       });
     }
   }
+  try {
+    const head = readFileSync4(join3(root, path), "utf8").slice(0, 4096);
+    const sig = recognizeSpdxAiDisclosures(head)[0];
+    if (sig) {
+      const value = sig.subjectRef ?? "";
+      const cat = spdxAiDisclosureCategory(value);
+      const model = /SPDX-AI-Model[ \t]*:[ \t]*(.+)/i.exec(head)?.[1]?.trim();
+      records.push({
+        source: "header",
+        granularity: "file",
+        ai: cat !== "human",
+        bot: false,
+        model,
+        disclosures: ["spdx-ai-disclosure"],
+        confidence: "disclosed",
+        evidence: `SPDX-AI-Disclosure: ${value} (${cat})${model ? ` \u2014 ${model}` : ""}`
+      });
+    }
+  } catch {
+  }
   if (opts.useBlame !== false) {
     try {
       const range = opts.startLine !== void 0 ? [`-L`, `${opts.startLine},${opts.endLine ?? opts.startLine}`] : [];
@@ -1040,12 +1094,22 @@ function provenanceMap(root, opts = {}) {
   const pct = commits.length ? Math.round(disclosed / commits.length * 100) : 0;
   const scope = prefix ?? "repo";
   const allModels = [...new Set(witnessed.flatMap((w) => w.models))];
+  let aiDefault;
+  try {
+    const p = join3(root, "AI_DISCLOSURE.md");
+    if (existsSync2(p)) {
+      const v = aiDisclosureDefault(readFileSync4(p, "utf8"));
+      if (v) aiDefault = { value: v, category: spdxAiDisclosureCategory(v) };
+    }
+  } catch {
+  }
   return {
     scope,
     trackedFiles,
     witnessedFiles: witnessed.length,
     witnessed,
     commitCoverage: { disclosed, total: commits.length },
+    aiDisclosureDefault: aiDefault,
     summary: `${scope}: ${trackedFiles} tracked file${trackedFiles === 1 ? "" : "s"}; ${witnessed.length} with witnessed AI provenance${allModels.length ? ` (${allModels.join(", ")})` : ""}; ${pct}% of the last ${commits.length} commits disclose origin.`,
     note: "Witnessed spans are precise (region-level, model-named); commit coverage is commit-level, not per-file authorship. Files without a witnessed span have unknown origin \u2014 disclosure, not detection: we report what's disclosed and never infer origin we can't see. Resolution is a configurable convention (ARCH \xA712)."
   };
@@ -1053,9 +1117,9 @@ function provenanceMap(root, opts = {}) {
 
 // ../analyzer/src/record-spans.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync2, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync, writeFileSync } from "node:fs";
+import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync5, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join as join3 } from "node:path";
+import { dirname, join as join4 } from "node:path";
 
 // ../analyzer/src/capture-local.ts
 var MATCH_THRESHOLD = 0.52;
@@ -1391,19 +1455,19 @@ function git2(root, ...a) {
 function autodiscover(root) {
   const enc3 = root.replace(/[/_]/g, "-");
   try {
-    const dir = join3(homedir(), ".claude", "projects", enc3);
-    return readdirSync2(dir).filter((f) => f.endsWith(".jsonl")).map((f) => join3(dir, f)).sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs)[0] ?? null;
+    const dir = join4(homedir(), ".claude", "projects", enc3);
+    return readdirSync2(dir).filter((f) => f.endsWith(".jsonl")).map((f) => join4(dir, f)).sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs)[0] ?? null;
   } catch {
     return null;
   }
 }
 function recordAiSpans(root, opts = {}) {
   const transcriptPath = opts.transcriptPath ?? autodiscover(root);
-  if (!transcriptPath || !existsSync2(transcriptPath)) {
+  if (!transcriptPath || !existsSync3(transcriptPath)) {
     return { written: false, matched: 0, discarded: 0, message: "transcript not found \u2014 pass a transcript path", error: "transcript-not-found" };
   }
   const commit = git2(root, "rev-parse", opts.ref ?? "HEAD");
-  const transcriptText = readFileSync4(transcriptPath, "utf8");
+  const transcriptText = readFileSync5(transcriptPath, "utf8");
   const parser = detectParser(transcriptText);
   if (!parser) {
     return { written: false, matched: 0, discarded: 0, message: "unrecognized log format (Claude Code is supported today)", error: "unrecognized-format" };
@@ -1414,7 +1478,7 @@ function recordAiSpans(root, opts = {}) {
     repoRoot: root,
     readFile: (rel) => {
       try {
-        return readFileSync4(join3(root, rel), "utf8");
+        return readFileSync5(join4(root, rel), "utf8");
       } catch {
         return null;
       }
@@ -1432,12 +1496,12 @@ function recordAiSpans(root, opts = {}) {
       message: `no AI-authored content from the session is structurally present (matched 0, discarded ${result.discarded.length})`
     };
   }
-  const out = join3(root, ".madeby", "spans", `${commit}.json`);
+  const out = join4(root, ".madeby", "spans", `${commit}.json`);
   let kept = [];
-  if (existsSync2(out)) {
+  if (existsSync3(out)) {
     const thisSource = `${result.tool}-session-log`;
     try {
-      kept = parseSpanManifest(readFileSync4(out, "utf8")).attestations.filter((a) => a.attribution.source !== thisSource);
+      kept = parseSpanManifest(readFileSync5(out, "utf8")).attestations.filter((a) => a.attribution.source !== thisSource);
     } catch {
     }
   }
@@ -1455,16 +1519,16 @@ function recordAiSpans(root, opts = {}) {
 }
 function writeParserSample(root, opts = {}) {
   const transcriptPath = opts.transcriptPath ?? autodiscover(root);
-  if (!transcriptPath || !existsSync2(transcriptPath)) {
+  if (!transcriptPath || !existsSync3(transcriptPath)) {
     return { written: false, message: "session log not found \u2014 pass its path", error: "transcript-not-found" };
   }
-  const text = readFileSync4(transcriptPath, "utf8");
+  const text = readFileSync5(transcriptPath, "utf8");
   const tool = detectParser(text)?.id;
   const skeleton = redactSample(text);
-  const dir = join3(root, ".madeby", "parser-samples");
+  const dir = join4(root, ".madeby", "parser-samples");
   mkdirSync(dir, { recursive: true });
   const stamp = (opts.now ?? (/* @__PURE__ */ new Date()).toISOString()).replace(/[:.]/g, "-");
-  const out = join3(dir, `${tool ?? "unknown-tool"}-${stamp}.txt`);
+  const out = join4(dir, `${tool ?? "unknown-tool"}-${stamp}.txt`);
   writeFileSync(out, skeleton);
   return { written: true, path: out, tool, message: `wrote a content-free format sample to ${out}` };
 }
@@ -1581,56 +1645,6 @@ To disclose: add a Co-Authored-By / Generated-by trailer, affirm your own author
   process.exit(result.pass ? 0 : 1);
 }
 
-// src/commands/ai.ts
-var ISSUE_URL = "https://github.com/MadeByFYI/MadeBy/issues/new";
-function aiCommand(args) {
-  const root = repoRoot();
-  if (!root) {
-    console.error("madeby ai: not a git repository.");
-    process.exit(2);
-    return;
-  }
-  const makeSample = args.includes("--make-parser-sample");
-  const positional = args.filter((a) => !a.startsWith("--"));
-  if (makeSample) {
-    const s = writeParserSample(root, { transcriptPath: positional[0] });
-    if (s.error === "transcript-not-found") {
-      console.error("madeby ai: session log not found \u2014 pass it: madeby ai --make-parser-sample <log>");
-      process.exit(1);
-      return;
-    }
-    console.log(
-      `madeby ai: ${s.message}.
-  \u2192 It contains only the log's structure + model ids \u2014 all code, prompts, paths, and secrets
-    were redacted locally. Review it, then attach it to a new issue so we can add a parser:
-    ${ISSUE_URL}`
-    );
-    process.exit(0);
-    return;
-  }
-  const res = recordAiSpans(root, { transcriptPath: positional[0], ref: positional[1] });
-  if (res.error === "transcript-not-found") {
-    console.error("madeby ai: session log not found \u2014 pass it: madeby ai <transcript.jsonl> [ref]");
-    process.exit(1);
-    return;
-  }
-  if (res.error === "unrecognized-format") {
-    console.error(
-      "madeby ai: unrecognized log format \u2014 no registered tool parser matched (Claude Code, aider, and\n  SpecStory are supported today). Help add your tool WITHOUT sharing any code or prompts:\n    madeby ai --make-parser-sample <log>   # writes a content-free format sample to review + share"
-    );
-    process.exit(1);
-    return;
-  }
-  if (!res.written) {
-    console.log(`madeby ai: ${res.message}. Nothing recorded.`);
-    process.exit(0);
-    return;
-  }
-  console.log(
-    `madeby ai: wrote ${res.path} \u2014 [${res.tool}] ${res.matched} witnessed file(s) matched, ${res.discarded} discarded (not present in the checkout).`
-  );
-}
-
 // src/commands/me.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
 function parseWithAi(args) {
@@ -1645,14 +1659,39 @@ function git3(root, args) {
   return execFileSync5("git", ["-C", root, ...args], { encoding: "utf8" }).trim();
 }
 var HUMAN_ATTEST = /^[ \t]*(?:Authored-by-human|Human-authored(?:-by)?)[ \t]*:/im;
-function meCommand(args) {
-  const { withAi, tool } = parseWithAi(args);
-  const root = repoRoot();
-  if (!root) {
-    console.error("madeby me: not a git repository.");
-    process.exit(2);
-    return;
+var ASSIST = /^[ \t]*Assisted-by[ \t]*:/im;
+var AI_AUTHOR = /^[ \t]*Authored-by-ai[ \t]*:/im;
+function attestAiAuthorship(root, opts = {}) {
+  const tool = opts.tool && opts.tool.trim() || "AI";
+  const base = { ok: false, changed: false, withAi: false, tool, added: [], category: "ai" };
+  try {
+    execFileSync5("git", ["-C", root, "diff", "--cached", "--quiet"]);
+  } catch {
+    return { ...base, reason: "staged-changes" };
+  }
+  let subject = "";
+  let message = "";
+  try {
+    subject = git3(root, ["show", "-s", "--format=%s", "HEAD"]);
+    message = git3(root, ["show", "-s", "--format=%B", "HEAD"]);
+  } catch {
+    return { ...base, reason: "no-commit" };
+  }
+  const added = [];
+  const trailers = [];
+  if (!AI_AUTHOR.test(message)) {
+    trailers.push("--trailer", `Authored-by-ai: ${tool}`);
+    added.push("Authored-by-ai");
+  }
+  if (trailers.length > 0) {
+    execFileSync5("git", ["-C", root, "commit", "--amend", "--no-edit", ...trailers]);
   }
+  return { ok: true, changed: trailers.length > 0, withAi: false, tool, subject, added, category: "ai" };
+}
+function affirmAuthorship(root, opts = {}) {
+  const withAi = opts.withAi ?? false;
+  const tool = opts.tool && opts.tool.trim() || "AI";
+  const base = { ok: false, changed: false, withAi, tool, added: [], category: withAi ? "with_ai" : "human" };
   let name = "";
   let email = "";
   try {
@@ -1660,17 +1699,11 @@ function meCommand(args) {
     email = git3(root, ["config", "user.email"]);
   } catch {
   }
-  if (!name || !email) {
-    console.error("madeby me: set your git identity first (git config user.name / user.email).");
-    process.exit(1);
-    return;
-  }
+  if (!name || !email) return { ...base, reason: "no-identity" };
   try {
     execFileSync5("git", ["-C", root, "diff", "--cached", "--quiet"]);
   } catch {
-    console.error("madeby me: you have staged changes. Commit them first \u2014 `me` affirms HEAD, not your index.");
-    process.exit(1);
-    return;
+    return { ...base, reason: "staged-changes", name, email };
   }
   let subject = "";
   let message = "";
@@ -1678,24 +1711,124 @@ function meCommand(args) {
     subject = git3(root, ["show", "-s", "--format=%s", "HEAD"]);
     message = git3(root, ["show", "-s", "--format=%B", "HEAD"]);
   } catch {
-    console.error("madeby me: no commit to affirm \u2014 make a commit first.");
-    process.exit(1);
-    return;
+    return { ...base, reason: "no-commit" };
   }
   const hasHuman = HUMAN_ATTEST.test(message);
-  const hasAssist = /^[ \t]*Assisted-by[ \t]*:/im.test(message);
+  const hasAssist = ASSIST.test(message);
   const trailers = [];
-  if (!hasHuman) trailers.push("--trailer", `Authored-by-human: ${name} <${email}>`);
-  if (withAi && !hasAssist) trailers.push("--trailer", `Assisted-by: ${tool}`);
-  if (trailers.length === 0) {
+  const added = [];
+  if (!hasHuman) {
+    trailers.push("--trailer", `Authored-by-human: ${name} <${email}>`);
+    added.push("Authored-by-human");
+  }
+  if (withAi && !hasAssist) {
+    trailers.push("--trailer", `Assisted-by: ${tool}`);
+    added.push("Assisted-by");
+  }
+  if (trailers.length > 0) {
+    execFileSync5("git", ["-C", root, "commit", "--amend", "--no-edit", ...trailers]);
+  }
+  const category = hasAssist || added.includes("Assisted-by") ? "with_ai" : "human";
+  return { ok: true, changed: trailers.length > 0, withAi, tool, name, email, subject, added, category };
+}
+function meCommand(args) {
+  const { withAi, tool } = parseWithAi(args);
+  const root = repoRoot();
+  if (!root) {
+    console.error("madeby me: not a git repository.");
+    process.exit(2);
+    return;
+  }
+  const r = affirmAuthorship(root, { withAi, tool });
+  if (!r.ok) {
+    if (r.reason === "no-identity") console.error("madeby me: set your git identity first (git config user.name / user.email).");
+    else if (r.reason === "staged-changes") console.error("madeby me: you have staged changes. Commit them first \u2014 `me` affirms HEAD, not your index.");
+    else console.error("madeby me: no commit to affirm \u2014 make a commit first.");
+    process.exit(1);
+    return;
+  }
+  if (!r.changed) {
     const already = withAi ? "already affirms human authorship and discloses AI assistance" : "already affirms human authorship";
     console.log(`madeby me: HEAD ${already}. Nothing to do.`);
     process.exit(0);
     return;
   }
-  execFileSync5("git", ["-C", root, "commit", "--amend", "--no-edit", ...trailers]);
   console.log(
-    withAi ? `madeby me: made by me, with AI \u2014 affirmed human authorship + disclosed AI assistance on HEAD \u2014 "${subject}" (Authored-by-human: ${name}; Assisted-by: ${tool}).` : `madeby me: affirmed human authorship on HEAD \u2014 "${subject}" (Authored-by-human: ${name}).`
+    withAi ? `madeby me: made by me, with AI \u2014 affirmed human authorship + disclosed AI assistance on HEAD \u2014 "${r.subject}" (Authored-by-human: ${r.name}; Assisted-by: ${r.tool}).` : `madeby me: affirmed human authorship on HEAD \u2014 "${r.subject}" (Authored-by-human: ${r.name}).`
+  );
+}
+
+// src/commands/ai.ts
+var ISSUE_URL = "https://github.com/MadeByFYI/MadeBy/issues/new";
+function aiCommand(args) {
+  const root = repoRoot();
+  if (!root) {
+    console.error("madeby ai: not a git repository.");
+    process.exit(2);
+    return;
+  }
+  const makeSample = args.includes("--make-parser-sample");
+  const witness = args.includes("--witness");
+  const positional = args.filter((a) => !a.startsWith("--"));
+  if (makeSample) {
+    const s = writeParserSample(root, { transcriptPath: positional[0] });
+    if (s.error === "transcript-not-found") {
+      console.error("madeby ai: session log not found \u2014 pass it: madeby ai --make-parser-sample <log>");
+      process.exit(1);
+      return;
+    }
+    console.log(
+      `madeby ai: ${s.message}.
+  \u2192 It contains only the log's structure + model ids \u2014 all code, prompts, paths, and secrets
+    were redacted locally. Review it, then attach it to a new issue so we can add a parser:
+    ${ISSUE_URL}`
+    );
+    process.exit(0);
+    return;
+  }
+  if (witness) {
+    const res = recordAiSpans(root, { transcriptPath: positional[0], ref: positional[1] });
+    if (res.error === "transcript-not-found") {
+      console.error("madeby ai --witness: session log not found \u2014 pass it: madeby ai --witness <transcript.jsonl> [ref]");
+      process.exit(1);
+      return;
+    }
+    if (res.error === "unrecognized-format") {
+      console.error(
+        "madeby ai --witness: unrecognized log format \u2014 no registered tool parser matched (Claude Code,\n  aider, and SpecStory today). The asserted disclosure still works \u2014 run plain `madeby ai` \u2014 or\n  help add your tool: madeby ai --make-parser-sample <log>."
+      );
+      process.exit(1);
+      return;
+    }
+    if (!res.written) {
+      console.log(`madeby ai --witness: ${res.message}. Nothing recorded.`);
+      process.exit(0);
+      return;
+    }
+    console.log(
+      `madeby ai --witness: wrote ${res.path} \u2014 [${res.tool}] ${res.matched} witnessed file(s) matched, ${res.discarded} discarded (not present in the checkout).`
+    );
+    return;
+  }
+  const tool = positional[0] || "AI";
+  const r = attestAiAuthorship(root, { tool });
+  if (!r.ok) {
+    if (r.reason === "staged-changes") {
+      console.error("madeby ai: you have staged changes. Commit them first \u2014 `ai` attests HEAD, not your index.");
+    } else {
+      console.error("madeby ai: no commit to attest \u2014 make a commit first.");
+    }
+    process.exit(1);
+    return;
+  }
+  if (!r.changed) {
+    console.log("madeby ai: HEAD already attests AI authorship. Nothing to do.");
+    process.exit(0);
+    return;
+  }
+  console.log(
+    `madeby ai: attested AI authorship on HEAD \u2014 "${r.subject}" (Authored-by-ai: ${r.tool}).
+  \u2192 asserted tier. For evidence-backed spans from your session log: madeby ai --witness [log].`
   );
 }
 
@@ -1747,8 +1880,8 @@ function whoCommand(args) {
 }
 
 // src/init-repo.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, join as join4 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, join as join5 } from "node:path";
 var GH_WORKFLOW = `name: Disclosure
 on: pull_request
 jobs:
@@ -1760,8 +1893,36 @@ jobs:
           fetch-depth: 0
       - uses: MadeByFYI/MadeBy/packages/action@v0.2.0
 `;
+var AGENTS_CONVENTION = `# AGENTS.md \u2014 Authorship disclosure convention (ACO)
+
+This repository asks any AI agent \u2014 or a human working with one \u2014 to **disclose who authored the
+changes they make**, per **ACO, the Authorship Certificate of Origin**
+(https://github.com/MadeByFYI/MadeBy/blob/main/ACO.md).
+
+## The rule
+
+When you author or modify content here, disclose the authorship **category** on your commit \u2014 one of:
+
+- \`human\` \u2014 a human authored it, no AI involvement.
+- \`with_ai\` \u2014 a human authored it with disclosed AI assistance.
+- \`ai\` \u2014 an AI agent authored it (a human remains accountable).
+
+Disclose **per commit, honestly** \u2014 the category describes what actually happened for that change.
+
+## The one-line way (asserted tier \u2014 no keys, no setup)
+
+After you commit, run the matching command (works with no install via \`npx\`):
+
+| Category  | Command                          |
+|-----------|----------------------------------|
+| \`human\`   | \`npx madeby me\`                  |
+| \`with_ai\` | \`npx madeby me --with-ai <tool>\` |
+| \`ai\`      | \`npx madeby ai [tool]\`           |
+
+Undisclosed content stays *unknown*, never guessed. See ACO for the standard.
+`;
 function writeIfAbsent(abs, rel, content, created, skipped) {
-  if (existsSync3(abs)) {
+  if (existsSync4(abs)) {
     skipped.push(rel);
     return;
   }
@@ -1774,11 +1935,17 @@ function initRepo(root, opts = {}) {
   const host = opts.host ?? "github";
   const created = [];
   const skipped = [];
-  writeIfAbsent(join4(root, ".madeby", "policy.json"), ".madeby/policy.json", JSON.stringify({ version: 0, mode }, null, 2) + "\n", created, skipped);
+  writeIfAbsent(join5(root, ".madeby", "policy.json"), ".madeby/policy.json", JSON.stringify({ version: 0, mode }, null, 2) + "\n", created, skipped);
+  writeIfAbsent(join5(root, "AGENTS.md"), "AGENTS.md", AGENTS_CONVENTION, created, skipped);
   if (host === "github") {
-    writeIfAbsent(join4(root, ".github", "workflows", "disclosure.yml"), ".github/workflows/disclosure.yml", GH_WORKFLOW, created, skipped);
+    writeIfAbsent(join5(root, ".github", "workflows", "disclosure.yml"), ".github/workflows/disclosure.yml", GH_WORKFLOW, created, skipped);
   }
   const nextSteps = ["Commit the created files."];
+  if (created.includes("AGENTS.md")) {
+    nextSteps.push("An AGENTS.md ACO convention was added \u2014 agents that read it disclose authorship (e.g. 'npx madeby me --with-ai <tool>'). Tune it to your repo's tools.");
+  } else if (skipped.includes("AGENTS.md")) {
+    nextSteps.push("You already have an AGENTS.md \u2014 add the ACO disclosure rule to it (reference: https://github.com/MadeByFYI/MadeBy/blob/main/AGENTS.md).");
+  }
   if (host === "azure-devops") {
     nextSteps.push("Add the Azure Pipelines template (packages/action/azure-pipelines-disclosure.yml) and wire it as a PR build-validation branch policy.");
   } else if (host !== "github") {
@@ -1787,7 +1954,7 @@ function initRepo(root, opts = {}) {
   if (mode !== "required") {
     nextSteps.push(`When ready to enforce: set mode to "required", then make the check required on the protected branch \u2014 the host's control plane (GitHub: gh api branch protection; Azure: a build-validation policy). See the MCP resource madeby://guide/enforce for exact commands.`);
   }
-  nextSteps.push("Contributors disclose origin with a Co-Authored-By / Generated-by trailer (AI), an Authored-by-human trailer ('madeby me'), a DCO Signed-off-by, a signed commit, or 'madeby ai' (record your own AI session's witnessed spans).");
+  nextSteps.push("Contributors disclose origin with a Co-Authored-By / Generated-by trailer (AI), an Authored-by-human trailer ('madeby me'), an Authored-by-ai trailer ('madeby ai' \u2014 AI authored, committer accountable), a DCO Signed-off-by, or a signed commit. Evidence upgrade: 'madeby ai --witness' records your own AI session's witnessed spans.");
   nextSteps.push("Existing history is accounted for honestly, not fabricated: run 'madeby check' over full history to recognize what's already disclosed; pre-adoption commits stay unknown. See madeby://guide/backfill.");
   return { created, skipped, policyMode: mode, host, nextSteps };
 }
@@ -1867,6 +2034,26 @@ var TOOLS = [
       endLine: args.endLine
     }) : provenanceMap(rootFor(args.repo), { prefix: args.prefix, commitLimit: args.commitLimit })
   },
+  {
+    name: "disclose",
+    description: "Disclose authorship on HEAD per ACO \u2014 the agent-native disclosure of work you just did. Pick the honest category: 'ai' (an AI authored it; you, the committer, are accountable) adds Authored-by-ai; 'with_ai' (a human authored it WITH AI assistance) adds Authored-by-human + Assisted-by; 'human' adds Authored-by-human. IMPORTANT: if the AI wrote the code and a human is merely committing it, that is 'ai' \u2014 do NOT claim 'with_ai'/human authorship the human didn't do. Amends HEAD's MESSAGE only (a testimony, never a content change) and refuses if there are staged changes. Evidence upgrade for the ai category (witnessed spans from a session log) is the CLI `madeby ai --witness`. Read the standard: madeby://guide/aco.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        path: { type: "string", description: "path to the repo (default: the server's working directory)" },
+        category: { enum: ["human", "with_ai", "ai"], description: "the honest authorship category (see the description). Defaults from with_ai if omitted." },
+        with_ai: { type: "boolean", description: "legacy shorthand: true \u21D2 category with_ai, false \u21D2 human. Prefer `category`." },
+        tool: { type: "string", description: "the AI tool to name (Assisted-by for with_ai, Authored-by-ai for ai). Default: AI." }
+      }
+    },
+    handler: (args) => {
+      const root = rootFor(args.path);
+      const tool = args.tool;
+      const category = args.category;
+      if (category === "ai") return attestAiAuthorship(root, { tool });
+      return affirmAuthorship(root, { withAi: category === "with_ai" || args.with_ai === true, tool });
+    }
+  },
   {
     name: "ai",
     description: "Made by AI (WRITE): record witnessed AI-authorship spans from YOUR OWN session log into the repo's .madeby/spans (asserted tier, self-reported) \u2014 how an agent DISCLOSES its own contribution. Honest by construction: it records only spans whose AI-authored content is STRUCTURALLY PRESENT in the checkout (survives reformatting); anything not present is discarded. Writes only derived attribution, locally \u2014 the log/content never leave the machine. It cannot claim a higher tier or attribute work to anyone else.",
@@ -1975,7 +2162,30 @@ var POLICY_SCHEMA = {
     accept: { type: "array", items: { type: "string" }, description: "restrict what satisfies the policy (e.g. dco-signoff, ai-trailer, commit-signature); omit \u21D2 any recognized disclosure counts" }
   }
 };
+var ACO_GUIDE = `# ACO \u2014 the Authorship Certificate of Origin
+
+ACO is the open standard MadeBy implements and verifies: a signed, content-bound, tiered statement of
+which of {human, with_ai, ai} authored a unit of work. **Disclosure, not detection** \u2014 it records what a
+party PUT ON THE RECORD, never inferring authorship from source. Full spec:
+https://github.com/MadeByFYI/MadeBy/blob/main/ACO.md
+
+## The three categories
+- **human** \u2014 a human authored it, no AI involvement.
+- **with_ai** \u2014 a human authored it with disclosed AI assistance.
+- **ai** \u2014 an AI agent authored it (a human remains accountable).
+
+## How an agent discloses its OWN work (asserted tier, no keys)
+- Collaborative / human-directed work you just did -> call **disclose** (with_ai: true, tool: "<your name>").
+  It affirms human authorship + discloses AI assistance on HEAD, classifying the commit with_ai.
+- Fully AI-authored spans recoverable from your session log -> call **ai** (records structurally-verified
+  spans, local-only).
+- Read what's already disclosed -> **who**. Align a whole repo -> **init** (also scaffolds an AGENTS.md
+  ACO convention so any agent working there discloses).
+
+Disclose per commit, honestly. Undisclosed content stays *unknown*, never guessed.
+`;
 var RESOURCES = [
+  { uri: "madeby://guide/aco", name: "ACO \u2014 the Authorship Certificate of Origin", description: "The open standard MadeBy implements + verifies: verifiable authorship disclosure (human/with_ai/ai), and how an agent discloses its own work.", mimeType: "text/markdown", text: ACO_GUIDE },
   { uri: "madeby://guide/align", name: "Aligning a repo with MadeBy", description: "The step-by-step workflow to align a repository (for humans and agents).", mimeType: "text/markdown", text: ALIGN_GUIDE },
   { uri: "madeby://guide/enforce", name: "Enforcing the disclosure check", description: "How to make the check required on a protected branch (GitHub / Azure DevOps) \u2014 the host's control plane, exact commands.", mimeType: "text/markdown", text: ENFORCE_GUIDE },
   { uri: "madeby://guide/backfill", name: "Honest backfill for existing repos", description: "How to account for pre-adoption history honestly \u2014 recognize, attach evidence, set a boundary; never fabricate.", mimeType: "text/markdown", text: BACKFILL_GUIDE },
@@ -2052,7 +2262,7 @@ function startMcpServer() {
     }
     handle(msg);
   });
-  process.stderr.write("madeby mcp: ready (stdio; tools: init, check, who, ai; resources: align/enforce/backfill guides, policy schema)\n");
+  process.stderr.write("madeby mcp: ready (stdio; tools: init, check, who, disclose, ai; resources: aco/align/enforce/backfill guides, policy schema)\n");
 }
 
 // src/madeby.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "madeby",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "MadeBy — verifiable content provenance. Disclose your AI use (madeby ai) and gate PRs on disclosure (madeby check).",
   "license": "MIT",
   "type": "module",