using-git-notes-for-ai-context — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited using-git-notes-for-ai-context (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Git notes and trailers form a zero-infrastructure metadata layer for AI agent context. Notes attach post-hoc metadata without changing commit SHAs. Trailers embed structured key-value pairs inside commit messages.
| Scenario | Use |
|---|---|
| Known at commit time, concise (<5 lines) | Trailer |
| Known at commit time, verbose | Note |
| Post-hoc (after commit) | Note |
| Attribution data | Note → ai/attribution |
| Prompts / sessions | Note → ai/prompts |
| Constraints, rejected alternatives, directives | Trailer (Lore protocol) |
| CI/CD output | Note → ci/* |
| Deployment records | Note → deployments |
Rule of thumb: If the metadata should travel with the commit and be visible in git log, use trailers. If the metadata is post-hoc, verbose, or machine-generated, use notes.
When authoring commits, keep subject/body format aligned with the repository's commit convention; this skill focuses on metadata structure, storage, and querying.
Identify the task, then follow the matching workflow.
references/01-core-concepts-and-namespaces.md §Namespace Scheme:
git notes --ref=ai/attribution add -m \
'{"schema":"ai-context/1.0","agent":{"tool":"claude-code","model":"claude-opus-4-6"}}' HEADcommit creation (using your team's normal commit flow), for example:
AI-Agent: claude-code/claude-opus-4-6
Constraint: Must remain backward-compatiblegit notes --ref=ai/attribution show HEAD orgit log -1 --format='%(trailers)' HEAD.
references/03-hooks-scripts-and-automation.md.
git log --format='%(trailers:key=Constraint,key=Directive,key=Rejected)' -- <file> for sha in $(git log --format='%H' -- <file>); do
git notes --ref=ai/attribution show "$sha" 2>/dev/null
doneconstraints and directives.
git config --add remote.origin.fetch '+refs/notes/*:refs/notes/*'
git config --add remote.origin.push '+refs/notes/*:refs/notes/*' git config --add notes.rewriteRef "refs/notes/ai/attribution"
git config notes.rewrite.rebase true
git config notes.rewrite.amend true git push origin 'refs/notes/*' --dry-runreferences/03-hooks-scripts-and-automation.md.
references/04-team-enterprise-and-security.md.
Default recommendations:
git ai init) — broadest agentsupport (12+), rebase survival, open standard.
just trailer conventions.
For detailed comparison, see references/02-use-cases-and-tools.md §Tool Comparison.
# Notes
git notes --ref=ai/attribution add -m 'data' HEAD # Add
git notes --ref=ai/attribution append -m 'more' HEAD # Append
git notes --ref=ai/attribution show HEAD # Read
git log --show-notes=ai/attribution # Show in log
# Trailers (read/query)
git log -1 --format='%(trailers)' HEAD # Read all
git log --format='%(trailers:key=Constraint)' -- file # Filter by key
git log -1 --format=%B HEAD | git interpret-trailers --parse # Parse raw message
# Sync
git push origin 'refs/notes/*' # Push all notes
git fetch origin 'refs/notes/*:refs/notes/*' # Fetch all notesrefs/notes/ai (bare) cannot coexist withrefs/notes/ai/prompts. Always use sub-paths like ai/attribution.
refs/notes/ai (bare). If usingGit AI, use non-ai/ prefixes for custom namespaces (e.g., dev/prompts, dev/decisions) to avoid ref conflicts.
notes.rewriteRef (see "Setting up"workflow). Git AI handles this automatically.
append to add to existing notes,or use separate namespaces.
namespace — see references/04-team-enterprise-and-security.md §Merge Strategies.
— notes/trailers mechanics, namespace scheme, structured JSON format
session metadata, CI/CD, tool comparison
— post-commit/pre-push hooks, GitHub Actions, aliases, context harvest
— remote sync, merge strategies, compliance, redaction, signing, limitations
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.