Artifacts Agent Commit Notes

Agent attribution carried in git-notes on a Cloudflare Artifacts repo, built around the reason the metadata does not go in the commit message: a message is an input to the commit SHA, so writing attribution at commit time means recording it before review has happened and before any eval score exists, and adding it later means rewriting history and invalidating every downstream reference. A note is a separate object pointing at a commit, mutable, attachable hours after the fact, replaceable when the reviewer signs off, and it never changes the SHA of the thing it describes. The cost is the two facts the three files are organised around. Notes live on their own refs under refs/notes, which are in neither the default fetch refspec nor the default push refspec, so a clone that does not ask for them gets complete history and zero provenance with no error and no empty directory to hint that anything was skipped; the clone helper adds the refspec to the config rather than passing it once, and sets notes.displayRef so fetched notes are actually visible in git log rather than sitting in the object database unreferenced by any command a human runs. And notes are keyed by the SHA they annotate, so a rebase, amend, or squash strands every note on commits that are no longer reachable, which is why the commit path sets notes.rewriteRef (a config with no default value, meaning git copies notes forward for no ref at all until it is set) and why the read path returns 404 rather than an empty 200, since human wrote this and a rebase orphaned the note are indistinguishable from the reader's side. Each agent writes to its own ref because a notes tree cannot hold two entries under one name, so on a shared ref the second agent either fails or discards the first agent's record with add -f, and append concatenates raw bytes into something that parses as neither document. The Worker never commits, because the Artifacts binding is a control plane plus log, readCommit, and readTree with no content write anywhere on it: it authorises the run, mints a fifteen-minute write-scoped repo token, hands back the exact push refspec so no harness has to remember it, and revokes early rather than waiting out the TTL. Credentials go through http.extraHeader rather than the basic-auth remote URL form, which would write the secret into .git/config where git remote -v prints it into CI logs. Reading a note back handles the notes-tree fanout, which git rebalances from flat to two-level to three-level as the count grows, so the path that worked at fifty commits stops working at fifty thousand.