Attribution

Attribution is enforced, not asserted.

Most tools let you claim how much a model helped. Byline measures it. The claim a journal, a regulator or a publisher asks for is produced from the version history rather than from memory, and a write that cannot be attributed is refused rather than saved.

The chain

Four steps, all of them ordinary git.

Snapshot before. Your uncommitted edits are saved before the model touches anything, so its turn starts from a known point.
Commit the turn. Its changes are committed with the model that produced them named in the message.
Replay ownership. The history is replayed word by word to work out who last wrote each one, and the editor tints accordingly.
Disclose at export. The AI-use statement is generated from that count, with a regression test guarding the numbers.

Nothing here is a private format. Clone the repository, run git log, and the same record is there without us.

Three things it will not do

It will not write unattributed. If the repository cannot commit, the write is refused rather than left on disk. Uncommitted text would count as yours.
It will not write where you reserved the text. A work in research-only mode refuses every writing tool and offers a comment instead.
It will not fill a blank convincingly. A field you have not set prints as not set, in the document and in the control table.

Other tools, same rules

A model that reaches the manuscript from somewhere else is disclosed too.

Byline exposes the manuscript over MCP, so a desktop assistant or a coding agent can work on the real files rather than on a copy pasted into a chat window. Those writes are committed and named the same way. The vendor differs; the answer to whether a person wrote the words does not.

What a connecting model is told

That leaving a comment is usually the right move, because a suggestion you accept leaves the words yours and the same words written directly do not. It is told the manuscript's conventions on connection, before it can touch anything.