GitHub put the code in public. Copilot put the questions in court.

GitHub’s Copilot training dispute is not one clean question. It combines copyright, open-source licence compliance, attribution and the mechanics of an autocomplete system that can sometimes produce code resembling material in its training set.

The class action brought by developers alleged that Copilot could reproduce licensed code without preserving attribution or licence terms, including claims under the Digital Millennium Copyright Act. Courts have narrowed parts of the case, but the underlying product question remains: what should happen when an assistant’s convenience depends on information whose conditions are easy to erase?

The takedown machine is not a provenance system

GitHub’s DMCA process is designed to remove allegedly infringing material and provide a counter-notice route. The company also publishes notices in a public repository. That is useful transparency, but it is a response after a dispute—not a record of provenance attached to every suggestion Copilot generates.

The mismatch is familiar: the platform can process millions of public repositories as training material, while the individual developer is left to inspect an output and guess whether a licence obligation travelled with it.

The missing feature is a receipt

A responsible coding assistant should make similarity and provenance legible. If a suggestion is close to public code, the user needs a clear match, the relevant licence and a decision they can make before shipping it. ‘Publicly accessible’ is not a substitute for ‘safe to reuse.’

Copilot may be useful. That is not the same as the governance being finished. Until the receipt exists, the risk is being shifted from the platform that trained the model to the developer who commits the output.

The technical question is traceability

An assistant generates code from patterns learned during training; it does not normally return a source-file reference with every completion. A developer sees an output string, not the chain of repositories and licence terms that may resemble it.

A useful provenance control would detect close matches before acceptance, show the relevant repository and licence, and keep a local decision record. That differs from a takedown system, which acts after code is already published.