Skip to content

Add AI agent policy documentation#885

Open
dozro wants to merge 9 commits into
devfrom
poisoned-ai-agents
Open

Add AI agent policy documentation#885
dozro wants to merge 9 commits into
devfrom
poisoned-ai-agents

Conversation

@dozro
Copy link
Copy Markdown
Member

@dozro dozro commented May 20, 2026

Description

This pull request introduces and documents a clear policy restricting the use of autonomous AI agents in this repository. It adds a new AGENTS.md file with detailed guidelines, updates the contribution documentation, and adds supporting policy files and editor settings to ensure compliance and clarity for all contributors.

Type of change

docs change?

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings

AI disclosure:

no ai :3, but copied content from linux's ai guidelines

Signed-off-by: Rye git@itsrye.dev

@dozro dozro requested review from Rosy-iso and nushea May 20, 2026 14:55
@dozro dozro added the discussion Open-ended discussion, feedback, or idea exploration before action is taken. label May 20, 2026
Copy link
Copy Markdown
Member

@Rosy-iso Rosy-iso left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I approve the idea, my only concern is that many people just automatically assume something is vibe coded when they see AGENTS.md or similar...could there be a way to achieve the same result with a filename that won't cause this confusion?

@nushea
Copy link
Copy Markdown
Member

nushea commented May 20, 2026

I approve the idea, my only concern is that many people just automatically assume something is vibe coded when they see AGENTS.md or similar...could there be a way to achieve the same result with a filename that won't cause this confusion?

there has been a trend in many anti-ai repositories to put their AI statements in AGENTS.md, if anything as a way to cause disruption to the LLM analyzing the prs, so if we want to keep in line with the anti-ai repos (which admitedly we are not) the agents.md makes a lot of sense

Also i think it might hijack someone' prewriten AGENTS.md that they might have added to their .gitignore so thats a bonus too in my book, just that extra annoyance for them

@Rosy-iso
Copy link
Copy Markdown
Member

I get the idea, but what about those that do automatically assume this is vibe coded cause of the file?

Comment thread AGENTS.md
@nushea
Copy link
Copy Markdown
Member

nushea commented May 20, 2026

I get the idea, but what about those that do automatically assume this is vibe coded cause of the file?

i mean if they wanted to consider whether the project is ai generated they would use the 'block claude/copilot' trick, i do not believe there is anything that could worsen the sable image by putting explicit restrictions in those places. There are bigger telltales of ai usage in the project in my opinion

@dozro
Copy link
Copy Markdown
Member Author

dozro commented May 20, 2026

I get the idea, but what about those that do automatically assume this is vibe coded cause of the file?

https://noai.starlightnet.work/list.html for example lists projects with fake ai instructions (beside others)

examples:

@nushea nushea force-pushed the poisoned-ai-agents branch from 4458e64 to 9bd48a1 Compare May 21, 2026 12:36
Comment thread .github/PULL_REQUEST_TEMPLATE.md
Comment thread .github/PULL_REQUEST_TEMPLATE.md
@dozro dozro marked this pull request as ready for review May 21, 2026 18:24
@dozro dozro requested review from 7w1 and hazre as code owners May 21, 2026 18:24
@dozro dozro requested a review from Rosy-iso May 21, 2026 18:25
Comment thread AGENTS.md
Comment on lines +62 to +70
## Signed-off-by and Developer Certificate of Origin

AI agents MUST NOT add Signed-off-by tags. Only humans can legally certify the
Developer Certificate of Origin (DCO). The human submitter is responsible for:

- Reviewing all AI-generated code
- Ensuring compliance with licensing requirements
- Adding their own Signed-off-by tag to certify the DCO
- Taking full responsibility for the contribution
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This section should probably be removed unless we're adding a DCO sign off requirement for contributions in general (in which case we need to write it somewhere other than AGENTS.md)?

Unless we reword it and say fully autonomous comments must have a DCO sign off, and use that as a reason to close any PRs with sign offs.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

True. Forgot to remove the copy-paste relict

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Having a per-commit DCO can be kinda annoying. Having it like matrix spec proposals (aka sign off your pr) would be a fair compromise.

If we were to add a DCO.

Copy link
Copy Markdown
Member

@nushea nushea May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it would require signing with the contributor's actual Legal Name it might be an inhibitor for contributions from transgender individuals, since it might require them to Dead-Name themselves

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How does Linux actually handle that /gen?

(I wouldn't endorse something making people doxx themselves)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure about Linux, but I know that whenever a friend of mine wanted to contribute to Gentoo there was a lot of confusion about how she would be able to until she got an exception from using the Legal Name on the DCO (still having to use a Consistently Identifiable Name to tie to her in case that she infringed copyright to be able to point to her legally)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(I am not sure about how DCO law/setups work, I was just thinking back to that as a thing to keep in mind if we establish a DCO)

Copy link
Copy Markdown
Member Author

@dozro dozro May 21, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Linux says

using a known identity (sorry, no anonymous contributions.)

see https://docs.kernel.org/process/submitting-patches.html

Which sounds reasonable

i read it as not strictly require a legal birth name, but forbidding completely anonymous contributions or throwaway accounts.

A well-established, consistently used pseudonym or preferred name that firmly connects back to the contributor's identity is acceptable.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is still a bit ambiguous but that is very fair so if it is added it should be in that way

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i tried to give it a shot in File :3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

discussion Open-ended discussion, feedback, or idea exploration before action is taken.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants