To Ban or Not to Ban? How Open Source Projects Govern GenAI Contributions

May combine two claims.

Recent coding agents navigate repositories, generate full patches, and execute pipelines with greater autonomy.

“Recent coding agents take this further by navigating repositories, generating full patches, and executing pipelines with greater autonomy [34, 64, 71].”

• cites [34] [34] Hao Li, Haoxiang Zhang, and Ahmed E Hassan. 2025. The rise of AI teammates in software engineering (SE 3.0): how autonomous coding agents are reshaping software engineering. arXiv preprint arXiv:2507.15003. doi:10.48550/arXiv.2507. 15003 [cs.SE] -Not checked yet

  Not checked in the free run.

• cites [64] [64] Xingyao Wang, Boxuan Li, Yufan Song, Frank F. Xu, Xiangru Tang, Mingchen Zhuge, Jiayi Pan, Yueqi Song, Bowen Li, Jaskirat Singh, Hoang H. Tran, Fuqiang Li, Ren Ma, Mingzhang Zheng, Bill Qian, Yanjun Shao, Niklas Muennighoff, Yizhe Zhang, Binyuan Hui, Junyang Lin, et al. 2025. OpenHands: an open platform for AI software developers as generalist agents. In The Thirteenth International Conference on Learning Representations (ICLR 2025) . OpenReview.net, Singapore, 38 pages. https://openreview.net/forum?id=OJd3ayDDoF - sourcePartly supported

  Section 4.2 (p. 7) describes agents interacting with repositories, editing files, executing code, and attempting to fix GitHub issues; §2.2 (p. 4) describes a runtime for complex software-development workflows. These passages support greater autonomy in repository-level work, but they do not establish that agents generate full patches or execute entire pipelines. (LLM, conf=0.82)

  Experimental — accuracy not yet measured
• cites [71] [71] John Yang, Carlos E. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press. 2024. SWE-agent: agent-computer interfaces enable automated software engineering. In Advances in Neural Information Processing Systems , Vol. 37. Curran Associates, Inc., Red Hook, NY, USA, 5052850652. doi:10.52202/079017-1601 - sourceSupported

May combine two claims.

Documentation of prompts or AI interactions was observed too rarely for a standalone strategy, but it works as a policy instrument supporting disclosure, provenance, or evidence gating.

“We observed this too rarely for a standalone strategy, but it works as a policy instrument supporting disclosure, provenance, or evidence gating.”

Classified as probably not a substantial claim. May combine two claims.

A third concern is whether a contributor actually understands, explains, and owns the change.

“A third concern is whether a contributor actually understands, explains, and owns the change.”

May combine two claims.

Many projects acknowledge the productivity benefits of GenAI and recognize that continuously rejecting LLM-generated code is not a good approach.

“At the same time, many projects acknowledge the productivity benefits and recognize that 'continuously rejecting LLM-generated code is not a good approach' [25].”

• cites [25] [25] Immich Contributors. 2026. Object storage. GitHub Discussion. https://github.c om/immich-app/immich/discussions/23745 Accessed: 2026-03-26. -Not checked yet

  Not checked in the free run.

May combine two claims.

O2's core judgment is that GenAI-related inputs may enter the workflow, but only under explicit conditions of accountability, visibility, and verification.

“The core judgment behind O2 is that GenAI-related inputs may enter the workflow, but only under explicit conditions of accountability, visibility, and verification.”

Classified as probably not a substantial claim.

A fourth concern is that review capacity becomes the first bottleneck.

“A fourth concern is that review capacity becomes the first bottleneck.”

Classified as probably not a substantial claim.

Disclosure seeks not to determine whether AI may be used, but to turn AI use from a hidden practice into a visible, discussable, and reviewable input signal.

“Disclosure seeks not to determine whether AI may be used, but to turn AI use from a hidden practice into a visible, discussable, and reviewable input signal.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Most orientation disagreements clustered at the O2/O3 boundary.

“Most orientation disagreements clustered at the O2/O3 boundary.”

May combine two claims.

The role of compliance and provenance safeguards varies sharply by orientation: in O1, provenance uncertainty serves as a rationale for categorical exclusion; in O2, it becomes a contributor-facing compliance obligation; in O3, it is folded into general licensing responsibility.

“This strategy's role varies sharply by orientation: in O1, provenance uncertainty serves as a rationale for categorical exclusion; in O2, it becomes a contributorfacing compliance obligation; in O3, it is folded into general licensing responsibility.”

May combine two claims.

Orientations are dominant case-level logics, and strategies can co-occur with any orientation.

“Orientations are dominant case-level logics, and strategies can co-occur with any orientation.”

Classified as probably not a substantial claim.

Boundary exclusion governs the behavior of excluding certain classes of GenAI-mediated input from the acceptable contribution surface altogether.

“Boundary exclusion governs the behavior of excluding certain classes of GenAI-mediated input from the acceptable contribution surface altogether .”

Classified as probably not a substantial claim.

O1 texts define AI-generated code as a class of input whose admissibility is in question from the outset.

“These texts define AI-generated code as a class of input whose admissibility is in question from the outset.”

May combine two claims.

Organizational form and domain context function as boundary conditions that shape where pressure first arises, but do not reliably predict which orientation a project adopts.

“Organizational form and domain context function as boundary conditions that shape where pressure first arises, but do not reliably predict which orientation a project adopts.”

May combine two claims. The quote only partly states this claim.

The review bottleneck concern appears in four closely related manifestations: intent and context, surface completeness and correctness, authorship and responsibility, and review capacity.

“This concern appears in four closely related manifestations:”

May combine two claims.

Accountability reinforcement does not primarily regulate whether AI was used; it regulates whether the submitter understands the content, can explain it during review, and is willing to remain responsible for revising, defending, and maintaining it.

“It does not primarily regulate whether AI was used. Instead, it regulates whether the submitter understands the content, can explain it during review, and is willing to remain responsible for revising, defending, and maintaining it.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Entry admissibility and input qualification strategies move governance toward the point of intake, addressing what kinds of inputs may enter the system and what qualifying information must accompany them.

“These strategies move governance toward the point of intake, addressing what kinds of inputs may enter the system and what qualifying information must accompany them.”

May combine two claims.

In O2, accountability reinforcement forms part of an explicit AI-specific boundary regime, whereas in O3 it is more often absorbed into general contribution-quality expectations.

“In O2, accountability reinforcement forms part of an explicit AI-specific boundary regime ('The AI generated it is never an acceptable answer'), whereas in O3 it is more often absorbed into general contribution-quality expectations.”

Classified as probably not a substantial claim. May combine two claims.

O1's core judgment is that certain GenAI-related inputs present structural, nonabsorbable risk-including provenance uncertainty, copyright and licensing incompatibility, or taintedness-and should therefore not be absorbed into the existing review process.

“The core judgment behind O1 is that certain GenAI-related inputs present structural, nonabsorbable risk -including provenance uncertainty, copyright and licensing incompatibility, or taintedness-and should therefore not be absorbed into the existing review process.”

May combine two claims.

Boundary exclusion is near-universal in O1 (93%) but also appears in 43% of O2 projects, where it typically applies selectively to specific contribution surfaces-such as fully generated PRs or unverified security reports-rather than as a blanket prohibition.

“Boundary exclusion is near-universal in O1 (93%) but also appears in 43% of O2 projects, where it typically applies selectively to specific contribution surfaces-such as fully generated PRs or unverified security reports-rather than as a blanket prohibition.”

May combine two claims.

GenAI makes PRs easier to generate without making them easier to review, explain, or validate.

“GenAI makes PRs easier to generate without making them easier to review, explain, or validate.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

The sampled repositories are highly visible, well-established, and collaboratively intensive.

“As shown in Table 1, the sampled repositories are highly visible, well-established, and collaboratively intensive.”

Classified as probably not a substantial claim.

Disclosure's immediate target is contributors' reporting behavior when submitting issues, PRs, comments, or reports.

“Its immediate target is contributors' reporting behavior when submitting issues, PRs, comments, or reports.”

May combine two claims.

Across the 67 cases, O2 was the most common dominant orientation (40 cases, 59.7%), followed by O1 (14, 20.9%) and O3 (13, 19.4%).

“Across the 67 cases, O2 was the most common dominant orientation (40 cases, 59.7%), followed by O1 (14, 20.9%) and O3 (13, 19.4%).”

May combine two claims.

At issue entry, AI makes reports look plausible without making them more actionable, creating triage costs.

“At issue entry, the problem is triage costs : AI makes reports look plausible without making them more actionable.”

Probably not a substantial claim: may not pass S4 (based).

Responsibility and evidence restoration strategies address how projects restore accountability, explanation, and evidence where GenAI makes them thinner.

“These strategies address how projects restore accountability, explanation, and evidence where GenAI makes them thinner.”

May combine two claims.

In communication and discussion, GenAI contributions create low-value AI text and weaker human exchange.

“In communication and discussion, the same responsibility problem appears as low-value AI text and weaker human exchange.”

Classified as probably not a substantial claim.

Accountability reinforcement seeks to pull responsibility back from the tool to the named human contributor.

“Accountability reinforcement seeks to pull responsibility back from the tool to the named human contributor.”

May combine two claims.

The paper identifies seven recurring concern areas across OSS contribution workflows: review bottlenecks and contributor responsibility in code contribution, low-value AI text in communication, rising triage costs at issue entry, pressure on high-priority security channels, adversarial incentives, copyright/licensing/provenance uncertainty, and platform defaults and tooling limits.

“We identified seven recurring concern areas distributed across code contribution, communication, issue entry, security reporting, incentive structures, provenance and licensing, and platform infrastructure.”

• Also stated in: § 4 RQ1: Maintainer Concerns · p. 4 · plain

  “Maintainer concerns therefore span seven recurring concern areas: 1) review bottlenecks and contributor responsibility in code contribution, 2) low-value AI text in communication, 3) rising triage costs at issue entry, 4) pressure on high-priority security channels, 5) adversarial incentives, 6) copyright/licensing/provenance uncertainty, and 7) platform defaults and tooling limits.”

Classified as probably not a substantial claim.

Each strategy takes effect through policy instruments, the textual and workflow mechanisms a project deploys.

“Each strategy takes effect through policy instruments , the textual and workflow mechanisms a project deploys.”

May combine two claims.

In broad terms, O1 concentrates on front-gate and infrastructural controls, O2 carries the broadest AI-specific governance layer, and O3 relies more heavily on general-purpose quality controls while adopting fewer explicit AI-specific mechanisms.

“In broad terms, O1 concentrates on front-gate and infrastructural controls, O2 carries the broadest AI-specific governance layer, and O3 relies more heavily on general-purpose quality controls while adopting fewer explicit AI-specific mechanisms.”

May combine two claims.

Security channel governance differs from the general evidence gating of B2: B2 gates ordinary PR and issue handling, whereas C4 protects high-priority security channels, where fake reports immediately consume scarce incident-response time.

“Security channel governance also differs from the general evidence gating of B2. B2 gates ordinary PR and issue handling, whereas C4 protects high-priority security channels, where fake reports (fabricated, hallucinated, or unverifiable vulnerability reports) immediately consume scarce incident-response time.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Review burden and workflow protection strategies protect maintainer time, review queues, and high-priority channels once inputs have already entered the system.

“These strategies protect maintainer time, review queues, and high-priority channels once inputs have already entered the system.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Verification and evidence gating may include local test logs, proof-of-concept artifacts, reproduction steps, references, or explicit human validation notes.

“This may include local test logs, proof-of-concept artifacts, reproduction steps, references, or explicit human validation notes.”

May combine two claims.

When maintainers conclude that repository-level rules can no longer control the relevant problems, they may suspend external PRs, redirect reporting channels, or even migrate their main collaboration venue.

“When maintainers conclude that repository-level rules can no longer control the relevant problems, they may suspend external PRs, redirect reporting channels, or even migrate their main collaboration venue.”

May combine two claims.

Moderation and sanctions define more consistent ways to close, reject, block, or ban such inputs, thereby reducing the cost of repeated case-by-case negotiation.

“Rather than trying to improve such inputs, this strategy defines more consistent ways to close, reject, block, or ban them, thereby reducing the cost of repeated case-by-case negotiation.”

Classified as probably not a substantial claim.

AI tooling governance seeks to restore responsibility and control at the tool layer rather than only at the human layer.

“AI tooling governance belongs in this group because it also seeks to restore responsibility and control, but does so at the tool layer rather than only at the human layer.”

May combine two claims.

Even when contributors act in good faith, review bandwidth remains limited, and GenAI can significantly increase the rate at which reviewable-looking inputs are produced.

“This strategy makes explicit a practical reality of OSS maintenance: even when contributors act in good faith, review bandwidth remains limited, and GenAI can significantly increase the rate at which reviewable-looking inputs are produced.”

May combine two claims.

We identified three governance orientations (prohibitionist, boundary-and-accountability, and quality-first) that explain how projects interpret these challenges differently, and abstracted 12 cross-project governance strategies and their policy instruments.

“We identified three governance orientations (prohibitionist, boundary-and-accountability, and quality-first) that explain how projects interpret these challenges differently, and abstracted 12 cross-project governance strategies and their policy instruments.”

May combine two claims.

Scope and intentionality control governs not only PR size, but whether a contribution is framed within the right problem context.

“Scope and intentionality control governs not only PR size, but whether a contribution is framed within the right problem context.”

Probably not a substantial claim: may not pass S4 (based).

AI tooling governance is a further step than accountability and verification: projects do not merely regulate how humans should use AI, but begin to regulate AI tools and agents directly through files such as AGENTS.md, Copilot instructions, or other tool-facing repository rules.

“Compared with accountability and verification, it is a further step: projects do not merely regulate how humans should use AI, but begin to regulate AI tools and agents directly through files such as AGENTS.md , Copilot instructions, or other tool-facing repository rules.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Incentive redesign is one of the least frequent but most revealing strategies in the corpus.

“Incentive redesign is one of the least frequent but most revealing strategies in the corpus.”

May combine two claims.

GenAI enters OSS collaboration at multiple workflow stages, raises maintainer concerns across these stages, and projects articulate governance responses.

“Drawing on a corpus of public governance materials from 67 OSS projects, we showed how GenAI enters OSS collaboration at multiple workflow stages, what maintainer concerns it raises across these stages, and what governance responses projects articulate.”

May combine two claims.

Incentive redesign does not regulate how a particular input is written or reviewed; instead, it targets the broader reward structure that makes certain kinds of harmful input worth producing in the first place.

“It does not regulate how a particular input is written or reviewed. Instead, it targets the broader reward structure that makes certain kinds of harmful input worth producing in the first place.”

Classified as probably not a substantial claim.

Verification and evidence gating seeks to change contributor behavior by requiring sufficient supporting material before an input is processed further.

“Verification and evidence gating seeks to change contributor behavior by requiring sufficient supporting material before an input is processed further.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Capacity and queue control treats the review queue itself as a scarce resource in need of governance.

“Capacity and queue control treats the review queue itself as a scarce resource in need of governance.”

Probably not a substantial claim: may not pass S3 (load-bearing). The quote only partly states this claim.

Disagreements between the two authors were resolved through discussion.

“Disagreements were resolved through discussion.”

Probably not a substantial claim: may not pass S3 (load-bearing).

When rewards remain in place, AI lowers the cost of producing bad-faith or low-value reports.

“When rewards remain in place, AI lowers the cost of producing bad-faith or low-value reports.”

Classified as probably not a substantial claim.

All concern and strategy counts reported are case-level presence counts rather than mention frequencies, so repeated expressions within the same case were counted once.

“All concern and strategy counts reported below are case-level presence counts rather than mention frequencies, so repeated expressions within the same case were counted once.”

May combine two claims.

O2 locates the governance problem in AI-mediated input itself and admits such input only under AI-specific rules of disclosure, human accountability, verification, or enforcement.

“O2 thus locates the governance problem in AI-mediated input itself and admits such input only under AI-specific rules of disclosure, human accountability, verification, or enforcement.”

May combine two claims.

The trade-off of disclosure is that contributors must bear additional metadata-reporting costs, and explicit AI marking may generate concerns about differential treatment.

“At the same time, the trade-off is concrete: contributors must bear additional metadata-reporting costs, and explicit AI marking may generate concerns about differential treatment.”

Classified as probably not a substantial claim. May combine two claims.

The inclusion criterion for GenAI governance was fixed before document analysis began and stayed stable throughout screening, not shaped by findings.

“We fixed this inclusion criterion before document analysis began, building on prior definitions of OSS contribution governance [1, 11, 12]. The criterion stayed stable throughout screening; we only refined how it applied to borderline cases, so it was not shaped by our findings.”

• cites [1] [1] AdamAlami, Raúl Pardo, Marisa Leavitt Cohn, and Andrzej Wąsowski. 2022. Pull request governance in open source communities. IEEE Transactions on Software Engineering 48, 12 (2022), 4838-4856. doi:10.1109/TSE.2021.3128356 - sourceNot checked — no full text of the source
• cites [11] [11] Nadia Eghbal. 2020. Working in Public: The Making and Maintenance of Open Source Software . Stripe Press, South San Francisco, CA, USA. -Not checked yet

  Not checked in the free run.

• cites [12] [12] Omar Elazhary, Margaret-Anne D. Storey, Neil A. Ernst, and Andy Zaidman. 2019. Do as I do, not as I say: do contribution guidelines match the GitHub contribution process?. In 2019 IEEE International Conference on Software Maintenance and Evolution (ICSME) . IEEE, Los Alamitos, CA, USA, 286-290. doi:10.1109/ICSME. 2019.00043 - sourceNot checked — no full text of the source

May combine two claims.

O3 locates the problem not in AI use per se, but in ordinary contribution quality under cheaper-generation conditions, addressed through general controls of reviewability, testing, scope, and maintainability.

“O3 thus locates the problem not in AI use per se, but in ordinary contribution quality under cheaper-generation conditions, addressed through general controls of reviewability, testing, scope, and maintainability.”

Probably not a substantial claim: may not pass S2 (checkable).

The three orientations should be read as ideal-typical governance logics rather than static labels or a ranking of policy strictness.

“The three orientations should therefore be read as ideal-typical governance logics rather than static labels or a ranking of policy strictness.”

May combine two claims.

The objection to AI-generated text in communication is not simply verbosity, but that it adds little context and displaces direct human exchange.

“The objection is therefore not simply to verbosity, but to generated text that adds little context and displaces direct human exchange.”

May combine two claims.

Prior research streams have not converged on how OSS projects govern GenAI within contribution workflows, leaving a lack of systematic understanding.

“However, these streams have not yet converged on the question of how OSS projects govern GenAI within contribution workflows.”

• Also stated in: § 1 Introduction · p. 1 · plain

  “We still lack a systematic understanding of what concerns GenAI raises across different stages of OSS contribution workflows, and how projects organize their responses into governance approaches and concrete strategies.”

Classified as probably not a substantial claim. May combine two claims.

Boundary exclusion does not ask how to review GenAI-related input more effectively; it asks a prior admissibility question: whether such input should be treated as reviewable at all.

“Unlike disclosure, accountability, or verification, this strategy does not ask how to review GenAI-related input more effectively. It asks a prior admissibility question: whether such input should be treated as reviewable at all.”

Classified as probably not a substantial claim. May combine two claims.

Two authors independently performed both seed screening and full-corpus coding.

“To strengthen analytic credibility, two authors independently performed both seed screening and full-corpus coding.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

Accountability indicates answerability and ownership in review, not blame.

“Accountability indicates answerability and ownership in review, not blame.”

Classified as probably not a substantial claim.

For O1, the prior question is not how to review such inputs more effectively, but whether they should enter the workflow at all.

“The prior question is not how to review such inputs more effectively, but whether they should enter the workflow at all.”

Probably not a substantial claim: may not pass S2 (checkable).

What maintainers need from disclosure is not abstract transparency for its own sake, but a way to calibrate expectations once inputs become longer, more polished, and more contribution-like.

“What maintainers need is not abstract transparency for its own sake, but a way to calibrate expectations once inputs become longer, more polished, and more contribution-like.”

May combine two claims.

When a Node.js TSC member submitted a 19,000-line PR generated with Claude Code, the incident triggered a petition by over 80 developers calling for a project-wide ban on AI-assisted contributions.

“when a Node.js TSC member submitted a 19,000-line PR generated with Claude Code [7], the incident triggered a petition by over 80 developers [26, 27] calling for a project-wide ban on AI-assisted contributions.”

• cites [7] [7] Matteo Collina. 2026. Virtual File System for Node.js. GitHub Pull Request #61478, nodejs/node. https://github.com/nodejs/node/pull/61478 Accessed: 2026-03-26. -Not checked yet

  Not checked in the free run.

• cites [26] [26] Fedor Indutny. 2026. No AI Code in Node.js Core. Change.org petition. https: //www.change.org/p/no-ai-code-in-node-js-core Accessed: 2026-03-26. -Not checked yet

  Not checked in the free run.

• cites [27] [27] Fedor Indutny. 2026. No AI in Node.js Core: A Petition to Disallow Acceptance of LLM-Generated Pull Requests. GitHub Repository. https://github.com/indut ny/no-ai-in-nodejs-core Accessed: 2026-03-26. -Not checked yet

  Not checked in the free run.

May combine two claims.

Governing GenAI in OSS extends beyond a binary ban-or-not question and requires coordinated responses across accountability, verification, review capacity, code provenance, and platform infrastructure.

“We show that governing GenAI in OSS extends well beyond banning - it requires coordinated responses across accountability, verification, review capacity, code provenance, and platform infrastructure.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Expansion stopped when connectivity saturation and category saturation were met.

“Expansion stopped when two criteria were met: connectivity saturation , when new links no longer produced qualifying cases, and category saturation , when new cases no longer introduced new codes.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The concern about adversarial incentives is not mere noise, but noise made worthwhile by institutional incentives.

“Here the concern is not mere noise, but noise made worthwhile by institutional incentives.”

Classified as probably not a substantial claim.

The issue with provenance is not ordinary review quality, but whether such inputs can be admitted at all.

“Here the issue is not ordinary review quality, but whether such inputs can be admitted at all.”

Classified as probably not a substantial claim.

Two authors independently examined each remaining repository's governance surfaces for public text tying GenAI-related inputs to contribution rules, review expectations, security handling, channel restrictions, or sanctions.

“Two authors then independently examined each remaining repository's governance surfaces (CONTRIBUTING, SECURITY, standalone AI policies, AGENTS.md , and issue/PR templates) for public text that tied GenAI-related inputs to contribution rules, review expectations, security handling, channel restrictions, or sanctions.”

May combine two claims.

Inter-rater agreement was Cohen's kappa 0.742 for governance orientation, 0.745 for concerns, and 0.840 for strategies.

“For governance orientation, which assigned one dominant label to each of the 67 project-level cases, Cohen's kappa was 0.742. For concern and strategy coding, which allowed multiple codes per case, we calculated Cohen's kappa per code on binary presence/absence decisions and report the macro-average across codes: 0.745 for concerns and 0.840 for strategies.”

Classified as probably not a substantial claim.

AI changes the cost balance between generating and reviewing code.

“As a maintainer of matplotlib observed, AI 'changes the cost balance between generating and reviewing code' [39].”

• cites [39] [39] Matplotlib Contributors. 2026. [PERF] Replace np.column\_stack with np.vstack().T. GitHub Pull Request. https://github.com/matplotlib/matp lotlib/pull/31132 Accessed: 2026-03-26. -Not checked yet

  Not checked in the free run.

Classified as probably not a substantial claim. May combine two claims.

The issue is not AI use alone, but whether a human author remains accountable.

“The issue is not AI use alone, but whether a human author remains accountable.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Accountability reinforcement redefines authorship as a responsibility relation rather than a mere act of submission.

“In this way, the strategy redefines authorship as a responsibility relation rather than a mere act of submission.”

May combine two claims.

The issue with platform/tooling is not only what contributors do, but what platforms make easy and what projects still cannot control.

“Here the issue is not only what contributors do, but what platforms make easy and what projects still cannot control.”

May combine two claims.

The surge of AI generated contributions grew beyond the maintenance capabilities of many well-known open source projects, causing chaos and debates.

“The surge of AI generated contributions grew beyond the maintenance capabilities of many well-known open source projects, causing chaos and debates within the cornerstones of the modern digital infrastructure.”

Classified as probably not a substantial claim.

The findings should be interpreted as an analytically transferable account of publicly visible GenAI governance rather than a prevalence estimate for the entire OSS ecosystem.

“Accordingly, the findings should be interpreted as an analytically transferable account of publicly visible GenAI governance rather than a prevalence estimate for the entire OSS ecosystem.”

May combine two claims.

The benefit of capacity and queue control is making maintainer time governable as a resource; the cost is that waiting time and participation friction are reallocated to contributors, especially newcomers.

“The benefit is making maintainer time governable as a resource; the cost is that waiting time and participation friction are reallocated to contributors, especially newcomers.”

Classified as probably not a substantial claim. May combine two claims.

Our results are coded from public texts and have not been validated by the repository owners or maintainers, so our interpretations of individual policies may contain imprecisions.

“Our results are coded from public texts and have not been validated by the repository owners or maintainers, so our interpretations of individual policies may contain imprecisions.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Smaller projects, low-activity repositories, non-GitHub communities, and non-English communities may encode similar pressures less explicitly or govern them differently.

“Smaller projects, low-activity repositories, non-GitHub communities, and non-English communities may encode similar pressures less explicitly or govern them differently.”

May combine two claims.

These findings reveal a structural shift in OSS governance - from code review toward upstream admission control, and from text-based policies toward infrastructure-level assurance.

“Taken together, these findings reveal a structural shift in OSS governance - from code review toward upstream admission control, and from text-based policies toward infrastructure-level assurance.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

He et al. [23] find that the adoption of Cursor can transiently boost development velocity, while leading to a persistent increase in static analysis warnings and code complexity.

“He et al. [23] find that the adoption of Cursor can transiently boost development velocity, while leading to a persistent increase in static analysis warnings and code complexity.”

• cites [23] [23] Hao He, Courtney Miller, Shyam Agarwal, Christian Kästner, and Bogdan Vasilescu. 2026. Speed at the cost of quality: how Cursor AI increases shortterm velocity and long-term complexity in open-source projects. In Proceedings of the 23rd International Conference on Mining Software Repositories (MSR '26) . Association for Computing Machinery, New York, NY, USA, 1-19. https: //arxiv.org/abs/2511.04427 Accepted at MSR 2026 Mining Challenge; preprint available at arXiv. Accessed: 2026-03-26. -Not checked yet

  Not checked in the free run.

Classified as probably not a substantial claim. May combine two claims.

Stricter intake controls protect maintainer capacity but raise participation costs and may discourage external contribution.

“Each path carries an explicit trade-off: stricter intake controls protect maintainer capacity but raise participation costs and may discourage external contribution, so projects should move up the map gradually rather than adopt maximal controls by default.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Later governance changes may alter how particular OSS projects are best interpreted.

“Our analysis is thus a cross-sectional account of one time window, and later governance changes may alter how particular OSS projects are best interpreted.”

• AssumptionRests on an assumption: GenAI-related governance is changing quickly: platforms, tools, and project rules continue to shift over short periods of time.

Probably not a substantial claim: may not pass S2 (checkable).

These categories remain interpretive abstractions rather than naturally given classes.

“These categories remain interpretive abstractions rather than naturally given classes.”

Classified as probably not a substantial claim.

Our findings should be read as an account of public governance interfaces rather than a complete account of every path through which OSS projects actually process AI-related contributions.

“Our findings should therefore be read as an account of public governance interfaces rather than a complete account of every path through which OSS projects actually process AI-related contributions.”

• AssumptionRests on an assumption: Actual governance may depend on private maintainer discussions, discretionary triage, informal coordination, moderation practices, or security workflows that are not visible in repository texts.

Probably not a substantial claim: may not pass S3 (load-bearing).

Pull-based development has always faced 'review friction'.

“Pull-based development has always faced 'review friction' [21]”

• cites [21] [21] Georgios Gousios, Martin Pinzger, and Arie van Deursen. 2014. An exploratory study of the pull-based software development model. In Proceedings of the 36th International Conference on Software Engineering . Association for Computing Machinery, New York, NY, USA, 345-355. doi:10.1145/2568225.2568260 - sourceNot checked — no full text of the source

Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

Treating a review-throughput problem as an AI-specific one leads to over-engineering new AI gates where existing quality controls suffice, whereas treating a provenance or accountability problem as generic quality control leads to under-engineering.

“Treating a review-throughput problem as an AI-specific one leads to over-engineering-new AI gates where existing quality controls suffice-whereas treating a provenance or accountability problem as generic quality control leads to under-engineering.”

Classified as probably not a substantial claim. May combine two claims.

We also do not directly evaluate the causal effectiveness of these rules or whether they are enforced uniformly.

“We also do not directly evaluate the causal effectiveness of these rules or whether they are enforced uniformly.”

Classified as probably not a substantial claim.

This study analyzes governance as it is publicly expressed and institutionally encoded in project materials.

“This study analyzes governance as it is publicly expressed and institutionally encoded in project materials.”

Classified as probably not a substantial claim.

This limitation is unlikely to invalidate the descriptive taxonomy.

“Most analyzed materials are maintainer-authored or directly linked from the projects' own governance texts, so this limitation is unlikely to invalidate the descriptive taxonomy, though it does bound what we can claim about intent, enforcement, and outcomes.”

Probably not a substantial claim: may not pass S4 (based).

Tooling governance depends heavily on whether tools and agent ecosystems actually read and comply with repository-level instructions.

“First, it depends heavily on whether tools and agent ecosystems actually read and comply with repository-level instructions.”

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

Shipping features that encourage 'effortless-to-produce but expensive-to-validate' contributions without providing the tools to detect, prioritize, or block them creates an unsustainable burden on the community.

“Shipping features that encourage 'effortless-to-produce but expensive-to-validate' contributions without providing the tools to detect, prioritize, or block them creates an unsustainable burden on the community.”

• AssumptionRests on an assumption: GenAI creates a radical socio-technical asymmetry, where the cost of producing a plausible, complete-looking PR approaches zero, while the cost of reviewing it remains high or even increases.

Probably not a substantial claim: may not pass S3 (load-bearing).

Agent-Trace [9] proposes a machine-readable provenance format of AI contributions, conversation links, and file- or line-level attribution, to shift the burden of 'proof of work' from human disclosure to tool-level transparency.

“Similarly, Agent-Trace [9] proposes a machine-readable provenance format of AI contributions, conversation links, and file- or line-level attribution, to shift the burden of 'proof of work' from human disclosure to tool-level transparency.”

• cites [9] [9] Cursor Contributors. 2026. Agent Trace. Open specification, version 0.1.0 (RFC). https://agent-trace.dev/ Accessed: 2026-03-27. -Not checked yet

  Not checked in the free run.

May combine two claims.

By addressing harmful input at the level of institutional reward rather than downstream filtering, incentive redesign functions as a high-cost governance escalation that may also discourage some good-faith participation.

“By addressing harmful input at the level of institutional reward rather than downstream filtering, this strategy functions as a high-cost governance escalation that may also discourage some good-faith participation.”

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing). May combine two claims.

The three orientations are best understood as ideal-typical dominant logics, and orientation counts should therefore be read as approximate patterning rather than sharp natural groupings, especially near the O2/O3 boundary.

“The three orientations are best understood as ideal-typical dominant logics, and orientation counts should therefore be read as approximate patterning rather than sharp natural groupings, especially near the O2/O3 boundary.”

Probably not a substantial claim: may not pass S2 (checkable).

Identifying the right orientation tells maintainers which family of strategies to use first, protecting the project without blocking valuable human-AI collaboration.

“Identifying the right orientation tells maintainers which family of strategies to use first, protecting the project without blocking valuable human-AI collaboration.”

Classified as probably not a substantial claim.

This limitation does bound what we can claim about intent, enforcement, and outcomes.

“Most analyzed materials are maintainer-authored or directly linked from the projects' own governance texts, so this limitation is unlikely to invalidate the descriptive taxonomy, though it does bound what we can claim about intent, enforcement, and outcomes.”

Probably not a substantial claim: may not pass S2 (checkable).

The future of OSS governance lies not just in writing better markdown files, but in reconfiguring the infrastructure itself to make GenAI contributions legible and governable by default.

“These shifts suggest that the future of OSS governance lies not just in writing better markdown files, but in reconfiguring the infrastructure itself to make GenAI contributions legible and governable by default.”

May combine two claims.

Vouch [22] reframes entry as a web-of-trust problem, where contributions are filtered based on endorsement before review: participants may need to be vouched for before interacting with selected project surfaces, and projects can extend this further into a web-of-trust model across repositories.

“For example, Vouch [22] reframes entry as a web-of-trust problem, where contributions are filtered based on endorsement before review: participants may need to be vouched for before interacting with selected project surfaces, and projects can extend this further into a web-of-trust model across repositories.”

• cites [22] [22] Mitchell Hashimoto and Vouch Contributors. 2026. Vouch. GitHub repository. https://github.com/mitchellh/vouch Accessed: 2026-03-27. -Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S2 (checkable).

There is no 'one-size-fits-all' AI policy.

“For maintainers , the immediate implication is that there is no 'onesize-fits-all' AI policy.”

Probably not a substantial claim: may not pass S2 (checkable).

The O2/O3 distinction matters for practice.

“The O2/O3 distinction matters for practice.”

May combine two claims.

The benefit of verification and evidence gating is reducing secondary verification cost during review; the trade-off is a clear increase in submission preparation cost.

“The benefit is reducing secondary verification cost during review; the trade-off is a clear increase in submission preparation cost.”

May combine two claims.

The costs of channel, venue, and platform reconfiguration are substantial: contributors must adapt to new channels or platforms, and projects assume new infrastructural burdens and potential ecosystem friction.

“Its costs, however, are substantial. Contributors must adapt to new channels or platforms, and projects assume new infrastructural burdens and potential ecosystem friction.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Our analysis is a cross-sectional account of one time window.

“Our analysis is thus a cross-sectional account of one time window, and later governance changes may alter how particular OSS projects are best interpreted.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Strategy findings are less sensitive to that boundary because strategy presence was coded independently of orientation.

“Strategy findings are less sensitive to that boundary because strategy presence was coded independently of orientation.”

Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

Projects using tooling governance must maintain a layer of policy text written for machine consumption and keep it aligned with ordinary contributor-facing rules.

“Second, projects themselves must maintain a layer of policy text written for machine consumption and keep it aligned with ordinary contributor-facing rules.”