discussion: guidelines for AI-assisted contributions

[Yaxuan-w]

AI-assisted contributions (code, docs, reviews) are becoming common in our project on either documentation or coding. Right now we don't have any written guidance on this, so contributors have to guess what's expected.

This issue is to discuss what the policy should cover. Some questions need to be discussed:

• Should PRs note when they are substantially AI-assisted (e.g., a line in the PR description or a Co-Authored-By / Assisted-by trailer)?
• Regardless of tooling, the contributor submitting a PR is responsible for understanding and testing it. Do we want to state this explicitly in CONTRIBUTING or in AI Policy file?
• Should reviewers treat AI-assisted PRs any differently, or is our normal review bar sufficient?
• Does the same guidance apply to code, docs, and issue/PR discussions, or do we only care about code?

My personal leaning on the questions above

• Any tools are fine, but human-in-the-loop is required. Contributors must read and review all AI-generated code or text themselves before asking others to review it.
• Disclosure is voluntary but AI must not be listed in Co-authored-by. Only humans can be authors and take on the accountability that comes with authorship.
• The core principle is preventing "extractive contributions": a contribution should be worth more to the project than the maintainer time it takes to review it. Sending unreviewed LLM output to maintainers extracts their time.
• Copyright responsibility stays with the contributor: regenerating copyrighted material with an AI tool does not remove the copyright.
• Same guidance applies to all parts.

We could follow the structure used by the Bytecode Alliance wasmtime:

• An org-level policy file, AI_TOOL_POLICY.md, lives in their governance repo. For us that would be this community repo.
• Each active project repo carries a thin AGENTS.md with a few hard rules for AI tools themselves (no auto-opened PRs, no auto-comments/reviews, no AI in Co-authored-by), each pointing back to the org-level policy.

Their policy is itself a lightly adapted copy of the LLVM AI Tool Use Policy, which in turn is based on the Fedora Council's policy on AI-assisted contributions, and all under permissive licenses. We can adapt this and add attribution.

[JustinCappos]

You can also look at the guidance for other projects. gittuf follows the guidance from the openSSF, etc. and seems to be handling this well. It's mostly just a field in any PR that get submitted.

[Uk-jake]

I agree. I've also been interested in this topic. I'll look into how other open source projects handle AI guidelines and usage. Adding clear policies will be very helpful for our project.