fixup! doc: create ai-guidelines and include to CONTRIBUTING

Author: RafaelGSS

doc/contributing/ai-guidelines.md

@@ -1,16 +1,14 @@
 # AI use policy and guidelines
 
 * [Core principle](#core-principle)
-* [Using AI for code contributions](#using-ai-for-code-contributions)
-* [Using AI for communication](#using-ai-for-communication)
+* [When AI is used in contributions](#when-ai-is-used-in-contributions)
+* [When AI is used in communications](#when-ai-is-used-in-communications)
 
 This document aligns with the [OpenJS Foundation AI Coding Assistants Policy][].
 
 ## Core principle
 
-Node.js expects contributions to come from _people_. Contributors are free
-to use whatever tools they choose, including AI assistants, but such tools
-never replace the contributor's own understanding and responsibility.
+Tools should never replace human judgment, regardless of whether they are powered by AI.
 
 Node.js requires contributors to understand and take full responsibility for
 every change they propose. The answer to "Why is X an improvement?" can
@@ -20,13 +18,15 @@ If AI tools assisted in generating a contribution, acknowledge that honestly.
 Regardless of how much code is generated by AI, disclosure does not serve
 as a disclaimer of responsibility.
 
-The contributor remains the sole author and bears full responsibility for every line.
-If the disclosure involves trademarks or commercial brands, it's recommended to
-anonymize it in the commit message or only mention the brand/trademark in the
-PR description, but not in the commit message, unless the context would not
-have made sense without mentioning the specific brand/trademark. The goal
-is to prevent the commit messages, which are part of the codebase, from being
-abused for profit-driven marketing.
+Be aware that the mention of for-profit trademarks or commercial brands in commit
+messages, which are part of the code base, can be abused for profit-driven marketing.
+If the disclosure involves for-profit trademarks or commercial brands, it's
+recommended to either anonymize the branding (e.g. say `a frontier reasoning model`,
+`a closed-source coding agent` instead of `<brand>`), or only mention the
+for-profit brand/trademark in the PR description, but not in the commit message,
+unless the message would not have made sense without mentioning the specific
+brand/trademark. These recommendations only apply to for-profit tools/models, not
+any non-profit ones.
 
 Pull requests that contain AI-generated code the contributor has not
 personally understood, tested, and verified waste collaborator time and
@@ -41,36 +41,30 @@ approved in advance by the project. To request approval, either open an issue in
 be done in the form of a GitHub workflow, submit a pull request to add the workflow
 and use the usual pull request review process to seek consensus.
 
-## Using AI for code contributions
+## When AI is used in contributions
 
 Contributors may use AI tools to assist with contributions, but such tools
 never replace human judgment.
 
 When using AI as a coding assistant:
 
 * **Understand the codebase first.** Do not skip familiarizing yourself with
-  the relevant subsystem. LLMs frequently produce inaccurate descriptions of
-  Node.js internals — always verify against the actual source. When using an AI
-  tool, ask it to cite the exact source it’s relying on, and then
-  match the claim against that resource to verify if it holds up in the current
-  code.
+  the relevant subsystem. Always verify analysis generated by tools against
+  the actual source code with human judgement.
 
 * **Own every line you submit.** You are responsible for all code in your
-  pull request, regardless of how it was generated. This includes ensuring
-  that AI-generated or AI-assisted contributions satisfy the project's
-  [Developer's Certificate of Origin][] and licensing requirements. Be
-  prepared to explain any change in detail during review.
-
-* **Keep logical commits.** Structure commits coherently even when an LLM
-  generates multiple changes at once. Follow the existing
-  [commit message guidelines][].
-
-* **Test thoroughly.** AI-generated code must pass the full test suite and
-  any manually written tests relevant to the change. Existing tests should not
-  be removed or modified without human verification. Do not rely on the LLM
-  to assess correctness. It is crucial to manually verify the correctness of
-  tests against the expected behavior of the feature being tested,
-  independently of the feature's implementation.
+  pull request, regardless of how it was created. The submitted changes
+  must satisfy the project's [Developer's Certificate of Origin][] and licensing
+  requirements. Be prepared to explain any change in detail during review.
+
+* **Keep the commits logical.** The [commit message guidelines][]
+  and [commit squashing guidelines](./pull-requests.md#commit-squashing)
+  must be followed regardless of what tool is used in the pull request.
+
+* **Test thoroughly.** Existing tests should not be removed or modified
+  without human verification. It is crucial to verify, with human judgement,
+  the correctness of new tests against the expected behavior of the feature being
+  tested, independently of the feature's implementation.
 
 * **Do not disappear.** If you open a PR, follow it through. Respond to
   feedback and iterate until the work lands or is explicitly closed. If you
@@ -79,20 +73,20 @@ When using AI as a coding assistant:
 * **Do not use AI to claim "good first issue" tasks.** These issues exist to
   help new contributors learn the codebase and processes hands-on.
 
-* **Edit generated comments critically.** LLM-generated comments are often
-  verbose or inaccurate. Remove comments that simply restate what the code
-  does; add comments only where the logic is non-obvious.
+* **Keep the comments useful.** Verify with human judgement that the
+  comments are necessary and accurate. Remove comments that simply
+  restate what the code does. Add comments only where the logic is non-obvious.
 
-## Using AI for communication
+## When AI is used in communications
 
 Node.js values concise, precise communication that respects collaborator and contributor time.
 
-* **Do not post messages generated entirely by AI** in pull requests, issues, or the
-  project's communication channels.
-* **Verify accuracy** of any LLM-generated content before including it in a
-  PR description or comment.
-* **Link to primary sources** — code, documentation, specifications — rather
-  than quoting LLM answers or linking to LLM chats.
+* **Do not paste messages generated entirely by AI** in pull requests, issues, or the
+  project's communication channels. Such communication may be removed in accordance
+  to [the Node.js moderation policy](https://github.com/nodejs/admin/blob/main/Moderation-Policy.md).
+* **Verify claims about the code with human judgement before using them in communications**. Results
+  from AI tools should only be treated as hypothesis. Link to actual code, documentation and
+  specifications as source of truth.
 * Grammar and spell-check tools are acceptable when they improve clarity and
   conciseness.