AI policy for contributions

[seisman]

As AI-assisted tools are now commonplace in open-source development, PyGMT should document a policy for their use in contributions.

Here are some useful resources (I haven't look at them carefully):

• List of AI policies by different open source projects: https://github.com/melissawm/open-source-ai-contribution-policies
• https://blog.scientific-python.org/scientific-python/community-considerations-around-ai/
• https://discuss.scientific-python.org/t/a-policy-on-generative-ai-assisted-contributions/1702

[sjh9714]

Another resource for the pile — this one empirical rather than a policy text.

I scanned 2,204 recently merged agent-authored PRs (Devin, GitHub Copilot's coding agent, Codex, Claude Code, Cursor) on public repositories, read-only via the GitHub API with deterministic checks and no LLM judgment, to see what agent PRs actually do rather than what policies assume they do.

Zero of the 2,204 declared, in any machine-checkable form, what they intended to change. Of the 349 that touched CI workflows or package manifests, 12.9% escalated workflow permissions and 17.5% added unpinned actions. 3.9% edited agent instruction files (AGENTS.md, CLAUDE.md, .mcp.json). Repositories with 10k+ stars had roughly half the finding rate of the long tail.

The practical takeaway for a draft: most published policies ask for disclosure, which is self-reported and unverifiable. The things that actually consume reviewer time — scope, CI permission changes, and edits to agent instruction files — are checkable from the PR itself without having to trust the author's answer. It may be worth deciding up front which of your clauses you want to be verifiable and which are aspirational.

Methodology and all queries are public: https://github.com/sjh9714/mergewarden/blob/main/docs/study/methodology.md — findings there are review evidence, not vulnerability claims, and no repositories are named.

[weiji14]

Thanks for opening this discussion @seisman, and @sjh9714 for the comments. I have my own personal opinions on using cloud-hosted frontier models, but would defer to more active maintainers in the PyGMT project on what is a reasonable stance on AI-assistance going forward. If possible, I think we should discuss the principles of what kinds of AI-assisted contributions should or should not be accepted, much like what matplotlib has documented, and then use those principles to guide our stance on an (semi-)enforceable policy.

Will leave this thread open for others to pitch in before saying more.