AI policy for contributions

[seisman]

As AI-assisted tools are now commonplace in open-source development, PyGMT should document a policy for their use in contributions.

Here are some useful resources (I haven't look at them carefully):

• List of AI policies by different open source projects: https://github.com/melissawm/open-source-ai-contribution-policies
• https://blog.scientific-python.org/scientific-python/community-considerations-around-ai/
• https://discuss.scientific-python.org/t/a-policy-on-generative-ai-assisted-contributions/1702

[sjh9714]

Another resource for the pile — this one empirical rather than a policy text.

I scanned 2,204 recently merged agent-authored PRs (Devin, GitHub Copilot's coding agent, Codex, Claude Code, Cursor) on public repositories, read-only via the GitHub API with deterministic checks and no LLM judgment, to see what agent PRs actually do rather than what policies assume they do.

Zero of the 2,204 declared, in any machine-checkable form, what they intended to change. Of the 349 that touched CI workflows or package manifests, 12.9% escalated workflow permissions and 17.5% added unpinned actions. 3.9% edited agent instruction files (AGENTS.md, CLAUDE.md, .mcp.json). Repositories with 10k+ stars had roughly half the finding rate of the long tail.

The practical takeaway for a draft: most published policies ask for disclosure, which is self-reported and unverifiable. The things that actually consume reviewer time — scope, CI permission changes, and edits to agent instruction files — are checkable from the PR itself without having to trust the author's answer. It may be worth deciding up front which of your clauses you want to be verifiable and which are aspirational.

Methodology and all queries are public: https://github.com/sjh9714/mergewarden/blob/main/docs/study/methodology.md — findings there are review evidence, not vulnerability claims, and no repositories are named.