Policy for AI tools usage

[d1nuc0m]

It may be time to have an explicit policy about AI tools usage, many project now have it, one way or another. See for example:

• Fedora
• Gentoo
• Linux Kernel
• OpenInfra

[d1nuc0m]

My personal opinion: I'd go with something like Gentoo policy. Copyright is unclear + I share the ethical concerns, especially after episodes like matplotlib and AI agents.

[bastelfreak]

I share the same concerns as the Gentoo policy. Especially the legal risks.

[binford2k]

My biggest concern here is that if we don't have a solid and defensible policy, then bits will just keep getting merged here and there without any coherence. Then we have to either retrofit a policy, or go back and remove contributions, neither of which sounds pleasant.

[NeatNerdPrime]

Creating an MCP - Model Context Protocol - and license that under GPL3 would most likely solve many issues. In doing so it would tell AI (any AI) to follow the 'openvox' specifications:

For more information on MCP's: https://github.com/modelcontextprotocol

I'm working on such an MCP starting from the ruby-sdk.

[d1nuc0m]

@binford2k acceptance of the policy could be integrated in the DCO (yet another issue XD)? Maybe it's possible to enforce a policy only after a certain date? Some previous contributions might not have been disclosed as AI-helped, retrofitting/removing might not be possible

[binford2k]

@d1nuc0m yes, I have a PR open to start the DCO implementation and I was intending to add the AI policy right alongside.
OpenVoxProject/.github#10

[maxadamo]

Isn’t the new Puppet Server CA (the one that was written in Go) entirely vibe-coded?
I share the Gentoo community’s concerns and frustrations and I also remember the person who said “there’s no Claude. It’s just other people’s code”. However, I’m wondering if they’re realistic and how long these anti-AI policies will last (at Stack Overflow, they changed their AI policies quickly).
I imagine in a couple of months we could be facing a lack of proper AI adoption policies.
AI can certainly help reviewing the PRs and can be useful in several tasks.

[d1nuc0m]

Isn’t the new Puppet Server CA (the one that was written in Go) entirely vibe-coded?

Ooof, are you sure? O.o

(at Stack Overflow, they changed their AI policies quickly).

I mean, they had to generate revenue somehow

AI can certainly help reviewing the PRs and can be useful in several tasks.

I guess reviews are less problematic on a copyright side, as they're not inserting anything in the code

[maxadamo]

Isn’t the new Puppet Server CA (the one that was written in Go) entirely vibe-coded?

Ooof, are you sure? O.o

Yes, Trevor states this in the README: https://github.com/trevor-vaughan/golang-puppet-ca.
I also created a project where 90% of the JavaScript code is generated by Copilot (but my project is not linked to OpenVox)

This is why I believe an anti-AI policy is unrealistic.
Furthermore, if only Gentoo is raising the copyright issue I tend to doubt it’s true.
The Linux kernel and Fedora don’t mention copyright at all.
OpenInfra is simply requesting that AI be configured to respect open-source licensing.

We use Mend (formerly WhiteSource) to scan for licensing issues, but algorithms do not belong to anyone.

Finally, code can be copied even without AI though it would be an intentional act by someone who becomes liable.

[binford2k]

Isn’t the new Puppet Server CA (the one that was written in Go) entirely vibe-coded?

I would phrase that as "A new Puppet Server CA".

It's only one example and people may or may not use it. Our intention is to make the interface pluggable such that the end user can choose the implementation so that it can more cleanly tie into existing infrastructure.

[d1nuc0m]

My thoughts after the last monthly sync...

Disclosure

As the AI usage seems to be inevitable, I'd request disclosure of AI usage (see Fedora/Linux policies) and of model used (in case there might be issues with a specific model) and the DCO where the contributor claims they have all the rights to use that code. Personally I'd not use AI but this would not forbid others.

Human in the loop

Question - do we want to specifically request a human in the loop? Matplotlib case is extreme, but it is a reminder that there are fully autonomous agents contributing to FOSS around. I'd lean for yes/human in the loop, because “A computer can never be held accountable, therefore a computer must never make a management decision.” (IBM Training Manual, 1979).

"Slop" prevention

Do we want to have a policy to close PRs in case the contributor is clearly not understanding the code they wrote/just feeding it into an LLM/not responding to questions?

[binford2k]

@d1nuc0m did you see the wiki page we talked about? https://github.com/voxpupuli/community-triage/wiki/Working-space-for-crafting-our-AI-policy

[d1nuc0m]

@binford2k thanks, I thought we had to discuss here first