Re: Ballot option: Allow AI-Assisted Contributions

Hi Nilesh,

On 04/08/26 at 14:55 +0000, Nilesh Patra wrote:
> Hi Lucas,
> 
> Thanks for drafting this proposal. I had a couple of queries, see below-
> 
> On Wed, Jul 22, 2026 at 09:31:10PM +0200, Lucas Nussbaum wrote:
> > The Debian project allows AI-assisted contributions (partially or fully
> > generated by an LLM), provided the following conditions are met:
> > 
> > 1. **Legal Compatibility:** Contributors should ensure that the terms and
> >    conditions of the generative AI tool do not impose contractual
> >    restrictions that conflict with the distribution, modification, or use of
> >    the output in the context of Debian.
> 
> I am not sure how one fully could ascertain that. Is code generated by
> ChatGPT/claude/codex/cursor/gemini (which most of the LLM users make use
> of these days) satisfy this criteria?
> 
> Similar to https://wiki.debian.org/DFSGLicenses would it be possible to
> have a list of such LLMs which are acceptable?

AFAIK, none of the commonly used tools or APIs make claims over
copyright or other aspects that would be a problem (so they are all OK
AFAIK).

> > 4. **Explicit Disclosure:** When a significant portion of the contribution
> >    is taken from a tool without manual modification, contributors should
> >    disclose the tool's use. This may be recorded using Git trailers, such as
> >    `Generated-By:` or `Assisted-By:`.
> 
> This is a good point, but honestly, I really doubt if a new contributor
> is going to read in detail all of this proposal. In many cases,
> contributors may deliberately not disclose AI usage. Is there a way to
> enforce this policy? The same goes for the "Accountability" point.
> 
> Also, could the wording be changed to "contributors *must* disclose
> tool's usage"?

This ballot option is a position statement, not a set of hard rules part
of Codes of Conduct. It should be read as a set of strongly recommended
practices. Also in the discussion, some good points were made about why
some contributors might prefer not to disclose AI use. So I think that
"should" is more appropriate here.

> > 5. **Prior Discussion of Bulk or Automated Changes:** Similarly to the
> >    mass-bug filing process (Developers Reference section 7.1.1),
> >    contributors should discuss their intention before submitting bulk or
> >    autonomously generated contributions. Any such automated process should
> >    be overseen by a human who remains accountable for its behavior and
> >    output.
> 
> I wanted to discuss a little bit on the lines of this point. I'm not
> sure if a proposal could help with this situation - but I will ask you
> anyway.
> 
> A problem that I have heard about from other open source maintainers is
> that they are seeing a wave of large amount of PRs completely written by
> AI which have no utility and are really just "slop". I also got to know
> this is more common when the said projects participate in outreach
> programs like GSoC for instance, and a wave of slop happens to come from
> potential applicants which is further increasing because of easy
> accessibility to LLMs.
> 
> This is especially quite bad for Debian as we already have very limited
> volunteer time. Do you think it is possible to have a point and/or edit
> existing points which could stop us from getting in that situation?
> 
> PS: If someone wants to say that Debian should stop participating in
> outreach programs, this particular discussion is _not_ for that topic.
> Please do not respond to this mail if that is your solution.

I agree there is a risk here, but I'm not sure how to address it. It
looks hard to define how to draw the line -- an untolerable amount of
slop might arise from the combination of several contributors pushing a
small amount of slop. If that becomes an issue, maybe we should
investigate technical solutions. https://github.com/mitchellh/vouch
could be a source of inspiration here.

> > 6. **Community Courtesy:** To respect the preferences of project members who
> >    wish to avoid AI-generated content, contributors should clearly label
> >    such content in mailing list and bug discussions (e.g., by identifying
> >    such content with a clear disclaimer or a machine-readable tag like
> >    `[AI-Generated]`).
> 
> Could this be changed to "contributors *must* label such content"?

See my answer about disclosure above.

Lucas