AI-Assisted Contributions
// How We Work With AI
We use AI tools in our work, and we think you are entitled to know exactly how. This is the same policy we publish on our open source repositories and apply to client work. It exists because "an AI wrote it" is never an acceptable answer to "why did this break?"
Allowed uses
- Code generation, refactoring, and bug fixes within the scope of an explicitly described task.
- Writing or updating tests, documentation, and changelog entries.
- Architectural analysis and design recommendations — provided a human reviews and approves them before any implementation begins.
Rules for AI coding agents
- Branch before coding. The agent creates and checks out a new branch from the default branch before writing any code, following the feat/, fix/, refactor/, or chore/ prefix convention. Direct commits to the default branch are never allowed.
- Produce a PR description before finishing. Every coding session ends with a written summary of the changes: title, type of change, summary, breaking changes, migration notes, and a test plan checklist.
- No autonomous commits. The agent never commits or pushes without explicit human instruction. Every commit requires a human to review the diff and approve it first.
- No destructive git operations. No force pushes, hard resets, or branch deletions without explicit human confirmation.
- Scope discipline. The agent modifies only files directly related to the described task. It does not refactor, reformat, or add documentation to files it was not asked to touch.
- No secret handling. The agent never reads, writes, or commits files that may contain credentials, API keys, or environment secrets — .env files, private keys, certificates, and the like.
- Dependency changes require approval. Any addition, removal, or version change in the project's dependency manifest must be explicitly requested by a human before it is applied.
- Architecture changes require prior agreement. Anything affecting a public API, layer boundaries, or a plugin or extension registry is discussed and agreed before implementation.
- The repository's agent instructions are the source of truth. The agent reads and follows them at the start of every session, and surfaces any conflict between those instructions and a user request to a human before proceeding.
Who is responsible
- They have reviewed every AI-generated change line by line.
- They have run the project's static analysis and full test suite locally before submitting.
- They accept sole responsibility for any defects, regressions, or security issues the code introduces.
This policy is enforced in our own open source repositories, where the branch history, the reviews, and the release pipeline are all public. You are welcome to check that we hold to it.
Want this in writing on your project?
If your procurement or security team needs a written answer on how AI is used in the code you are buying, this is it — and we are happy to attach it to a contract. Tell us what you are building and we will come back with a written estimate covering scope, timeline, and cost.