Over the previous yr numerous well-known open supply initiatives have drawn a tough line on AI. The
causes are comprehensible, and in a number of instances the maintainers have been proper to behave. However Aurelia is
going to take a distinct place, and we wish to be clear about it.
The Aurelia group is pro-AI.
That sentence will rub some individuals the incorrect method, so here’s what we imply by it and the place the bounds
are.
Why initiatives are closing up
The shift has been arduous to overlook. In January 2026, curl shut down its six yr previous bug bounty program
as a result of the safety group was being buried in AI generated vulnerability experiences. The maintainers
described lengthy, assured, fully fabricated submissions. By late 2025 solely round one in twenty
to 1 in thirty experiences have been actual, down from roughly one in six a yr earlier. Daniel Stenberg
known as it an try to take away the motivation for submitting made up lies.
He’s not alone. Ghostty moved to a zero tolerance coverage, solely permitting AI assisted contributions
for pre accepted points and current maintainers. tldraw began auto closing exterior pull requests.
On the distribution stage, Gentoo forbids contributions created with the help of pure
language processing instruments, NetBSD treats LLM generated code as presumed tainted and off limits
with out prior written approval, and QEMU rejects code recognized and even suspected to have been produced
by an LLM. There’s now even a maintained index of initiatives that reject AI generated code.
We get it. While you preserve one thing vital and the queue fills with believable trying nonsense
sooner than people can triage it, closing the door is usually the one lever left. Exhausting accountable anybody
for pulling it.
Our place
We don’t suppose the reply for Aurelia is to ban a class of device.
We care about one factor: the standard of what lands within the framework and its packages. How you bought
there may be what you are promoting. Whether or not a change was hand written, drafted by an agent, or someplace in
between doesn’t change the bar it has to clear. Each submission is held to the identical commonplace.
This works in each instructions. An AI assisted pull request doesn’t begin with a strike towards it,
and a hand coded one doesn’t get waved by means of on precept. We evaluate the code, the checks, the
reasoning, and the influence on the remainder of the framework. The place it got here from doesn’t enter into it.
Price remembering: curl got here again to HackerOne a couple of month after shutting this system
down. The fashions had improved and the standard of actual experiences went up. That’s roughly how we see the
trajectory too. The tooling retains getting higher, and treating an entire class of contributor as responsible
by default ages badly.
There’s a motive we lean this fashion. We already shipped
expertise for AI coding
brokers
in order that instruments like Claude Code and Codex
have correct Aurelia 2 context as an alternative of guessing from previous examples. We wish individuals constructing on
Aurelia with no matter instruments make them productive. Closing the door on those self same instruments at
contribution time can be inconsistent.
This isn’t a licence to submit slop
Being pro-AI isn’t an invite to throw generated code over the wall and hope a maintainer cleans
it up. That’s the behaviour that broke issues for everybody else, and we’re not inquisitive about
inheriting it.
For those who open a pull request, you personal it. You might be vouching for it. Saying an agent wrote it isn’t an
clarification for why it’s incorrect, untested, or subtly breaks an edge case you by no means checked. The Linux
kernel landed on a smart model of this: AI code is allowed, however the human who submits it’s on
the hook for it. We really feel the identical method.
So earlier than you open that pull request:
- Perceive the change. For those who can not clarify what it does and why, it isn’t prepared.
- Run it. Ensure
npm run constructpasses and the related checks are inexperienced. - Add checks for brand new behaviour. Generated code that adjustments behaviour with out protection isn’t achieved.
- Maintain it scoped. Sprawling, speculative refactors are arduous to evaluate regardless of who or what wrote
them. - Don’t paste a wall of assured prose into the outline. Inform us what modified and the way you already know
it really works.
None of that is new. It’s the identical factor we’ve all the time requested of contributors. AI simply makes it
simpler to supply a number of output shortly, which suggests it’s simpler than ever to supply a number of
output that appears completed and isn’t.
The bar doesn’t transfer
If a change improves Aurelia, is nicely examined, matches the structure, and doesn’t compromise the
framework or its packages, we wish it. Whether or not you typed each character or labored alongside an agent
to get there makes no distinction to us.
If a change is sloppy, untested, or doesn’t maintain up underneath evaluate, it will get the identical response it could
have a decade in the past, regardless of the way it was produced.
That’s all there may be to it. Use no matter instruments make you quicker, and maintain the work to the identical bar
everybody else has to clear.
Sources and additional studying:
