feat(ci): vouch first-time contributors, and say the rule about understanding - #605
Merged
Conversation
…standing Two things, and the second is the one that costs nothing. The vouch check closes a pull request from an account that has not been vouched and comments explaining how to get vouched. The judgement stays human: a maintainer comments /vouch @username, the command workflow appends to the list, and the check only ever reads it. Nothing here scores anybody. That distinction is deliberate. This repository already runs a contributor reputation check that computes a judgement about a person, and that mechanism was withdrawn at CoSAI WS4 after the 20 August call because it produced false and operationally misleading signals. Automating the enforcement of a human decision is a different thing from automating the decision. Running both would score and gate the same contributor, so they should not both stay; that is a separate call and this change does not make it. The list lives on a dedicated orphan branch, seeded with the 17 accounts that already have a merged pull request here so nobody who has contributed before gets turned away. The check reads it from that branch rather than from the pull request branch, because an author can edit any file in their own fork. It fails open: an unreadable list is our problem, and silently closing every pull request would be worse than letting one through. CONTRIBUTING also gains the rule worth having whether or not the gate ships: use agents, and understand what you submit. If you cannot explain a change with the agent closed, do not open the pull request. The pattern comes from another open-source project running the same kind of gate. The idea worth borrowing was keeping the list off the pull request branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Uc16CsknaQ9PTLxGj8TXXj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pilot in one repository, deliberately not merged. There is a decision below that has to come first.
The decision blocking merge
This repository already runs
contributor-check.yml, a contributor reputation check that computes a judgement about a person onpull_request_target. That is the mechanism withdrawn at CoSAI WS4 after the 20 August call, because it produced false and operationally misleading signals.If both ship, a first-time contributor gets scored and gated. They should not both stay. This PR does not remove the old one, because retiring an existing control is not a call to make silently.
What this adds
A gate where the judgement stays human. A maintainer comments
/vouch @username;vouch-command.ymlappends to the list;vouch-check.ymlonly ever reads it. Nothing here scores anybody. Automating the enforcement of a human decision is a different thing from automating the decision, and that difference is why this shape survives contact with a community and the reputation check did not.The list is seeded. 17 accounts, everyone with a merged PR in this repo, on a dedicated orphan
vouchedbranch. Turning this on turns nobody away who has already contributed.It reads the list off the
vouchedbranch, never the PR branch. An author can edit any file in their own fork. This is the detail most worth getting right.It fails open. An unreadable list is our problem; silently closing every PR would be worse than letting one through.
No new secret. Uses the permission API rather than org membership, so anyone who can already push is skipped without a PAT.
Nothing from the PR is checked out. It runs on
pull_request_targetwith a write-capable token, so it must never execute code from the incoming branch, and it does not.The half that costs nothing
CONTRIBUTING.mdgains the understanding rule: use agents, a lot of this was built with them, and if you cannot explain your change with the agent closed, do not open the PR. That belongs in every repository including the spec ones, gate or no gate, and it answers the "feels vibe coded" feedback already on the record from the AAIF Technical Committee.Scope
Not proposed for
trace-specortrace-registry. A vendor-run gate on a specification heading into foundation governance is the wrong shape, andTERMS.mdin the registry says "anyone may register as a producer and submit records."🤖 Generated with Claude Code
https://claude.ai/code/session_01Uc16CsknaQ9PTLxGj8TXXj