AI Usage Policy

[thesoundhead]

Since the development process involves AI agents, I think it would be a good idea to document a statement on how these are used and e.g. if a final human review is mandatory. What do you guys think?

[thesoundhead]

To be more clear: The statement should refer to the role AI agents play in development, whether a full human review is mandatory before anything gets merged (I'd argue it should be, and that saying so is the single most valuable sentence in the whole document), and whether contributors should disclose AI assistance in their PRs. Given that Yuvomi handles fairly sensitive data, a plain statement that a human has read and understood every merged line is cheap reassurance to offer.

[LEON-BROTHER]

I agree on this topic :)

[ulsklyc]

This is now in CONTRIBUTING.md, shipped today.

You asked for three things, and you get three answers - one of which is not the one you argued for.

The role agents play. Stated plainly rather than left to inference: they are used here extensively, much of this repository was drafted with them, and two of them review pull requests automatically. Contributors will see those comments on their own PRs, so the document also says what they are not - a second pair of eyes with no authority to merge anything.

Disclosure. Yes, asked for, and framed as practical rather than moral: one line in the PR description, no mark against the contribution. The reason it is worth asking is that generated code fails in different places than hand-written code does - plausible APIs that do not exist, tests that assert what the implementation happens to do rather than what it should. Knowing where to look is worth more than a policy about it.

Mandatory full human review - here I did not write the sentence you wanted. You called it the single most valuable sentence in the document, and I think you are right about why: it is the one a reader with sensitive data in the app most wants to see. But "a human has read and understood every merged line" is not something a one-person project shipping several releases a week can keep, and a promise that cannot be kept is worse than none, because it earns exactly the trust it does not deserve.

So the document says what is true instead. Every merge is performed by the maintainer, including dependency updates and outside contributions - there is no path by which an agent merges its own work. Beyond that decision, three things are mechanical: the full suite runs on every PR and red is not merged, the Hard Constraints are enforced by tests rather than intentions, and a claimed fix carries a test that failed before it. Where a change touches authentication, permissions, storage or anything reaching the network, the review is line by line.

That is a weaker claim than the one you asked for and a verifiable one, which I would rather have in a document about trust.