mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-06 19:35:13 +02:00
37 lines
3.3 KiB
Markdown
37 lines
3.3 KiB
Markdown
|
# AI Contribution Policy
|
||
|
|
|
||
|
|
Nyx accepts contributions that were drafted, refactored, or reviewed with the help of AI tools (LLMs, code assistants, agent systems). We care about the contribution, not the keystrokes. AI changes the failure modes though, so we ask contributors to follow a few rules.
|
||
|
|
|
||
|
|
## What we ask of contributors
|
||
|
|
|
||
|
|
By opening a pull request you affirm that:
|
||
|
|
|
||
|
|
1. **You have read and understood every line you are submitting.** If you cannot explain a change under review, it is not ready to merge. "The model wrote it" is not an answer we will accept for a bug or a regression.
|
||
|
|
2. **You have the right to submit the code.** AI-generated code is only as license-clean as its training data and its prompt. Do not paste proprietary, GPL-incompatible, or confidential code into an AI tool and then submit the output here. If a model reproduced a substantial verbatim snippet from an identifiable source, disclose it.
|
||
|
|
3. **You take responsibility for the change.** The DCO `Signed-off-by:` trailer applies the same way to AI-assisted code as it does to hand-written code. You are certifying origin and right-to-submit.
|
||
|
|
4. **You disclose material AI use in the PR description.** A one-line note is enough. For example, "Drafted with an AI assistant; reviewed and tested by me." Trivial uses like tab-completion, renames, or formatting do not need to be called out. New analysis passes, rule logic, or security-relevant code do.
|
||
|
|
|
||
|
|
## What we look for in review
|
||
|
|
|
||
|
|
AI-assisted PRs face the same bar as any other PR, but reviewers will pay extra attention to:
|
||
|
|
|
||
|
|
- **Tests that exercise the new behavior.** Not just "it compiles." Fixtures under `tests/fixtures/` and assertions in `expected.yaml` are how we verify security logic.
|
||
|
|
- **Consistency with the existing engine.** Drive-by refactors, speculative abstractions, or parallel implementations of existing passes will usually be rejected, even if they look clean in isolation.
|
||
|
|
- **Fabricated references.** AI tools sometimes invent function names, crate APIs, CVE IDs, or citations. Every symbol referenced in a PR must exist, and every external claim must be verifiable.
|
||
|
|
- **Rule metadata honesty.** Rule descriptions, CWE mappings, and severity ratings are part of how downstream users triage. Do not inflate severity or cite CWEs the rule does not actually detect.
|
||
|
|
|
||
|
|
## What we will not accept
|
||
|
|
|
||
|
|
- PRs that are clearly unreviewed agent output, such as changes in the wrong file, nonsense tests, hallucinated APIs, or code that does not compile.
|
||
|
|
- PRs that add "AI-generated" boilerplate, marketing copy, or filler documentation to pad scope.
|
||
|
|
- Mass-generated PRs across many unrelated areas in a single change.
|
||
|
|
- Code that was generated by pasting another project's proprietary source into an AI tool.
|
||
|
|
|
||
|
|
## Project's own use of AI
|
||
|
|
|
||
|
|
For transparency, the README includes an [AI Disclosure](README.md#ai-disclosure) describing where AI was used in Nyx itself. The short version: the analysis engine is predominantly human-written and human-reviewed, while documentation, fixtures, and rule metadata were drafted with AI assistance and audited before landing. We hold outside contributions to the same standard.
|
||
|
|
|
||
|
|
## Questions
|
||
|
|
|
||
|
|
If you are unsure whether a contribution falls inside this policy, open a draft PR or an issue and ask before investing time. We would rather have the conversation early than reject work at review.
|