| mikal | So that's fine. Where can I find a clear written statement of that policy in a git repo or OpenStack website (i.e. not an IRC chat)? Can the foundation consider treating Co-Authored-By like DCO and assert that only entities which have signed the contribution / copyright assignment agreement may appear in the Co-Authored-By field, thus stopping LLMs | 01:41 |
|---|---|---|
| mikal | from being credited there? | 01:41 |
| mnasiadka | I sort of agree that we need to make it clear for developers and enforcable | 05:41 |
| fungi | i think step 1 would be for someone to propose an openstack-specific contribution policy, similar to the licensing requirements document. it would be fine to make it very small, referring back to the openinfra policy for ai generated content but then calling out anything openstack expects beyond that | 13:08 |
| fungi | raise the proposed change on the openstack-discuss mailing list, then see what feedback the community and tc have prior to getting it in shape to approve | 13:09 |
| TheJulia | mikal: I can raise the question regarding co-authored-by to the governing board, but if your seeking the permission to use co-authored-by instead of Assisted-by, the board is likely to reject because the board expects contributors to read/review and at least put a little bit of thought/effort into their changes and assert that the authors are the authors, and not the LLM because the result is based upon the context handed to the LLM. | 13:12 |
| fungi | hunting around, so far the only high-profile project i've come across that explicitly forbids co-authored-by for llms is kubernetes, but they enforced that by changing their cla checker to also require declared co-authors on commits to have agreed to their cla, so not really an approach we can mimic | 13:13 |
| TheJulia | Yeah, I was just typing something similar to that | 13:14 |
| fungi | also kubernetes is notable in further eschewing commit message trailers that mention llm tooling anyway, they expect that info to go in pull request descriptions, so a fairly github-specific solution | 13:14 |
| TheJulia | So, I know of at least one standards body which has also basically said "no co-authored-by" and "no mention of specific LLM usage" under the same basic concern that k8s had. | 13:16 |
| TheJulia | Coupled with under their agreements, they expect all rights waived to the community, so trying to tie back to an LLM at that point is super problematic | 13:16 |
| fungi | oh, as in not something they expressed *in* a standard, but requirements for people collaborating on developing standards? | 13:17 |
| TheJulia | yup | 13:17 |
| fungi | that makes sense, i would expect many organizations that require copyright assignment to share that concern | 13:18 |
| TheJulia | yeah, I think they intent to make the primary git repo more open and move to the DCO as well at some point, but... they have to navigate the legal side of their foundation structure as well. | 13:18 |
| * TheJulia shrugs | 13:18 | |
| TheJulia | Its that tension between ICs wanting specific readings or their perfect engagement pattern in their own minds, versus legal basically. A tale as old as... lawyers? | 13:19 |
| fungi | we had to basically dissolve our foundation in order to make that change | 13:26 |
| TheJulia | ... yeah, that is a *super* tough one | 13:28 |
| TheJulia | I don't know how the other group I work with will navigate it or if they will just find a happy middle ground which works for them | 13:29 |
| TheJulia | In that case, luckily I'm just an IC | 13:29 |
| JayF | TheJulia: Quite simply, I don't want people who have banned Claude in GitHub to see the message on OpenStack repos that it has a commit from someone they banned. It's a negative sign of quality to have LLM authors in your codebase to a large number of people, including me. | 13:48 |
| JayF | Mainly because it comes with the implication that you're letting the agent merge things on its own | 13:48 |
| JayF | How to handle this is as much a marketing and community decision as a technical one | 13:48 |
| TheJulia | yup, I share your concern there. | 13:49 |
| JayF | I think this got eaten by the commit trailers discussion: https://etherpad.opendev.org/p/security-policy-in-repo is where I've tossed a proposal. Should be pretty basic to do if we get agreement on the shape. | 14:30 |
| mnasiadka | fungi: Kubernetes does not allow AI generated commit messages, and does not allow to use assisted-by trailer - they allow only a descriptive “This PR was written with the assistance of generative AI” (or similar) | 15:16 |
| mnasiadka | See https://www.kubernetes.dev/docs/guide/pull-requests/#ai-guidance | 15:16 |
| fungi | mnasiadka: yes, i found that too. it's labeled as "guidance" though not a governance policy, so not the sort of think mikal is asking for as far as i can tell | 15:19 |
| mnasiadka | fungi: guidance using the wording “you must” or “something is not allowed” is a funny worded guidance | 15:20 |
| fungi | kubernetes effectively prevents co-authored-by with an llm tool in commit messages by requiring the co-author to agree to a cla, which an llm can't (legally) do | 15:20 |
| mnasiadka | I’d lean towards us saying co-authors should be in the DCO and not allowing co-authored-by trailer to achieve the same ;-) | 15:21 |
| fungi | i agree it's odd that guidance in their contributor guide makes demands while not referring to any actual policy document, but that may be a nuance of how their commun ity is organized, i've never participated in it | 15:22 |
| fungi | note that we won't be able to use the same enforcement in gerrit to check that co-authors have corresponding signed-off-by, though we could require a zuul job that runs on all release deliverables to prevent nonconforming changes from merging | 15:23 |
| TheJulia | JayF: w/r/t security-policy-in-repo, i like it. Short and to the point. | 15:26 |
| fungi | JayF: i haven't had time to look yet, is it part of implementing the current goal proposal? | 15:27 |
| fungi | or will it require edits to the goal? | 15:27 |
| fungi | i was preparing to push up a review to switch it from proposed to accepted, in order to continue the discussion | 15:28 |
| fungi | i tossed a link to the current security.rst goal document into your pad, looks like it's more or less aligned | 15:56 |
| tkajinam | As a person continuously "nitpicking" AI tagging recently... Co-Authored-By tag isn't really a trivial because it eventually causes copy-right problem and really interfere with the core of software development. | 16:23 |
| tkajinam | I don't care if they use their own fancy tags, but the term "Authored" has quite larger meaning than just tagging. | 16:24 |
| tkajinam | I can understand people don't like asking to fix that instead of their code change, but that can impact our whole development ecosystem and shouldn't be treated as a trivial matter. | 16:27 |
| tkajinam | though this is just my own view and can be adjusted according to the official decision. | 16:28 |
| tkajinam | s/asking/being asked/ | 16:28 |
| clarkb | it wouldn't surprise me if ^ is the entire reason the tools are so insistent on adding the notes too | 16:30 |
| JayF | fungi: gonna be honest, I forgot that proposal existed. I'll go take a look. | 16:41 |
| -opendevstatus- NOTICE: The Gerrit service on review.opendev.org will be offline momentarily to restart onto updated container images, but should return within a few minutes | 17:08 | |
| * JayF is authoring a resolution which can serve as a place to chat about this w/r/t AI policy in practice | 17:09 | |
| opendevreview | Jay Faulkner proposed openstack/governance master: Resolution: Provide an AI Policy Interpretation https://review.opendev.org/c/openstack/governance/+/1012080 | 17:29 |
| JayF | TheJulia: mnasiadka: mikal: tkajinam: clarkb: ^ This is my attempt at providing a place for productive discussion. I would imagine if this lands, we'd put real docs in project-team-guide, but I didn't want to "create policy via documentation" so to speak | 17:31 |
| TheJulia | tkajinam: And a fun aspect is you may author 95% of a change, and ask an ai to clean up your wording a little to make it better and more understandable... and at that point we do expect Assisted-By in the current model That doesn't necessarilly mean the AI did all the work. | 17:32 |
| * JayF notes that he's not missing an *-by: on that above change. He wrote an AI policy with a human brain 😱 | 17:32 | |
| TheJulia | gasp! | 17:33 |
| clarkb | I'm more than happy to subject everyone else to the occasional typo and poor gramar :P | 17:33 |
| TheJulia | clarkb: lol | 17:33 |
| JayF | TheJulia: often what I do in those cases is have the llm provide a review and do the changes it wants | 17:33 |
| clarkb | as long as the intent is understandable and someone looking back in 6-18 months can figure it out then good enough | 17:34 |
| JayF | TheJulia: because if I did 95% of it, I damn sure don't want to label it as asst-by | 17:34 |
| JayF | and if we start saying that counts as assistance... well, every change is going to need an "Assisted-by: My favorite search engine" perhaps :D | 17:34 |
| fungi | can't we abbreviate it ass'd-by | 17:34 |
| fungi | ? | 17:34 |
| fungi | and then enjoy the double-meaning | 17:35 |
| TheJulia | JayF: well, if you have a direct search engine results to code pipeline to demo.... ;) | 17:37 |
| * TheJulia facepalms and shakes her head | 17:38 | |
| JayF | TheJulia: if someone wrote a FUSE module for storing files in the "unlimited" gmail storage back in the day ... someone has written an agent which uses google's AI mode for free tokens | 17:38 |
| TheJulia | oh, surely. | 17:38 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!