QGIS Bans AI Code Outright: How a "Conscience Test" Became Level 0 Governance

Title

QGIS Bans AI Code Outright: How a "Conscience Test" Became Level 0 Governance

Meta Description

QGIS bans AI code contributions yet relies on a "conscience" enforcement mechanism. This article uses a three-tier governance ladder to analyze AI policies across twenty top open-source repositories, finding six policies with zero machine enforcement—Level 0 prose governance cannot be falsified.

Article Content

The QGIS community merged QEP #387 this week: a blanket ban on LLM, AI, or agent-assisted code contributions in the qgis/qgis repository. Violators face "code revert and contributor rights sanctions." This proposal replaces the previous human-AI collaboration policy, passed by vote, and is now in effect on the master branch. The Hacker News discussion thread has accumulated over three hundred comments, split between "limiting attention is reasonable" and "this policy will spoil like milk."

The line that truly ended this debate came from the project's own answer during the proposal discussion. When asked how compliance would be enforced, a core contributor said: by conscience—whether you yourself wrote this code by hand.

That is not an enforcement mechanism. It is a conscience test with a revert clause attached. Measured against the taxonomy this series has been building, QEP #387 is a textbook Level 0 governance: a piece of English prose that nobody enforces, failing silently, with drift invisible. The project knows this—that enforcement note is honest testimony. What is missing from this debate is the "ladder"—and the cost of climbing to the second rung.

First, Give the Ban Its Due: It Is Rational

Before rating anything, one must acknowledge: maintainer workload pressure is real, and they are not imagining it. The proposal's rationale—"enormous and unsustainable pressure," AI submission volume exceeding "what human reviewers can seriously engage with"—matches maintainer reports across every domain. Nor is this QGIS's first attempt at governance: an earlier AI-assisted PR labeling process was tried, then quietly died, with around fifty PRs flagged and forty closed. They tried lighter governance, and it didn't hold. Nyall Dawson's "close the door first," then selectively reopen, is a stopgap one voter openly conceded: "this baby may not survive."

The blanket ban answers "how do we survive this quarter." This article asks the next question: what material is this policy made of, and what does that material cost?

The Three-Tier Ladder: Applied One by One

Every governance measure sits on one of three rungs, graded by what enforces it.

Level 0—Prose Governance. "AI contributions prohibited" written in a document nobody enforces, failing silently: drift is invisible because the trigger condition—is this code AI-assisted?—cannot be evaluated by anything other than conscience. The definitional gaps in the QGIS thread are not drafting accidents; they are proof that the trigger condition is unevaluable. Does autocomplete count? Translation? A sort model that reorders your imports? A rule with an undecidable scope cannot be enforced by anything less than a human's honest memory—and the project has said that is their mechanism.

Level 1—Primitives in Context. Contributors make a declaration, visible in the PR: template field, trailer line, a checkbox that survives into the commit. It fails visibly—but only if someone looks. QGIS tried this rung: the labeling process. It failed for a boring reason—roughly fifty flags across the entire history, which is not enforcement, it is decoration. Level 1 works when CI checks it, and QGIS's CI does not.

Level 2—Host Rejection. Governance lives in a gate that trusts nobody's memory. This is the rung the debate keeps skipping, because people conflate two different problems: detecting AI code (adversarial, unwinnable—simple code is undetectable, and always will be) versus binding process to signatures (boring, winnable, and precisely why "receipts" exist).

The receipt schema this series follows puts that distinction into code. Every verdict must carry judged_by—required, no default; the schema throws rather than encapsulating an unlabeled verdict. For LLM-judged checks, spec_hash is mandatory: the prompt defining the judgment is hashed, so a rubric and its paraphrase produce different ids. Neither field claims to detect lies. They make an unlabeled claim unsealable—a lie, if it comes, must come with a signature.

Falsifiability is the implicit criterion in this article's rating framework. A governance measure is called "falsifiable" when the policy itself publicly states to what extent it is enforced and where it fails—so readers can check whether the policy was honored. Level 0 prose governance is most dangerous not because it is weak, but because it hides its weakness: the text claims a prohibition but never says who enforces it or at which step, so the gap between "the policy exists" and "the policy works" is never observed by anyone. Rust's AI policy writes in its introduction, "we recognize many provisions of this policy cannot be enforced"—handing its failure boundary over to public scrutiny. If readers find provisions indeed unenforced, that is not a scandal, because the policy already admitted it. QGIS's QEP #387, by contrast, packages the same unenforceable conscience test in hard-edged language about reverts and sanctions, making the policy appear to sit on a higher rung than it does. The difference is not severity, but one being falsifiable and the other only trustworthy.

The Empirical Section: Twenty Repos, Six Policies, Zero Enforcement

A taxonomy without data is just preaching. So I audited the twenty most-starred repositories on GitHub—the projects whose policies shape the "normal perception" of thousands of contributors. Method, openly: pull each repo's contribution docs and AI policy files, read every policy found in full, rate by ladder, and check each repo's GitHub workflow names for any automation referencing AI, LLM, or disclosure.

Fourteen of twenty repositories have no AI policy at all in their contribution docs—including several that receive hundreds of AI-generated PRs. Six have policies. I read all six in full, rated each by ladder, and every one stops below the gate:

Repository	Policy Text	Level	Machine Enforcement
denoland/deno	AI-assisted contributions: "you must disclose" in the PR description; "PRs will be rejected if there is suspicion of undisclosed AI use"	1	None
pytorch/pytorch	AI content "must be clearly disclosed and isolated" in a marked PR template section, with human commentary	1	None
nodejs/node	Contributors "should disclose" the tools used "and what the contributor did to personally verify generated output"; DCO still applies	1	None
home-assistant/core	Unreviewed AI content "will not be accepted"; autonomous agents banned, PRs closed on "belief"	1	None
flutter/flutter	Conduct policy—"focus on behavior, not tools," violations handled through conduct channels	0–1	None
rust-lang/rust	Conditionally permitted—and self-labeled: "we recognize many provisions of this policy cannot be enforced"	0–1, labeled	None
qgis/QGIS	Ban: revert + sanctions, trigger = conscience	0	None

The "Machine Enforcement" column is the absence finding: I checked each repo's workflow names for anything referencing AI, disclosure, or contribution labels—nothing. A deeper CI content audit might hide an exception; the name-level scan found none.

Three findings in ascending order of interest. Deno, node, and PyTorch converge on "disclosure"—the ecosystem consensus level is "say it out loud," and PyTorch goes furthest: AI content must be isolated in a marked PR template section, with human commentary. That is the closest thing to structure anyone has published—the template makes the section exist by default; an empty section is at least visible. Home Assistant closes PRs on "belief"—"we believe they were autonomously created"—the strongest trigger in the sample, enforced by the weakest tool. And Rust wrote this article's thesis before I did: "We recognize many provisions of this policy cannot be enforced. Our goal is not to catch every violation… Our goal is to eliminate plausible deniability: to force people to choose between following the policy and deliberately violating it."

Rust is the proof of ladder fairness. Its policy is prose—by trigger condition, Level 0—and it says so loudly, in its own introduction. QGIS threatens reverts and sanctions from the same rung, without that label. Same material, opposite honesty: one writes "these provisions cannot be enforced" where an enforcement mechanism should be; the other wraps a conscience test in revert threats. The difference between them is not severity, but whether the policy's own level is falsifiable.

A note on why this audit scans workflow names rather than CI content. GitHub Actions workflow files can contain arbitrarily complex conditional logic and can pull external scripts or call reusable workflows at runtime; an exhaustive audit would require reading all YAML plus its referenced scripts, repo by repo—infeasible across twenty active repositories. Name scanning is an upper-bound estimate: if even workflow naming doesn't mention AI, disclosure, or contribution labels, then at least checks created for that specific purpose don't exist—and real projects typically give specialized checks self-explanatory names. This method will miss checks buried under generic names (like ci.yml, lint.yml), thereby underestimating enforcement. The author discloses this roughness to keep the conclusion's boundary clear: "zero enforcement" means "no evidence at the name level," not "confirmed by exhaustive audit to have no CI checks whatsoever." Any stronger claim would require per-repo deep reading—the scale of another study.

What a Level 2 AI Contribution Policy Looks Like

Not detection. Process, signatures:

• A provenance trailer on every commit, shaped like Signed-off-by: Authored-by: human or Authored-by: human, assisted-by: <tool>. It claims no LLM detection—a declaration, required by CI, rejected at the gate when absent. The Linux kernel approach praised in the Hacker News thread—"allow LLM usage, but you are fully responsible for the code it produces"—is this level: responsibility bound to signature, not detection heuristics.
• Reverts with logged reasons. The "code revert and sanctions" QGIS already threatens becomes enforceable the day reverts carry receipts: which commit, which rule, which reviewer. Sanctions that live in private conversations are not governance.
• Publicly published exception logs. Dawson's "close the door, reopen case by case" (autocomplete replacement, translation) is the right shape—but a case-by-case channel without a public log quietly becomes a corridor. The exception ledger is the policy's audit trail.
• Optional, and only when maintainers want it: documentation honeypots. Plant a decoy instruction in the contribution docs and see who commits it—this deliberately failing probe has proven useful for evaluating agents. Cheap, imperfect, and honest about being a tripwire, not a judge.
• Write the level into the policy. Rust's LLM policy does this in its own overview—"we recognize many provisions of this policy cannot be enforced"—and that sentence is why nobody can accuse Rust of pretending. A labeled weakness beats an invisible one—true of constitutions, and of code.

None of this detects AI code. Detection is the adversary's game, and the adversary is winning. The receipt regime claims something narrower and truer: when a contribution violates the rules, the violation is provable, attributable, and on the record—rather than found by feel (if found at all).

The provenance trailer borrows from the Git community's existing DCO (Developer Certificate of Origin) mechanism. DCO requires each commit to carry a Signed-off-by: line, declaring the contributor has the right to submit the code and accepts the open-source license; it is semantics in a line, not a technical isolation—CI can only check whether the line is present, not verify its content is true. The Authored-by: human, assisted-by: <tool> proposed here follows exactly the same shape: a contributor's declaration of authorship, not a detection of code origin. This matters engineering-wise because once a trailer enters a commit, it is permanently sealed into git history; changing history changes the commit hash, breaking the reference chain. Thus "unlabeled claims" become technically difficult: to hide AI involvement, a contributor must actively delete or forge a trailer line—itself a traceable action with signature marks. The CI gate needs only do one thing at this layer—reject when the trailer is missing, leaving the adversarial part to human reviewers' common sense.

The Cost, Stated Plainly

Seatbelt tax. One provenance trailer is thirty seconds per commit, forever, for every contributor—including the ninety-nine percent who will never game the system. Level 0 costs nothing and catches nothing; Level 2 makes everyone pay, and catches process violations, not authorship. No rung is free. A maintainer who says "my contributors won't accept friction" has already chosen Level 0, and after this week's data—the pressure is real—it is a defensible choice. It should be a labeled choice.

The seatbelt tax metaphor points at a class of public-governance dilemmas: the externality caused by a few violators is borne as a defensive cost by all participants. Traffic research long ago found that mandatory seatbelts did not significantly change drivers' risk preferences, and actually made drivers go faster—the benefit of the defensive measure partly offset by behavioral adjustment. This article borrows that framing to illustrate the cost structure of provenance trailers: it is completely useless for the ninety-nine percent of contributors who never use AI, pure friction; for the small minority who want to hide it, it is no technical barrier, only one more step of active forgery. So Level 2's payoff is not "catching more people," but converting "violation" from a fuzzy, excusable gray zone into an action with a clear signature. Opponents can reasonably say this conversion isn't worth thirty seconds per contributor per commit—that is precisely a maintainer's legitimate right to choose. The dispute is not whether to wear seatbelts, but whether this choice is explicitly labeled in the policy.

Two Honest Limitations

This survey is a snapshot with disclosed roughness. Twenty repositories chosen by prominence, contribution docs and policy files as the policy surface, workflow names as the enforcement surface—deeper CI content audits, or policies living outside these files, will be missed. Five of the six policies came from full reading (Rust's from Rust Forge), one (QGIS) from its merged proposal and core team comments. Whether policy authors accept my level assignments is their right to dispute—the levels are quoted from their own text, so disputes can be precise.

QGIS choosing survival over verifiability this quarter is not wrong. Fifty flags and forty closed PRs was a real attempt with real numbers; "unsustainable pressure" is not performance. What this article argues is: stopgaps should carry their own label—Level 0, honesty-based, revision pending—just as this series labels every weakness it admits, just as Rust labels its own provisions. A project that writes its governance level into its policy has not solved enforcement. It has made the absence of enforcement falsifiable.

One-line Summary

QGIS bans AI contributions outright yet enforces only by conscience; this article uses a three-tier ladder to audit twenty top repositories, exposing governance levels and their costs.

Paragraph Summary

The QGIS community merged QEP #387, banning LLM and agent-assisted code contributions outright, but when asked how to enforce it, a core contributor's answer was "judge by conscience whether you wrote this code by hand." This article proposes a three-tier ladder: Level 0 is unenforced prose governance that fails silently; Level 1 is a declaration visible in the PR, effective only when CI checks it; Level 2 is host gate rejection, binding process to signatures rather than detection. The author audited the twenty most-starred GitHub repositories, finding fourteen with no AI policy at all and six with policies that all stop below the gate, with zero machine enforcement. Deno, node, and PyTorch converge on "disclosure," while Rust openly admits its provisions cannot be enforced—more honest than QGIS's hidden weakness. The article argues Level 2 should rely on provenance trailers, CI gates, and exception logs, at the cost of a thirty-second "seatbelt tax" per contributor per commit—and that stopgaps should carry their own level label.