AGENTS.md

1# AI & Automated Agent Policy
2 
3This document outlines our policy on AI-assisted contributions and automated agents interacting with this project.
4 
5## Issues
6 
7### Good First Issues
8 
9Issues tagged with `good-first-issue` are there to allow new contributors to learn the processs of contributing to open source and Vapor with relatively easy tasks, to help grow open source. These issues are written by human maintainers and are intended to be solved by humans learning the codebase. **Do not use automated agents to claim, triage, or submit solutions to `good-first-issue` tickets.**
10 
11### Security Issues
12 
13Security vulnerabilities must be reported by humans through our responsible disclosure process. Automated scanning tools may identify potential issues, but all security reports must be reviewed, verified, and submitted by a human. Automated or AI-generated security reports will be closed without action. See our [organisation security policy](https://github.com/vapor/.github/blob/main/SECURITY.md) for disclosure instructions.
14 
15### General Issues
16 
17Issues must reflect genuine, human-identified bugs or feature requests. We will close issues that appear to be generated entirely by an automated agent without meaningful human review. Low-effort, bot-generated issues waste maintainer time and will not be tolerated.
18 
19## Pull Requests
20 
21We welcome AI-assisted contributions under the following conditions:
22 
23- **A human must author and submit the PR.** Using AI tools (Copilot, Claude, Cursor, etc.) to help write or refine code is fine, but a human must understand, review, and take responsibility for every change in the PR.
24- **Fully automated PRs will be closed.** If a PR appears to have been generated and submitted by an agent with no meaningful human involvement, we will close it.
25- **Contributors must be able to discuss their changes.** Maintainers may ask questions about implementation choices during review. You should be able to explain and defend your approach.
26- **AI-generated code must meet the same standards as any other contribution.** It must pass CI, follow project conventions, include tests where appropriate, and be consistent with the existing codebase.
27 
28## How We Identify Automated Contributions
29 
30We look for patterns such as:
31 
32- Generic or templated issue descriptions with no project-specific context
33- PRs submitted moments after an issue is opened
34- Inability to respond to review feedback in a meaningful way
35- Bulk submissions across multiple issues in a short timeframe
36- Commit messages or PR descriptions that read like raw LLM output
37 
38Maintainers reserve the right to close any issue or PR that we believe violates this policy. These decisions are made at our discretion and are final.
39 
40## Why This Policy Exists
41 
42Open source thrives on human collaboration. Automated noise—whether from bots filing low-quality issues or agents submitting unreviewed code—drains maintainer energy and undermines the community we are building. This policy exists to protect contributor experience, maintain code quality, and keep Vapor a welcoming place for people who want to learn and contribute.
43