Hi, The discussion so far has landed on documenting which tools were used, the review practices applied, and human ownership of changes. That's all well and good, but it isn't what the ASF generative tooling guidance [1] actually requires. For a contribution that includes AI-generated content, the contributor needs to ensure that the tool's terms place no restrictions on the output inconsistent with the Open Source Definition, that at least one of the guidance's conditions on copyright and third-party material is met, and that there's reasonable certainty of this. From the tool itself providing information about output similar to its training data, or from code scanning. Peer review and adversarial LLM review are good engineering practices, but they address correctness and security, not the license compatibility of the generated output. They don't satisfy any of these conditions, and nothing said in the thread so far addresses them.
So, for the initial import: which tools were used, have their terms been checked against condition 1, and what code-scanning or tool-provided training data exists to support the remaining conditions? If the answer is "none yet", then that's what the committed provenance review needs to produce, and it needs to be done, with anything that can't be established removed or reimplemented, before the podling's first release. My larger concern is simpler: who is making the commits? Were the bootstrap commits made by a person who reviewed each change before it went in, or by agents running under a person's identity? A commit rate of roughly 100 commits over three days by one developer makes genuine per-commit human review hard to credit, and the ICLA representations attach to the person named on the commit. Going forward, I'd want it stated plainly: commits are made by human committers who have reviewed the change and can stand behind it. Agents don't hold Apache accounts, and an LLM review is not a committer review. None of this is an objection to AI-assisted development as such; it is simply that existing guidance needs to be followed. There's also a broader discussion to be had about what we expect of AI-native projects, and our existing guidance may need to be updated, especially as new AI laws come into effect. Thanks, Justin [1] https://www.apache.org/legal/generative-tooling.html
