From 9e209deb4e626b9cf656db7235d08b30c53911da Mon Sep 17 00:00:00 2001 From: Ettore Di Giacinto Date: Thu, 3 Sep 2026 17:02:05 +0000 Subject: [PATCH] docs(dco): let maintainer-operated automation sign off The AI-assistant policy says an AI agent must never add a Signed-off-by trailer, because only a human can certify the DCO. That is right for the case it was written for: an assistant helping a contributor who then signs off themselves. It does not fit automation a maintainer runs. Those pull requests have no human submitter, so nothing ever signs and the DCO check blocks them permanently. Sixty-one open pull requests from the maintenance bot are in exactly that state, every one of them correctly following the documented rule. Carve out the case: automation a maintainer operates signs off with that maintainer's identity. The maintainer certifies the DCO, as they do for a commit they typed by hand, because they configured the automation, own its output, and take responsibility on merge. The Assisted-by trailer still records that a model wrote the code, so provenance is unchanged. Keep the exception narrow. An assistant helping an outside contributor still must not sign off, and a bot must not sign for anyone but its operator, including on a contributor's branch it pushes to. Assisted-by: Claude:claude-opus-5 Signed-off-by: Ettore Di Giacinto --- .agents/ai-coding-assistants.md | 34 +++++++++++++++++++ AGENTS.md | 2 +- CONTRIBUTING.md | 2 +- .../content/reference/ai-coding-assistants.md | 20 +++++++++++ 4 files changed, 56 insertions(+), 2 deletions(-) diff --git a/.agents/ai-coding-assistants.md b/.agents/ai-coding-assistants.md index d0d9c882cc88..b2ce5e27da96 100644 --- a/.agents/ai-coding-assistants.md +++ b/.agents/ai-coding-assistants.md @@ -49,6 +49,40 @@ AI agents MUST NOT add `Co-Authored-By` trailers for themselves either. A human reviewer owns the contribution; the AI's involvement is recorded via `Assisted-by` (see below). +### Exception: automation operated by a maintainer + +The rule above addresses the common case, an AI assistant helping a human +contributor who then signs off. It does not fit automation that a +maintainer runs themselves, which opens pull requests with no human +submitter to sign. Applied literally there, nothing ever signs and the +DCO check blocks the pull request permanently. + +A maintainer-operated bot MUST therefore add a `Signed-off-by` trailer +naming **the maintainer who operates it**, not the bot and not the model: + +``` +Assisted-by: Codex:gpt-5 +Signed-off-by: Ettore Di Giacinto +``` + +This is not the AI certifying the DCO. The maintainer is, exactly as they +do for a commit they typed by hand: they configured the automation, they +own its output, and they take responsibility for it when they merge it. +The `Assisted-by` trailer still records that a model produced the code, so +the provenance trail is unchanged. + +The exception is narrow and does not widen the rule for anyone else: + +- It applies only to automation a LocalAI maintainer operates and whose + output that maintainer reviews before merge. +- The sign-off names a real person who accepts DCO responsibility. +- An AI assistant helping an outside contributor still MUST NOT sign off. + That contributor adds their own trailer. +- A bot MUST NOT sign off on behalf of anyone other than its operator, and + MUST NOT add a trailer for a contributor whose branch it pushes to. If + automation contributes to someone else's branch, it leaves the sign-off + to that contributor. + ## Attribution When AI tools contribute to LocalAI development, proper attribution helps diff --git a/AGENTS.md b/AGENTS.md index 71302268aab1..abbb342df537 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -8,7 +8,7 @@ Human contributors: see [CONTRIBUTING.md](CONTRIBUTING.md) for the development w LocalAI follows the Linux kernel project's [guidelines for AI coding assistants](https://docs.kernel.org/process/coding-assistants.html). Before submitting AI-assisted code, read [.agents/ai-coding-assistants.md](.agents/ai-coding-assistants.md). Key rules: -- **No `Signed-off-by` from AI.** Only the human submitter may sign off on the Developer Certificate of Origin. +- **No `Signed-off-by` from AI.** Only the human submitter may sign off on the Developer Certificate of Origin. One exception: automation a maintainer operates signs off with *that maintainer's* identity, since no other human submitter exists to certify it. See [.agents/ai-coding-assistants.md](.agents/ai-coding-assistants.md). - **No `Co-Authored-By: ` trailers.** The human contributor owns the change. - **Use an `Assisted-by:` trailer** to attribute AI involvement. Format: `Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]`. - **The human submitter is responsible** for reviewing, testing, and understanding every line of generated code. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index d87db37eae63..655695cfcc1b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -218,7 +218,7 @@ LocalAI follows the **same guidelines as the Linux kernel project** for AI-assis The full policy for this repository lives in [`.agents/ai-coding-assistants.md`](.agents/ai-coding-assistants.md). Summary: -- **AI agents MUST NOT add `Signed-off-by` tags.** Only humans can certify the Developer Certificate of Origin. +- **AI agents MUST NOT add `Signed-off-by` tags.** Only humans can certify the Developer Certificate of Origin. Automation operated by a maintainer is the one exception: it signs off with that maintainer's identity, because there is no other human submitter to certify it. - **AI agents MUST NOT add `Co-Authored-By` trailers** attributing themselves as co-authors. - **Attribute AI involvement with an `Assisted-by` trailer** in the commit message: diff --git a/docs/content/reference/ai-coding-assistants.md b/docs/content/reference/ai-coding-assistants.md index 3144a4d5976f..801c6ef663a3 100644 --- a/docs/content/reference/ai-coding-assistants.md +++ b/docs/content/reference/ai-coding-assistants.md @@ -34,6 +34,26 @@ All contributions must comply with LocalAI's licensing requirements: AI agents MUST NOT add `Co-Authored-By` trailers for themselves either. A human reviewer owns the contribution; the AI's involvement is recorded via `Assisted-by` (see below). +### Exception: automation operated by a maintainer + +The rule above addresses the common case, an AI assistant helping a human contributor who then signs off. It does not fit automation that a maintainer runs themselves, which opens pull requests with no human submitter to sign. Applied literally there, nothing ever signs and the DCO check blocks the pull request permanently. + +A maintainer-operated bot MUST therefore add a `Signed-off-by` trailer naming **the maintainer who operates it**, not the bot and not the model: + +``` +Assisted-by: Codex:gpt-5 +Signed-off-by: Ettore Di Giacinto +``` + +This is not the AI certifying the DCO. The maintainer is, exactly as they do for a commit they typed by hand: they configured the automation, they own its output, and they take responsibility for it when they merge it. The `Assisted-by` trailer still records that a model produced the code, so the provenance trail is unchanged. + +The exception is narrow and does not widen the rule for anyone else: + +- It applies only to automation a LocalAI maintainer operates and whose output that maintainer reviews before merge. +- The sign-off names a real person who accepts DCO responsibility. +- An AI assistant helping an outside contributor still MUST NOT sign off. That contributor adds their own trailer. +- A bot MUST NOT sign off on behalf of anyone other than its operator, and MUST NOT add a trailer for a contributor whose branch it pushes to. If automation contributes to someone else's branch, it leaves the sign-off to that contributor. + ## Attribution When AI tools contribute to LocalAI development, proper attribution helps track the evolving role of AI in the development process. Contributions should include an `Assisted-by` tag in the commit message trailer in the following format: