Who gets credit and trust in OSS maintainership when most contributions are AI-generated PRs?

The shift

Generating a plausible-looking PR — code, tests, a description that reads like it understands the issue — goes from scarce (a contributor spending real hours) to abundant (an agent opening dozens in an afternoon, at near-zero cost to the submitter). Review capacity, judgment about what's worth merging, and accountability for what ships did not get cheaper at all.

The axioms

• A PR represents time a human chose to spend on this project — contribution volume is a costly signal of commitment. Rests on: writing code being slow and effortful.
• Maintainer review capacity scales roughly with contributor trust built over time — you review strangers harder than regulars. Rests on: the number of untrusted submissions being naturally throttled by how hard they are to produce.
• Git history and PR count function as a reputation ledger — "prolific contributor" signals skill and reliability. Rests on: volume being expensive enough to correlate with ability.
• Whoever's name is on the commit is answerable for it — blame, credit, and liability trace to a person. Rests on: authorship mapping cleanly to a single accountable human.
• Maintainers are the bottleneck, so the scarce resource to protect is their time, and the scarce resource to attract is contributors willing to spend theirs. Rests on: patches being hard to produce, so supply of contributions is naturally limited.

Invalid axioms

1. Contribution volume is a costly signal of commitment. Writing a plausible PR is now free and instant, so volume no longer proves anything about dedication or even understanding of the codebase. Habit-trap: projects still weight "frequent contributor" badges, contribution graphs, and PR counts in trust and access decisions as if each one still cost the submitter something.
2. Review effort should scale inversely with a submitter's track record. Track record itself is gameable at scale now — an operator can farm a plausible history with agents before landing the PR that matters. The habit-trap is treating "10 merged PRs" as a shortcut past scrutiny rather than as a number that's now cheap to manufacture.
3. Maintainer time is the bottleneck to protect; contributor time is the bottleneck to attract. Attracting contributions is no longer the constraint — anyone can point an agent at open issues and flood the queue. Projects still run onboarding, "good first issue" funnels, and recognition programs built for a world where getting people to submit anything was the hard part.

Unchanged axioms

1. Someone accountable must own what ships. A model can generate the diff; it cannot be the party that stands behind a security regression or a broken API contract. Maintainers still have to decide, and their name (or the org's) is still what's on the line when it breaks in production — that didn't get cheaper.
2. Verifying correctness, not producing a plausible patch, is the scarce act. A PR that compiles, passes tests, and reads coherently can still be subtly wrong — the failure mode is confidently plausible, not obviously broken. Reviewing for correctness under adversarial or careless volume is harder now, not easier, because the plausible-wrong rate went up while review headcount didn't.
3. Trust is a relationship built over time between people, not a score derived from artifacts. The maintainers who get real commit access and real say in roadmap are still the small set of people other maintainers know, have worked with, and would vouch for personally. That circle doesn't expand just because PR supply did.
4. Judgment about what the project actually needs is still a taste call. Deciding whether a feature fits the project's direction, whether an abstraction is the right one, whether now is the time to take on a dependency — none of that is a pattern-match problem an agent resolves for the maintainer. It's still a human call under ambiguity.

New axioms

1. Review queues are now adversarial-by-default, and nobody has resourced for that. When submission is free, spam, low-effort "AI slop" PRs, and bad-faith flooding (to pad a resume, farm a bounty, or just see what sticks) become a standing tax on maintainer attention, not an edge case. Projects have no established norm yet for how much verification effort a free-to-produce PR deserves before it's even read.
2. Credit attribution breaks down when the human's contribution shrinks toward "wrote the prompt." If a contributor's real input was a two-line prompt and an agent did the rest, what does authorship even mean for changelog credit, CLA sign-off, or a resume line — and does it matter if the code is correct anyway? No consensus exists on whether credit should attach to prompting, reviewing, or nothing at all.
3. Provenance and disclosure have no settled norm. Should a PR say it's AI-generated or AI-assisted, and does it change how it's reviewed if it does? Right now disclosure is voluntary and inconsistent, so maintainers can't calibrate scrutiny based on origin even if they wanted to.
4. A track record built partly on agent output can no longer function as a trust shortcut, but nothing has replaced it. The old ladder — small PRs, then bigger ones, then commit access — assumed each rung was earned at human speed. When rungs can be climbed at agent speed, projects need a new way to decide who gets elevated trust, and haven't built one.

Where it breaks

The reputation ladder (invalid) and the credit-attribution problem (new) collide directly at the "grant commit access" decision: maintainers still promote based on contribution history, but that history no longer reliably indicates the human's actual skill or judgment — it might indicate skill at operating agents, or nothing at all. Projects that keep using PR count and merge history as the gate to trust are handing elevated access based on a signal that's been hollowed out, right as the cost of being wrong about who to trust (supply-chain risk, malicious agent-assisted PRs) goes up.

Separately, the "maintainer time is the resource to protect" habit (invalid) collides with the adversarial-review problem (new): triage bots and auto-labeling get built to save maintainer time on the assumption that PR volume is still roughly honest-effort, but the same automation that would help a maintainer skim also makes it easier for low-effort or bad-faith submitters to format their way past that first filter.

ai-axioms.vercel.app/axioms/engineering/swe-oss-maintainership-ai-axioms