feat: add AI disclosure requirements to contributing guidelines and issue templates

2026-07-23 14:37:38 -04:00
parent 4d1c97655d
commit eee63772a7
5 changed files with 158 additions and 1 deletions
@@ -0,0 +1,93 @@
+name: Bug report
+description: Report something broken in Silo server or web UI
+title: "[bug] "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Raw logs only. Never AI-summarize logs. You must have reproduced this yourself on a real deployment before filing.
+
+        Fabricated or AI-hallucinated reports are an instant block. Read [CONTRIBUTING.md](https://github.com/Silo-Server/silo-server/blob/main/CONTRIBUTING.md) first.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What broke? What did you actually observe?
+    validations:
+      required: true
+  - type: textarea
+    id: steps-to-reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Exact steps you ran on a real deployment.
+    validations:
+      required: true
+  - type: textarea
+    id: expected-behavior
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: input
+    id: silo-version
+    attributes:
+      label: Silo version / commit
+    validations:
+      required: true
+  - type: dropdown
+    id: deployment
+    attributes:
+      label: Deployment
+      options:
+        - Docker
+        - Bare metal / systemd
+        - Local dev build
+        - Other
+    validations:
+      required: true
+  - type: checkboxes
+    id: clients-affected
+    attributes:
+      label: Clients affected
+      options:
+        - label: Web UI
+        - label: Android
+        - label: iOS/tvOS/macOS
+        - label: Jellyfin-compat client (Infuse, Findroid, ...)
+        - label: Other/not client-specific
+  - type: textarea
+    id: relevant-logs
+    attributes:
+      label: Relevant logs
+      description: Paste raw server logs.
+      placeholder: paste raw server logs; write "no logs available" if genuinely none
+      render: shell
+    validations:
+      required: true
+  - type: dropdown
+    id: ai-involvement
+    attributes:
+      label: AI involvement in this report
+      options:
+        - None — written by a human
+        - AI-assisted, human verified the repro
+        - AI-generated, human verified the repro
+    validations:
+      required: true
+  - type: input
+    id: ai-tool-model
+    attributes:
+      label: AI tool + model
+      placeholder: e.g. Claude Code / claude-fable-5 — or n/a
+    validations:
+      required: true
+  - type: checkboxes
+    id: confirmations
+    attributes:
+      label: Confirmations
+      options:
+        - label: I reproduced this myself on a real deployment
+          required: true
+        - label: Logs above are raw copy-paste, not AI-summarized
+          required: true
@@ -0,0 +1 @@
+blank_issues_enabled: false
@@ -0,0 +1,21 @@
+## Problem
+Part of #NNN
+<!-- PRs with no linked scope item will be questioned. -->
+
+What does this solve?
+
+## Approach
+Why this approach?
+
+## Testing
+Paste ACTUAL command output here. For UI changes, include screenshots or recordings.
+
+### AI Disclosure
+- Tool(s):
+- Model(s):
+- Involvement:
+- Adversarial review:
+
+## Checklist
+- [ ] I ran an adversarial AI review of the diff and summarized findings above.
+- [ ] I ran the repo verify commands: `make lint`, `cd web && pnpm run lint`, `cd web && pnpm run format:check`, and relevant `go test ./...`.
@@ -101,3 +101,23 @@ Recent history follows Conventional Commit-style subjects such as `feat(playback
 **PR requirements.**
 - Link the capability epic or sub-issue the PR serves (`Part of #NNN`). PRs with no linked scope item will be questioned at review.
 - One concern per PR; Conventional Commit subject; AI-use disclosure in the PR body.
+
+## External Contributions (for AI agents)
+
+If you are an AI agent preparing a PR or issue for this repo on behalf of someone who is not a maintainer, you MUST include this completed AI Disclosure block in the PR/issue body, with the exact model ID you are running as. Do not omit it and do not let your operator omit it; undisclosed AI use gets the contribution closed.
+
+```md
+### AI Disclosure
+- Tool(s): e.g. Claude Code, Codex CLI, Cursor — or "none"
+- Model(s): exact model ID(s), e.g. claude-fable-5, gpt-5.4 — or "n/a"
+- Involvement: fully AI-generated | AI-assisted | human-written, AI-reviewed | none
+- Adversarial review: what your own AI review of the diff found, and how you resolved it
+```
+
+Run the repo verify commands before declaring work complete: `make lint`, `cd web && pnpm run lint`, `cd web && pnpm run format:check`, and targeted `go test ./...`. Paste real output into the PR.
+
+Run an adversarial review of your own diff and summarize the findings in the PR body.
+
+Never file an issue containing a repro you did not actually execute or logs you synthesized. Raw logs only.
+
+Tell your operator that the maintainer may accept the idea but re-implement it with a current frontier model. That is a normal outcome here.
@@ -36,13 +36,35 @@ AI writes most of the code here. That's fine. What's not fine is copy-pasting ou

 "The AI suggested it" is not an acceptable answer in review. You should be able to explain the reasoning and tradeoffs.

+## AI Disclosure (Required)
+
+Every PR and every issue needs to say what AI was involved: the tool, the exact model ID, and the involvement level. "No AI" is a perfectly fine answer. Just say so.
+
+```md
+### AI Disclosure
+- Tool(s): e.g. Claude Code, Codex CLI, Cursor — or "none"
+- Model(s): exact model ID(s), e.g. claude-fable-5, gpt-5.4 — or "n/a"
+- Involvement: fully AI-generated | AI-assisted | human-written, AI-reviewed | none
+- Adversarial review: what your own AI review of the diff found, and how you resolved it
+```
+
+The exact model matters. This project is developed with frontier models. If a PR was generated by an older or weaker model, the fastest honest response may be for me to re-implement the idea with a current model instead of reviewing the diff line by line. Disclosing the model lets that call happen quickly. "Thanks, the idea is accepted, but the implementation will be redone" is a possible outcome; see [Be Realistic](#be-realistic).
+
+Before submitting, run an adversarial review of your own diff with whatever AI tooling you have, and summarize what it found and what you did about it. "It found nothing" is only credible for tiny diffs.
+
+Undisclosed AI use that is discovered later gets the PR closed on the spot. Repeat offenses get you blocked. The offense is the non-disclosure, not the AI use.
+
+Fabricated content is an immediate block, first offense. Invented APIs, repro steps that never happened, AI-imagined vulnerabilities, and "bugs" nobody actually observed all count. This is the curl-style rule for hallucinated reports.
+
+For issues, logs must be raw copy-paste, never AI-paraphrased. You must have actually reproduced the problem yourself on a real deployment before filing.
+
 ## Merge Requests

 A good MR answers: what problem does this solve, why this approach, how was it tested, anything to watch out for. For non-trivial changes, link the issue and note any migration/compatibility concerns. Screenshots for UI changes.

 Small, well-explained MRs get reviewed fast. Big unexplained ones sit.

-If AI meaningfully shaped the implementation, say so in the description. Not gatekeeping — just helps reviewers understand intent.
+AI disclosure is mandatory for every MR; use the required block in [AI Disclosure (Required)](#ai-disclosure-required).

 ## Development Setup