2
2
3
3
## 1. Purpose and Scope
4
4
5
- This policy governs the use of AI tools, particularly CodeRabbitAI, GH Copilot, and
6
- Codecov-ai-reviewer, within the Multicast project's development workflow. It establishes
7
- guidelines for responsible AI integration while maintaining the project's security, quality, and
8
- integrity.
5
+ ### 1.1 Rational :bookmark :
6
+
7
+ > [ !IMPORTANT]
8
+ > This policy governs the use of AI tools, particularly CodeRabbitAI, GH Copilot, and
9
+ > Codecov-ai-reviewer, within the Multicast project's development workflow. It establishes
10
+ > guidelines for responsible AI integration while maintaining the project's security, quality, and
11
+ > integrity.
12
+
13
+ ### 1.2 Definitions :book :
14
+
15
+ * 1.2.A The following acronyms and abbreviations are used throughout this document:
16
+ * ** AI** - Artificial Intelligence
17
+ * ** CEP** - Convention Enhancement Proposal
18
+ * ** CI** - Continuous Integration
19
+ * ** CWE** - Common Weakness Enumeration (security vulnerability classification system)
20
+ * ** e.g.** - exempli gratia (for example)
21
+ * ** GH** - GitHub (as used in "GH Copilot")
22
+ * ** GHI** - GitHub Issues
23
+ * ** LLM** - Large Language Model
24
+ * ** PR** - Pull Request
9
25
10
26
## 2. AI Role Definitions
11
27
@@ -14,7 +30,7 @@ integrity.
14
30
* 2.1.A Assistive Code Review:
15
31
* AI may provide feedback on code quality, style compliance, and potential issues.
16
32
* 2.1.B Assistive Project-Management Delegation:
17
- * AI may provide feedback when requested on GHI ( GitHub issues), as well as open new, or comment
33
+ * AI may provide feedback when requested on GitHub issues (GHIs ), as well as open new, or comment
18
34
on existing, GHI, to track suggested improvements to the project content.
19
35
* 2.1.C Documentation Improvement:
20
36
* AI may suggest improvements to documentation clarity and completeness.
@@ -30,7 +46,7 @@ integrity.
30
46
### 2.2 Prohibited AI Roles :no_entry_sign :
31
47
32
48
* 2.2.A Sole Developer:
33
- * AI (especially LLM type AI) is not well suited for innovation; No vibe-coding, the direction
49
+ * AI (especially LLM bassed AI) is not well suited for innovation; No vibe-coding - the direction
34
50
and development of the project CANNOT meaningfully come from AI.
35
51
* 2.2.B Sole Approver:
36
52
* AI approval alone is insufficient for merging any PR.
@@ -51,7 +67,7 @@ integrity.
51
67
* All PRs MUST receive at least one human review from an authorized maintainer
52
68
* 3.1.B Verify or Resolve
53
69
* Human reviews must verify (or conversely reject) the AI's suggestions.
54
- * Discussions are encouraged in both cases, as Humans and AI alike, may later consider relevant
70
+ * Discussions are encouraged in both cases, as humans and AI alike may later consider relevant
55
71
project content in future reviews.
56
72
* 3.1.C Very Large PRs
57
73
* For PRs exceeding 99 changed files, at least two human reviews are recommended.
@@ -96,7 +112,7 @@ integrity.
96
112
> > document it to make it even clearer.
97
113
> ~ Steve McConnell
98
114
99
- * All AI-suggested code changes must be verified by a human maintainer (see 3.1.B).
115
+ * All AI-suggested code changes must be verified by a human maintainer (see § 3.1.B).
100
116
* 4.1.B Signed Commits
101
117
* Code signing with different keys for human vs. AI contributions is required.
102
118
* 4.1.C Security Assessments
@@ -116,7 +132,7 @@ integrity.
116
132
* The project implements a dual-approval system to help prevent single points of failure.
117
133
* AI approvals are tracked separately from human approvals in the review process. Humans
118
134
must be responsible for the actual merge of pull-requests.
119
- * Every user (e.g., AI or human) must have a distinct code-signing identity (see 4.1.B).
135
+ * Every user (e.g., AI or human) must have a distinct code-signing identity (see § 4.1.B).
120
136
* Only human controlled identities may merge branches, or commit to the default branch directly.
121
137
122
138
> [ !NOTE]
@@ -133,9 +149,9 @@ integrity.
133
149
* The ` .coderabbit.yaml ` file is the source of truth for CodeRabbitAI configuration.
134
150
* 5.1.B Dependabot Configuration
135
151
* The ` .github/dependabot.yml ` file is the source of truth for @dependabot configuration.
136
- * 5.1.C Changes
152
+ * 5.1.C Configuration Updates
137
153
* Changes to these configurations require PR approval from at least one core maintainer.
138
- * 5.1.D Audits
154
+ * 5.1.D Configuration Audits
139
155
* Regular audits of AI configuration will be conducted to ensure alignment with this policy.
140
156
141
157
### 5.2 Monitoring and Reporting
0 commit comments