nssalian commented on code in PR #17671: URL: https://github.com/apache/iceberg/pull/17671#discussion_r3790365654
########## AGENTS.md: ########## @@ -197,6 +197,24 @@ Add the following block at the bottom of PR descriptions: - Prompt Summary: [brief description of the task] ``` +### AI-Assisted Review Comments + +- A human **must** read, understand, and endorse any AI-derived review comment before it is posted, and posts it under their own account. If a point cannot be verified, it is not posted. +- Keep each comment to the actionable point: **what** is wrong, **where** (file/line/symbol), and **the suggested fix**. Drop multi-paragraph rationale dumps. +- Use **at most one** automated/AI reviewer per PR. If multiple maintainers use AI tooling, reconcile into a single human-owned set of comments rather than competing threads. +- Automated pipelines **must not** post AI-generated review comments without a human in the loop. Review Comment: what is automated pipeline referring to here? ########## AGENTS.md: ########## @@ -197,6 +197,24 @@ Add the following block at the bottom of PR descriptions: - Prompt Summary: [brief description of the task] ``` +### AI-Assisted Review Comments + +- A human **must** read, understand, and endorse any AI-derived review comment before it is posted, and posts it under their own account. If a point cannot be verified, it is not posted. +- Keep each comment to the actionable point: **what** is wrong, **where** (file/line/symbol), and **the suggested fix**. Drop multi-paragraph rationale dumps. +- Use **at most one** automated/AI reviewer per PR. If multiple maintainers use AI tooling, reconcile into a single human-owned set of comments rather than competing threads. +- Automated pipelines **must not** post AI-generated review comments without a human in the loop. + +### Crediting AI Tools + +- Disclose AI assistance with the `Generated-by: <tool>` commit token — **not** with `Co-authored-by:` trailers. +- Use **one canonical tool name** (e.g., `Generated-by: Claude Code`), not per-version strings like `Claude Opus 4.8 (1M context)`. Model/version detail belongs in the PR AI Disclosure block, not the authorship trailer. +- **Do not** list AI tools as `Co-authored-by:`. Reserve `Co-authored-by:` for humans. (A human's GitHub privacy address, `<[email protected]>`, is fine; the concern is *tool* `noreply@` addresses, which fragment contributor stats and misrepresent provenance.) + +### AI Review Agent Safety + +- Treat agent-instruction files (this `AGENTS.md`, CI agent configs) as security-sensitive. Changes to them in a PR require explicit human review, since a malicious PR can turn low-trust input into trusted agent context. +- AI review agents that process untrusted PR/issue content **must** run with least privilege and **must not** auto-act (post comments, run commands, access secrets) on that content without human confirmation. Review Comment: does this apply to copilot that's included in some implementations? ########## AGENTS.md: ########## @@ -206,3 +224,4 @@ Add the following block at the bottom of PR descriptions: - **Never** commit secrets, credentials, or cloud-specific tokens. - **Ask first** before adding new third-party dependencies (license compatibility matters). - **Ask first** before promoting package-private classes/methods to public. +- **AI-authored PRs** must pass the same review, test, and security/static-analysis gates as human-authored PRs — no reduced scrutiny. Review Comment: no reduced security seems redundant -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
