Good‑Actor Documentation Isn’t Enough

Open‑source projects cannot rely on declaratory documentation rules alone to control AI‑generated or malicious patches because adversarial contributors will simply lie or obfuscate provenance. Project governance must instead combine provenance tooling, defensible review gates, reproducible build provenance, and enforcement practices that assume bad actors won’t self‑report. — This reframes debates from symbolic disclaimers about 'AI slop' to concrete engineering and governance requirements (build provenance, signed commits, automated provenance audits) that determine software security and trust in critical infrastructure.