Study finds zero of 2,204 AI-authored GitHub PRs declared machine-readable scope

·1 views

A developer scanned 2,204 recently merged pull requests authored by AI coding agents — including Devin, Copilot, Codex, Claude Code, and Cursor — on public GitHub repositories. Using a deterministic, checkout-free policy engine that reads only PR metadata and file contents via the GitHub API, the analysis found that not a single PR included a machine-readable declaration of its intended scope. Around 7% of fully analyzed PRs triggered at least one boundary finding, with workflow-touching PRs showing the highest risk concentration, including unpinned actions and escalated permissions. Notably, 3.9% of PRs modified agent control-plane files such as AGENTS.md or CLAUDE.md, which effectively shape the behavior of all future agent PRs in a repository. The author argues that since AI agents generate rich task context at creation time, a simple standardized scope contract embedded in PR bodies could make intent machine-verifiable rather than leaving reviewers to guess.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Two-Tier AI Code Review in CI Cuts Costs by Routing Low-Risk PRs Locally

A developer rebuilt their CI-integrated AI code reviewer after noticing high costs from sending every pull request diff to a large frontier model. The redesigned system uses a small local model as a first-tier triage filter, classifying diffs as low or high risk based on whether they touch sensitive areas like authentication, cryptography, or financial logic. Low-risk changes — such as formatting fixes, docs, and test updates — are stopped at the first tier with no expensive API call made. Only high-risk diffs are escalated to the large model, which uses prompt caching to avoid re-processing the stable system prompt and repo context on every review. The approach significantly reduces per-review costs while preserving meaningful oversight for the code changes most likely to introduce security or logic vulnerabilities.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds lifecycle monorepo to standardize training course folder structure

A developer consolidated scattered training course materials from multiple repositories into a single monorepo, assigning every course an identical five-stage numbered folder structure from planning to post-training follow-up. The numbered prefixes (00–04) enforce workflow order visually, mirroring how timestamped database migrations encode sequence as information. A _TEMPLATE directory lets users bootstrap a new course with one command, using placeholder tags to mark unfilled sections, and a simple grep check confirms completion when no placeholders remain. Retired materials are stored in a dated _ARCHIVED folder rather than deleted, preserving past decisions and the reasoning behind them. A root CLAUDE.md file documents all naming conventions and structural rules in a machine-readable format, making the system accessible to both human collaborators and AI coding agents.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open-Source SSI SDK Aims to Give Users Control Over Digital Identities

A Self-Sovereign Identity (SSI) SDK has been open-sourced to help individuals and organizations manage their digital identities without relying on a central authority. The framework is built on decentralized identifiers (DIDs) and verifiable credentials, allowing parties to issue and verify digital assertions cryptographically. The decision to open-source the SDK was driven by goals of fostering community innovation, improving transparency, and democratizing access to secure digital identity tools. Key features include DID management, blockchain integration, verifiable credential issuance, and cross-platform compatibility. Developers using the SDK are advised to follow strict security practices, including private key protection, regular audits, and keeping dependencies up to date.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Insufficient source data — article body not available for summarization

The source provided contains only a link, a comments URL, and minimal metadata with no article text. There is no substantive content available to extract facts from. A reliable summary cannot be produced without the actual article body. Please provide the full article text for accurate summarization.

0 comments Read more at Hacker News