Git moves toward formal votes on AI contributions after summit

The Git project has published notes from its 2026 Contributor's Summit and is drafting a formal voting process for policy fights that cannot be settled by consensus, with AI-generated contributions the immediate test case.

Taylor Blau circulated the summit summaries so the wider community can continue the discussions. Topics included the security mailing list, Git 3.0 planning, documentation for newcomers, Outreachy funding, pluggable object databases, AI contribution rules, and protocol v2 work for pushes against repositories with huge ref counts.

AI policy remains the sharpest divide. The Developer Certificate of Origin requires contributors to certify their submissions, yet it is unclear how that applies to model output. Reviewers report a rising tide of thin "meat proxy" patches, calls for Assisted-by style attribution, and worry that a looser stance will invite still more low-quality mail. Others note that the Linux kernel is more permissive and that fear of lawsuits may be overstated. No consensus emerged.

Emily Shaffer has posted a process document, not an AI policy itself, so the project can take a binding community vote when ordinary discussion fails. Voting would be a last resort for policy only, started with agreement from the Git PLC or primary maintainer. Eligible voters would be people who already landed a commit in next or supplied multiple code reviews before the process begins; each vote counts equally to deter last-minute dogpiling. After proposals are seconded and frozen, a two-week mail ballot would decide the outcome. Junio C Hamano called the framing sensible, stressed that technical questions should stay out of votes, and asked that the merged text define the process rather than merely propose it.

On the release front, attendees sketched Git 3.0 for roughly March 2027. A 2.99 series would signal the break; 3.0 itself could ship the same day with only default flips, including SHA-256 and mandatory Rust. Platform support for SHA-256 is uneven: GitLab is ready, GitHub is nearing general availability, and some other forges and JGit lag. Security maintainers separately described an unrelenting flow of AI-generated reports, many duplicates or outside the project's threat model, and discussed documenting that model, moving stale non-issues to the public list, and cutting releases once enough real fixes are triaged rather than waiting for the noise to stop.