Machine authors, machine principals, and no shared FOSS rule

Free software is meeting the same non-human actor at two doors and answering with two different instincts. On emacs-devel, a would-be ELPA contributor who openly "burnt some tokens" to build a Magit-inspired Sapling client is stripping headers and declaring every mistake human. On the WIMSE working group list, chairs are running a call for adoption of an AI-agent authentication and authorization draft that treats autonomous agents as workloads with credentials, delegation, and audit obligations. One community is still unsure whether machine-shaped patches belong in a curated free-software archive. The other is designing how machines will hold identity and exercise authority once they are already operating across trust boundaries. The through-line is simple and unfinished: FOSS has mature rules for human authors and maturing rules for deterministic services, and almost none for synthetic contribution or for agents as principals.

Swithin Chan asked to place sl.el on non-GNU ELPA (and hoped for GNU ELPA): a small, Windows-friendly Emacs interface to Meta's Sapling, built because stock Git on Windows felt too slow for day-to-day work. The submission was framed as practical necessity, not ideology. What followed pulled Richard Stallman into the orbit of provenance. Chan later wrote: "I have removed the header. All errors are solely by mine." That retreat is the story. ELPA culture assumes a human who can take copyright-shaped responsibility for every line. A package produced with LLM assistance sits badly against assignment, licensing clarity, and the expectation that someone accountable stands behind the text. Headers that name a model, and headers that hide one, both create problems the archive has no finished policy for. Chan's path to continued review was to reassert sole human authorship and ongoing maintenance, with Transient menus and Sapling options added under that claim.

Stallman's explicit words in the same broader exchange draw a narrower, practical line. When Chan pointed at CVE-2024-30205 and offered help colored by LLM use, Stallman did not ban the tool as a sensor: "We don't object to getting information about bugs and problems that is based on someone's running an LLM. Maintainers should verify that the bug is real, because LLMs and humans both make mistakes, and if so, fix the bug." He wanted each issue mailed separately to bug-gnu-emacs so the right people could own it. On the specific Org-mode remote-file trust flaw, he added that if the bug is said to be gone, "it can't hurt to verify that it really is gone." Chan answered with a check that exercises the fixed behavior: a hostile TRAMP Org path refused, a local file still loaded, result PASS on current Emacs. Philip Kaludercic, on the packaging side, kept ordinary hygiene in view: whether the cited CVE still applied to present releases, Windows performance, Transient fit. The visible thread never closes a general ELPA rule for model-generated Lisp. What it shows is a working distinction in the free-software nervous system: LLM output as bug leads may be filtered by maintainers; LLM output as distributable code presses authorship, license, and liability assumptions hard enough that the contributor erased the machine from the header to stay in process.

Across the IETF fence, Justin Richer opened a formal call for adoption of draft-klrc-aiagent-auth (AIMS) as a WIMSE working-group document, stressing that adoption is a starting point, not a blessing of every line. Pieter, a co-author, recused from chairing process around it. The list answered with broad A votes. Joseph Salowey captured the mood: "While it might not be perfect, I think it is a good starting point." Peter Thairu, Thi Nguyen-Huu, Amin Hasbini, Kieran Sweeney, morganLR, and others joined in favor, then immediately loaded the draft with the hard problems adoption is supposed to enable.

morganLR put the technical split cleanly: "At the identity layer the draft has it right: agents are workloads. The difference in kind is at the authority layer, where two properties co-occur that prior workload classes lack: intent is generated at runtime, so authorization must bind at the action rather than at grant time; and counterparties are discovered at runtime, so trust cannot be assumed pre-federated." A verifier, on this view, does not interpret a mission. Authorization binds to operation, arguments, resource, and principal. That is not another microservice passport; it is a different shape of power of attorney.

The gaps named in supporting mail are concrete. Kieran Sweeney argued that Section 10 already contains the links of multi-hop life (agents invoking agents, transaction tokens down an internal chain, cross-domain identity chaining, token exchange at tool boundaries) but not the weld: no composition story for an A-to-B-to-C path a verifier can check end to end, and no use of the RFC 8693 act claim built for attribution along such chains, even while Section 11 demands reconstruction of the full execution trail including delegated authority. Thi Nguyen-Huu attacked time-bounded posture: assessment at provisioning that only shortens lifetime leaves a credential carrying a past judgment between rotations. The counter-design is condition-bound credentials, held with hardware-backed keys the draft already permits, so when posture fails the credential dies without waiting on expiry or revocation delivery. Amin Hasbini tied the same objects to law already in force. DORA and NIS2 need operators to show what an agent did and under whose delegated authority in a form that survives the operator, which wants stable instance identifiers (not only config classes), grants that signed action records can cite, and signature agility because retention outlives algorithms. morganLR restated an operator-excluded boundary as a nameable requirement: no party running the agent's infrastructure may expand its authority or fabricate authorization evidence, and the accountable party must be checkable outside the operator's trust domain. The draft does not forbid that; it does not yet say it.

Set beside the Emacs thread, the missing middle is obvious. Curated Lisp archives are being asked whether a human who used a model may land the result under a free license, and what header tells the truth. Workload-identity engineers are being asked how an agent receives credentials, narrows scope across hops, binds runtime intent, and leaves an audit trail regulators and counterparties can trust. Both ask whether a non-human can participate in systems built for people and for predictable services. Human contribution norms (review, copyright, DCO-like accountability) and service identity norms (OAuth client patterns, workload identity, chaining drafts) do not yet compose into a rule for "code a model wrote" or "agent a human delegated."

Stallman's verify-then-fix stance on LLM-sourced bug noise, paired with a contributor's insistence on sole human ownership of package text, is one community instinct: keep the human as author and liable party; treat the model as a tool. WIMSE's adoption drive is the other: once agents act across organizational and regulatory boundaries, pretending they are only tools fails in operations and in compliance; they need principal semantics. Neither instinct is frivolous. Neither yet hands the other a portable norm.

sl.el remains a packaging and authorship problem under human claim. AIMS carries strong support and an explicit backlog: multi-hop composition, condition-bound credentials, operator-excluded accountability, instance-stable identifiers, algorithm agility, and authority binding matched to runtime intent. Unresolved is the shared FOSS question under both fights. When a machine writes the patch, who is the author for license and blame. When a machine holds the credential, who is the principal for delegation and audit. And whether those two answers must be the same kind of answer.