# Gate Contributions on Demonstrated Comprehension Not on Tooling ## Claim A contribution policy should test whether the submitter understands the change, because comprehension is necessary for quality and cheap to evidence, whereas tool use is neither. <!-- atomicity: 1 idea ✓ --> ## Evidence **Source**: [[3. Resources/Readwise/Articles/The PHP Podcast 2026.07.30]] — PHP Architect podcast (2026-07-30) > [!quote] > if you can make a one paragraph statement summarizing at a high level what's going on in the vulnerability The mechanism is self-policing rather than detective. Writing the paragraph forces the submitter to look at the finding, and a bogus finding produces a summary that exposes itself — the worked example being a report that has to admit "I wrote this exec call into my repro script and the exec call is accepting arguments from the command line," which explains why it isn't a bug. What maintainers actually receive instead is three pages of narrative that diverges mid-document. The contrast case in the same episode is Codeberg's policy restricting AI-assisted contribution, which none of the three hosts could explain the enforcement of. The best available heuristic — flagging work disproportionate to contributor count — was immediately falsified on air by a host who legitimately ships tens of thousands of lines because they write codegen tools. Worse, the policy would also bar the episode's own sponsor, an AI code-review tool that sits on a continuum with the linters and security analyzers projects have run for years. The two approaches fail differently and that difference is the whole point. Tool-detection produces false positives against the most productive legitimate contributors and false negatives against anyone who strips signatures. Comprehension-gating produces neither, because it selects on an act that is causally necessary for a good contribution and expensive to fake convincingly. ## Scope & conditions - **Holds** where a short comprehension artifact is cheap for legitimate contributors and expensive to fake — currently true for vulnerability reports, where a fabricated summary must survive contact with the actual code. - **Breaks** as models improve: when the artifact becomes as cheaply generated as the submission it gates, the filter stops discriminating. This rule has a shelf life, and its expiry is a function of model capability rather than policy design. - **Breaks** for contribution types where comprehension is not the binding quality constraint — translations, typo fixes, mechanical dependency bumps. - **Weakens** where maintainers lack the capacity to read even the one-paragraph summaries, which is the volume problem it is meant to relieve arriving one level up. ## Links - [[3. Resources/Permanent Notes/Maintainer Attention Is the Scarce Resource in Open Source]] — applies-in: comprehension-gating is an attention-conservation mechanism, shifting validation cost from the scarce reviewer back to the submitter who created it - [[3. Resources/Permanent Notes/Casual Contributors Are Users Not Community Members]] — evidence-for: the low-context drive-by contribution is exactly what a comprehension gate is designed to catch before it consumes review time - [[3. Resources/Permanent Notes/The Maker Should Not Grade Its Own Homework]] — extends: the submitter is the maker, so requiring them to evidence their own verification is weaker than independent checking and is justified only because maintainer attention cannot scale to check everything - [[3. Resources/Permanent Notes/When Answers Are Cheap Understanding Becomes the Scarce Good]] — applies-in: when generating a plausible bug report is nearly free, the understanding behind it is the scarce good, so policy should measure that rather than the output - [[3. Resources/Permanent Notes/Vague Prompts Are Expensive Specificity Cuts AI Error and Cost Together]] — extends: specificity is the prompt-side discipline and the one-paragraph summary is its contribution-side twin, both forcing the defining work to happen where it is cheapest - [[3. Resources/Permanent Notes/Zet · Rapid weaponization outpaces manual update workflows]] — applies-in: machine-scale reporting is the interrupt stream this gate exists to throttle - [[3. Resources/Permanent Notes/Real Standards Adoption Means Implementing the Draft and Pushing the Gaps Upstream]] — extends: a well-formed upstream report is the same discipline applied to standards work - [[Open Source Governance MOC]] — applies-in: contribution policy design - [[3. Resources/Permanent Notes/A Defense Experts Fail Is Not a Defense for Users]] — contrasts on where the burden lands (added 2026-08-01): this note pushes validation back onto the submitter who created the cost; that one shows why pushing it onto the *recipient* fails outright, because the experts positioned to catch the problem already didn't. - [[AI Agent Safety MOC]] — applies-in: human-in-the-loop validation requirements for agent-generated artifacts - [[3. Resources/Permanent Notes/A Demo-Only Rubric Selects for Developers Who Cannot Explain What They Shipped]] — extended by: score the explanation as part of the rubric, not as a follow-up (Saha). ## Implications - Practical adoption is a single required field in a security issue template. It costs nothing and is testable — measure valid/invalid submission ratio before and after. - The design lesson generalizes past AI: any policy naming a *technology* will misfire on legitimate users and miss bad actors, while a policy naming an *act* degrades gracefully. - Daniel Stenberg shutting down curl's bug bounty is the leading indicator that the current disclosure pipeline for widely-used infrastructure is failing, and that triage capacity — not feature work — is the resource needing funding. ## Open Questions - Does the one-paragraph rule survive adversarial submitters who ask a model to write a convincing summary, and how would a maintainer detect that? - What is the measured false-negative rate — how many legitimate reports get discouraged by the extra step? - If comprehension artifacts become cheap to fake, what replaces them? Reputation cannot, given the volume problem it already fails to solve. - Who funds triage capacity once bounty programs close? ## Source - [[3. Resources/Readwise/Articles/The PHP Podcast 2026.07.30]] — the one-paragraph rule, the Codeberg enforcement problem, and the curl bug-bounty shutdown