CHAOSS OSPO WG, March 19 2026  🔗 **Source:** [CHAOSS OSPO WG, March 19 2026](https://www.youtube.com/watch?v=H9SsKPdj80Y) Okay, cool. And uh for our next agenda item today, we have Emma Irwin, who will be talking about AI and what OSPO should be thinking about them. And I'll pass it on to you, Emma. >> Thank you, Natalyia. So, some disclaimers about that. Um actually, maybe I'll introduce myself first for those that I haven't met before. I see Remy, who I know it's always nice to see you. Um who am I? So I've been working in open source for 20 years. Um for for 10 of those in the capacity of a developer and for the last 10 or so um sort of when you reach 20 you just keep saying 20. Um as kind of a technical program manager in the capacity of helping organizations be efficient and respectful and show up in the open source ecosystem. So I worked at Misilla for a number of years on the open innovation team in what was essentially an official OSPO at the time just helping uh teams get good at open source but also um innovating on a lot of things including safety and digital spaces and then uh for 5 years on Microsoft's open source programs office. So I was laid off there actually last year um as many folks are. So, um I'm not the disclaimer is more that I'm not currently in an OSPO, but I've kind of spent a lot of my time um kind of figuring out and kind of in a way uh fortunate to have a bit of time to just start tinkering and and um I launched the AI um al AI and open-source alignment working group in chaos and that came from uh so I watched a podcast or listened to a podcast as many of us do and they were talking about this topic of AI alignment which is also known as AI safety. I actually have a definition on one of these slides but um and that was the really compelling thing that came out of that for me is that alignment is really about ensuring that what AI systems do is what humans want and need essentially and that's also what when you hear open or when you hear the word safety or AI safety essentially that means the same thing as well. Um yeah, does it do what humans expect? Now there's like another layer to that which is which humans right and so um so a lot of what we do in the AI alignment group um right now we all well we just ran a s survey actually maybe I'll pop it into the chat a little bit later. I know that we're closing it today or tomorrow, so I don't know whether it'll work, but we're trying to understand how AI is turning up in people's uh lives and workflows and businesses so that we can start to form an opinion or maybe define a set of principles um that state these are the things that that these are the principles of alignment for open source and that that represents like decades of labor, um the community values as well as the business value. So we're, you know, we want to make sure that there's kind of this when we ask the question of which humans, there's always being this kind of unofficial agreement between communities and businesses that open source is both of us, but there might be need to be a bit more clarity around that. So that's what and we did do a ton of sharing um articles and we are building resources. So if you join the AI working group just to to view the resources that people are always sharing then you might find it worth it and then if you get around to contributing or attending call that's just a bonus but I like a lot of people sharing things. So okay so that's my preamble. Um I am working I am kind of working for myself right now and I have like some contracts but I'm not part of any OS hospital right now. So, uh, there might be a gap in what I'm thinking and what hospitals are actually doing, but maybe that's also superpower. I'm embracing the I'm embracing the um the wildness of of the world right now, the good parts, I guess. So, I said some of this already, and this is a lot of the content in my site is generated from blog posts I've written or uh other things. So, um, I mentioned what alignment is. Alignment is designing systems so that their goals, behaviors and uh decisions are consistent with human values and intentions in the context of chaos which is where we are. Open source alignment means consistent with what we've built known value and expect um our metrics specifically but also with the knowledge that those metrics might need to change to adapt to to that. So um and then I also like to call out there's these two contracts between communities in in open source and businesses in open source ospos like you're probably used to to context switching. You know when you talk to executives you talk about um you know innovation and um reduced um like capac like being able to to leverage the community's um efforts and the hiring pipeline. These are all things that we've been saying to businesses and then we when we talk to communities and folks who you know are building those then we talk about um you know making sure that we're good citizens in the the community and all these sorts of things. We've always had those kind of two contracts essentially. Um but my worry is a little bit it's getting a little bit too further apart the more we remove humans from that. And so I won't go too much into that but that's sometimes you'll hear me refer to the two contexts or two languages. Um and yeah I won't read the rest of the slide but I think OSPO's role if I was to be so bold as ensure that alignment with humans remains a priority as AI changes how open source is built released and sustained. So, um, if I was in an hospital right now, I would be trying to I would be trying to keep that, uh, central still because I know that it's all about going fast right now and making the money and everything. And, you know, it's that's a very easy thing to lose in this moment. So, I also thought like I have these three sections, use, release, and contribute, which usually map to our OSA priorities. And I have like just a couple slides that synthesize some of the things we've been talking about in the AI alignment group. But then I thought I'd pause in each of these sections to just kind of hear from each of you what you think the the problems and work to be done etc is under each of those if that sounds okay then I don't have to just listen to myself talk. So yeah context you know AI is now in the middle of how we use open source. So under the the using open source, here's some just various data from some of the sources that we've been sharing around in our group which you might have also seen out there. Um you know from a risk perspective and what can go wrong you know where we're where most OSOs have tools for things like um typo squatting. I don't know actually where the term slop squatting comes but there's you know just kind of a leveling up of how uh there's both the hallucination of names now coming into play and also you know the oh yeah I'll share my sure I'll share these after sure with a disclaimer that you know um I put these together pretty fast uh it's really hard to understand licensing in LLM so I actually spent a bunch of time the last couple weeks even with a full open source model. So that's open model, open data, open everything. And I found it almost impossible still without like a lot of effort and maybe some tokens to figure out what the license is of data that something was trained on. So this is really it's really hard. Um there's um you know we don't really know how some code is being put together, what the context agents are being given and so on. So I won't read all of that. you know, there's 4% of Claude commits are now a authored by Claude alone. So, there's all this stuff that's happening really, really fast. And I and so I think that's really one of the reasons I was glad to come today is because I think we need to talk more um potential and this is where I'll like ask you. I'm sorry there's so many words on this, but I had to put it together quickly. Uh potential open source focuses OSO focuses. So I mean I I personally always feel like an OSO's role is very much about education of engineers and um but maybe it's also becoming education via two agents and AI like this context setting for the AI we're using I don't know but um so there's a lot of different things that like there's these three sections govern dependency shape how agents operate and protect the dependency ecosystem. There's a lot of different work that we could be doing. Um I'll just call out a couple here. So um um visible dependencies disappear. So monitor the health of Yeah. So I'm I'll just kind of over on this protect the dependency ecosystem square like fourth down there this monitor because this is relevant to chaos monitor the health of critical dependencies. I mean in the past we have a chaos the bus factor which became I think the contributors factor and there's also response time and all these sorts of things that we have in the past thought about the health of open source communities which might themselves be changing so burnout signals there we actually might see an increase in merges we actually might see more activity which makes it seem like there's more contributors when it's really AI and so I think there's some adjustment that we need to do when we're not just that we're monitoring the health of our dependent ies, but looking for s like trying to get through the noise of the trying to find the human in the middle and see like is are they there? Are they are they actually healthy or burnt out? So, um I think there's definitely some innovation for OSOs to do around monitoring the health of their dependencies. So, that's one uh I'll I'll choose one from each square so that I don't uh so going backwards the shape how agents operate. So, you know, this is a really interesting one for me because I mean, I don't know how much work you've all done building agents. I've done like very little, but I have done I have been working a lot with coding like co-pilot and claude and worked a little bit with agents and I've I've realized that for example opening is is in the training data. So if I ask tell an agent to you know build an open source solution it'll immediately go for llama or like some other like well-known models which actually are mixed license and you know the training data is not open and that kind of thing. So I think that the context setting for the agents and the AI we're working with coming from hospitals will be really important so the engineers for example are you know have um that context provided to them that they should be working with initially to kind of cut through any biases or hallucinations or or whatever that might be happening with their coding agents. Um I also kn yeah I'll leave that for a second. in governing governance. Um there's a few things here. I mean these are all exper I see these more as experiments than like this is a thing you should do. I think a OSPO should experiment with context standards for agents. They should experiment with different um health models of dependencies license compliance. Um yeah I guess tracking tools published and approved. Yeah. So there's there's a few different governance things. I you know I'm one of the things I'm doing right now is working with the internet society on upgrading their code of conduct and we're adding an AI clause around consent. So um that there's um that anytime one of our maintainers you know uses AI is with the consent of the community anytime uh we contribute upstream it's you know there's a clarity and consent that that project wants that. So I think that that's also a governance thing. So those are just some ideas. Um I have some more questions we don't have answers to yet and I think that's most of what we're doing right now. So the first one is actually based on a project that I know is happening with ecosystems uh right now which is should agents manage abandoned dependencies. Um, and you know, Andrew, I'm not sure if you know them, is like incredibly brilliant. And I've seen, you know, this the idea that we could solve some of our s sustainability and risk issues by, you know, assigning angels to the job of maintaining some abandoned or you project. So, but is that something we want to happen? What what does that look like? Who decides? Are we working with organizations? Is it just like if I was at Microsoft, is this just Microsoft, you know, with their agents in a version or is this all like companies coming together to do it? I I mean I don't know. I think a lot of people are talking about this kind of thing, but um of course there's if we think about alignment again, which I think is the center of this is that alignment with what communities, you know, who is the community involved in that? And I think there's just a lot of like removing humans entirely is a risk. I can see from a business perspective why that would be desirable. Who is responsible when agent selects a dependency that turns out to be malicious? I mean just generally the ownership of AI everything is that the engineer um like how does OSPO build policy around that to protect them as well because you know I'm I'm sure that they're not you know no one wants to get in trouble for something that they you know do they blame AI and what's the accountability there um yeah what should the if there's a context library what should it contain I mean there's actually like a ton of work for OSOs now when I was laid off it felt like ospos are being absorbed into organizations because it was primarily an engineering capacity but I feel like there's just so much work cut out for us at this point. Um at what point does AI tooling require disclosure to your user? This is again about consent. I think consent is really central but um those are some questions that I had. So maybe I'll just pause there and you know just among us how is AI turning up in your like what questions do you are you seeing or work that you're thinking about in the use like taking a dependency >> well I can't I can't hear you Natalia no I'm just thinking but >> yeah I guess like one of the things I've been thinking about um a lot of my work um is centered around like repository hygiene and repository standardization. So >> and then um recently some of our repos uh shipped like a agents.mmd to be able to facilitate um work with um agents doing development on their repo. So, I'm just thinking of things like that, like how can we set up the repo with enough documentation um in that we can help guide agents to doing development the way that aligns with how we'd like them to do it. Um yeah, so kind of thinking about like setting the infrastructure and the foundation um to be able to support agents doing work on repositories. Yeah. Yeah. Interesting. Anyone else thinking about anything specific in use as it relates to AI? I I don't know. But uh in terms of um so what what we try to do in in in our case is to kind of stay off all of the security and and responsibility part and just build recommendations and best practices. So also approved licenses. Yes. Okay. we have a kind of a list of licenses that we recommend but then uh for for everything else we just refer to the to to security but yeah but but but those are interesting questions that are uh I think the the interesting one for us is the around the dependencies and uh because already just to understand what your dependencies are it's a good question and uh Yeah. And I think there there's probably somewhere in executive suites asking can we just for for all these inactive can we just fork them and maintain them or rewrite them? I'm sure there's all kinds of questions like that and you know the hospital is going to be pulled into those conversations I sus suspect. >> Yeah. Because if you rewrite them then probably someone else wants to rely on them. I don't know. And then you start to be provider of of the famous uh um XKCD right >> leg of the whole thing but >> okay I don't want to cut anyone off though if anyone had any last things to say about use but um yeah no one's figured it out that's the the one comforting thing in this moment although it's also comforting when things are figured out but it means there's work to be done which is helpful in this economy so release. So releasing open source you know this is um you know when I at Microsoft we the we had policy and sort of automation around releasing we uh I mean I'm sure they still do but like some of the things that we did before AI was a factor was you know you couldn't your repo couldn't turn to public till you had sort of the business sign off and the legal sign off and those sorts of things. I think that kind of process will still be important, but there's there's kind of a lot more that's coming into play right now. And also the training of maintainers that you just can't throw an open project over the wall. That's probably more true than ever. Um, but one of the interesting things that I keep getting stuck on too is like the open source AI and I I feel like this is an area that's because there's such a race right now, there's there's just a lot of noise around what that means. So for me just making sure the engineers understand what that means. So this OSI definition which uh you know has the training data can be doesn't have to be I'm trying to avoid the word hidden but you know um you don't have to open the training data it can be described um there's the meta the meta lama style there's um vendor marketing there I mean there's just a lot of things and when I have gone into my my chat agent and said you know what open- source AI solutions solions do you have? I have to really keep reprompting it and reprompting it and reprompting it till I get to something that I want. So I feel like there's still a TBD around what open source AI is right now like that we actually understand what the license are that we can reproduce the training that there's community governance and no one has achieved this and I don't even think anyone's working on it to be honest but um and maybe that this is me being like an open- source kind of I think they call us purists when they're trying to insult but but I I I I feel like this is work to be done as well like you you know, um, organizations are going to be have an opportunity to lead how we talk about open source AI. Oh my gosh, it's such a bright screen. Potential open-source AIS to do. So, um, yeah, I just mentioned kind of the same rules like of releasing, but maybe a little harder to follow with AI writing things. You know, I'm not sure how hospitals are thinking about releasing code that includes code that is written by AI, which may or may not have the right license. I know everyone's kind of covering their eyes a bit right now. I don't mean ospose but the world. Um I mentioned the code of conduct needing AI clauses in you know just from um if if you're engineers releasing an open source project I'd want to make sure that my code of conduct has these type of clauses and I'll give you an example over at the internet society. I was in a community call and there's like a ton of AI notetakers suddenly just came into play. and like wa it's like flies in the room, right? And so, um, just making sure there's the consent pieces and interaction with your with your community, making sure that engineers understand how nervous essentially some folks might be to these types of things. And that can really help build the reputation for your organization in showing respect for individuals, the humans that come in, the alignment piece, um, training, data, transparency. I mean, OSO have always pushed organizations to be more open. And I think that includes things like data transparency and getting just better at at um helping people feel confident in what they're using. Agents acting in your name, self-explanatory. Um who's accountable if you have agents merging pull requests and you know if people feel frustrated by that, who's accountable for those frustrations? Um it's very easy. I I've had uh coding agents want to put my secret into like a file in that's not in git ignore and there's all kinds of risk there. I'm sure AI is getting really a lot better at this but it doesn't mean engineering engineers are prompting correctly. So there's a lot of risk. I I heard you say that you're not working your OSO isn't working so much on security which kind of makes sense that that's a a team that works with OSO rather than OPO's job but it depends on how big the organization is I guess. And then again, yeah, just community plan, not just code. Uh, I think that continues to be a risk for organizations to make sure that their engineering teams and I guess as AI becomes more makes coding more accessible, there's a whole new generation of people to teach what it means to release an open source project because it's not it's in a way it's made releasing things more accessible to another other generations of people. So there's maybe even more education to do there. Um, so yeah, some questions and again I threw these together so I hope they're relatively good. Similar questions about agents committing code on your behalf. Um, yeah, your license, is it relevant when you're um, if if it's just an agent and not a maintainer, is is that okay for your organization? Do you want to ask for a specific commitment from your engineers to turn up to to respond to any types of questions? I mean, what does it mean to interact with the activity when it when you're lean starting to lean heavily and your executives are leaning heavily on you to do it? So, that that's like quite challenging. And then should codes of conduct. Again, I keep bringing this up. I think because that's work that I'm doing right now, but um I think that that human piece is really really important and probably the thing we're most at risk in losing. And um in our AI alignment call yesterday um we have Coraline uh Mki from the contributors covenant and ethical licensing and she's really interested in this you know not losing the people part. Um and so that's why I emphasize there as well. Anyways, I'll stop there. So, releasing. So, your company putting code out there. What questions do you have or what are you running into? Any inspiration and cool things that you know about? Well, I understand that for question number two, the so that the scholars and in general practitioners are converging towards um the fact that uh that AI generated stuff is non-copyrightable, right? >> Mhm. >> And so it's kind of Yeah. And so I don't know. Uh and then the license. Uh yeah, there was an article someone had posted in our AI working group about licenses. Let's see if I can quickly find it. Um fair. Yeah, it was called fair. I don't know anything about fair source or like how it's being described, but this was something that came into our chat the other day. Maybe it's helpful. And and um >> something that I haven't really called out here is the cognitive load. Um there's an article on co Let me just find that too. Hold on a second. Um I'll try and find it when I'm you're not having to watch me scroll through it. But >> yeah, >> there's already the the discovery of cognitive overload for open source maintainers and there's the pressure from executives to, you know, go faster, use AI, these types of things. What is the OSO's role in setting helping engineers set boundaries for their cognitive load? I I feel like that's a thing as well in the future. Um yeah of copyright is yeah I saw that copy left is dead. Yeah, one thing that um our ospo has been thinking about, I had a conversation with Remy about this um for assisting maintainers with I guess like the burden of having to go through so many PRs now that um lots of people are using AI to make contributions to repositories. Oh, the formatting of this is not the greatest, but we were thinking of kind of setting up uh contributing guidelines that um guide the way that repositories accept PRs. So for instance, we don't accept PRs that don't directly address an existing issue, >> touch more than a certain amount of files, contain more than a certain amount of commits, contain uh change core system files, are untested, don't pass a test suite. And um these are guidelines that repositories can set themselves. And they can also just include that oh we are just not accepting um repositories that are entirely AI generated. But just having these like rules and restricting the um restricting um or adding certain limitations to how PRs are um structured to ensure certain things. So for instance, if we limit the amount of like files and commits, it would reduce the amount of review time needed from a maintainer or from a human and kind of reduces like the radius, right? Um testing suite just ensures there's no breaking changes. Um ensuring that PRs address existing issues means that it reduces the risk of I think the word was roadmap drift because it ensures that contributions made are align with like um the road map and the priorities of the project. So just having these certain guidelines can help the way that we review PRs and accept issues as well. But that's one thing our OPA has been thinking about. Um we haven't put this into practice quite >> quite yet and um haven't or are unable to talk about like actual tangible results but this is one of the ways we were thinking of guiding um AI development in repositories. Yeah. And and did you actually do it like proactively before like the problem arised? And uh >> you can totally do that too. Yeah. >> Okay. I love that roadmap drift. Is that what you said? >> Yes, that was the I think. >> Yeah. Yeah. It's like and and in technology we know that neurodeiverse people are over represented. So actually a lot of us are actually quite good at jumping between a lot of things. Um but you know that can actually be doubly bad as we're sort of like following the interest of um what people are contributing. I love the the idea of staying on track there. >> So just to go to contributing here because it's sort of our our um the uh runway home here. This is just what we were just saying, right? Like there's just a lot of the maintainer crisis is getting worse. Um, and I actually have like a little graph here to show how folks are we have a a read me in the AI alignment working group repo which I'll try and share um after this where we're we're trying to track LLM um projects but um you know it it's a whole layer on top of the already critical open- source sustainability issue and um so yeah it's causing obvious obviously a lot more problems and there's lots of way that that organizations are trying yeah that is an yeah ours is um ours is actually listed on that list so that would be so I think there's this like how open source projects are responding but also recognizing the sustainability risk something I did when I was laid off is like worked more in the sustainability space and I just I feel like I mean and I know from talking to Android ecosystems that there's fewer work. >> I think I lost the audio. >> Yes, I don't think we can hear you, Emma. Let me um >> Oh, now we do. >> Okay. Yeah, this is the problem. Um I apologize. I think it might have something to do with Firefox because as soon as I open Firefox this started happening. Um I was just what I was trying to say was um working in the open source sustainability. So this is becoming more prevalent. The exhaustion is becoming more prevalent. There's fewer and fewer companies contributing to open source financially and that's backed up by some of the data and ecosystems. they can track the GitHub sponsors number uh like whether a project is sponsored or not. And I don't think Andrew's shared those numbers publicly yet, but they're, you know, available in their data sets that it's decreased. It's just going down. There's fewer maintainers being sponsored, at least through GitHub sponsors, and I think actually um Open Collective is also reporting less less less funding. um the rallying cry to do more about this, the rallying cry to do more about to do more funding is louder than ever, but the actual actions do not seem to be translating out of that. And so I would suggest that it's also an hospital's responsibility to help their executives see that as a as a opportunity to show up in the ecosystem in some way. Um Foss Fund was a program I ran at Microsoft and there's still I think Foss funds being run but I think there's a 2.0 0 of that where we you know you apply metrics for chaos you look for maintainers who are struggling under this kind of thing help them set up governance not just give money but give time and help them set up I think that there's an opportunity there anyways um off my platform there um potential to-dos yeah upstream contribution policy protect your dependencies attribution uh I think is something emerging out of um code uh AI I type of um efforts. Uh it was interesting. Coralina who's in our group used to work at GitHub like many many years ago and created an action that allows you to ban user or to ban contributions from users that you have banned from the organization. And so people are banning Claude and they're b so she's like this tool I made 10 years ago is suddenly like new again. So um so there's all types of things that people are thinking about um the authorship I guess of participating in ecosystem norms is it's a massive opportunity honestly to show to help companies show up right now uh for communities and for people for maintainers for um you know for chaos to to build new metrics that kind of build on the work that we've done. It's not like a lot of the metrics have gone away, but there's a new layer to them. And I think that, you know, helping people evaluate their ecosystems better. Um, these are just some more questions. They're they're kind of similar. >> I think we lost my gain. >> Yes. in. >> Yeah, sorry. I don't know what's going on. I'm almost done here. So, hopefully I'll just I'll just have to put up with it. There's there's something I need to figure out that's going on with my system. A reboot helped, but then when I opened Firefox, it started again. So, I think that might be my culprit, which is weird for internet, but and then um if you're if there was a action framework, I was just playing with this idea. Can you hear me now? Yeah. is I mean I think it's always OSPO for me is education, teaching, capacity building, capability, competence building and just especially I think as you're as more non-engineers start to to work with open um things it's becoming the hospital's role is actually becoming more important or I think they're sometimes called OS AI project offices or whatever the so these are some more framework work ideas. I won't read them all because we're almost out of time and my connection is bad. Um, I also have this slide which I'll share my slides later in case they're helpful. Um, I have a bunch of the sources down below too. So, um, so yeah, these are just some of the things that we've been talking about in their AI alignment group too. So, they're not just all Emma. Um, I guess the last thing I would say is there are experiments. Yeah, I mentioned this already. I mentioned this already around agents that maintain open source. What does it mean for businesses and business partnerships? I think that partnership piece for OSOS is important to figure out how you're going to work with other companies on this. And yeah, so what you should do for sure is join our AI alignment working group chat like just come and hang out with us. You don't have to join calls or anything, but there's lots of great links being shared. We'd love you to share what you're learning. I think it's all about learning right now and all the rest of the things on this slide. And that's that's what I brought today. Um I'm sure there's a lot more things we could say, but that's that's kind of uh a few things that maybe are helpful and I'd love to hear continue the conversation. Okay, awesome. Thank you so much, Emma, for giving your presentation on AI and OSOS. Um there's been a lot to think about in this space. So it's really nice to um see everything come together and just have everything at least a lot more organized in my head. Um yeah. So you I saw that the uh AI alignment working group has a survey out. Um, I feel like some attendees in this uh call can totally fill out the survey if you can drop it in the chat. I think I h I have in the agenda too actually. Let me bring it up here. Okay, so here's the survey by the working group. Feel free to fill it out. Um, let's see. And we have two minutes left in our meeting. Any other final thoughts that anyone would like to share? Okay, awesome. Um, okay. And in terms of the future, next week we have a presentation by uh Travis Hathway who will be talking about how he uses chaos at Anaconda. Um so feel free to join us for that two weeks from now and we will have some other exciting presentations coming up in the future. Yes. Otherwise I think that's all for today. So I hope that everyone has a great week. Thank you Emma again. Thank you everyone for >> for hosting. >> Thank you. >> Thank you Natalia. >> Yes. Thanks Alan. Bye >> bye., CHAOSS OSPO WG, March 19 2026, YouTube, 01kp8g9p177jdx045s4d23pw27.