Is AI‑Generated Code Flooding Open‑Source? How Vouch Rewrites Trust

Open‑source governance crisis

For two decades the community relied on “trust but verify”: contributing code required effort (understanding the codebase, writing logic, submitting a PR), which acted as a natural filter for low‑quality contributions.

Since 2024 generative AI models and coding agents such as Claude Code enable anyone to produce code that looks reasonable without real understanding, creating a flood of “AI Slop”. Maintainers now spend time distinguishing human contributors from AI‑generated pull requests.

People can easily create contributions that look reasonable but are of very low quality without any real understanding.

Vouch: explicit trust mechanism

1. Explicit trust whitelist

Vouch replaces implicit goodwill with an explicit whitelist stored in a flat text file VOUCHED.td. The file records two categories:

Vouched : users allowed to participate (submit PRs, comment, etc.).

Denounced : users explicitly blocked for malicious code or AI abuse.

GitHub Actions can read the file and automatically close a PR if the author is not listed, preventing low‑cost AI opportunists from entering the project.

2. Social proof instead of technical barriers

Trust is earned by communicating like a normal human. A sincere issue comment such as “Hi, I am developer X, I want to fix Y, my approach is Z” is more effective than a cold AI‑generated one‑click PR.

Basically: introduce yourself as you would in any normal human social setting, and you’ll get a vouch.

Technical implementation

Trustdown (.td) format : the trust list is a simple text file, easy to read, diff, and fully version‑controlled with Git.

Built with Nushell : Vouch has no heavy dependencies and runs as a pure CLI tool.

Web of Trust : Project A can be configured to read Project B’s trust list. If a contributor is trusted in Mitchell’s terminal project Ghostty , the same trust is automatically recognized in any other project that references Ghostty’s list.

This design aims to create a cross‑project “trust federation” that lets high‑quality contributors flow freely while blocking AI‑generated junk.

Repository

https://github.com/mitchellh/vouch