A prominent open-source maintainer has proposed asking new contributors to submit terminal session recordings alongside their contributions as a way to distinguish human-written code from AI-generated patches. Rodrigo Arias Mallo, maintainer of the Dillo web browser, outlined the idea in a blog post reported by LWN.net on 26 May, suggesting developers use asciinema to capture their programming sessions as authorship verification.
The proposal arrives as open-source projects face an influx of AI-generated code submissions. Large language models can now produce functional patches with minimal human input, raising concerns about code quality, accountability, and the sustainability of volunteer-driven review processes. Arias's approach shifts verification from analyzing static diffs to examining the development workflow itself — the sequence of commands, debugging iterations, and decision-making that produces a finished contribution.
How the Framework Works
Under the proposed system, new contributors would record their terminal sessions using asciinema, an open-source tool that captures terminal output and keystrokes in a replayable format. Maintainers could then review these recordings to confirm a human developer authored the patch through genuine problem-solving rather than submitting AI-generated output wholesale.
The framework is explicitly voluntary. Arias and community respondents have emphasized that mandatory recording requirements would conflict with open-source accessibility. Instead, projects could adopt the practice selectively — scaling implementation based on review capacity, codebase sensitivity, or the risk profile of incoming contributions.
Technical Critique
The proposal's strength lies in its reliance on process documentation rather than output analysis. AI-detection tools for code have proven unreliable, producing both false positives and false negatives. A terminal recording provides an auditable trail of how a developer arrived at their solution, including false starts, research commands, and iterative refinement.
However, the approach introduces significant practical challenges. Reviewing terminal recordings is inherently time-consuming. A patch that takes minutes to review as a diff could require twenty or thirty minutes of playback to verify properly. For high-traffic projects receiving dozens of contributions weekly, this creates an unsustainable workload unless projects develop triage heuristics or delegate review responsibilities.
Spoofing represents another concern. While fabricating a convincing asciinema recording requires considerably more effort than generating a patch, determined actors could theoretically script terminal sessions or use AI to synthesize plausible command sequences. The proposal acknowledges this limitation but argues that the friction involved serves as a practical deterrent against low-effort automated submissions — a reasonable threshold for most community-moderated projects.
Privacy considerations also warrant attention. Terminal recordings can inadvertently expose environment variables, file paths, API tokens, or internal infrastructure details. Projects adopting this framework would need clear guidelines on what contributors should redact, how recordings should be stored, and who retains access. Open-source projects with limited infrastructure may struggle to provide secure, long-term storage for sensitive session data.
Implications for Development Teams
For organizations managing open-source dependencies, the proposal raises questions about supply-chain verification. Teams that rely heavily on community-maintained packages should monitor whether major projects adopt authorship verification frameworks, as this could affect contribution policies and vendor-assessment criteria.
Teams contributing upstream might consider recording their own development sessions as a goodwill practice — demonstrating transparency and easing the review burden on volunteer maintainers. Internal code-review policies could similarly benefit from workflow documentation requirements for high-risk changes, regardless of AI involvement.
The broader lesson is that authorship verification in open source is shifting from a binary question of human versus machine to a spectrum of meaningful human oversight. Projects that formalize expectations around contributor transparency while preserving accessibility for genuine newcomers will be better positioned to maintain trust as code-generation tools grow more capable.
Whether asciinema recordings become widely adopted remains uncertain. But the conversation signals that the open-source community is taking AI-generated contributions seriously and seeking solutions aligned with transparency rather than proprietary detection systems.
一位知名開源維護者提出，要求新貢獻者在提交貢獻時一併附上終端會話錄影，藉此區分人類編寫的代碼與 AI 生成的 patch。Dillo 瀏覽器維護者 Rodrigo Arias Mallo 在一篇網誌文章中闡述了此構想，LWN.net 於 5 月 26 日作出報道。他建議開發人員使用 asciinema 錄製編程會話，作為作者身份驗證手段。
此建議正值開源項目面臨 AI 生成代碼提交湧入之際。大型語言模型現已能夠以極少的人工輸入產生功能性 patch，引發了關於代碼質素、問責制以及志願者驅動審查流程可持續性的擔憂。Arias 的方法將驗證重心從分析靜態 diff 轉移至審查開發工作流程本身——即產生最終貢獻的命令序列、除錯迭代和決策過程。
框架運作方式
在建議的系統下，新貢獻者將使用 asciinema（一款以可重播格式記錄終端輸出和按鍵的開源工具）錄製其終端會話。維護人員隨後可審查這些錄影，以確認 patch 由人類開發人員透過真正的問題解決過程所撰寫，而非直接提交 AI 生成的輸出。
此框架明確採取自願性質。Arias 和社群回應者均強調，強制性錄影要求將與開源的可及性原則相衝突。相反，項目可有選擇性地採納此做法——根據審查容量、代碼庫敏感度或新貢獻的風險狀況來調整實施規模。
技術評析
此建議的優勢在於其依賴流程文件而非輸出分析。針對代碼的 AI 檢測工具已被證明不可靠，同時產生誤報和漏報。終端錄影提供了開發人員如何得出解決方案的審核軌跡，包括錯誤嘗試、研究命令和迭代優化。
然而，此方法引入了重大的實際挑戰。審查終端錄影本質上耗時。一個以 diff 形式只需數分鐘審查的 patch，可能需要二十至三十分鐘的播放時間才能妥善驗證。對於每週收到數十份貢獻的高流量項目而言，除非項目開發出分流啟發式方法或委派審查職責，否則這將造成不可持續的工作量。
偽造是另一項隱憂。雖然製造令人信服的 asciinema 錄影比生成 patch 需要更多功夫，但有心人士理論上可以編寫終端會話腳本或使用 AI 合成合理的命令序列。該建議承認此限制，但認為所涉及的摩擦足以作為對抗低質量自動化提交的實際阻嚇——對於大多數社群管理的項目而言，這是合理的門檻。
私隱考慮亦值得關注。終端錄影可能無意中暴露環境變數、檔案路徑、API token 或內部基礎設施細節。採納此框架的項目需要制定清晰指引，說明貢獻者應遮蔽哪些內容、錄影應如何儲存，以及誰保留存取權限。基礎設施有限的開源項目可能難以為敏感的會話數據提供安全的長期儲存。
對開發團隊的啟示
對於管理開源依賴項目的組織而言，此建議引發了關於供應鏈驗證的疑問。嚴重依賴社群維護套件的團隊應留意主要項目是否會採納作者身份驗證框架，因為這可能影響貢獻政策和供應商評估標準。
向上游貢獻的團隊或可考慮將錄製自身開發會話作為一種善意實踐——展示透明度並減輕志願者維護人員的審查負擔。內部代碼審查政策同樣可受益於針對高風險變更的工作流程文件要求，無論是否涉及 AI。
更廣泛的教訓是，開源中的作者身份驗證正從人類與機器的二元問題，轉向有意義的人類監督光譜。在規範貢獻者透明度期望的同時，又能兼顧真正新手可及性的項目，將更能隨著代碼生成工具日益強大而維持信任。
asciinema 錄影是否會獲廣泛採用仍有待觀察。但此次討論反映，開源社群正認真對待 AI 生成的貢獻，並尋求符合透明度而非專有檢測系統的解決方案。