用六维模型看清开源AI治理的空白
arXiv上传一篇论文，系统分析了SymPy、LLVM、matplotlib、OpenInfra、Apache软件基金会和Linux基金会6个开源组织的AI贡献策略。研究采用最相似系统设计，通过指标编码和过程追踪，推导出披露、责任、人类监督、许可、执行、维护者工作量六维分类法和政策成熟度评分。论文将维度映射到EU AI Act、NIST AI RMF（含UC Berkeley Agentic AI Profile）及ISO/IEC 42001和23894框架，识别出当前双方均未覆盖的治理空白，并提出了协调的分层框架雏形。
Regulating the Machine Contributor: Governance and Policy Alignment in Open Source
AI-assisted software development has moved from line-level autocomplete to agents that can plan changes, edit files, and submit pull requests with limited human supervision. Open-source software, however, evolves through a process designed for humans: contributor agreements, codes of conduct, and review norms all assume a legally accountable person who can attest to provenance and answer reviewer questions. Autonomous and semi-autonomous AI contributors strain those assumptions, and the 2025-2026 record of agent-driven incidents, AI-generated nuisance volume, and platform-level shutdowns shows that the gap is operationally consequential. Several open-source organisations have responded with contribution policies, but the result is fragmented, and its alignment with emerging AI governance frameworks (EU AI Act, NIST AI RMF with the UC Berkeley Agentic AI Profile, ISO/IEC 42001 and 23894) is unmapped at the contribution level. We compare policies across six organisations (SymPy, LLVM, matplotlib, OpenInfra, the Apache Software Foundation, and the Linux Foundation) using Most-Similar Systems Design with indicator-based coding and process tracing for SymPy and LLVM. From this we derive a six-dimensional taxonomy (disclosure, responsibility, human oversight, licensing, enforcement, maintainer workload), an ordinal Policy Maturity Score, and a mapping of documented agent incidents onto the dimensions each policy fails to govern. Aligning the dimensions with the regulatory frameworks above identifies overlapping gaps neither side currently closes, and we close by sketching the shape of a harmonised tiered framework and the empirical evaluation needed to calibrate it.