Runes' AI usage

TL:DR: We do use AI. Just not for our code.

AI is a hot topic, both for its incredible promises, and for its undeniable problems.
Our stance is based on both legal requirements and a need gfor performance and quality of our code

Legal

The output of an AI can not be copyrighted anywhere in the world (except in China).
This is already a problem for us, as it can introduce questions on the validity of the copyright we claim on the code.
No copyright means public domain in this case, no license at all.
Of course, that only applies to 100% generated content. The parts generated or modified by a human are the only parts protected by copyright law.
By avoiding the use of AI in our code, we assure that any extra contribution that might have been AI in bad faith does not tarnish our capability to claim copyright on the rest of the project.

This however leaves open a lot of other use of AI, where we don't need copyright assignment at all: code reviews, extra assets, extra services we don't care much about, like parts of the implementation of this website (not its content).
We don't have a problem in using AI for those extra use cases

Practical, quality concerns

AI tools and capabilities are still quickly evolving.
what was impossible last year, is looking much better today, ...but the quality we seek is still not there, and any code still looks really miopic, like someone did not read half of our codebase, and they have definitely no idea where the project is going.

Code needs to be reviewed.

both people and AI makes loads of mistakes. AI unfortunately has pushed the narrative of giving a huge production increase, but a programmer still struggles to review less than 1000 lines of code a day.
This has the unfortunate effect that allowing AI contributions will shift the responsability of review on the maintainers, who will be inundated with code that they can't possibly review.
At that point, you either start accepting everything, or nothing at all.
We are making a highly sensitive piece of code, where security and performance are expected, and a single mistake can spell doom to our reputation.
We just can't accept the gamble: we are not making a random website just for ourselves.

Signal to Noise Ratio

There is currently only one maintainer.
Deciding if we want to concentrate on actual development or on reviewing contributions, which are going to be mostly automated and ai-coded with little if any prior review, is a big problem at the moment.

Therefore for now we are trying to limit the contributions to human-only, in an effort to attract actual developers and dissuade one-off contributors that don't properly care about the project

CRA: Cyber Resiliency Act

Europe's CRA introduces liabilities for any security software.

We will not discuss the details here, but the long story short is that anyone that offers any kind of paid offer, like we are planning, is liable for damages with millions on the line as a minimum fine.
In order to avoid such risk we have to show that we are doing everything possible to keep up the quality of our work.
Introducing unreviewed code to speed up development will go contrary to this direction, so we will limit it.

CLA: Contributor Level Agreement

Open source develoepr do not particoularly like CLAs, since they are seen as a way for companies to turn to closed source later on.

We are however using this as an extra roadblock to avoid being inundated by contributions that we don't have the time to review.
Requiring a human to sign something something also ensures that only people that believe and are invested in the project will contribute, further removing automated and unreviewed nonsense.