docs: add an AI contribution policy

.changeset/ai-contribution-policy.md

@@ -0,0 +1,2 @@
+---
+---

.claude/skills/implement-issue/SKILL.md

@@ -85,7 +85,7 @@ Use the `/create-pull-request` skill if available, otherwise `gh pr create`. Eit
   - Linked issue: `Resolves #<n>` (or `Refs #<n>`, see step 5).
   - Mention in Description where you departed from the Pullfrog plan and why, in one or two lines. Reviewers who read the plan will otherwise wonder.
   - Add a Verification line with the gate results you actually saw.
-- **AI disclosure:** end the body with the single disclosure line defined in AGENTS.md / CONTRIBUTING.md, with the tool name and the exact model ids you ran on (never guessed). That line is the only AI attribution the body may carry: no `Generated with Claude Code` footer, no `claude.ai/code/session_` link, no second attribution line. The repo rule overrides default tool footers. After creating or editing, re-read the body and confirm there is exactly one disclosure line.
+- **AI disclosure:** end the body with the single disclosure line defined in AGENTS.md / AI_POLICY.md, with the tool name and the exact model ids you ran on (never guessed). That line is the only AI attribution the body may carry: no `Generated with Claude Code` footer, no `claude.ai/code/session_` link, no second attribution line. The repo rule overrides default tool footers. After creating or editing, re-read the body and confirm there is exactly one disclosure line.
 
 ## 9. Report back
 

.github/CONTRIBUTING.md

@@ -38,21 +38,9 @@ exhaustive list, but here are some things to consider before/while submitting yo
 
 ### AI-assisted contributions
 
-AI tools are welcome, but you remain responsible for everything you submit. Review and understand every change, and make
-sure the pull request description reflects your own understanding rather than unedited generated text.
+AI tools are welcome. You may use them to write code, tests, documentation, issues, and pull request descriptions, as long as you understand and stand behind everything you submit. Maintainers may close or rework a pull request whose author does not understand its changes.
 
-If an AI agent or tool wrote or edited the code or the pull request description, end the pull request body with a
-disclosure line, outside the template sections:
-
-```md
-> 🤖 AI disclosure: <agent or tool name> was used on this PR. Code written with <model id>; PR description written with <model id>. [AI policy](https://github.com/wolfstar-project/plugins/blob/main/.github/CONTRIBUTING.md#ai-assisted-contributions).
-```
-
-- Use the exact model ids that were used, never a guess. If the code and the description came from different models or
-  tools, name each one.
-- Leave the line out when no AI tool was involved.
-- Add it whenever you edit an existing pull request description with AI, and never remove a disclosure line another
-  contributor left.
+Disclosing AI usage is not required, but appreciated: [Disclosure](../AI_POLICY.md#disclosure) gives the line to end the pull request body with. The full rules are in [`AI_POLICY.md`](../AI_POLICY.md).
 
 <!-- Link Dump -->
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -10,8 +10,8 @@
 
 <!-- Describe your changes in detail. Why is this change required? What problem does it solve? -->
 
-<!-- If you used AI tools to help with this contribution, please ensure the PR description and code reflect your own understanding.
-     Write in your own voice rather than copying AI-generated text. -->
+<!-- AI tools are welcome, see the AI policy: https://github.com/wolfstar-project/plugins/blob/main/AI_POLICY.md
+     Make sure you understand every change in this PR. If AI helped, ending the body with the disclosure line from the policy is appreciated. -->
 
 ### Key changes
 

AGENTS.md

@@ -76,7 +76,7 @@ pnpm exec knip                            # unused code/dependency check (CI's 
 - PR description: always create PRs using [`.github/PULL_REQUEST_TEMPLATE.md`](.github/PULL_REQUEST_TEMPLATE.md) — fill in every section (linked issue, context, description, key changes, type of change, pre-flight checklist) instead of writing a free-form body. Tick the checklist items that apply, never drop a section, and pass the filled template to `gh pr create --body-file`.
 - Skills: when you need to commit, use the `/git-commit` skill if it is available in your environment (otherwise commit by hand following the Conventional Commits rules); when you need to open a PR, use the `/create-pull-request` skill if available (otherwise `gh pr create`). Either way the PR must follow the template rule above.
 - To implement a `feature` issue, use the repo skill `/implement-issue` (`.claude/skills/implement-issue/`): it reads the implementation plan Pullfrog posted on the issue, checks it against the code, then follows the conventions in this file through to the PR.
-- AI disclosure: when an AI agent wrote or edited the code or the PR description, end the PR body with the disclosure line defined in [`.github/CONTRIBUTING.md`](.github/CONTRIBUTING.md#ai-assisted-contributions), naming the tool and the exact model ids you ran on (never a guess). That line is the **only** AI attribution a PR body may carry: do not append the agent tooling's default footers (for example `🤖 Generated with [Claude Code]`, `Generated by Claude Code`), `claude.ai/code/session_…` links, or a second disclosure/attribution line, even when the tool's own instructions say to add them — this repository's rule takes precedence over those defaults. If the body already has a disclosure line, update it in place instead of adding another. Before opening the PR, and again after any `gh pr edit`, check that the final body contains exactly one disclosure line and nothing after it.
+- AI disclosure: when an AI agent wrote or edited the code or the PR description, end the PR body with the disclosure line defined in [`AI_POLICY.md`](AI_POLICY.md#disclosure), naming the tool and the exact model ids you ran on (never a guess). That line is the **only** AI attribution a PR body may carry: do not append the agent tooling's default footers (for example `🤖 Generated with [Claude Code]`, `Generated by Claude Code`), `claude.ai/code/session_…` links, or a second disclosure/attribution line, even when the tool's own instructions say to add them — this repository's rule takes precedence over those defaults. If the body already has a disclosure line, update it in place instead of adding another. Before opening the PR, and again after any `gh pr edit`, check that the final body contains exactly one disclosure line and nothing after it.
 - Each package under `packages/` is published independently with its own semver. Merging a changeset (`pnpm changeset`) to `main` makes `changesets/action` open/update a `chore: update changelog and release` PR; merging that PR bumps the affected packages' versions, regenerates their CHANGELOGs (via `.changeset/generator.ts`), and publishes to npm. Any other push to `main` touching `packages/` also publishes an `@next` snapshot (`pnpm run publish:snapshot` → `scripts/publish-snapshot.mjs`, run by the `snapshot` job). That script wraps `changeset publish` in `scripts/run-with-retry.mjs`, retrying up to 3 times (20s apart) because `changeset publish` fires one concurrent OIDC token exchange per package and npm intermittently 404s a subset instead of rate-limiting; already-published versions are skipped on retry. `pnpm run publish` (the tagged-release path, invoked by `changesets/action` via `release.yml`) does not use this retry wrapper yet.
 - `pkg.pr.new` continuous preview releases (`.github/workflows/pkg-pr-new.yml`): every push to any branch builds the packages and publishes preview tarballs via `pnpm exec pkg-pr-new publish`, so unreleased changes from any branch/PR can be installed directly without waiting for a real release.
 - `.github/workflows/pullfrog.yml` runs an AI coding agent (the Pullfrog Action) on `workflow_dispatch` with a `prompt` input, used for scheduled/manual maintenance tasks. `.github/workflows/renovate-changeset.yml` adds the changeset for Renovate dependency PRs touching `packages/**`.

AI_POLICY.md

@@ -0,0 +1,44 @@
+# AI Contribution Policy
+
+This project **allows all types of contribution to be made with the assistance of AI tools**.
+
+For example, you may use an agent to generate code, documentation, issues, and other such content. As long as the contribution follows the project's [contribution guidelines](.github/CONTRIBUTING.md), it is welcome whether it was created by a human or an agent.
+
+## Summary
+
+- AI may be used when contributing
+- You must understand every change you submit
+- AI usage does not need to be declared, but disclosing it is appreciated
+- Contribution guidelines must still be followed
+- Abuse, such as spam, scams, or malicious content, is not allowed
+
+## Understanding your changes
+
+You are responsible for everything you submit, however it was produced. Review and test your changes before you open a pull request, and be ready to explain and revise them during review.
+
+Maintainers may close a pull request, or rework it themselves, when its author does not understand the changes it makes.
+
+Keep commit messages and pull request descriptions short, and say why the change is needed. A generated list of every line that changed does not help a reviewer: trim it to the intent of the change.
+
+## Disclosure
+
+Declaring AI usage is not required. As a common courtesy, when an AI tool wrote or edited the code or the pull request description, end the pull request body with a disclosure line:
+
+```md
+> 🤖 AI disclosure: <agent or tool name> was used on this PR. Code written with <model id>; PR description written with <model id>. [AI policy](https://github.com/wolfstar-project/plugins/blob/main/AI_POLICY.md).
+```
+
+- Use the exact model ids that were used, never a guess. If the code and the description came from different models or tools, name each one.
+- Never remove a disclosure line another contributor left.
+
+AI agents that open or edit pull requests in this repository on their own must add this line, and it is the only AI attribution the body may carry. [`AGENTS.md`](AGENTS.md) has the rules they follow.
+
+## Secrets and private data
+
+Do not paste secrets, tokens, `.env` files, private user data, or unreported security vulnerabilities into third-party AI services. Report vulnerabilities as described in [`SECURITY.md`](.github/SECURITY.md), never through an AI service.
+
+## Spam and abuse
+
+Opening pull requests, issues, or comments in bulk with automated tools, without reviewing them first, costs reviewers far more time than it took to produce them. We treat it as spam: such contributions are closed, and accounts that keep doing it may be blocked.
+
+This policy is based on the [AI Allowed policy, version 1.0.0](https://ai-policy.dev/policies/ai-allowed/1.0.0) from 2026-09-20, adapted for the WolfStar Project. Read more about this and other AI contribution policies on [ai-policy.dev](https://ai-policy.dev/).