The Shape of Memory Malleability

GitHub had already shipped a blunt fix for AI-driven PR noise: a cap on how many open pull requests a non-collaborator could have, plus a manual way for maintainers to search for and exempt specific users. It worked, where maintainers put in one name at a time. Yet, feedback kept pointing that: the judging if a user is trustworthy based on write access was the wrong signal.

That distinction broke immediately at scale. For example, Rust has contributors who aren't org members but have 10 to 30 legit PRs open at once. They are long-time-trusted contributors. However, the cap couldn't tell them apart from a first-time account flooding the repo with AI-generated noise. Charlie Marsh at OpenAI and Ivorforce at Godot said versions of the same thing on the public issue. Four maintainers, four major projects, and the same objection- independently.

We set out to design a rule builder maintainers could configure once, correctly, with the logic available exactly when they needed it, and validate it with real maintainers before it shipped. My job was the fix: let maintainers define trust themselves, instead of GitHub defining it for them with a single access flag. I owned usability testing on PlaybookUX, AI prototyping with Copilot, and green lights on the engineering and accessibility after.