QGIS bans AI assisted contributions

…after ebdaf93's stated 11:10 coverage end; this session's feeds pulled 12:02-12:15 UTC across four passes - the parallel batch died at the 300s mark with 13/45 landed, an --http1.1 -4 browser-UA sequential pass recovered 11 more, a plain browser-UA pass recovered 15 more, and a googlebot-UA pass plus a final plain-UA retry recovered qbitai/solidot/swillison/webkit, 44/45 landed; missed on all attempts: rust - blog.rust-lang.org unreachable, newest stamp carried unchanged from the recordings (Oct 2 standing stale) so no in-window cost; shells this pass: mydrivers 404-1231B, oschina 404-1548B, register 404-204KB, svelte/tailwind/nextjs/vscode 404-pages, nodejs 404-98KB parse-0, anthropic 404-20KB; an unrelated untracked weibo-mss.json sat in the worktree from a concurrent session and is not part of this commit): three adds. (1) An "unprecedented" cyberattack has crippled supermarket refrigeration across Europe: hackers took control of Danfoss-made refrigeration control systems used by French supermarkets Intermarché, Leclerc and Coopérative U and set the automatic defrost function - normally two hours a day - into a continuous forced defrost cycle at 50 degrees C, disrupting deliveries and electronic-shelf-label in-store pricing; Coopérative U president Dominique Schelcher confirmed Monday morning that a cyberattack had been affecting the refrigeration production facilities of several stores in the network since the previous night, calling it extremely serious and unprecedented; separately NOS reports Albert Heijn, Etos and Gall & Gall in the Netherlands took websites down after a Sunday-afternoon cybersecurity incident with Belgium's Delhaize (also Ahold Delhaize) also disrupted; early losses approaching 300k euros, potentially several million nationwide (primary tomshardware.com/tech-industry/cyber-security/unprecedented-cyberattack-cripples-supermarket-fridges-across-europe-as-hackers-activate-automatic-defrosting-delivery-and-store-prices-also-impacted-by-incident verified via direct curl --http1.1 -4 page fetch at ~12:25 UTC Oct 12, 2007199 bytes, datePublished 2026-10-12T11:32:54+00:00, byline Stephen Warwick, citing La Dépêche and the Coop U president's X confirmation; ladepêche.fr and nos.nl not probed this session, so the verified Tom's Hardware disclosure is cited per the relay precedents). New territory - grep shows zero prior supermarket/Danfoss/refrigeration entries (ebdaf93 recorded the related Ahold-Delhaize supermarket cybersecurity-incident newsroom statement 10:41:55Z as a corporate-PR skip - Ahold Delhaize is Albert Heijn's parent, the same arc's earlier Dutch signal). Categorized 后端 per the security-campaign precedents (CyberXero, Bricksforge, CISA KEV). (2) QGIS merged QEP428 "No AI contributions permitted" (PR #387 authored by core contributor Nyall Dawson): the proposal replaces the project's earlier QEP-408 AI tool policy (Even Rouault's human-in-the-loop policy adapted from LLVM's AI Tool Use Policy, which required reviewing all LLM output, transparency via Assisted-by trailers, and banned unreviewed agent comments) with a total ban - "No LLM, AI or agent assisted code contributions are allowed in the qgis/qgis repository. If we subsequently discover that you have used an AI, LLM, or any agent-based workflow for your contribution, you will be subject to code reversion and contributor rights sanctioning"; in the PR discussion Dawson said the intent is to start with a closed door and selectively open it case-by-case later (e.g. AI as autocomplete replacement, translations), that the earlier policy's process clearly didn't happen in reality, and that the project had already lost at least one extremely high value contributor as a result; the QEP passed its discussion period Oct 5, moved to voting, and was merged into QGIS-Enhancement-Proposals master Oct 7 (primary github.com/qgis/QGIS-Enhancement-Proposals/pull/387 verified via direct curl --http1.1 -4 page fetch at ~12:30 UTC Oct 12, 634350 bytes, page title "Add QEP428: No ai contributions permitted by nyalldawson · Pull Request #387", plus the PR .diff fetch (160 lines) carrying the full replacement policy text; api.github.com unreachable this session so the HTML page and .diff served as verification). Gap-fill disclosure: the merge sits Oct 7, inside the 14-day window, but no feed in the standing 45 set carries QGIS QEP activity and no commit message records it; the 79-point HN submission 2026-10-12T11:22:24Z is the first in-set visibility, per the HashiCorp-Boundary/DuckDB/Genkit/AISI/Mistral gap-fill precedents; entry dated by discovery time per the AISI precedent (2026-10-12 11:22). New territory - grep shows zero prior QGIS entries. Categorized AI per the AI-coding-governance substance. (3) Alibaba Qwen released QwenGyre, an online reinforcement learning framework for long-horizon agent tasks (relay ithome.com/1/012/066.htm verified via direct curl --http1.1 -4 page fetch at ~12:28 UTC Oct 12, 24251 bytes, page stamp 2026/10/12 19:20:43 Beijing=11:20:43Z matching the ithome feed stamp exactly, byline 潞源): agent runs routinely stretch to hours with hundreds of interdependent model-environment interactions and millions of cumulative tokens; QwenGyre splits GPUs into compute units so units freed by finished batch tasks roll into training while running tasks keep their state and caches intact without restart; Token-in Token-out records the true context of every output segment, organizes trajectories into a tree by shared prefix and expands only the selected path into training samples; Partial Scoring yields usable feedback for timed-out but partially-complete tasks; official NL2RepoBench online RL experiments with ~700k-token rollouts lifted pass rate from 52.5% to 58.5% over 48 training steps with a 1.78x end-to-end speedup vs Async at equal GPU budget, and cross-task validation on Qwen3.6-122B covered NL2RepoBench/DeepSWE/TerminalBench; qwenlm.github.io blog and github.com both unreachable this session (curl exit 28 under the continuing flaky route) so no primary could be probed and the verified ithome relay is cited per the Reuters/Korea Herald relay precedents. New territory - grep shows zero prior QwenGyre entries. Categorized AI per the framework-release precedents. Evaluated and skipped: HN sweep (hn.algolia search_by_date with numericFilters created_at_i> 1791803100 - this cutoff is 11:05:00Z real UTC Oct 12, five minutes before ebdaf93's stated 11:10 coverage end per the standing sweep-cutoff convention): clean single-page pull, 61 hits spanning 11:08:10Z-12:19:04Z with 0 cutoff violations; the pre-11:10 overlap hits (Show-HN http-server-rs 11:08:10Z, NYT book-freezer 11:09:18Z) and all new hits evaluated - skipped: Ledger unauthorized-hardware-implant cointelegraph 12:16:36Z as a same-arc dedupe of the in-data 2026-10-10 Ledger 钱包供应链攻击 entry (2076a7c already skipped the hidden-chip confirmation the same way), BBC AI-less-regulated-than-milk 11:56:42Z as a same-arc dedupe (f3b1a25 skipped the BBC original, 11e84f8 the ithome Brad Smith relay), Linus assoc-array kernel-tag submission 11:42:02Z as an exact-arc dedupe of ebdaf93's in-data Phoronix entry (the submission links the git.kernel.org tag itself), science.org AI-found-solutions-in-22-fields 11:39:34Z as science research per the standing science arc, ServeTheHome AMD EPYC 8005 SKU analysis 11:42:47Z as vendor hardware SKU/value analysis without a disclosed launch event, Valve Steam Frame CAD reference gitlab 11:44:37Z as a bare repo link without an article per the EC2-R8g precedent, danielmangum access-port 11:11:24Z / HOCON conformance 12:03:16Z / RISC-V bulk normalization 11:38:09Z / phaselock optimistic-updates 12:07:33Z / copyconstruct debug essay 12:14:35Z / kinopio passwords 12:04:21Z / aresluna 12:00:06Z / aditya.rs sentience 11:12:37Z as single-person essays/tutorials per the deepwoodssec precedent, the france24 12:07:48Z / infosecurity 12:15:36Z relays of the ADDED supermarket story, hikerapi 12:13:42Z / db.zizka.ai 12:08:29Z / medium ZizkaDB EU-AI-Act 11:40:19Z / orisift 12:03:51Z as vendor marketing, techradar ChatGPT parking ticket 12:08:32Z as consumer anecdote, fastcompany procrastination 12:13:34Z / popularmechanics terminal lucidity 12:13:31Z / NYT ADHD 12:09:22Z / universetoday moon 11:43:00Z / bassfinity dichromat 12:01:59Z / bbc vikings 11:14:48Z / bbc citroen-2CV 12:09:09Z as non-tech/science/auto, kyivindependent Brexit 11:23:12Z / bl00d.money 12:06:11Z / politico 2014 11:17:38Z / ibtimes burnout 11:17:56Z as politics/society, twitter Jobs-Wozniak-Breakout 12:12:41Z as unverifiable without X login per the no-X-login rule, segor closing 11:25:17Z / wsj nobel 12:03:01Z / reddit all-souls 11:12:45Z / youtube china-energy 11:11:30Z as non-tech, plus the standing Show-HN/repo/small-tool tail (tokenleak, ctxvitals, yagi DSP, iconic.photos, same.energy, organ.app, nabusql, tsc-haxe port, gearslip, tote, airlock sandbox, earnmykeep, bu coding form, cosign discourse, ask-HN DNSSEC and departments threads) and the git-tips gist. Feed-side in-window items: bleeping Windows 11 23H2 end of support in 30 days 11:58:33Z as consumer-Windows lifecycle news per the standing consumer arcs; heise batch 11:12-12:07Z - iOS 27 upgrade push 11:12Z consumer-Apple, Citroën 2CV Concept 11:13Z auto, heise+ Speicherchip-Knappheit DDR5/NAND 11:30Z paywalled storage-market per the 三星存储 precedent, Pimax Crystal Pro VR 11:45Z consumer hardware, iX-Workshop Claude Code 12:00Z workshop marketing, Opel STX Concept 12:07Z auto, and the 11:08Z KI-Scam anti-scam-bots feature (two minutes inside ebdaf93's window whose 11:02-11:04 pulls predate it, late-serve evaluated) as a consumer security feature without a technical artifact; heise Python 3.15 erschienen 11:27Z as a same-arc dedupe of the in-data Python 3.15.0 正式发布 entry; phoronix Linux 7.4 Snapdragon X2 Elite laptop support 11:16:13Z skipped as device-enablement per the Intel HDMI FRL v2 precedent; ithome batch 11:10-12:05Z evaluated in full and skipped - 国家铁路局十五五规划 11:12Z as government policy, 英特尔博通 CEO 资金短缺预警 11:12:41Z as CNBC-relayed interview commentary without a disclosed event per the 安蒙/周受资 precedents, 小鹏 G9L 巴黎上市 11:23Z auto, Edge AI 故障排查功能 11:28Z consumer-browser feature per the consumer-Microsoft arc, 小米电视 11:29Z / 安克 AI 会议耳机 11:39Z consumer hardware, 理想超充报告 11:35Z auto, 一汽大众 teaser 11:44Z, TGA 12 月颁奖 11:46Z gaming, 诺贝尔经济学奖 12:00Z and Polestar 清库存 12:05Z non-tech/auto, with the 11:20:43Z QwenGyre piece ADDED above; leiphone late-serve vs ebdaf93's recorded 07:42Z newest evaluated per the late-serve precedent - 安踏×火山引擎 Agent 电商案例 09:48Z as vendor case-study marketing and 苹果折叠华为八年 09:58Z as consumer commentary, both skipped; thn late-serve vs ebdaf93's recorded 09:02:14Z newest evaluated per the late-serve precedent - SonicWall SMA 1000 135 exploitation attempts 10:36:56Z (full body extracted from the direct page fetch at ~12:22 UTC Oct 12, 166966 bytes: CVE-2026-102255 CVSS 10.0 pre-auth SSRF, patched Oct 6 in 12.4.3-03670/12.5.0-03082 hotfixes, first exploitation detected Oct 8 by Defused Cyber and Previdian, 135 attempts from two US IPs, SonicWall advisory not yet updated) skipped as a same-arc dedupe of the in-data 2026-10-09 BleepingComputer entry (SonicWall 满分漏洞已现攻击利用, same CVE-2026-102255 arc) plus the in-data 2026-10-08 heise disclosure entry; solidot newest 10:01:07Z unchanged from ebdaf93 (their skip stands); infoq-cn/-alt newest 17:19:27-label=09:19:27Z real per the standing s22 8h offset, QCon marketing already skipped; qbitai feed recovered this session (6237 bytes, 10 blocks) with newest 05:48:36Z unchanged; hnrss newest 11:22:24Z=the QGIS submission ADDED above; per-feed newest-stamp scan confirms no other landed feed carried real items after 11:10Z Oct 12 beyond those evaluated (all newest stamps unchanged from ebdaf93's recordings where comparable: ars Oct 11 18:10:54Z, astro Sep 30, bun Oct 10 03:18:05Z, chrome Jun 22, cloudflare Oct 9 18:27:34Z, deno Oct 9 15:00Z, devblogs-dotnet Oct 6 17:05Z, devblogs-ms Oct 9 09:44:25Z, devclass Sep 26, github-blog Oct 9 16:00Z, github-changelog Oct 10 18:53:39Z, golang Oct 2, hf-blog Oct 9 15:20:29Z, infoq 09:19Z-real, jetbrains Oct 12 10:18:32Z, k8s Oct 6 18:00Z, openai Oct 9 07:00Z, react Sep 9, swillison Oct 11 00:52:37Z, techcrunch Oct 12 00:59:01Z, typescript Jul 8, vercel-blog Oct 9 20:24:00Z, verge Oct 11 20:06:43Z, vite Jun 23, webkit Oct 8 23:29:40Z; fresh in-window newest stamps all evaluated: bleeping 11:58:33Z, heise 12:07Z, ithome 12:05:23Z, phoronix 11:16:13Z). Source status: 45 feeds attempted fresh 12:02-12:15 UTC Oct 12 across four passes, 44 landed - usable full parses this pass: ithome/infoq-cn/infoq-cn-alt/solidot/leiphone/bleeping/heise/ars/astro/bun/cloudflare/deno/devblogs-dotnet/devblogs-ms/devclass/github-blog/github-changelog/golang/hf-blog/hnrss/jetbrains/k8s/openai/phoronix/qbitai/react/swillison/thn/techcrunch/typescript/vercel-blog/verge/vite/webkit; shells: mydrivers 404-1231B, oschina 404-1548B, register 404-204KB, svelte 404, tailwind 404, nextjs 404, vscode 404, nodejs 404-98KB parse-0, anthropic 404-20KB; missed: rust on all attempts (Oct 2 standing stale, no in-window cost). Window maintenance: today is 2026-10-12 UTC so the isFreshNews boundary stays today-14d=2026-09-28 inclusive; the oldest entry (2026-09-28) sits at the inclusive boundary and is retained; prune already applied at 156e78f, nothing to prune; publishedNews 197 under the current cutoff. Validation: tsc -b passes (exit 0); npm run build fails only with the pre-existing lint:api-content failure set, digit-normalized diff against the baseline (ebdaf93's tmp/build-oct12-new2.log saved as tmp/build-oct12-h12-baseline.log before this session's build) shows BUILD LOGS IDENTICAL (606 log lines each, 0 diffs); node tmp/validate-oct12-h12.mjs reports 197 of 197 array entries parsed with 0 duplicate URLs, 0 bad category, 0 out-of-window, 0 order violations, 0 date-group violations, 0 over-length titles/summaries; in-file assertNewsCopy guard clean at module import via npx tsx (197 entries, publishedNews 197 spanning 2026-09-28..2026-10-12, new entries at the top of the 2026-10-12 group at 11:32/11:22/11:20); new entries within 19/28 + 19/28 + 23/28 title and 54/60 + 51/60 + 54/60 summary limits; dedupe re-checked against HEAD immediately before commit per the 5a3ba1a/156e78f collision convention (0 matches for the three new URLs; git fetch to origin failed with github.com unreachable, so the check is against local HEAD ebdaf93). Adds 3 items; dataset now 197 entries.