The Machine Wrote It. Who Owns It?
The Linux kernel mailing list just hosted the most consequential governance brawl of the year. Almost nobody is reading the LKML email that matters. Everyone is reading the wrong one.
The lazy reading of the past two weeks goes like this: Linus Torvalds, the benign tyrant of the Linux kernel, put his foot down and said AI is fine, fork it if you do not like it. This is taken as evidence that the kernel is now an AI-curious project, that the great culture war over generative tooling has been resolved in favour of velocity, and that anti-AI factions are losing.
That is the press release. The mechanism is somewhere else entirely.
There are three questions hiding under the surface of the LKML thread, and the discourse is fighting about the wrong one. The question of whether AI belongs in the kernel is settled, by Torvalds, by fiat. The interesting question is what happens to the licence when the machine writes the code. The second is who owns the patch when the human cannot explain it. The third is whether the answer to both is the same answer we have been arriving at for three years, because if it is, that answer deserves to be said out loud one more time, louder, with the receipts.
Here it is.
I. – The BDFL Moment, Restated
Let us begin with the surface. Linus Torvalds is the BDFL (Benevolent Dictator for Life) of the Linux kernel. The acronym is old and slightly embarrassing by modern standards, but the structural reality is unchanged: one human, with final say, on what enters the tree. He has not behaved like a dictator often in recent years. He has been more manager than monarch, more Reid Hoffman than Genghis Khan. The reflexes are dampened.
He activated them last week.
A thread on LKML about Sashiko – an agentic Linux kernel code review system – drifted, as LKML threads do, into AI code generation. Laurent Pinchart, a maintainer with serious standing, asked that AI-generated code reviews be triaged before bothering authors. He linked to the Software Freedom Conservancy’s recommendations on LLMs in free software. The Conservancy’s first two points are direct: support people who reject LLMs outright, and respect every contributor’s self-determination on whether to use them at all. Nobody should be required to use these tools under threat of termination. The text is sober, non-hostile, careful. It is also, by Silicon Valley standards, distinctly anti-AI in posture.
Torvalds’ reply cut through all of it:
Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it or just walk away.
This is the BDFL principle, weaponised. Not a discussion. Not a coalition. Not a vote among maintainers. A line in the sand, drawn by the man whose name is on the tree. The reaction in adjacent communities was predictable. The reaction in the developer-Twitter sphere was a sub-tweet storm. The reaction in certain circles of the European open-source establishment was, one suspects, a quiet drink.
But Torvalds is correct about one thing, and he is correct about it for reasons nobody wants to say out loud. The kernel is a technical project. Its decisions are supposed to be made on technical merit, not on social signalling. If AI tooling is producing better bug reports than humans, the answer is to use the better bug reports. If AI tooling is producing slop, the answer is to filter the slop. The tool is not the project. The maintainer is the project.
This is the surface reading. Now we go underground.
II. – The Copyright Question, Layered Properly
Here is the question the kernel discussion is not having, and which the free software movement has been quietly not-having for two years.
Who owns code that an AI just generated on the fly?
A vocabulary note before the doctrine, because the vocabulary is load-bearing. We have been calling this technology artificial intelligence, and the term is wrong. What sits behind the API is not a synthetic mind that displaces human authorship; it is a substrate built from human work – every poem, every theorem, every forgotten blog post, every commit, scraped and compressed into a probabilistic paste that can be queried for patterns. Damien Walter named it correctly in 2025 and we sharpened the argument in The Cargo Cult of Compute: these systems are not artificial intelligence. They are collective intelligence. They belong to humanity collectively, because they are made of humanity. The dispute is not whether the machine is an author; the machine is not an author and was never an author. The dispute is whether any human can claim creative control over an arrangement of substrate that, by construction, is composed of everyone.
The honest answer is narrower than the alarmist version and more useful than the dismissive version. The US Copyright Office position, as it stands after the March 2023 Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence and reinforced by the D.C. Circuit’s 2025 affirmance of Thaler v. Perlmutter, is layered, not binary. It runs like this.
Layer one: AI-only works are uncopyrightable. A pure prompt-to-output work, with no human creative direction, selection, arrangement, or integration, is not a work of authorship under 17 U.S.C. § 102. Thaler put this beyond argument when the court affirmed the Office’s refusal to register an AI system as an author. The machine is not an author. Its raw outputs default to the public domain.
Layer two: human creative contributions to AI-assisted works remain copyrightable. This is where the alarmist version collapses. The Office’s Zarya of the Dawn decision (February 2023) is the operative precedent: the author kept copyright in the text she wrote and in the selection, coordination, and arrangement of the AI-generated images, but lost copyright in the individual images themselves, which the Office ruled had insufficient human authorship. The doctrine is not “AI kills copyright.” It is “AI kills copyright in the parts where there was no human creative control, and preserves it in the parts where there was.”
A maintainer who pastes a model’s output into the tree and signs the commit owns nothing copyrightable in that patch. A maintainer who substantially directs, edits, restructures, integrates, and meaningfully reviews the output owns her creative contribution to the patch, and the licence attaches to that contribution. The legal test and the accountability test converge on the same question: did a human make the creative choices, and can she demonstrate them?
This is the actual answer. It is sharper than “copyleft is dead” and sharper than “AI is fine, relax.”
Every copyleft licence in existence – GPLv2, GPLv3, AGPL, LGPL, the EUPL, our own LCL-1.0, even the BSL and the SSPL – rests on the assumption that copyright exists in the work being licensed. Under the layered doctrine, that assumption holds exactly to the extent that a human exercised creative control over the work. The licence does not vanish. It attaches, where it always attached, to the human-authored portion of the contribution. The AI-generated elements underneath are public domain and ride along unprotected; the human-authored structure on top carries the licence.
The permissiveness of MIT makes this almost invisible: MIT is permissive to begin with, so the default-to-public-domain treatment of the AI-generated elements is roughly what MIT would have granted anyway. The strictness of GPL makes this loud but not fatal: copyleft attaches to the human-authored arrangement, which is what gives the licence its force. A patch that is ninety percent machine-generated and ten percent human-edited is still licensed under the GPL to the extent of the ten percent. The ninety percent is a public-domain substrate the human is rearranging.
Even our LCL-1.0 survives intact on this reading. The Libertarian Commonwealth Licence adds attribution, anti-capture, anti-DRM, and chain-of-custody clauses – all of which attach to the human’s contribution and assume the human can demonstrate what she did. The chain-of-custody clause is, in fact, more relevant under the layered doctrine than under the old one. It is now legally load-bearing, not decorative.
So the kernel discussion is asking the wrong question in two directions at once. The “copyleft is dead” crowd is compressing a spectrum into a cliff and panicking about a ruling that has not been made. The “AI is fine, fork it” crowd is skipping a question that will land on them in court the first time a GPL violation meets a creative-control defence. The honest position is the legal doctrine and the accountability doctrine asking the same thing of every commit: show your creative work, or do not claim the licence.
This is not a future problem. It is a present problem. Red Hat, NVIDIA, and a non-trivial fraction of Linux kernel contributors are now shipping AI-assisted code. Some of that code has zero human creative contribution. Some of it has a human commit but a machine-written body. The legal status of that code in a GPL-enforced project is resolved in principle and unresolved in evidence. The principle is settled: copyright attaches to the human-authored portion. The evidence is what is missing. Nobody is producing it.
The Conservancy’s recommendations, careful as they are, do not produce this evidence. They talk about disclosure, accountability, and self-determination. They do not talk about creative control or how a maintainer proves it. They cannot, because the answer requires a tooling layer the movement does not yet have.
III. – The Maintainer Crisis, Named Properly
Ludpool, a Red Hat engineer who is plainly both pro-tooling and pro-accountability, named the second question with brutal precision on the same thread:
Can the LLM write code that won’t take me much longer to understand to a reasonable extent such that I can reasonably own and explain it rather than if I wrote it myself? At what point is vibe coding simply not realistic for a human to be able to claim accountability over what about agentically written code?
This is the question. Not “is the AI useful?” – it is. Not “is the AI accurate?” – it is getting there. The question is can the human who signed the patch explain it. Because if the human cannot explain it, the human did not write it, and the project has accepted code from a contributor who is not, in any meaningful sense, a contributor.
The downstream effect is mechanical, and it is already showing.
Maintainer burnout is rising in every major open-source ecosystem. The OS Summit 2025 maintainer survey, the Tidelift survey, the GitHub Octoverse data – they all converge on the same number. Maintainers are drowning. Not because AI made their work impossible, but because AI made their inbox impossible. Bug reports generated by agents. Feature requests generated by agents. Pull requests generated by agents. Every contributor on earth now has access to a junior intern that runs on tokens, and they are all pointing it at the same maintainers.
Torvalds’ response, characteristically, is to remind people of an old truth. The kernel is not going to slow down to accommodate bad patches. The kernel is not going to merge vibes. The kernel is going to be a place where people who can do the work do the work, and people who cannot are filtered out. The throughput problem is solved by maintainer sovereignty, not by tooling limits. If you want to merge into the kernel, you have to own the patch. If you cannot own the patch, the patch does not enter the tree.
This is the correct answer at the project level. It is the wrong answer at the ecosystem level. Because most projects are not the kernel. Most projects have one maintainer, working nights, with a backlog of six months. Most projects cannot enforce Ludpool’s “the contributor must be able to explain it” rule, because enforcing that rule requires reading the contributor’s explanation, which requires time, which is the resource the maintainer does not have. The maintenance crisis is a labour allocation crisis dressed as a tooling crisis, and tooling will not solve it.
The maintainer crisis, named properly, is the accountability vacuum. We have a generation of tools that can produce more code than humans can review. We have a generation of contributors who can produce more patches than maintainers can read. The bottleneck was always review, and review was always scarce, and we have now made the bottleneck tighter by an order of magnitude.
This is not a problem the Conservancy’s recommendations solve. This is not a problem Linus can solve with a BDFL pronouncement. This is a problem of protocol design.
IV. – The Libertarian Lens, Applied
Let us run the four Libertarian questions on the situation.
-
What does this do to exit rights? The maintenance crisis shrinks them. When maintainers burn out and projects die, contributors and users lose the option to fork, to patch, to migrate. The right of exit is meaningless if the thing you would exit from is dead. AI tooling, by accelerating the throughput pressure on maintainers, accelerates the death of the projects we depend on for exit. That is bad.
-
What does this do to protocol-level power? The creative-control test shifts power from the legal-system to the platform. If copyright now attaches only to demonstrated human authorship, the durable governance is whatever can prove creative control – and that is the platform that hosts the patch, the build, the signature, the chain of custody. The major AI labs, the foundation-model vendors, the code-hosting platforms – they become the de-facto governors of what counts as “human creative contribution,” because they hold the receipts. The licence is the floor; the platform is the witness.
-
What dependency/capture surface expands? Every. Single. One. The legal uncertainty around AI-generated code expands the capture surface for the entities that can afford lawyers to navigate the uncertainty. The small maintainer, the independent contributor, the sovereign individual coder – they cannot afford the legal review. They will, by default, accept whatever the AI produces. They will, by default, lose whatever copyright claim they might have had. The dependency surface is the legal system itself.
-
What is the concrete sovereignty response? The protocol answer. Not the licence answer. The protocol answer.
V. – The Sovereign Trinity for the Collective Intelligence Age
There are three things that work. They work because they work for the same reason – they make ownership verifiable, not just claimed.
Code provenance. Not licence metadata. Not a CONTRIBUTORS file. Cryptographic, signed, on-chain or in a verifiable log, attesting to the chain of creative control for every line. Was this written by a human? By an AI? Under what model, what prompt, what temperature? Was the human’s contribution a complete rewrite, a partial edit, a review pass, an architectural rearrangement? This is not a licence. It is a passport. The copyright doctrine says copyright attaches to demonstrated creative control; the provenance log is the artefact that proves it. The Maintainer Passport, the AI-Assist Receipt, the Signed Review Log – these are the documents that will matter in court, in merge review, and in the maintainer’s own defence six months later when the patch breaks in production. The licence is the law; the provenance log is the evidence.
Maintainer sovereignty. Projects are sovereign. Maintainers decide. This is not the BDFL principle – that is one-man rule. This is project sovereignty: every project sets its own threshold for contribution, and every contributor agrees to it on entry. The kernel has it; most projects do not. The sovereign-stack answer is a machine-readable project constitution, a CONTRIBUTING.md that is not a polite suggestion but a binding contract between the maintainer and the contributor, enforced by tooling. If you submit code you cannot explain, the patch is rejected by automation, not by human labour. This is the labour-allocation answer. The maintainer’s time is the scarce resource; we do not spend it on automated rejection.
Protocol-level exit. When the legal regime is contested, the protocol must hold. A copyleft licence that attaches only to demonstrated human creative contribution is no longer self-certifying – the contributor must prove their authorship before the licence has force. A protocol-level exit – a reproducible build graph, a content-addressable store, a verifiable fork lineage – survives every legal regime because it does not depend on copyright to keep the commons. If your fork is reproducible, if your derivation chain is signed, if your exit path is provable, then the question “who owns this?” is answered by the chain, not by the court. The Sovereign Stack answer is that we do not depend on copyright to keep the commons. We depend on protocol. The chain is the licence, the chain is the fork, the chain is the exit.
This is the Trinity. Provenance, sovereignty, exit. Not a licence. Not a manifesto. A protocol.
VI. – What If We Are Wrong?
The conservative position is that the layered doctrine is stable. AI-only works are public domain; human creative contributions to AI-assisted works are copyrightable. The Copyright Office has been remarkably consistent on this since 2023, and Thaler v. Perlmutter (D.C. Cir. 2025) closed off the strongest “AI is an author” challenge. The legal test – human creative control – is unlikely to be overturned.
This is plausible. It is also not enough.
The cost of the conservative position is that the legal test has to be demonstrated, and the demonstration requires evidence the open-source movement does not currently produce. A maintainer who claims copyright in a patch must show their creative contribution – the prompt engineering, the architectural choices, the integration decisions, the review work that produced the final committed artefact. Without a signed chain of custody, that claim is reduced to a commit message and an assertion. In a courtroom, that is not evidence. In a maintainer’s own defence when the patch blows up in production, that is not evidence either.
The cost of building the provenance stack anyway is low. Provenance logs are useful regardless of how the courts rule. Maintainer sovereignty contracts are useful regardless of AI’s capabilities. Reproducible builds are useful regardless of copyright doctrine. We are not betting against the Copyright Office’s good sense. We are buying insurance against the only thing that matters: the maintainer being asked, on the stand or in the post-mortem, to prove what they did.
The asymmetry is the decision. When the cost of failing to prove creative control is civilisational and the cost of building the protocol is just engineering, the rational move is to engineer.
VII. – Torvalds Was Right, For The Wrong Reasons
Torvalds is correct that the kernel will not slow down. He is correct that the tool is not the project. He is correct that fork-and-walk is the open-source answer to disagreement.
He is wrong that this is the only question.
The kernel can absorb the AI tooling debate because the kernel has Torvalds. The kernel has a maintainer class that has been hardened by twenty-five years of patch review. The kernel has a culture of accountability that is enforced by social pressure and project sovereignty. The kernel will survive the AI code generation crisis because the kernel was already strong.
The average project will not.
The average project has one maintainer, a part-time contributor base, no legal counsel, and a backlog measured in years. The average project is going to drown in AI-generated slop unless we give it protocol-level tools that the kernel already has by social convention. The kernel can rely on Torvalds. The average project cannot rely on anyone. It needs the Maintainer Passport, the signed AI-Assist Receipt, the machine-readable project constitution, the reproducible build graph. These are the tools that scale. These are the tools that travel.
Torvalds solved the kernel’s problem. He did not solve the ecosystem’s problem. The ecosystem’s problem is the protocol question, and the protocol question is the Libertarian question, and the Libertarian question is the same question we have been answering for three years: provenance, sovereignty, exit. The commonwealth licence – our LCL, the GPL, the AGPL, the Apache – is not dead. But it is no longer self-certifying. The licence is the floor; the protocol is the building. And the floor now depends on evidence the protocol produces.
The honest answer to “who owns the code?” is the same answer as “who is on the hook when it breaks?” It is the human who can demonstrate creative control and explain the patch. The machine’s output is public domain until a human transforms it through genuine authorship. We make “genuine” provable not by trusting the commit message, but by signing the chain of custody. That is not a hedge. That is the answer, regardless of which way the next court rules.
Strategic Imperatives
- Treat code provenance as the new copyright. Every AI-assisted patch ships with a signed receipt: model, prompt, human review pass, commit attestation, demonstrable creative contribution. The receipt is the artefact that survives the creative-control test.
- Codify maintainer sovereignty as a machine-readable contract. A
CONTRIBUTING.mdis a suggestion. A signed, tool-enforced project constitution is a wall. Reject AI-only and unowned patches at the protocol layer, not at the maintainer’s inbox. - Build the protocol-level exit before the licence fails. Reproducible builds, content-addressable stores, signed fork lineages. If the legal foundation shifts under us, the protocol must keep us standing.
- Stop debating whether copyleft is dead and start building what comes after it. The licence was the 20th-century answer. The protocol is the 21st-century answer. The Libertarian answer is both, layered.
- Name the substrate correctly, and the doctrine follows. The technology is not artificial intelligence; it is collective intelligence – a probabilistic paste of human work that no individual can author but that humans, by their creative control, can arrange. Say so in the project constitution, in the patch description, in the press release. Vocabulary is the first protocol. A tool described as a synthetic mind invites abdication. A tool described as a shared substrate invites authorship.
git log --pretty=format:'%H %an: %s' | grep -i 'co-authored-by: AI' | wc -l