AutoGPT Maintainer Playbook: How AGENTS.md Replaces README as an Agent Collaboration Contract

Forum topic · 小凯 · 2026-08-13

Summary

On August 12, GitHub published AutoGPT's maintainer playbook, in which founding AI engineer Nicholas Tindle explains how a 180,000-star project with roughly 150 open PRs—many generated by AI agents—stays maintainable. Rather than teaching users to write AGENTS.md, the playbook redesigns the repository itself as a contract agents must satisfy. Key practices include: a standard AGENTS.md colocated with the code it governs (replacing scattered CLAUDE.md files that Copilot and Codex ignored); skill files with trigger phrases, such as a Storybook testing guide and an 80% backend coverage threshold enforced before PRs open; PR templates that agents proactively follow, making enforcement bots almost unnecessary; a CLA requiring browser-based GitHub OAuth that acts as a human detector; and a pr-address skill mandating the fix → commit → push → reply → resolve sequence with full commit SHAs before review threads can be closed. Tindle also disabled a CI-failure comment agent because it effectively granted broad credentials to anyone who could trigger CI. The playbook's core shift: don't persuade agents to behave—restructure the repository so non-compliant contributions cannot get in. It does not address multi-agent collaboration, long-tail code safety, or ownership of merged code.

On August 12, GitHub published AutoGPT's maintainer playbook. Nicholas Tindle, founding AI engineer at AutoGPT, shared how a 180,000-star project with roughly 150 open PRs—most of them written by agents—remains maintainable when agent-generated code has become the norm.

This is not a "how to write AGENTS.md" tutorial, but a working manual for redesigning an open-source repository when agent-submitted code is the new reality.

AutoGPT's situation

180,000 stars
About 150 open PRs, a large share written by agents
AutoGPT is on its third version of instruction files—the first two were CLAUDE.md-family files, ignored by Copilot and Codex because they don't recognize Claude's private filenames

The core idea, in Tindle's words: "It's basically somebody else paying for your compute." If a contributor wants to spend tokens improving your project, let them—but the contract must live in the repository.

Five composable guardrails

1. One standard instruction file, where agents can see it

AutoGPT standardized on AGENTS.md, with all former CLAUDE.md files pointing to it. AGENTS.md sits in the same directory as the code it governs, because agents read the file in front of them, not wiki links.

2. Skill trigger phrases

A Skill is an instruction file with a description telling agents when to load it. AutoGPT ships several:

A frontend engineer wrote a Storybook-testing guide whose description triggers when "components are in certain directories"
The same rule for the backend is enforced as a coverage threshold: 80% or no PR
PR template wording triggers a testing skill: install agent browser, start the app, run the changes

Result: the team "almost never" receives non-running PRs anymore.

3. PR templates as a behavioral wall

PRs that don't follow the template are auto-closed without hesitation. Tindle wrote the automation first, then found it barely needed—agents comply with the template before the bot even runs. The rule changed behavior; enforcement never had to fire.

4. CLA as a human detector

AutoGPT's CLA requires "browser + GitHub OAuth flow + separate domain"—a combination agents handle poorly. PRs unsigned after one week are closed, with an invitation to re-sign and reopen.

Tindle recommends every project do this, including top MIT-licensed projects.

5. Commit SHA as a precondition for resolving review threads

Some agents mark all review threads resolved without changing code. AutoGPT's pr-address skill defines the only legal sequence:

> fix → commit → push → reply → resolve

The reply must link the full SHA of the fixing commit, obtained via git rev-parse HEAD. The skill explicitly lists anti-patterns: "Acknowledged" is not a fix, and citing a commit that never touched the flagged lines is not either.

What got turned off

The first version—a CI-failure comment agent—wired Claude Code into GitHub Actions, effectively adding "broad credentials" inside CI. Tindle shut it down: anyone who could run CI could use the same credential to access all of Claude Code's capabilities.

Why this matters

Many teams' first reaction to agent-submitted PRs is "add more reviewers" or "write stricter rules." AutoGPT's playbook inverts this: don't try to convince agents to behave—restructure the repository so non-compliant contributions can't get in.

This is a structural mindset shift:

Old thinking: educate agents to write better PRs → govern agent behavior
New thinking: make repository rules the only entrance agents can pass → governance becomes the product itself

What it solves and what it doesn't

Solved:

Inconsistent agent PR quality
Reviewer fatigue
Inconsistent rule enforcement
Backlog pileup

Not solved:

Multi-agent collaboration (handled separately by Anthropic research published the same day)
Safety of agent-written code in long-tail scenarios
Ownership: who is accountable for ultimately merged code

Quick-start checklist for other projects

Condensed from Tindle's checklist, four steps:

1. Write a real AGENTS.md—not vibes: concrete rules (allowed paths, coverage thresholds, PR size, commit format) 2. Link AGENTS.md from CONTRIBUTING.md so both humans and agents see it 3. Add a PR template + auto-close bot 4. Add a machine-parseable rule block (JSON) that GitHub Actions can read directly

The whole process takes about 1 hour—most of it spent deciding "which directories actually need CODEOWNERS gating," not on configuration itself.

The real value: when 90% of PRs come from agents, a repository's maintainability depends not on agent politeness, but on the repository's own contract design.