Almost every smartphone in a pocket and every web browser on a desktop relies on a silent, invisible engine to manage its data. SQLite is that engine. Because it operates as the bedrock for millions of applications, its primary virtues are not speed of feature delivery or cutting-edge experimentation, but absolute stability and unwavering reliability. However, as AI agents begin to flood open-source repositories with automated contributions, the SQLite project has drawn a hard line in the sand, signaling a fundamental clash between the era of generative AI and the requirements of critical infrastructure.
The AGENTS.md Mandate and the End of AI Contributions
The shift became official with the introduction of a new policy file in the project repository: `AGENTS.md`. This document serves as a definitive guide for developers using AI-based automation software, known as agents, to interact with the SQLite codebase. The core directive is blunt: SQLite does not accept code generated by AI agents. While many projects are currently experimenting with how to integrate AI-authored pull requests, SQLite has opted for a policy of total exclusion.
This barrier to entry is not merely about the origin of the code, but about the legal and technical accountability of the contribution. SQLite maintains a strict requirement that all contributions must either be pre-approved through a formal agreement or be legally assigned to the public domain. Even when a human developer submits a concise pull request, the project often treats it as a proof of concept rather than a final product. In such cases, the SQLite internal team takes the logic and rewrites the implementation from scratch. This ensures that every line of code in the production environment is authored and understood by the maintainers, regardless of whether the original suggestion came from a human or a machine.
Recent updates to the `AGENTS.md` file reveal a hardening of this stance. Previously, the documentation stated that SQLite did not (currently) accept agentic code. In a recent commit, the word currently was deleted. The accompanying commit message, Strengthen the statement about not accepting agentic code, transforms a temporary caution into a permanent operational principle. By removing the temporal qualifier, the project has signaled that this is not a phase of skepticism, but a long-term architectural decision.
The Strategic Divide Between Bug Reporting and Code Implementation
While the ban on AI-generated code is absolute, the project has carved out a specific, narrow utility for AI: the discovery of flaws. SQLite distinguishes between agentic code and agentic bug reports. The project will accept bug reports generated by AI, provided they include a reproducible test case. This creates a symbiotic but strictly hierarchical relationship where the AI acts as the scout and the human acts as the architect. The AI is permitted to find the hole in the fence, but it is forbidden from attempting to fix it.
This distinction became a necessity due to the sheer volume of AI-generated noise. As AI agents began scanning repositories and submitting reports at a scale humans cannot match, the signal-to-noise ratio collapsed. To prevent the core development workflow from being buried under a mountain of AI hallucinations and low-quality reports, the project established the SQLite Bug Forum. This dedicated channel physically separates AI-generated reports from human-led discussions, allowing maintainers to filter through the automated submissions without disrupting the primary development pipeline.
Under the leadership of D. Richard Hipp, the workflow follows a rigid sequence. An AI agent identifies a potential bug and submits a report to the forum. If the report includes a concrete input and an expected result that allows for immediate reproduction, it is deemed valid. However, the process stops there for the AI. The actual fix is implemented by a human developer who rewrites the logic from the ground up. This eliminates the risk of merging subtle AI-generated vulnerabilities or inefficient patterns into the codebase. By restricting AI to the role of an informant, SQLite leverages the productivity of automation while maintaining total human sovereignty over the source code.
This operational split solves a critical efficiency problem. Instead of spending hours debugging an AI-generated patch that almost works but contains a hidden edge-case failure, developers spend their time solving well-defined problems. The cost of manually rewriting a fix is lower than the cost of auditing a machine-generated one for the kind of catastrophic failures that a database engine cannot afford.
SQLite has made a conscious choice to prioritize system integrity over development velocity. In the realm of core infrastructure, the cost of a single undetected flaw outweighs the benefit of a thousand automated patches. As generative AI continues to saturate the software ecosystem, the value of human-verified, hand-written code is becoming a premium asset. For SQLite, trust is the only metric that matters.
