A flagship open source project just wrote down, in public, what it will and will not accept from a language model. That is this edition's lead. The other two items are smaller but on the same axis: a harness closing a containment gap it did not know it had, and a protocol change that makes one class of agent tooling easier to build safely than the alternative most people reach for.
1. Rust adopts a policy: LLMs may review, not create
rust-lang/rust is adopting an LLM policy · Jynn Nelson, Rust project · Inside Rust Blog, August 5, 2026
Five teams inside the Rust project have adopted an LLM usage policy for the rust-lang/rust monorepo, written by Nelson. The policy summarizes itself in one line: "It's fine to use LLMs to answer questions, analyze, distill, refine, check, suggest, review. But not to create." Disclosure is mandatory for public LLM-assisted content, LLM-generated code changes are held to a higher bar than human-authored ones (tests required, soundness-critical changes strongly discouraged even for domain experts), and reviewers may close non-compliant PRs without further discussion. Nelson names the pressure that forced the issue: at the time of writing there are 1,281 open PRs against the repository, and "with LLMs, none of these signals are reliable" that a polished, well-tested PR represents someone who understands their own code and intends to stick around.
Why it matters: This is the fourth institutional AI-contribution policy Dark Factory has tracked, after Codeberg, Debian and GCC, and the first to publish its reasoning at length instead of just the rule. If your factory contributes upstream to projects that have not yet drawn this line, expect them to draw it soon, and expect the Rust framing, LLMs may critique but not originate, to be the template they borrow.
2. Claude Code closes a worktree isolation gap
Claude Code changelog, version 2.1.222 · Anthropic, first-party release notes · August 4, 2026
Version 2.1.222 fixed two containment gaps in the same release. Worktree-isolated sessions and their subagents could run destructive git commands against the main checkout; isolation now applies to file edits and Bash in every session type. Separately, PreToolUse auto-allow hooks were bypassing tool restrictions inside background agent tasks such as summaries, compaction and renames. The same release removed the "ultraplan" feature and changed Remote Control so a repository's own settings file can no longer silently turn it on, only off.
Why it matters: If your operating assumption is that a git worktree keeps a background agent's mistakes off your main checkout, that assumption did not hold for subagents until yesterday. Anyone running parallel or unattended Claude Code sessions on the strength of worktree isolation should treat this as the point their containment story actually became true, not before.
3. Stateless MCP has recaptured my interest
Stateless MCP has recaptured my interest (and inspired mcp-explorer and datasette-mcp) · Simon Willison, independent developer (Datasette, LLM) · July 31, 2026
The July 28 Model Context Protocol specification collapses MCP's stateful two-request handshake, initialize a session, then call the tool, into a single stateless HTTP call, removing the need for a server to track session IDs or route repeat calls to the same backend. Willison built three tools against the new spec inside a week to test the claim rather than take it on faith: mcp-explorer, a CLI that lists and calls tools on any MCP server through uvx with no install step; datasette-mcp, a Datasette plugin exposing three SQL tools over MCP; and an alpha llm-mcp-client plugin for his own LLM tool, demonstrated querying his blog's database and returning a correct count of 151 notes. His stated reason for leaning back into MCP over giving an agent a shell and curl: "MCP tools are easier to audit and control, and simple enough that smaller models that run on a laptop can still drive them reasonably well."
Why it matters: This is the tradeoff Dark Factory readers keep re-deriving in different contexts, shell access is powerful and hard to secure, a fixed tool surface is auditable and controllable, and it just got measurably cheaper to implement correctly on both the client and server side. Anyone choosing a tool-exposure strategy for an agent this quarter now has a lower-cost version of the safer option.
Assembled from the Dark Factory rising-conversations monitor and landscape sweep for the window 2026-08-04 20:30 to 2026-08-05 10:03 EDT. Two limits on this edition: the landscape sweep is operating under a standing capture freeze (its own corpus lost 173 files to a migration issue, since diagnosed and confirmed recoverable but not yet restored), so it produced no scored candidates this run, only an unread, listing-level queue that could not be promoted under this lane's evidence rules; and two previously flagged threads, a Hacker News discussion of a possible supply-chain compromise in an agent-skills repository and a discussion of benchmark saturation research, have gone essentially flat since their last mention here and are not carried forward as thread-watch lines, since a line with no new movement would repeat prior figures rather than report anything gathering force. Both remain open for a future edition on either a primary read or renewed movement.