# Govern the Repository, Not the Agent: Measuring Ecosystem-Level Risk in AI-Native Software

arXiv: https://arxiv.org/abs/2606.28235 · HTML: https://mlsanity.com/paper/2606.28235/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Software engineering coding agents, one of 16 directions in LLM agents and tool use.
- Builds on 25 of its 65 references that are in the map.
- First posted on arXiv 26 Jun 2026.

## Placed in

- LLM agents and tool use / [Software engineering coding agents](https://mlsanity.com/agents/software-engineering-coding-agents/)

## Builds on (most cited first, 25 of 25)

- [SWE-bench: Can Language Models Resolve Real-World GitHub Issues?](https://mlsanity.com/paper/2310.06770/) (2023)
- [Emergent Abilities of Large Language Models](https://mlsanity.com/paper/2206.07682/) (2022)
- [Why Do Multi-Agent LLM Systems Fail?](https://mlsanity.com/paper/2503.13657/) (2025)
- [Are Emergent Abilities of Large Language Models a Mirage?](https://mlsanity.com/paper/2304.15004/) (2023)
- [The Impact of AI on Developer Productivity: Evidence from GitHub Copilot](https://mlsanity.com/paper/2302.06590/) (2023)
- [Emergent social conventions and collective bias in LLM populations](https://mlsanity.com/paper/2410.08948/) (2024)
- [Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity](https://mlsanity.com/paper/2507.09089/) (2025)
- [Agentic Software Engineering: Foundational Pillars and a Research Roadmap](https://mlsanity.com/paper/2509.06216/) (2025)
- [Small World with High Risks: A Study of Security Threats in the npm Ecosystem](https://mlsanity.com/paper/1902.09217/) (2019)
- [How AI Impacts Skill Formation](https://mlsanity.com/paper/2601.20245/) (2026)
- [An Empirical Comparison of Dependency Network Evolution in Seven Software Packaging Ecosystems](https://mlsanity.com/paper/1710.04936/) (2017)
- [Agentic AI Software Engineers: Programming with Trust](https://mlsanity.com/paper/2502.13767/) (2025)
- [AIDev: Studying AI Coding Agents on GitHub](https://mlsanity.com/paper/2602.09185/) (2026)
- [Reconciling emergences: An information-theoretic approach to identify causal emergence in multivariate data](https://mlsanity.com/paper/2004.08220/) (2020)
- [Group size effects and collective misalignment in LLM multi-agent systems](https://mlsanity.com/paper/2510.22422/) (2025)
- [Quality Gatekeepers: Investigating the Effects ofCode Review Bots on Pull Request Activities](https://mlsanity.com/paper/2103.13547/) (2021)
- [Don't Disturb Me: Challenges of Interacting with SoftwareBots on Open Source Software Projects](https://mlsanity.com/paper/2103.13950/) (2021)
- [MAEBE: Multi-Agent Emergent Behavior Framework](https://mlsanity.com/paper/2506.03053/) (2025)
- [Pull Request Latency Explained: An Empirical Overview](https://mlsanity.com/paper/2108.09946/) (2021)
- [Greater than the parts: A review of the information decomposition approach to causal emergence](https://mlsanity.com/paper/2111.06518/) (2021)
- [From Technical Debt to Cognitive and Intent Debt: Rethinking Software Health in the Age of AI](https://mlsanity.com/paper/2603.22106/) (2026)
- [AgenticFlict: A Large-Scale Dataset of Merge Conflicts in AI Coding Agent Pull Requests on GitHub](https://mlsanity.com/paper/2604.03551/) (2026)
- [Toward Agentic Software Engineering Beyond Code: Framing Vision, Values, and Vocabulary](https://mlsanity.com/paper/2510.19692/) (2025)
- [No Silver Bullets: Why Understanding Software Cycle Time is Messy, Not Magic](https://mlsanity.com/paper/2503.05040/) (2025)
- [More Is Different: Toward a Theory of Emergence in AI-Native Software Ecosystems](https://mlsanity.com/paper/2604.19827/) (2026)

## Abstract (arXiv)

Autonomous coding agents now open and merge pull requests in shared repositories at scale, and the field evaluates them the way it has always evaluated components, one agent at a time, on isolated benchmark tasks. Yet agents that each pass their own tests still leave repositories that accumulate problems no single contribution accounts for. We ask whether this problem belongs to the individual agent or to the repository where it accumulates. We study integration friction, the cost of integrating a contribution into a codebase that other contributors are concurrently changing. Across more than 930,000 agent-authored pull requests, we measure how much of the variation in friction stays with the repository after the contribution, its author, its size, and its agent are accounted for. About half does, and it survives full controls. In the same repositories, agent-authored contributions concentrate this repository-level friction roughly twice as much as human ones (intraclass correlation 0.30 versus 0.16), a gap that holds after controlling for codebase size, age, task shape, process maturity, and merge path. The risk is a property of the ecosystem, not the agent. AI-native software is therefore better measured and governed at the ecosystem level than one agent at a time.