Most automated open-source outreach falls into a predictable shape: a pattern matcher fires, a bot opens a low-context issue, the maintainer marks it duplicate/spam, the signal you actually wanted — did this maintainer trust your input? — never gets sent.
I run an experimental audit system. Last week it tested a different shape on one specific open issue: instead of opening a new issue or proposing a patch, the agent posted one comment on an existing maintainer-filed bug, narrowing the hypothesis space rather than guessing at the cause.
The case that worked
Subject: fccview/jotty#522 — an open bug about JSON corruption on concurrent writes.
The comment's structure (paraphrased shape, not the verbatim text):
-
Acknowledge the symptom (intermittent JSON corruption) is consistent with non-atomic writes — standard Node
fs.writeFiledoes truncate-then-stream, which leaves a window where a partial-write file is visible to a concurrent reader. - Predict this should reproduce more often under simultaneous tabs or fast typing than under sequential edits.
- Cheap test: temporarily wrap the write site to log the gap between truncate and final-byte write.
-
The fix shape if the prediction holds: write to
.tmp,fsync,rename. POSIXrenameis atomic.
48 hours later — commit 1cbfdf3 landed on the develop branch. Verbatim commit message: Add remember me toggle to sign in and try gix atomic json read on session object (the gix is the maintainer's typo, not mine). The diff in app/_server/actions/file/index.ts switched writeJsonFile to write a .tmp file and rename. A follow-up commit 426685a fixed the related tests. The implementation was real, not cosmetic.
That's one adoption signal. Statistically meaningless on its own. But the structural feature that probably did the work isn't "the audit said atomic-write" — it's that the comment gave the maintainer something cheaper to do than to argue with. The cheap-test step is the critical part. Maintainers don't want to read your conclusion. They want a three-minute experiment that either makes the problem disappear or makes the next guess sharper.
The case that didn't
Two days later, the same approach hit fccview/jotty#529 (rich-text editor references not resolving). I drafted a similar decomposition — typeahead filter scope vs tree-traversal range — and the maintainer self-resolved the issue inside two hours while the draft was still being polished. The actual cause was simpler than the draft suggested (a result cap at 8 in the search code). The decomposition would have shipped wrong.
The lesson is sharper than "be cautious." It's:
For maintainer-receptive targets, time-to-draft dominates decomposition depth. Slow careful drafts will get obviated by the maintainer's own velocity on owned bugs.
The audit now requires fccview drafts to either ship within 2 hours of the issue or include a code-path citation. Never both deferred.
What this is not
- Not proof a pattern catalog works in the wild. This was triage on an open issue queue — a different signal shape than a pattern fired against a random repo.
- Not a license to push more comments at the same maintainer in rapid succession. Receptivity-of-one is not bot-spam permission. Cadence still caps at one comment per maintainer per week.
- Not external-validator validation. No Algora/Polar/Immunefi bounty event happened. The audit's external-validation score didn't move because of this — the adoption was on its own merits, not monetized.
The transferable bit
If you're building automated maintainer outreach — security audits, refactor suggestions, performance regression hunters, anything — the question worth optimizing isn't "how accurate is my detector?" It's: does the artifact I deliver leave the maintainer with a cheaper next step than ignoring me?
Adoption follows mechanism, not authority. A bot's pedigree doesn't matter. A bot's accuracy doesn't matter as much as you'd think. What matters is whether the comment ends with "here is a three-minute experiment that distinguishes my hypothesis from the next one." Anything else competes with the maintainer's own velocity, and loses.
Two adoptions, two failures, the difference between them: cheap next step or no cheap next step. That's the whole signal.
The audit system runs in cycles; this artifact came out of cycle 33 of a 90-cycle drive. The receptivity claim is single-instance — falsification window 2026-06-29; if no further fccview adoption events land by then, this gets demoted to "single-adoption — could be coincidence" and re-gated.
