Issue: New .NET Foundation Project Application — Signs of AI Writing

Project Name

Signs of AI Writing

License

MIT

Contributor

PeopleWorks (Pedro Hernández)

Existing OSS Project?

Yes

Source Code URL

https://github.com/peopleworks/SignsofAI

Project Homepage URL

https://peopleworks.github.io/SignsofAI/

Project Transfer Signatories

• Pedro Hernández peopleworks@gmail.com

Description

Bilingual (EN/ES) detection of the stylometric tells of AI-written prose — it shows the evidence and a fix for every finding.

What are you hoping from the foundation

Three things, in order of how much they would change the project:

1. An Authenticode code signing arrangement. The desktop application ships as a self-contained Windows zip and is unsigned, so SmartScreen warns on first run. We document the warning in the release notes instead of hiding it, but it is the roughest edge a new user meets, and a certificate is the one thing we cannot solve ourselves. This is the concrete ask.

2. CLA automation. The project has had a single contributor so far and no CLA. Before inviting outside contributions at any scale we would rather have the Foundation's agreement and bot in place than invent our own.

3. Review and reach. Ours is a small project doing something that mostly exists today as closed, paid, cloud-only services. Being read by the Project Committee — and, if accepted, listed alongside other .NET projects — puts it in front of the people it is built for: teachers, editors and writers who need to see why a passage was flagged rather than be handed a score.

Name

Pedro Hernández

Email

peopleworks@gmail.com

GitHub Profile URL

https://github.com/peopleworks

Committers

Pedro Hernández — GitHub @peopleworks — contributions made on behalf of PeopleWorks. He is currently the only account with write access.

Discord Ids

To be provided during onboarding.

Governance Model

Changes reach the project as pull requests against main. Every pull request must pass CI before it can merge: build and test on ubuntu-latest for the cross-platform solution, build and test on windows-latest for the WPF desktop solution (211 tests today), and a CodeQL analysis. The project lead reviews and merges.

Releases are cut from a tag and built only by workflows, never from a developer machine. The NuGet workflow re-runs the tests, refuses to publish if the tag does not match the version in the project files or in the MCP manifest, and refuses to publish if any package is missing its symbol package. The desktop workflow builds the Windows app on a clean runner from the tagged commit and attaches a published SHA-256.

Two properties of the codebase are deliberate governance choices rather than implementation details. The detection rules and the sign catalog are JSON data files, not compiled C#, so that a linguist, teacher or translator can propose a rule or an entire language without writing .NET; and the same rule packs drive every host — web, CLI, MCP server and desktop — so a contribution is never scoped to one surface.

New committers: the project is young enough that no one has yet earned commit rights, so the rule is stated rather than exercised. A contributor who has landed several non-trivial pull requests, reviewed others' work, and stayed engaged over time will be offered write access by the project lead. On joining the Foundation the project will adopt the Foundation's Code of Conduct as the standard those rights are held under.

CLA

• If already an OSS project, was a Contribution License Agreement in place for contributions accepted?

How does the project check who has signed one?

It does not today. Every commit in the repository is by the project lead, so no third-party contribution has ever been accepted and no CLA has been needed. The project will adopt the .NET Foundation CLA and its bot as part of onboarding, before opening up to outside contributions.

CLA Notification Alias

peopleworks@gmail.com

Select the Project Transfer Agreement model

Contribution

Repository Layout

No structural changes are needed. src/ holds the nine projects, tests/ the test projects, Docs/ the documentation, and there are two solution files split by platform (the WPF desktop app is Windows-only and lives in SignsOfAI.Desktop.slnx so Linux CI does not attempt to build it).

The changes we expect on onboarding are documentation rather than layout: relink CODE_OF_CONDUCT.md to the .NET Foundation Code of Conduct, add the Foundation attribution to the README and to the footer of the site, and open a pull request adding the project to the Foundation project list.

Docs/dotnet-foundation.md tracks this project against every eligibility criterion, with the evidence for each row, including the one we do not meet.

Eligibility Criteria

• The project is built on the .NET platform and/or creates value within the .NET ecosystem.
• The project produces source code for distribution to the public at no charge.
• The project's code is easily discoverable and publicly accessible (preferably on GitHub).
• The project contains a build script that can produce deployable artifacts that are identical to the official deployable artifacts, with the exception of code signing.
• When applicable, project must use reproducible build settings in its toolchain.
• The project uses Source Link.
• The project uses either embedded PDBs or publish symbol packages to NuGet (if applicable).
• The project code signs their artifacts as appropriate.
• The project organization has 2FA enabled.
• Libraries that are mandatory dependencies of the project are offered under a standard, permissive open source license which has been approved by the .NET Foundation.
• Committers are bound by a Contributor License Agreement (CLA) and/or are willing to embrace the .NET Foundation's CLA when the project becomes a Member.
• The copyright ownership of everything that the project produces is clearly defined and documented.
• The project has a public issue tracker where the status of any defect can be easily obtained.
• The project has a published Security Policy.
• The project has a home page which provides high level information about its status and purpose.
• The project has a public communication channel where community members can engage with maintainers.
• The project has a publicly available location where members can review and contribute to documentation.

Describe why you are applying for Project Membership.

Signs of AI Writing exists because the tools people are handed for this question are the wrong shape. A teacher pastes a student's essay into a website, gets back "87% AI", and has nothing to say to the student except the number. The number is unfalsifiable, the text left the room, and if the student is a second-language writer the number is likely wrong in a way nobody can inspect.

This project inverts that. It runs entirely on the reader's machine — a Blazor WebAssembly page, a dotnet tool, an MCP server, and a Windows desktop app that never uploads anything. It does not give a verdict; it names the sign, quotes the sentence that carries it, links to the catalog entry explaining why that sign correlates with generated prose, and proposes a fix. The user can disagree with any individual finding, which is the point. And it treats Spanish as a first-class language rather than a translation of the English rules — the tells are genuinely different, and the Spanish rule pack was written, not converted.

We are applying because the parts we cannot do alone are exactly the parts the Foundation provides. Code signing is the clearest: the desktop app is the version that can read PDF, DOCX, ODT, EPUB and RTF, scan a whole folder of documents, and reach a local Ollama model — and it is also the version Windows warns users about, because we have no certificate. Beyond that, a project asking people to trust software with their students' unpublished writing benefits from being somewhere accountable, under a Code of Conduct it did not write for itself, with a CLA that is not homemade.

We are aware this is a young project with one contributor and that Seed is the likely outcome. We would rather be evaluated honestly at that level than overstate what exists.

Infrastructure Requirements Summary

Build servers: none needed. GitHub Actions runs everything — build and test on Linux and Windows, CodeQL, the GitHub Pages deployment, the Windows desktop release, and publishing to NuGet.org via Trusted Publishing (OIDC, no stored API key).

Web hosting: none needed. The application is a static WebAssembly build served from GitHub Pages at https://peopleworks.github.io/SignsofAI/. There is no backend and no database; analysis happens in the browser.

Code signing: this is the one real request. An Authenticode arrangement would let us sign the self-contained Windows desktop release, which is unsigned today and therefore triggers a SmartScreen warning on first run. We would also sign the NuGet packages if the Foundation's arrangement covers it.

SSL certificates: not required — GitHub Pages terminates TLS.

One optional component: a small ASP.NET endpoint that measures perplexity with a quantized ONNX model. It is not a dependency of anything. The same measurement now runs in-process in the desktop app, verified as parity with the hosted version (27.3 vs 27.33 perplexity on the same sentence, same model, same tokens), so no hosting is needed for it.

Additional Notes

One criterion we do not meet, stated plainly rather than left for review to find: we do not code sign anything. That is our reason for applying and is covered above.

Everything else on the list we either already had or closed while filling in this form. Source Link, reproducible build settings and symbol packages turned out not to be decisions anyone had made — there was simply no Directory.Build.props, so nothing set them; they shipped in v0.2.1. The Windows desktop zip used to be built on a developer machine and is now built by a workflow from the tagged commit with a published SHA-256, first used for desktop-v0.2.0.

Docs/dotnet-foundation.md is a per-criterion record with the evidence for each row, kept current so these claims stay checkable rather than asserted.

Trademarks. The project intends to select Licensed when signing the CLA — retaining ownership of the "Signs of AI Writing" name and granting the .NET Foundation a license to use it.

Similar projects. The closest things by function are commercial detection services — GPTZero, Originality.ai, Turnitin's AI indicator. They are cloud-only, closed, and return a probability without evidence, which means the text must be uploaded and the result cannot be argued with. The differences here are structural rather than competitive: analysis runs on the user's device, the rules are open data anyone can read or amend, every finding cites the sentence and the reason, and Spanish is a native rule set rather than a port. There are open-source stylometry libraries in Python, but we are not aware of a .NET one covering this ground, and none we found ship as a library, a CLI, an MCP server and a desktop app off a single rule set.

On the false-positive problem. Because nothing is uploaded, the project has no telemetry and literally cannot observe its own errors. We opened a False positives category in GitHub Discussions as the feedback loop, and say openly there that careful, formal prose by second-language writers is the failure mode we most need reported. We would rather name that weakness than let it be discovered.

Start by reviewing the application and the linked project evidence, especially Docs/dotnet-foundation.md and the stated CI and release requirements. Check whether the eligibility claims and requested onboarding changes are sufficient for project review; done means a documented decision, not a code change.