Govern the Repository, Not the Agent: Measuring Ecosystem-Level Risk in AI-Native Software

When AI agents autonomously write and merge code at scale, the usual way of evaluating them — task by task, in isolation — misses something important: the cumulative friction and technical debt that builds up in shared codebases over time. Studying over 930,000 agent-authored pull requests, this paper finds that about half of "integration friction" is a property of the repository ecosystem, not any individual contribution — and agent-authored code concentrates this risk roughly twice as much as human-authored code. Implications are significant for software governance, DevOps policy, AI code review tooling, and organizations that are beginning to integrate autonomous coding agents into production development workflows. Authors: Daniel Russo Paper: https://arxiv.org/abs/2606.28235v1