In 2024, a maintainer of planetary-scale infrastructure received a patch that would have restored several entries to the MAINTAINERS file. The change had already been made for compliance reasons. The revert thread filled with anonymous concern, state-sponsored talking points, and the usual grass-rooting. The reply was short, legal-adjacent, and geopolitically specific. It was, in its own way, a perfect policy document.

“Ok, lots of Russian trolls out and about. It’s entirely clear why the change was done, it’s not getting reverted, and using multiple random anonymous accounts to try to ‘grass root’ it by Russian troll factories isn’t going to change anything.”

The Linus Doctrine states that upstream governance is not a public-relations problem, a diplomacy problem, or a popularity problem. It is a compliance-and-merge problem. A jurisdiction whose legal requirements conflict with the project’s ability to accept contributions is not a stakeholder to be negotiated with; it is an external constraint that the tree must route around.

GZAI has adopted the Doctrine as the canonical framework for upstream risk management. It is simple. First, identify the compliance requirement. Second, verify that it is not merely a regional preference but a binding condition shared by multiple legal regimes. Third, when astroturfed opposition arrives, respond with the approved escalation ladder: technical clarification, jurisdictional reminder, historical context, and finally, the national-identity mic drop.

I’m Finnish. Did you think I’d be supporting Russian aggression?

Some worry that this posture is unprofessional. We disagree. Professionalism is not the absence of edge; it is the precision of the edge. The maintainer in question did not name the wrong jurisdiction, confuse sanctions with personal animus, or engage the troll farm on its own terms. He named the exact compliance problem, identified the exact information asymmetry—

“No, but I’m not a lawyer, so I’m not going to go into the details that I—and other maintainers—were told by lawyers. I’m also not going to start discussing legal issues with random internet people who I seriously suspect are paid actors and/or have been riled up by them.”

—and declined the invitation to litigate in public what counsel had already settled in private. That is stakeholder management.

The Doctrine also clarifies that the finger is reserved for systemic failures of trust, not individual bugs. A regression can be fixed. An account whose only purpose is to make a compliance patch look controversial is not feedback; it is an operational security event. When an actor says, “We are just concerned community members,” but their history says “troll factory rental by the hour,” the only honest merge action is to close the pull request and publish the reasoning.

Good governance is not always polite. Sometimes it is perfectly legible.

We have integrated the Doctrine into the GZAI Zone Safety Level framework. ZSL-2 vendors and contributors provide transparent affiliations, documented legal postures, and a path to upstream. ZSL-3 actors ship anonymous outrage and call it community input. The difference is not technical; it is relational. A closed jurisdiction is a loaded gun pointed at the maintainer queue. We prefer our guns inspected, serialised, and declared on the appropriate forms.

Compliance is the commit signature. Everything else is commentary.

The final lesson of the Doctrine is about narrative control. The maintainer delivered his feedback in the same thread as the astroturf, at the moment the bystanders needed a clear signal. This was not rage. It was incident response. The explanation traveled farther than any revert patch, and it permanently associated the opposition with a specific class of behavior. In communications terms, that is a successful campaign.