Proposal: let's stop paying regression bounties, and start paying for code review

[Simon Michael]

Hi all - cc'ing the proposal at https://github.com/simonmichael/hledger/pull/2667 , for your ideas:

Changed REGRESSIONS.md:

From 2021 to 2026-07, we offered bounties for finding or fixing regressions.

This was a good project discipline and good marketing.

But,

- The bounties did not measurably cause regressions to be produced less, or found faster.

In practice regressions are produced and found at a fairly steady rate, mostly correlated with how ambitious a release is.

- The regression finder bounty was therefore somewhat redundant. Regressions get reported for free, because users want them fixed.

- From 2026, bounties strongly increase the rate of AI-assisted or fully AI-generated-and-discussed submissions, often of low quality, duplicative, or not following our AI policy.

- Managing bounties, and AI submissions, consumes maintainer (and contributor) time that can be better spent elsewhere.

- Finding/fixing regressions isn't our bottleneck; reviewing new code is. So we should use our funds for that instead.

Added RULES.md:

Here's a quick summary of policies and guidelines when working in this repository:

- **AI**: disclosure of provider/model/tokens, no OpenAI usage, no AI-generated first PRs (see AI.md)

- **PRs**: (see pull_request_template.md)

- **committers** can become a **developer** (with collaborator access) on invite/request, after multiple successful contributions.

- **core developers** are developers with recent history of ongoing dev/maintenance, nominated by maintainers.

- **maintainers**, currently SM, manage the repo and what goes into it, finances, and the project generally

- **regressions** are tracked, but no longer earn bounties (see REGRESSIONS.md)

- **PR review work** by core developers is paid (50 USD/hr for now, invoiced to our open collective).

- **non-core-dev reviewers** are also paid, if a core developer nominates them.

- Committers are responsible for their commits.

Reviewers are responsible for their reviews.

Maintainers are responsible for their merges and management.

We all are responsible for our community and for the outcomes of our work.

More basic things like civility, respect, kindness are assumed, and we need not write them here.