AiBook · ISBN 9798173134660 · PDF

AiBook · Jeremy Schoemaker · 2026 · ch-54.html

Give It Back (OSS Opens Doors)

(Spine Ch. 54.)

“A project some random person in Nebraska has been thanklessly maintaining since 2003” Randall Munroe, xkcd #2347, Dependency (2020)

At 10:37 UTC on 7 August 2026 I was not contributing to open source. I was trying to keep my own agent alive. It talks to MCP servers over an SSE stream, the server sent a long run of frames the client had no use for, and the Rust reader called itself once per skipped frame. Skip enough of them and the stack runs out. That does not raise an error you read over coffee. The process aborts. My agent died mid-run, the log ending mid-sentence like a dial-up connection dropping at 94%.

So I read the diff instead of writing a workaround. The recursion became a loop. I opened the pull request at 10:37:22 and a maintainer named DaleSeo merged it at 14:34:19: 3.95 hours from a stranger’s patch to code that ships to everyone using the official Rust SDK for the Model Context Protocol. Nobody in that thread knew who I was, and it did not matter. The diff either fixed the stack overflow or it didn’t.

Bottom line: A merged pull request in somebody else’s repository is the one credential in software nobody can fake: the diff is right there and a stranger can check it in eleven seconds without calling anyone. The way you get one is not “contribute to open source.” Nobody ever got one that way. You run other people’s code in production, it bites you, and you refuse to work around it. Fifty-nine of mine are merged across 25 organizations, 58 of them between 3 August and 9 September 2026. That looks like a flex until you learn what it is: 58 nights my agent broke.

When it bites

The pattern

Start with what “merged” means, because people who have not shipped one hear it as “posted something.” A pull request is a change you propose to a code base you cannot write to. Merged means a maintainer read your diff and pressed the button that puts your code in the branch everybody else installs. #1146 was merged by DaleSeo. swiftlang/swift-package-manager #10443 by plemarquand. Those are people defending their own on-call rotation. They owe you nothing, and no amount of networking makes them press it.

The counting rule, stated once and used everywhere in this book: merged pull requests in repositories I do not own, derived with gh on 9 September 2026. My own repos do not count. Open does not count.

Repo PR What broke Hours to merge
openai/openai-agents-python #4606 max_turns clobbered a tripped input guardrail in streaming 1.41
modelcontextprotocol/rust-sdk #1146 Skipping an SSE event recursed; a burst blew the stack 3.95
huggingface/swift-transformers #384 Sampling returned one constant wrong token above 65,536 vocab 7.04
pytorch/ao #4817 NVFP4/MX QAT backward dropped the bias gradient 13.87
google-deepmind/open_spiel #1593 Quoridor forced-pass read the board before validating 38.45
anthropics/claude-code-action #1719 download_job_log stalled forever on a hung fetch 39.71
laravel/mcp #331 JSON-RPC notifications took an unvalidated params shape 41.76
microsoft/agent-framework #7837 Gemini finish-reason fallback cascaded into usage attach 84.80
google/adk-java #1449 InMemoryArtifactService ignored the user: namespace 87.04
apache/tvm #20170 fmod mapped wrong in Relax ONNX constant folding 94.80
envoyproxy/envoy #46954 isUrlValid hit signed-char undefined behavior 175.60
elastic/kibana #287214 Document IDs containing slashes broke the query-rules route 205.58
facebookresearch/xformers #1407 Missing mslk silently dropped the attention ops 226.12
swiftlang/swift-package-manager #10443 Auth credentials followed a cross-host redirect 343.91
huggingface/accelerate #4151 Disk offload crashed on FP8 tensors 779.92

That is 15 of 59. The other 44 are the same shape in other plumbing. Fourteen in mozilla-ai (mcpd config validation and tool schemas, plus otari, any-llm, any-guardrail, apron-tools, apron-auth, llamafile). Four in mozilla proper, all firefox-devtools-mcp, including a capability the server advertised but never implemented. Four in apache: a Beam flag collision, a Maven unbox, a Pulsar TLS cipher never passed to Jetty, and calcite #5223, which bounded DECIMAL expansion so an overflow check could not blow up on a huge exponent. Four more in huggingface, two in microsoft (markitdown RSS recursion, FLAML misaligned sample weights), two in mistralai (config validation that divided by zero), and singles in openai, google, google-deepmind, anthropics, modelcontextprotocol, bytedance/deer-flow, OpenBMB/MiniCPM-V, TanStack/ai, SillyTavern, QwenLM/qwen-code, two in MiniMax-AI, and zai-org/SCAIL-2, where a missing colon meant LoRA bias deltas were never fused. Plus fumeapp/laranuxt #14: a broken README link merged in 2020, six years earlier, and the only one that was not an outage.

I did not pick those projects off a list of good first issues. My agents run over MCP, so MCP plumbing is my plumbing. My cluster is Apple Silicon under MLX, so Swift tooling, quantization and offload code are my tooling. Every one of those repos stood between me and a working night, and working around them cost more than fixing them.

Now the reality check against my own hero story. Median time to merge across all 59: 111.55 hours, or 4.6 days. Fastest was #4606 at 1.41 hours. Slowest was the accelerate FP8 disk-offload crash, which sat 779.92 hours: 32.5 days. Total, 5,462 added lines and 539 deleted. If you plan on the 4-hour version you quit in week two.

The least exciting row in that table is the one I would hand a hiring manager. swiftlang/swift-package-manager #10443: DataTaskManager kept the authentication header when a download redirected to another host, so a registry credential goes wherever the redirect points. Sixty additions, seven deletions, 343.91 hours. Two weeks is the right caution for a stranger’s security patch inside Apple’s package manager.

At the other end, anthropics/claude-code-action #1579 is one changed line: a broken anchor to the Bedrock section of cloud-providers.md. It sat 164 hours, a maintainer merged it, and I felt like a hero over a link. The bar for a first patch is not a rewrite. It is something wrong plus somebody willing to fix it.

One worked example

7 August 2026, modelcontextprotocol/rust-sdk #1146.

SseAutoReconnectStream recursed into itself for every event it skipped. On a normal stream you never notice. On a server emitting a long burst of non-JSON frames, each skip adds a stack frame and the client dies with an abort. Not a hung request. Not a dropped message. Not a retry you can log. The process.

Before I found that, Jeremy Schoemaker, Lead Linux Security Engineer at a bank back when that title meant something, restarted his agent twice, rewrote his own error handling, and drafted an issue blaming the server. The defect was a function calling itself.

The fix wraps poll_next in a loop and replaces the tail calls with continue: 164 additions and 124 deletions in one file, the honest size of “same behavior, one less stack frame.”

Seven hours later I filed #1152 in the same repo: the SSE GET stream never mapped 401 and 403 challenges, so the auth client never got the signal to refresh its token. 136 additions, merged in 1.71 hours. Faster because it was smaller, and because the maintainer already had a data point from that morning saying my diffs do not waste an afternoon.

Outcome: both merged, both fixing a failure that reported itself as something else.

The quiet failure

The loud failure is padding the number. Somebody claims 200 contributions, you open the list, it is 190 typo fixes and a fork of their own repo. Dies on contact.

A PR title is a filename. Anybody who used Limewire in 2000 knows the lesson: the file said Metallica_-_One.mp3, 3.2 MB, downloaded clean, and what came out of the speakers was a man coughing for four minutes. Titles are metadata somebody typed. The diff is the bytes.

You cite real merged PRs, and everyone reasons from the titles anyway. fumeapp/laranuxt #14 and mozilla-ai/mcpd #278 both start with “fix.” One is a README link. One is 293 added lines that reject conflicting options and roll back a partial move. Same column, same verb, nothing like the same unit of evidence. I am the person most tempted to forget that, because it is my table.

Second, you blur merged into open. Fifty-nine merged is a claim about other people’s judgment. My 101 open PRs are a claim about my own output. Some will be closed unmerged, some will rot in the queue, and none count until somebody presses the button. If I say “contributor to Apple,” ask which repo and which state, and I should be the one asking first.

Third, the one the chapter title writes a check for. I can show you the keys. I cannot show you a hinge swinging. On 9 September 2026 I searched my own inbox and calendar for the moment a merge turned into a reply, an intro, an interview, a tier bump, anything. What I found was 59 merges and a spotless inbox. Zero. Not one of those 59 has a dated outcome attached to it.

So take the title as a bet, not a receipt. My honest belief, and it is only a belief, is that landing #1146 changes how a stranger reads my name three months later, and that the 59 rows are an asset that has not been called yet. Ask me again in a year. Until then the only thing I can prove is the part nobody can fake: the diffs shipped. The credential nobody can fake is also, apparently, the one that does not ring your phone.

Do / don’t

Do

Don’t

Where this sits in the book

Ch. 24 is the same instinct pointed the other way: the dependency you did not write can betray you, so read the diff. This chapter is what you do once you find the bug. Ch. 31 gives three moves when your agent blows up (retry, degrade, escalate); the fourth, which only exists in open source, is to fix the thing that broke so it stops breaking for everyone. Ch. 61 is this compressed: the patch you land upstream is the lever, because you do the work once and it ships to people you will never meet.

Sources and receipts

Counting rule: merged PRs in repos Jeremy does not own, via gh on 2026-09-09. Timestamps UTC.

Verified: 59 merged across 25 organizations, 58 between 2026-08-03 and 2026-09-09 plus one in 2020. Median 111.55 hours, fastest 1.41, slowest 779.92. 5,462 additions, 539 deletions. Open at pull: 101, across 52 orgs.

Org counts: mozilla-ai 14, apache 5, huggingface 5, mozilla 4, microsoft 3; two each in mistralai, google-deepmind, anthropics, google, openai, laravel, modelcontextprotocol, MiniMax-AI; one each in elastic, envoyproxy, facebookresearch, bytedance, OpenBMB, pytorch, zai-org, TanStack, SillyTavern, QwenLM, swiftlang, fumeapp.

Belief, not receipt (Jeremy, 2026-09-09): inbox and calendar search on 2026-09-09 found no merged PR that produced a named intro, reply, interview, or tier advancement. Count of door-opening outcomes with dates: zero. The chapter prints this as his belief and says so.

Why he was in these code bases: Jeremy, 2026-09-09: his agents (aigate, eldritchdm, ShoeAgent) run over MCP, so MCP bugs hit his production first; the Swift, MLX, quantization and offload filings come from his private exo cluster on Apple Silicon.

What I could not verify: