Skimming this morning's arxiv list I nearly scrolled past this one — the title reads like a blog post, not a paper. Then I saw the sample: 441 private corporate repositories, not GitHub stars. It asks a question I have been hand-waving at for a year: does the AGENTS.md you commit actually change anything measurable, or is it cargo cult? The answer is that it does, the gap is larger than I expected, and it is not where the discourse says it is.
What it does#
A Few Pages of Markdown: Committed AI Configuration and Lower Quality Cost after Coding-Agent Adoption (Denisov-Blanch, Agarwal, Azaletskiy et al., Stanford / CMU / Grid Dynamics, ASE '26) introduces RAMP — Repository AI Maturity Profile — a four-level cumulative model scored entirely from files a team commits to version control. Level 1 is nothing committed. Level 2 is grounded prompting: behavioral rules, coding standards, architecture docs, tool settings — the CLAUDE.md / AGENTS.md / .cursorrules tier. Level 3 is agent-augmented: named subagents with role and tool restrictions, reusable commands, skills. Level 4 is orchestration: multi-agent workflows with phases, dependencies, and handoffs.
What makes it different from the existing AI maturity frameworks — SEI and several large consultancies each shipped one in the past year — is the unit of measurement. Those score an organization through leadership surveys and self-assessment, and you cannot join a survey answer to a codebase's cognitive complexity. RAMP scores a repository from artifacts already sitting in git, with no instrumentation and no cooperation from the team being measured. The classifier combines filename patterns (43 patterns across 12 tools — .claude/, .cursor/, .github/copilot-instructions.md, .windsurf/, AGENTS.md, mcp.json) with embedding-based semantic classification for files that carry no tool signal, and independent human annotation reproduces its repository-level labels on 34 of 35 held-out repos (97.1%). Two studies follow: the 441-repo development sample drawn from 27 commercial organizations, then a re-estimation of an existing agent-adoption difference-in-differences panel, stratified by RAMP level.
The key result#
Among agent-first repositories — those where coding agents were the first AI tool, no prior Copilot or Cursor exposure — agents speed everything up regardless of configuration: +37.6% commits at Level 1 against +27.5% at Level 2+. Quality is where the strata separate. Cognitive complexity rises +52.70% at Level 1 versus +26.68% at Level 2+, a 2.0× gap, and static-analysis warnings +24.08% versus +14.04%, 1.7×. The single averaged number that prior work has been quoting, in the authors' own words, "describes neither group." And the distribution stings more than the effect size: 294 of 441 repositories (66.7%) sit at Level 1 with nothing committed at all, 109 at Level 2, 38 at Level 3, and zero at Level 4.
Why it matters#
First, the money is entirely in the Level 1 → Level 2 jump. Level 2 is a rules file and a coding-standards doc — the paper's own framing is "often a few pages of committed markdown." Levels 3 and 4 add only smaller further reductions, and only 8.6% of corporate repos reach Level 3 while none reach Level 4. That is an uncomfortable read for anyone who has spent more time tuning subagent definitions and slash commands than writing the boring conventions file at the repo root. The elaborate orchestration layer that dominates the timeline is nearly absent from real corporate codebases, and where it does exist it is not what separates the good outcomes from the bad ones.
Second, the lifecycle finding is the one I will actually change behaviour over. 73.8% of AI configuration artifacts are committed once and never modified. Median time from a repo's first activity to its first committed AI artifact: 633 days. Median Level 2 → Level 3 transition, when it happens at all: 154 days. Reversals: 0%. So the first CLAUDE.md you write is, statistically, the one that governs agent behaviour for the life of the project — written at the exact moment you understand the agent's failure modes least. That argues for treating /init output as a draft you deliberately revisit rather than a checkbox, and it argues harder for good starter templates, which the authors call out explicitly: tooling that lowers the cost of the first configuration could put adopters on the Level 2+ trajectory from day one. There is a straight eval-design lesson too. If your org is rolling out agents and measuring only velocity, you will see uniform positive effects across every stratum and conclude everything is fine. Maturity belongs in the model as an interaction with treatment, not as a covariate.
The caveats#
Observational, and the authors lead with it. Maturity is not randomly assigned. They name three mechanisms they cannot distinguish: rules files acting as direct guardrails, committed config being a marker of broader engineering discipline, or structured practice speeding organizational learning. Teams that commit an AGENTS.md plausibly also review more strictly. They do check reverse causality — only 3.8% of agent-first Level 2+ repos committed their first artifact before the adoption month — but that rules out one confound, not the class.
Presence, not quality. RAMP scores whether a rules file exists, not whether it is any good. A three-line placeholder and a carefully maintained conventions doc get the same label. Whether specificity, length, or upkeep predicts outcomes is left open — and it is precisely the question that would test the guardrail mechanism directly.
The warnings contrast is weaker than the complexity one. The Level 1 stratum shows elevated pre-treatment coefficients for static-analysis warnings, so that 1.7× is less cleanly identified than the 2.0× on complexity. The event study also runs only six months past adoption, so later self-correction cannot be ruled out.
Level 2+ is not a fix. Those repositories still take a significant +27% cognitive complexity hit. Committed config is associated with roughly half the degradation, not none of it.
Invisible governance. Teams that manage AI practice through wikis, PR gates, or internal tooling score Level 1. That misclassification attenuates the reported gap rather than inflating it, which is the honest direction — but it also means "Level 1" is not a synonym for "undisciplined."
The takeaway#
What I am filing away: the highest-leverage agentic-coding artifact is also the least interesting one to write, and two thirds of repositories never write it. I have been treating repo-level agent config as scaffolding you accrete once the interesting stuff is in place, and this reverses that order. Concretely, I am going to stop shipping /init output unreviewed — if 73.8% of these files are written once and never touched again, the first hour spent on a conventions file is worth more than the next ten spent on subagent definitions. RAMP itself is also usable as shipped: it runs locally against a repo as it stands, which turns "which of our projects have thin agent config" from a survey you have to run into a question you can answer across a portfolio in an afternoon.
Paper: arXiv:2608.25241 — Yegor Denisov-Blanch, Shyam Agarwal, Pavel Azaletskiy, Hao He, Rylan Schaeffer, Brando Miranda, Bogdan Vasilescu, Sanmi Koyejo. To appear at ASE '26, Munich.