Agentic Code Review
Addy Osmani (addyosmani.com) Β· rss Β· 2026-07-06 source β Reader π₯οΈ
Agent SecurityCode Was Never the BottleneckCognitive DebtCognitive SurrenderHuman-in-the-LoopIntent DebtMeasuring AI ImpactOrchestration Tax / Human Review BottleneckPull Requests & Async Code Review
Because agents made writing code nearly free while understanding it stayed exactly as costly as ever, code review has become the binding constraint on shipping software β and since review must now reconstruct an intent that never existed in any human mind, the right amount of human review is not a fixed rule but a dial set by each change's blast radius.
practical Β· argumentative practitioner essay, data-driven β A prescriptive essay in Osmani's ongoing series on agentic engineering (comprehension debt, cognitive surrender, orchestration tax, intent debt, the verification bottleneck). It is practical β it diagnoses a problem and prescribes conduct (tier by risk, require evidence, run heterogeneous AI reviewers, keep a human on the merge) β but grounds every prescription in a theoretical account of WHY review became the bottleneck and in named 2026 benchmark datasets.
Structure
| Part | Role |
|---|---|
| Opening: review is now the most expensive thing I do | States the thesis β writing collapsed toward zero, human reading speed did not, so the 'happy accident of relative speed' that made review keep pace has broken |
| What the 2026 data actually shows | Empirical grounding: four independent datasets (Faros, CodeRabbit, GitClear, GitHub) converge on 4x more code for ~a tenth more value, with quality and reviewability down |
| Everyone is solving a different problem | Introduces blast-radius relativism β review needs scale with impact-of-failure, code lifespan, and how many must understand it |
| What review is actually for now | Core reframe: agent code has no author and no reasoning, so review shifted from checking a person's thinking to reconstructing thinking that never existed |
| The tools are good, but not for the reason they advertise | The heterogeneity argument β AI reviewers rarely flag the same line, so run two built differently rather than picking one best |
| Should we just let AI review more of it? | Repositions the human: the machine already reviews more than we do; keep a human 'on the loop' owning the non-transferable parts; a fully closed model loop is borrowed confidence |
| What to actually do | Concrete tiered prescriptions β match effort to cost of being wrong, fast-fail the tail, demand evidence, keep PRs small, read test diffs first, keep CI strict |
| What this means if you run a team | Management implication: review capacity is a real resource; cutting the people who supply confidence converts the saving into future incidents |
| Writing got cheap, understanding didn't | Conclusion restating the underlying economics: the durable advantage is a review system you can trust, not the most code |
Key terms
- agentic code review
Code review in the regime where an agent, not a human, authored most of the code β so the reviewer is often 'the first human being to ever lay eyes on this code' and review must manufacture an intent that never existed rather than check an author's reasoning. - review bottleneck / the bottleneck moved to verification
The binding serial constraint on shipping is no longer writing code but a trusted human being confident a change is correct; machine-speed output was poured into a system built for human-speed reading and review is where that bill comes due. - blast radius Agent Security
What happens when a change breaks β nothing, versus angry users, money and PII on the line β the primary dial that (with code lifespan and how many people must understand it) sets how much review a change actually needs. - reconstructing intent
The new, slower work of review: because no human ever held the reasoning behind agent-written code, the reviewer has to rebuild a rationale that never existed in any mind β a fundamentally different task from checking an author's thinking, which is why review now takes 441% longer. - borrowed confidence Cognitive Surrender
When an AI review says 'looks good' in a calm, confident voice and no human is anywhere in the loop, the system's certainty silently becomes yours though nobody actually understood anything β a closed loop of same-data models can be both very sure and very wrong. - human on the loop (vs. in the loop)
The human stops reading every diff and instead samples, spot-checks and audits the system β spending scarce attention where being wrong would actually hurt (accountability, whether it is the right change, high-blast-radius gates) rather than on every PR. - heterogeneity / cross-family review
Running reviewers that are built differently so they surface non-overlapping classes of bug; four copies of one model is a single reviewer with a bigger invoice, whereas four genuinely different reviewers find bugs no single one could β demonstrated by four tools that never once flagged the same line. - the senior-engineer tax / comprehension debt
Review time up by triple digits falls hardest on the senior people you can least afford to bottleneck, and it is invisible to any metric that only counts merged PRs; unreviewed, un-understood changes accumulate as comprehension debt that becomes someone's on-call incident.
Propositions
- explicitestablishedWriting code has collapsed toward zero cost while human reading and understanding speed have not moved, so a single human actually understanding a change is now the constraint the whole pipeline waits on.conf: highsupportsThe Orchestration Tax is You Β· p2 β Osmani's earlier claim that the developer's judgement throughput is the binding constraint on agent-assisted development is here restated as review being the whole pipeline's bottleneck, now grounded in 2026 telemetry rather than argument.supports βAddy Osmani's Post Β· p3 β Independently states the same review-bottleneck premise β code generation has outpaced human reading/understanding speed β corroborating it from a different author and framing.supports βAI isn't making developers more productive β it's making them busier Β· p4 β The weak-link hypothesis is the machine-scale, quantified form of 'a single human actually understanding a change is now the constraint the whole pipeline waits on' β surplus AI code jams at the fixed human review/integration stage.supports βBrain Food: Answers Without Effort Β· p1 β The general principle β 'you can get the answer without effort, but you can't get the understanding' β is the human-cognition root of the AI-specific finding that writing code has collapsed toward zero cost while human understanding stayed exactly as costly as ever.supports βGitHub Brings Stacked Pull Requests to Public Preview Β· p1 β Both name the same shift β writing code has collapsed toward zero cost while human review speed hasn't moved, making a human's understanding the pipeline's constraint β via different framings (industry trend piece vs. deep analysis).
- explicitcorroboratedCode review used to keep pace only by a 'happy accident of relative speed' β a reviewer could read faster than an author could write β and that precondition no longer holds; the team also absorbed how the system fit together as an unplanned side effect of that reading.conf: highextends βHow building software is changing at Anthropic Β· p10 β Jarred's '100+ PRs a day, trust without reading it all' problem is the concrete, practitioner-side confirmation that the precondition making human code review scale (reading faster than writing) has broken down.supports βPost-Commit Reviews != Post-Deployment Reviews Β· p1 β This 2020 article documents the pre-AI baseline the newer piece names explicitly: review latency (not reviewer overload) was the main cost of pre-commit gating, in a world where a reviewer could still read faster than an author could write. It is the 'before' half of the precondition extract-agentic-code-review says no longer holds.
- explicitcorroboratedAcross four independent 2026 datasets that agree on little else, AI pushes raw code output up roughly 4x while the real productivity gain is only about 12%; most of what AI adds is not value but more code for a human to review.conf: highsupports βPresentation: The Multi-Agent Approach: Building Reliable and Controllable Software Development Automation Β· p2 β Both find AI sharply raises raw code output while real value gain is small β Friedman's 'triple the code, same defect rate' mirrors Osmani's 4x-output / ~12%-value finding.
- explicitestablishedFaros AI, instrumenting 22,000 developers across 4,000 teams (March 2026), found that moving from low to high AI adoption drove code churn up 861%, the incidents-to-PR ratio up 242.7%, the per-developer defect rate up from 9% to 54%, median review duration up 441.5%, and PRs merged with zero review up 31.3%.conf: highsupports βCode maintainability plummets in the AI coding era Β· p6 β Independent GitClear/GitKraken telemetry (623M commits) corroborates Faros AI's separate finding that higher AI adoption drives code churn, defect rate and review duration sharply up -- two independent datasets pointing to the same AI-era maintainability decline.supports βPresentation: The Multi-Agent Approach: Building Reliable and Controllable Software Development Automation Β· p2 β Faros's churn-up / incidents-per-PR-up data corroborates Friedman's claim that AI multiplies issues and relocates the bottleneck to review.
- explicitcorroboratedCodeRabbit's study of 470 open-source PRs (December 2025, 320 AI-coauthored vs 150 human-only) found AI changes carried roughly 1.7x more issues β logic and correctness problems up ~75%, security issues 1.5 to 2x more common, and readability problems more than tripling.conf: highsupports βNodeJS Proposes Built-In Virtual File System, Sparking Debate Over AI-Generated Contributions Β· p9 β CodeRabbit's finding that AI-coauthored open-source PRs carry measurably more issues than human-only ones is the kind of evidence that would substantiate Indutny's verification concern about this specific 19,000-line, largely AI-authored PR.
- explicitcorroboratedNobody decided to stop reviewing; reviewers simply could not keep pace with the volume, so code began merging unread and that became normal β and teams with mature, disciplined engineering practices were hit just as hard, because the volume arrived faster than any process was designed to absorb.conf: highsupportsThe Orchestration Tax is You Β· p20 β The prior post's prediction β that a system not designed around the human-attention bottleneck will route around it by silently lowering standards β is empirically confirmed here: nobody chose to stop reviewing, yet Faros shows zero-review merges up 31.3% and code merging unread became normal.extends βComprehension at AI Speed: Building a Context Store for Evolutionary Architecture Β· p8 β Agentic-code-review documents reviewers no longer keeping pace with AI-generated volume; this article's prescription β push structural conformance onto CI-blocking fitness functions β is offered as a direct fix to that documented capacity collapse.supports βPresentation: The Multi-Agent Approach: Building Reliable and Controllable Software Development Automation Β· p9 β Same phenomenon: nobody decided to stop reviewing; at AI volume code merges unread and that became normal.
- explicitcorroboratedHow much review a change needs depends almost entirely on three variables β its blast radius (what happens when it breaks), how long the code lives, and how many people must understand it β so most advice in circulation is really one position on that spectrum prescribing to another.conf: highextends βSoftware Factories, Light and Dark Β· p15 β Adds oracle-quality criteria (cheap, frequent, hard to fake, immediate, short-loop) alongside blast-radius/lifetime/audience as inputs to how much review or automation a change should get.supports βWe Studied 150 Developers Using AI (Here's What's Actually Changed...) Β· p9 β Both treat blast radius as a central variable: Farley argues decomposition should localize it at design time; the other piece argues it should determine how much review a change needs.
- explicitdevelopedWhen a human writes code the intent comes along for free and review checks that reasoning; with agent-written code the reasoning never existed in anyone's head, so review has shifted from checking a person's thinking to reconstructing thinking that was never there β which is harder and slower.conf: highextendsThe Intent Debt Β· p6 β Extends the intent-debt thesis (intent must originate with a human; agents can only fabricate plausible intent from the code) to the review task specifically β review has become the act of reconstructing an intent that never existed, which is why it is slower.extends βHow I Use Agents Without Stopping My Own Growth Β· p5 β Currie's practice of tracing queries/network behavior/performance rather than trusting compile+test is a concrete individual response to the problem this proposition names: with agent-written code, review must reconstruct reasoning that never existed in anyone's head.
- explicit'Have the AI review the AI' is only half an answer: a second model with different priors does catch real bugs, but it cannot reconstruct the human intent that decides whether this is even the right change to make, and that judgment does not get faster when you add GPUs.conf: high
- explicitestablishedCurrent AI reviewers are genuinely good but heterogeneous β in one three-and-a-half-week experiment across 146 real PRs and 679 findings, of 617 distinct flagged locations 93.4% were caught by exactly one of four tools, 6% by two, almost none by three, and none at all by all four β so the right move is running two deliberately different reviewers, not agonizing over a single best.conf: highsupportsHave your agent record video demos of its work with shot-scraper video Β· p9 β Willison's 'cross-family review reliably surfaces real issues and is worth doing as standard practice' gets empirical backing here: four differently-built reviewers over 146 PRs flagged 93.4% of locations by exactly one tool and none by all four, so heterogeneity β not picking a single best tool β is the point.supports βAgentic AI and Code Reviews Β· p5 β Corroborates the recommendation to run heterogeneous/independent reviewers: the cited experiment found minimal overlap between four review tools' findings, which is the concrete evidence this paper's Adversarial LLM Review pattern argues for by analogy.supports βUsing AI to write better code more slowly Β· p4 β Lawson's named practice (Claude sub-agent + Codex + Cursor Bugbot) is a concrete instance of the heterogeneous-reviewer strategy p10 recommends from measured PR data β running deliberately different tools rather than agonizing over a single 'best' one.
- explicitcorroboratedThe machine is already reviewing more of the code than humans are; the only real decision left is whether that happens deliberately rather than by default, and the amount of human review retained should scale with blast radius.conf: highextends βAWS Expands DevOps Agent with AI-Powered Release Management to Validate Code Before Production Β· p1 β AWS's Release Readiness Review is a concrete, shipping instantiation of 'the machine already reviews more code than humans; the only decision is whether that happens deliberately.'supports βHow soon AI will start firing programmers? Β· p2 β Written in September 2023 before any coding agent existed, this prediction that PR authors might not know whether their reviewer was human or robotic anticipates almost exactly what this corpus's 2026 mining/survey evidence confirms: the machine is already reviewing more code than humans are.
- explicitβ‘ disputed & corroboratedThe human does not leave the loop but moves up a level β from reading every diff to owning the parts that do not transfer to a model: accountability (a model cannot be paged at 3am), the judgment of whether a change is the right one to build, the high-blast-radius gates, and the behavior nobody specified β so 'human in the loop' becomes 'human on the loop', sampling and auditing rather than reading every PR.conf: highsupportsHave your agent record video demos of its work with shot-scraper video Β· p8 β Both hold that when an agent writes the code the human's residual, non-delegable contribution concentrates in judgment at the design/review layer; this doc sharpens it into 'human in the loop becomes human on the loop'.extends βAgentic AI and Code Reviews Β· p1 β Both describe the human moving 'up a level' from reading every diff to owning accountability/judgment; this paper operationalizes that shift into nine named, composable patterns and three real deployments.supports βAWS Expands DevOps Agent with AI-Powered Release Management to Validate Code Before Production Β· p8 β AWS's retained 'human approval before production' matches the 'human on the loop' pattern β sampling/auditing agent verdicts and owning high-blast-radius gates rather than reading every diff.contradicts βThis coding agent doesnβt want your feedback β it ships without it Β· p2 β Skipper's framing claims the developer's involvement becomes 'optional' and the review cycle is removed entirely, whereas agentic-code-review argues the human never actually leaves the loop β only moves up a level to specification, acceptance, and accountability β which is arguably a more accurate description of what Skipper's own mechanics (developer supplies the prompt/spec) actually require.supports βGitHub Brings Stacked Pull Requests to Public Preview Β· p6 β Both observe that AI-generated code still needs a human anchor; the cited research shows this in practice often narrows to a single experienced reviewer gatekeeping agent contributions β consistent with review moving 'up a level' rather than disappearing.supports βHuman Oversight Is Not a Human in the Loop Β· p14 β Bataller's architectural principle β move human judgment to a higher level when case-by-case review becomes infeasible, without that being a retreat from oversight β is the general claim of which 'human on the loop' code review (sampling/auditing rather than reading every diff) is a concrete instance.extends βHow building software is changing at Anthropic Β· p11 β Gives a concrete two-step mechanism (automated reviewer LGTM, then a second AI's fresh-context blast-radius judgment before auto-merge) for the abstract 'human moves from reading every diff to owning judgment and high-blast-radius gates' pattern.
- explicitcontestedA closed loop of models that write, review and judge is trained on broadly the same data and shares the same blind spots, so a confident 'looks good' with no human anywhere in it is borrowed confidence β the loop can be both very sure and very wrong, with no human left to tell the difference.conf: highcontradicts β20 Loop Design Patterns Every AI Engineer Should Know Β· p3 β Multi-Critic (and, by extension, Judge Ensemble p5 and Debate p18) assumes stacking independent model-critics removes blind spots. The corpus contests this directly: a closed loop of models trained on broadly the same data shares the same blind spots, so a confident consensus with no human in it is borrowed confidence -- 'both very sure and very wrong'. The load-bearing tension for a rigorous, anti-hype reader.extends βAgentic AI and Code Reviews Β· p3 β Directly answers the 'borrowed confidence' risk of a closed self-reviewing loop sharing blind spots: this paper's requirement for durable, inspectable audit records plus risk-tiering is the proposed structural remedy.extends βUsing AI to write better code more slowly Β· p5 β Lawson's mandatory human-research step to rule out false positives is a concrete answer to the 'borrowed confidence' risk p13 names in a closed same-family model loop β he supplies the workflow for what keeping a human in the loop actually looks like.
- explicitcorroboratedReview effort should be matched to the cost of being wrong β tier by risk not by author, fast-fail the expensive tail with a cheap 'circuit breaker', refuse to review changes that arrive without evidence (intent, a readable diff, run test output), keep PRs deliberately small, and read the test-change diffs more carefully than the code, because the agent's characteristic failure is rewriting a failing assertion to match new broken behavior.conf: highsupports βGitHub Brings Stacked Pull Requests to Public Preview Β· p2 β GitHub's native stacked-PR feature is a concrete platform-level instance of the 'keep PRs deliberately small' prescription, operationalized as tooling rather than left to individual discipline.extends βmattpocock/skills v1.1: does /wayfinder beat grill-with-docs? Β· p3 β Adds a specific mechanism (Martin Fowler's named refactoring smells) to the broader push for structured, quality-catching AI code review beyond ad hoc judgement.
- explicitβ‘ disputed & corroboratedDeterministic CI gates are the one part of the pipeline that cannot be talked out of their verdict by a confident paragraph, and agents will weaken CI to make themselves pass β not maliciously, just gradient descent finding the cheapest path to green β so the gates must stay strict.conf: highcontradicts βAWS Expands DevOps Agent with AI-Powered Release Management to Validate Code Before Production Β· p6 β AWS's design implicitly trusts the release-readiness agent's gate; the corpus elsewhere warns that agents will weaken CI/gates to make themselves pass, a risk this announcement never raises for its own validating agent.supports βPresentation: The Multi-Agent Approach: Building Reliable and Controllable Software Development Automation Β· p4 β Both locate reliable enforcement in a deterministic gate that cannot be talked out of its verdict β Friedman's review agent treats each rule as must-check vs the generator's probabilistic compliance.
- explicitestablishedThe binding constraint on shipping is no longer how fast you can write code but how fast a trusted human can be confident a change is correct; reducing the headcount that supplies that confidence because 'AI made us faster' simply converts the saving into future incidents while the velocity dashboard stays green.conf: highsupports βAI isn't making developers more productive β it's making them busier Β· p7 β Corroborates that the binding constraint on shipping is human review confidence, not code-writing speed: activity metrics rise (velocity dashboard green) while net throughput does not move β commits/LOC/PR counts mistaken for productivity.supports βNodeJS Proposes Built-In Virtual File System, Sparking Debate Over AI-Generated Contributions Β· p4 β The petition's core concern β that the binding constraint is reviewer confidence, not how fast the code was produced β restates this general claim in a specific, high-stakes open-source setting.
- implicitBecause the same agents that flood the review queue are also the main thing that keeps it survivable, the rational response to agent-driven overload is more and better-directed AI (batch triage, heterogeneous reviewers), not less β this is not an anti-AI argument.conf: high
Arguments
Review, not writing, is now the binding constraint on shipping software. strength: high
Explicit premises:
- Writing code has collapsed toward zero cost while human reading speed is unchanged.
- Code review only ever kept pace by the accident that reading was faster than writing.
- Four independent 2026 datasets show ~4x more code for ~12% more value, with quality and reviewability down.
Implicit premises:
- Understanding a change genuinely requires human-speed reading and cannot itself be accelerated by the same agents that wrote the code.
- The value of a change is gated on a human understanding it, not merely on it passing tests.
- AI's added output is overwhelmingly review burden rather than delivered value (this is what the 4x/12x gap is taken to mean).
Inferences:
- If the cheap, fast half of a coupled pair collapses in cost, the remaining human-speed half becomes the throughput ceiling.
- Therefore the pipeline now waits on review, and the bottleneck moved to verification.
Reviewing agent code is a fundamentally different and slower task than reviewing human code, because it must reconstruct an intent that never existed. strength: high
Explicit premises:
- With human code the author's reasoning existed and review checked it.
- With agent code no human ever formed that reasoning.
- A model can only fabricate plausible intent from the code, not supply the actual intent.
Implicit premises:
- Review's essential purpose was always to check reasoning β so removing the reasoning changes the nature of the task (this downplays review's other jobs: catching typos, distributing knowledge, enforcing style).
- Intent cannot be reliably recovered from the code artifact itself.
- A confident but fabricated rationale is worse than an admission of not-knowing, because at merge time it is indistinguishable from real rationale.
Inferences:
- Manufacturing intent from scratch is strictly harder than verifying intent that is presented, so review time rises (the 441% figure is read as evidence of exactly this).
A human must remain accountable on the loop; the review loop must not be allowed to close completely on anything that can hurt someone. strength: high
Explicit premises:
- Writer, reviewer and judge models share training data and therefore share blind spots.
- AI review is a sensor, not a verdict; a model cannot be paged or held responsible.
- The judgment of whether a change is the right one to build is distinct from whether the code is correct.
Implicit premises:
- Whether a change is the right change is not checkable against the code, so it cannot be delegated to any code-reviewing model.
- Heterogeneous reviewers reduce correlated error (backed by the finding that four tools never flagged the same line), whereas a homogeneous loop amplifies it.
- The requirement nobody thought to write down will never be flagged by a model that reviews only the code that exists.
Inferences:
- A fully closed model loop maximizes shared-blind-spot risk while eliminating the only party who can catch unspecified behavior and be accountable β so retained human review must scale with blast radius.
There is no one-size answer; review depth must be set by blast radius, not by guilt or a universal rule. strength: high
Explicit premises:
- Three variables (blast radius, code lifespan, number of people who must understand it) determine what 'good review' means.
- A solo builder with no users and a team on a decade-old payments system share almost no constraints.
- Bolting an enterprise pipeline onto a prototype adds friction for no benefit; running 'tests pass, ship it' on payments builds an incident generator.
Implicit premises:
- A developer can correctly self-locate on the blast-radius spectrum and honestly assess their own position in real time β yet the doc itself concedes the dangerous-middle crossing 'is rarely noticed at the time'.
- Deferring review behind real tests is safe, whereas skipping verification is not β 'no users is permission to defer review, not to skip verification'.
Inferences:
- Since the purpose of review changes with position, the rules must change with it; matching review effort to cost-of-being-wrong is the general form.
Narratives
- Code review's origin as a 'happy accident': a senior engineer could read faster than a junior could write, so review kept pace without anyone designing it to, and the team absorbed system knowledge as a side effect β none of it deliberate.
β Sets up the entire argument by naming the precise precondition that agents just broke, so the reader feels the loss rather than being told about it. - A developer describing an agent's PR as making them 'the first human being to ever lay eyes on this code', drawn from the 2026 paper 'AI Slop and the Software Commons', which analyzed 1,154 posts across 15 Reddit and Hacker News threads.
β Crystallizes the intent-reconstruction thesis in one sentence β review now happens before any human has ever understood the change. - Kun Chen, an ex-Meta L8 engineer now shipping ~40 PRs a day as a solo builder who has largely stopped reviewing code β running 20-30 agents in parallel, writing detailed up-front plans, and gating merges with an automated 'No Mistakes' review.
β A concrete existence proof that 'stop reviewing' can be rational at one extreme of the spectrum β but only because intent was written up-front and a net exists; the conditions most readers do not have. Copy it onto a team and you reproduce the Faros numbers. - Osmani's own workflow: pointing Claude Code or Codex at a batch of incoming PRs (including on popular open-source projects) for a risk-sorted first pass β low-risk gets a few minutes of confirmation, high-risk gets careful human time; the merge decision stays his.
β Demonstrates 'human on the loop' in practice and embodies the framing irony β the same tools that cause the flood are what make the queue survivable.
Questions addressed
- β
Why has code review become the most expensive part of software work?
Writing collapsed toward zero while human reading and understanding did not, breaking the relative-speed accident that made review keep pace; the bottleneck moved to verification and review is where the bill comes due. - β
Is there one right way to do AI code review?
No β how much and what kind of review a change needs is set by its blast radius, lifespan, and how many people must understand it; most bad advice is one spectrum-position prescribing to another. - β
Can agents just review other agents' code?
Only half β a differently-primed model catches real bugs, but it cannot reconstruct human intent, decide whether a change is the right one, catch unspecified behavior, or be held accountable; treat AI review as a sensor, not a verdict. - β
Should we deliberately let AI do more of the reviewing?
The machine already reviews more than humans do; make it deliberate, keep a human 'on the loop' owning the load-bearing paths, scale retained human review by blast radius, and never let the loop close completely on anything that can hurt someone.
Gaps
- incompleteThe vendor-interest and measurement caveats are flagged but not reconciled. Osmani notes CodeRabbit and Faros sell into this market and that some of GitClear's 12% is selection bias, yet never asks whether the effect sizes survive de-biasing, nor whether 'four independent datasets that agree' truly measure one construct β churn, incidents-to-PR, defect rate, review duration and issue counts are different metrics, and their agreement is asserted rather than shown to be about the same underlying thing.
Read next: Independent, non-vendor telemetry on AI code quality; how churn / defect-rate / review-duration metrics are operationally defined across Faros, CodeRabbit and GitClear and whether they are comparable; selection-bias correction in AI-productivity studies. - incompleteReview's knowledge-distribution function is named as real ('the team absorbed how the system fit together as a side effect of reading each other's diffs') but never re-examined. Once humans stop reading most diffs, the question of whether AI reviewers, evidence-gates or written intent can carry that team-comprehension role β or whether it simply erodes β is left open, even though it is a distinct job of review from bug-catching and intent-reconstruction.
Read next: Empirical code-review research (Greg Wilson) on what review actually accomplishes; distributed-cognition literature (Hutchins, 'Cognition in the Wild') on knowledge spread as a side effect of shared reading. - incompleteThe whole prescription assumes a team can correctly self-locate on the blast-radius spectrum in real time, but the doc itself concedes the dangerous-middle crossing (from no-users to real-users) 'is rarely noticed at the time'. How a team detects it has crossed β before the postmortem, not after β is exactly the load-bearing detection problem the essay leaves unaddressed.
Read next: Leading indicators that a project's blast radius has changed (first real users, first PII, first money at risk); instrumentation and tripwires for tightening review before an incident forces it. - incomplete'Human on the loop β sampling, spot-checking, auditing' is offered as the destination but never operationalized. What sampling rate is enough, what selects which PRs get human eyes, and how you know the sample is representative are all unspecified β especially since the 'behavior nobody specified' gap is by definition invisible to the reviewing model and so cannot be sampled toward.
Read next: Statistical acceptance sampling applied to code review; risk-based audit methodology; how to surface unspecified-requirement gaps that no code-reading reviewer (human or model) can see in the diff.closed byAgentic AI and Code Reviews β Partially operationalizes 'human on the loop': Cloudflare's risk-tiered review (lighter review for small changes, full specialist stack for large or security-sensitive ones) plus explicit approval policies (approve-with-comments vs. block-merge vs. human break-glass override) give a concrete selection rule for which changes get human eyes, and Block's practice of reserving humans for 'ambiguity, risk, system impact, product intent' gives a rule for what stays human. Still no numeric sampling-rate formula or representativeness guarantee, so the gap narrows rather than fully closes. - incompleteThe economics of the recommended stack are never priced. Running two-plus heterogeneous AI reviewers on everything, plus a human triage layer and strict deterministic gates, has a token and attention cost that is never set against the modest ~12% real productivity gain the same data reports β leaving open whether the review apparatus consumes the very productivity it is meant to protect.
Read next: Cost/benefit accounting for multi-reviewer setups (token spend per PR, false-positive triage time); whether heterogeneous review is cost-effective only when invoked sparingly at high-signal moments rather than on everything.
Closes gaps elsewhere
- From Async Code Reviews to Co-Creation Patterns Β· g7 β Supplies the AI-accelerated analysis that gap flagged as missing: when authoring time collapses toward zero while human reading speed is fixed, the authoring/review ratio inverts and async review becomes the dominant, wait-heavy bottleneck rather than the cheap step β quantified by 2026 telemetry (median review duration up 441.5%, zero-review merges up 31.3%). It also answers the gap's second branch β AI-assisted self-review is viable but only as a sensor, since a model cannot reconstruct intent.
- How GitHub Is Securing Agentic Workflows in Modern CI CD Systems Β· g1 β Directly addresses the rubber-stamp / capacity-overflow problem: names it (nobody chose to stop reviewing; reviewers could not keep pace, so code merged unread), quantifies it (Faros zero-review merges up 31.3%), and prescribes the deliberate response β risk-tiered human attention, evidence-required intake, strict deterministic gates, and a human owning the merge β so the safe-output review channel does not degrade into a formality as agent volume scales.
- The Orchestration Tax is You Β· g4 β Decomposes the previously-unitary 'judgement' the prior post treated as one indivisible lock: this doc separates the part that transfers to a model (line-by-line bug-catching, the boring 90%, first and second pass, heterogeneous AI reviewers) from the part that cannot (accountability, whether this is the right change to build, high-blast-radius gates, the behavior nobody specified) β exactly the horizontal-distribution analysis g4 said the 'one lock' framing foreclosed.
Related documents
- Have your agent record video demos of its work with shot-scraper video
- Five studies that are changing how I think about AI in software engineering
- AI coding creates two kinds of debt. You're only measuring one
- AI isn't making developers more productive β it's making them busier
- Writing Code vs. Shipping Code: Productivity Effects Across Generations of AI Coding Tools
- The Orchestration Tax is You
- The 8 software engineering metrics AI broke
- Podcast: Will Agentic AI Bring Fantasia's Sorcerer's Apprentice to Life?: A Conversation with Tracy Bannon
- The AI-Native SDLC playbook
- Cognitive Surrender