Stop reading every line; keep the judgment
Agent-written code broke the old bargain. Review used to be
how a team shared understanding and caught mistakes at a human
writing speed. Agents write faster than anyone can honestly
read, and the leftover ritual—approve the giant diff, leave a
style comment, merge—creates three failure modes that look
like diligence. Shared misunderstanding: author and reviewer
both nod at a fluent summary neither could reconstruct.
Complexity ratchet: each “working” PR adds a table, a service,
or a queue that is cheap to generate and expensive to unwind.
Nerd-sniping: the review finds twenty optional problems and
ships none of the original job. Humans are not unnecessary.
Product intent, taste, and irreversible calls still need a
person who will stand behind the sentence. Routine correctness
auditing does not.
Replace line-by-line browsing with a quality system the agent
can fail in public. Start with a contract: goal, non-goals,
interfaces, and a checkable done. Score findings by risk, not
by how clever they sound—data loss, security, and broken
invariants beat naming. Encode the contract as tests the
author did not get to write alone: properties and invariants
on the core, plus mutation testing so a green suite that the
agent authored cannot congratulate itself. Add an architecture
and scope check that asks what new dependency, table, or
privilege appeared, and refuse unexplained surface area. Then
demand runtime or device evidence for anything a user will
touch. Anti-gaming is part of the design: the model must not
own both the implementation and the only oracle that says it
worked.
Give reviewers a stop condition. A finding budget—three
blockers, a handful of P1s, everything else later—beats “find
every possible problem,” which is how reviews invent a second
product. When the remaining risk is cheaper than another hour
of comments, ship. The human gate is now: does this still
match the product we meant, and is the proof of correctness
stronger than a chat log? If yes, you do not owe the diff a
close reading. If no, send it back with a smaller contract,
not a longer comment thread.
Checklist
-
Before the agent runs: write goal, non-goals, interfaces,
and a done-check that is not “looks good.”
-
Reject any PR the author cannot explain without pasting a
model transcript.
-
Risk-weight findings (P0 data/security/invariants, then
behavior, then style) and enforce a finding budget.
-
Require invariant or property tests on the risky core;
mutation-test that suite so agent-written checks cannot be
the only oracle.
-
Diff the architecture: new tables, services, privileges, or
network paths need an explicit why or they do not merge.
-
Attach runtime or device evidence for user-facing paths;
green unit tests are not a ship certificate.
-
Stop when remaining risk is cheaper than more review—file
leftover nits, do not grow the change.
This week: pick one agent workflow, write a one-page contract
plus a finding budget, and refuse to line-read the next diff
that arrives without both.