Agents implement, humans gate

The debate about AI and software engineering keeps collapsing into two camps: autocomplete with better marketing, or the end of programmers. Our production system is neither. Agents write most of our first-pass code. Humans review every diff and perform every merge. The interesting part is not the agents. It is the harness that makes their output safe to ship.

This is not a pilot program. The platform this blog describes ships this way. So did the blog.

The loop

A ticket goes to an agent. The agent implements in an isolated worktree with the same setup a person gets: the repo conventions, the build, the test suite, the pre-commit hooks. When it believes it is done, the automated gates run: type checks, tests, linters, structural rules. Only then does a human see the work, as an ordinary pull request, reviewed line by line. The human merges it or sends it back. The agent has no merge rights, anywhere, ever.

The gates do not care who wrote the code

Every rule we enforce on people is enforced on agents by machinery rather than trust. A file size cap recently stopped an agent mid-feature and forced a growing module to be split into focused ones, which is exactly what it should force a person to do. A dead-code checker rejected an unused export in pre-commit. Commit conventions, secret scanning, accessibility rules on icons: all mechanical, all blind to authorship.

That symmetry is the design. The moment agents get a softer path than people, the review bar is theater.

Where it fails, honestly

Agent failures are rarely dramatic. They are plausible. A recent change double-escaped an apostrophe inside a string literal, which silently terminated the string; the type checker caught it before a human ever looked. Hand-computed diagram coordinates once printed two labels on top of each other, which no static check can see; a mandatory visual preview caught that one. And agents faithfully amplify whatever conventions the codebase actually has, including the ones you regret. A tidy repo gets tidy agents. The reverse is also true.

So the defense is layered by failure class: typed content that refuses to compile when a claim drifts, tests that pin behavior, hooks for the mechanical, preview for the visual, and a human for the judgment. The bottleneck moved from writing code to judging it. We think that is the correct place for the bottleneck to live.

Why bother

Because it expands what we can ship without lowering the bar. The posts on this blog, their figures, the feed behind them, and the tests pinning all of it went from tickets to production in days, every line reviewed by a person. The same loop maintains the platform those posts describe.

The uncomfortable version of the claim is that the agents are not the asset. Anyone can run agents. The asset is the harness: the gates, the conventions, the tests, and reviewers who refuse to move the bar. Which is the same belief that shapes everything else we publish here: a check you can run beats a claim you are asked to trust.