Pinned Tweet
Most codebases fall into a majority-rework band.
The largest group has rework rates between 50% and 70%. Fewer than one in ten remain below 30%.
Low rework is the exception, not the norm.
Moving engineering judgment upstream means defining intent and acceptable tradeoffs before coding starts.
That’s only half the solution. Those decisions need to persist through implementation, review and production. Here's how we think it should work:
Where does that connection break down for your team?
Agent code is everywhere now: SDKs, hooks, configs, plugins, skills, MCP servers, CI.
Every one of those has a new way to bake-in security.
Baz now runs a dedicated agent-security reviewer on every PR that touches agent code.
baz.ai/resources/blog/agent-…
"Why can't we just build this with Claude?" We heard it all week at @WeAreDevs . Getting a model to review a diff isn't hard. We've learned firsthand that the hard part is everything around it:
- One policy, emitted as AGENTS.md, Cursor rules, and Copilot instructions, so the agent in the IDE and the agent in CI follow the same constraints
- Workflows to check against the ticket and the spec, not only the diff
- Records of the run: which tools fired, what context they pulled, why the comment was published, and what the run cost
- Repo-wide security scans, not just the pull request, with file, line, severity, and confidence on each finding
- Fixes that close the thread only after they match the original comment and CI is green, with the commit, the rule, and a revert attached
- Maintaining the same record for planner, reviewer, fixer, and merger runs, so a new agent type does not mean a new black box
If your team built review in-house, what held up and what are you still maintaining by hand?
Houston, we have a problem. 👾
We asked #WeAreDevs: AI wrote it. Who reviews it?
27% said aliens. We have so many questions...
So, we’re taking the board international. Follow along to see who developers around the world trust to keep their AI-written code in check.
#TrustFallCode
You can't 10x one part of the SDLC without rethinking the system around it. AI accelerated code generation. What has to change because of it?
We’re putting that question on the table at @WeAreDevs.
Join fellow engineering leaders to compare notes.
Sept 25 · 10–11 AM PT
Save your seat ↓
wearedevelopers.com/world-co…
#wearedevs
San Jose, we’re coming for your pull requests (and more). Baz is headed to @WeAreDevs World Congress North America.
Find us at Booth 756:
→ Bring a repo
→ See Baz review it
→ Get a free 2-week trial
→ Leave with ✨ light-up keycaps ✨
Sept 23–25. See you there!
#wearedevs
baz retweeted
Had to take Jev to a test drive. Took 1 specific part of our process - assigning severities to findings - and the pretty inital results are crazy.
14x cheaper and 23x faster, and almost 90% accuracy with minimal tweaks is amazing.
Nice work @typesafeai !
Tonight’s question: what happens to Agile when multiple agents are working in the same repo at once?
@guysenkot is digging into it at AI Native Dev NYC with @tessl_io .
We have some opinions... What’s yours?
baz retweeted
One very interesting thing about code reviews starting to fade in many places:
I still remember how, as a manager, code reviews would be one of the places where conflict between individuals or teams would be very EASY to spot for me, as a manager (then figure out how to deal with it).
What happens when there's not much of this code review happening? Does it mean there's no longer any conflict (or interaction?) between devs on the same team, or between teams?
As a broader question: are AI agents drastically changing team dynamics? Or just hiding them? They sure feel they are reducing human-to-human interaction via the code, I'll be honest
baz retweeted
Did a PR to one of our upstream projects and they requested some minor changes.
What’s even the point with this workflow? You already wrote the prompt, why make me ping my agent again so your agent then merges?
baz retweeted
How I do code reviews these days: more code = more selective human review i.e. don't read all the code.
1. Every PR gets a multi-agent first pass. It should find bugs, verify them, rank by severity, suggest fixes. Approval stays a human call on anything that matters.
2. Low blast radius changes on less sensitive code (there's often a lot!) can skip a deep human review once that review is clean. This helps keep the explosion of PRs manageable.
3. Core / sensitive paths still need an owner and human sign-off. That's where you spend time: verification, constraints and earning trust in what the agents can safely cover. You want to keep recoverability.
Agents do the first pass and humans cover blast radius.
Great question from @GergelyOrosz!
baz retweeted
Honestly spending time on creating good e2e tests is the best thing you can do to ensure your agents don’t generate stuff that breaks, these tests help agent’s catch things that break so frequently and allow you to be confident and still move at high velocity
baz retweeted
What techniques do you use for making AI-authored PR's easier to review?
- I.e. use /show-me by @dexhorthy for easy-to-read diffs
- Describe the changes in pseudocode
- Mermaid diagrams
- Evidence of TDD
The wildest version of this I've heard is @dctanner's agent, who uses Playwright to record a video of the frontend feature working with text-to-speech over the top. So the agent literally talks you through its change.
baz retweeted
Getting a fix out fast has always been a goal for engineering orgs
Feature flags beat merging and deploying a fix every time
baz retweeted
Highly agree - haven't reviewed a pr in months
Guardrails I use:
- pre commit hooks using husky: check for lint, prettier, formatting etc
- full suite e2e (playwright) test pre-commit hooks
- Codex is great at computer use so helps a lot with actual QA testing, like actual manual testing
- @greptile
- lots of o11y (@sentry @BetterStackHQ) and setup alerting to a slack channel
- ci pipeline covering typescript checks, app build and Postgres build with migrations (this one is so important)
- lots of meaningful unit, integration and regression testing coverage that run in ci
- evals for skills
- e2e (playwright) testing in ci (smoke tests)
Yep my gh actions go brrr but I ship with confidence. Let's me focus on building
We ditched code review at @DuckbillHQ (mostly)
About a month ago, we found ourselves with 60 open PRs for a team of five. They had been accumulating for a few weeks and we all had the sudden realization we were looking at two days of just code review.
baz retweeted
Still reading the code, differently from before.
I use autofix to automatically iterate on any AI code review comments.
Once ready for me, I am mostly looking at the architecture and abstractions of the changes.
- how does this solve the problem at a high level?
- Do the pieces of the change make sense? - Do the interfaces match the problem and seem coherent?
- is this the appropriate level of complexity for the problem?
- is there any database concurrency write issues?
- reading any critical logic
Ci and lint enforce mandatory test coverage, any known anti patterns / problematic code and various other static analysis things.
Stacked PRs are helpful for streamlining this process as the total amount of files to focus on is much smaller.
Above all, I trust in my monitoring and ability to quickly address and rollback an issue should there be one, as there eventually will be.
baz retweeted
more code → more selective review, not necessarily less review. ideally that's how it should be
some ways to make your job easier:
- automate the obvious stuff. prettier/ESLint for formatting & linting, CI for tests/type checks, dependabot for dependencies, snyk/codeQL for security checks
- more attention is ideal when there's higher risk for eg: a 20-line auth change can deserve more scrutiny than a 500-line UI refactor
- go deep on the irreversible stuff like data migrations, APIs, architecture, permissions, infra, business logic
- keep the prs small because smaller diffs will make meaningful review dramatically easier