← Back to context

Comment by DavidYoussef

21 days ago

The article nails the core issue but I think misdiagnoses the solution space.

The problem isn't that AI code review exists - it's that current tools are solving the wrong problem. They review code that humans wrote. The actual crisis is reviewing code that AI wrote.

  When AI increases code volume by 10x but reviewer count stays flat, you
  don't need better review tools. You need risk triage. Not every PR deserves
  the same attention:

  - Typo fix to a README? L0. Auto-approve with an evidence log.
  - New utility function with tests? L1. One model scans it, posts findings.
  - Changes to auth middleware or payment flow? L3. Three models have to reach
    consensus before a human even looks at it.
  - Production deployment config? L4. Models + mandatory human sign-off.

  We've been building this (codeguard-action on GitHub, MIT licensed) - a
  GitHub Action that classifies PR risk, runs multi-model review proportional
  to that risk, and produces a cryptographic evidence bundle proving what was
  checked. The evidence is hash-chained and independently verifiable offline
  with a separate tool.

  The point isn't to replace human reviewers. It's to stop burning them out
  on L0-L1 changes so they have capacity for the L3-L4 ones that actually
  matter.

  The 786-PR-backlog problem mentioned upthread isn't a review problem. It's
  a triage problem.