I gate on what a test suite can check

An assistant I built for an Architecture Decision Review Board could hit Submit on the form. I would gate that. The fleet that builds my software is specced to open and ship its own pull requests untouched — today it should auto-deploy everything. The difference is not the size of the action. It is whether the outcome can be checked mechanically.

engraving of a double-ended cylindrical plug gauge resting at a diagonal, two stepped cylindrical ends of differing diameter joined by a knurled, cross-hatched grip band in the middle

The board’s Submit is a business process, and there is a lot more subjective nature to that. A bug fix is the other thing entirely: you know the inputs, you know the expected output, and after the entire test suite runs, if it works you should be able to ship it. Verifiability drew that line. Consequence did not.

Review does not scale with generation. When AI helped me one function at a time, I read the code. At ten thousand lines a card, are you going to read all of it and understand it as if you wrote it? No — so the review moves out of my reading and into the systems that write, test, and validate. You have to trust these systems, and there’s no other way around it.

My own scar cuts against that. The night my fleet ran away, nothing I built stopped it — the vendor’s five-hour usage window ran out and the agents went quiet. The governor of last resort was someone else’s quota. The field is more careful on purpose. Claude Code, the tool I build with, blocks production deploys in auto mode by default — and merging a pull request no human has approved.

In my own shop I pay for the downside. If we burn a whole lot of tokens, then fine, we burn a whole lot of tokens. At a client boundary the arithmetic changes: I would certainly be reviewing everything I ship to them. That review thins as the system gets solid enough that it surfaces issues and I manage issues, not gruntwork.

Fig. 01 — Verifiability drew the line, not consequence: everything with a mechanical check ships, and only the board's Submit — a business process — lands past the gate. At a client boundary the same gate moves to the far left and everything gets reviewed.

A bad merge does not falsify this — a bad merge is another card, and I keep moving forward. What would falsify it is losing access to the models — then I would have to sit down and figure out how the code was written. The risk I carry is dependency, not correctness. As long as I’ve got tokens to burn, I’m going to keep trusting these systems.

More writing

I don’t know if the air cover was real
Cover is local: a direct leader's willingness backed one level up, not an executive's presence
Newer · Sep 2026

My eval is the health check
The eval that gates my deploys doubles as the health check, real dependencies included
Older · Sep 2026

Start

Tell me what’s stuck

I’ll tell you in about a day whether I’m the right person. The first conversation is fit, not a free architecture review.