Gate the Patch, Not the Model: A Three-Check Loop for Untrusted Code Outputs

<p>My build passed on my laptop. It died on a free server in 40 seconds.</p> <p>Same code. Same lockfile. Same commit hash. So what changed?</p> <p>The answer is boring and

<p>The pull request looked finished. Twenty-three files. Tests green. A free coding model had been left on the ticket overnight. Then a reviewer opened

<p>Your AI system isn't going to crash. It's going to drift.</p> <p>A recommendation engine making 1.4 model calls instead of 1. A retrieval pipeline fetching 5 chunks instead of

<p>Same-session tests are not evidence. If an agent writes a production hunk and the assertions in one pass, a green build often means the two files agreed on a private story, not

<p>A recorded expected value is a leak. An agent that can read <code>assert f(x) == y</code> can patch <code>f</code> until that line is green and leave every unlisted input

<p>A green check is a local fact. Merge is a promotion.</p> <p>If you let an agent-written diff jump from “tests passed on my laptop” to <code>main</code>, you skipped three

<p>Four agents entered an infinite loop in November 2025. They ran for 11 days. The bill was $47,000. Nobody noticed until it was over.</p> <p>The team was running a market

<h1> How I Built an AI-Powered Code Review Bot That Saves 10 Hours/Week—Here's the Cheapest Way to Deploy It </h1> <p>My team was drowning. Every pull request meant 20-30 minutes