I looked at a feature a colleague shipped last week, and it was wrong in the ways I would have predicted. Not broken, just built on shortcuts I knew we would pay for later. I had no time to spare, and reopening the decision would have taken a meeting, a design argument, and most of a sprint. So I said nothing, and his version became the version the team now supports.

This is how the standard on a team actually gets set: not by what anyone agrees is correct, but by what someone was willing to ship before the rest of us could object.

The interesting question is not whether the work was bad. The interesting question is why bad work, once shipped, almost never gets undone, even when everyone quietly knows it is bad.

“Done” Changes the Question

#

Before the work exists, the question on the table is “is this the right approach?” Once it ships, the question quietly becomes “is it worth fighting to change this?” Those are different questions, and the second one is almost always answered no.

The reason is not that the work got better when it merged. It is that reversing it now costs something it did not cost before. You have to schedule a conversation, justify the rework to someone who already feels they finished, and spend a credibility budget you were saving for your own work. Letting it stand costs nothing in the hour you notice it. So you let it stand, and so does everyone else who noticed.

A piece of work does not have to be good to survive. It only has to be done, because done work turns a technical judgment into a political cost, and political costs are paid by the person who raises them.

The Cost to Object Is Concentrated. The Cost to Absorb Is Hidden.

#

The whole pattern rests on this one asymmetry.

Objecting to bad work is expensive in the moment, and you pay the full bill yourself. It is your afternoon, your difficult conversation, your reputation as the person who slows things down. The benefit of objecting, if you win, is spread across the team and across the next year, and most of it lands on people who will never know you fought the fight.

Absorbing the bad work is the opposite. It is free in the moment, and its cost is distributed across the whole team and deferred into the future, where it shows up as the friction of working around a decision nobody loved.

Faced with a cost that is large, immediate, and personal, against a cost that is small, deferred, and shared, almost everyone picks the second one. That is not laziness. It is a rational response to badly priced incentives.

The bad call survives not because anyone thinks it is good, but because the person who would have objected was busy, and objecting then would have cost them their afternoon, and they did not have an afternoon.

The Bar Drifts to the Most Willing Shipper

#

Once you accept that done work is sticky and objection is expensive, a consequence follows that most teams never state out loud.

The effective quality bar is not set by what the team agrees is correct. It is set by whoever has the lowest bar and the highest willingness to act first.

If you ship before anyone can object, your version becomes the default, and the default is what everyone else now has to spend energy to dislodge. The person who cares about doing it right is at a structural disadvantage. Doing it right takes longer than doing it fast, and by the time the careful version is ready, the fast version is already the reality.

The disadvantage compounds. Other people copy the shortcut, because the shortcut is now the pattern the codebase rewards. The exception becomes the convention. A year later, nobody remembers that the pattern started as a shortcut someone shipped under deadline. Defending the shortcut has become the team’s default position, because that is what defaults do.

Teams do not converge on their best engineer’s standard. They converge on whatever the most active shipper leaves behind, and they call it the way things are done here.

The Cost Was Never Avoided. It Was Moved.

#

Every time a team absorbs bad work, it tells itself the absorption was free. It was not.

The cost was simply transferred, from one person’s afternoon of objection to the whole team’s months of working around the decision, and from a bill addressed to the moment into a bill addressed to the future.

Then the rework arrives, and it is always larger than the objection would have been. By the time the shortcut finally breaks badly enough to force a rewrite, other code has been built on top of it, the original author has moved on, and the team is paying to redo work it already paid to do once.

This is the cruel accounting of absorption. It looked like the cheap option only because its invoice came later and was addressed to someone else. Paid in full, with interest, by whoever is still standing near the code when it finally fails.

The Decision Was Usually Unsound for a Reason

#

It is worth noticing why the shipped work is so often the wrong call, because it is rarely because the author was incompetent.

The person who ships first is usually optimizing for the thing in front of them, getting something working, hitting a deadline, unblocking a demo. The costs they are creating live somewhere they cannot see: in the downstream maintenance, in the constraints they did not know about, in the parts of the system their shortcut quietly contradicts.

They made a locally reasonable decision that is globally wrong. Nobody was in the room to add the global view, because the work was already done by the time the people who held that view heard about it.

The person closest to the keyboard is rarely the person closest to the consequences, and shipping first lets them decide for everyone without ever holding the cost.

The pattern is not only a problem with AI-generated code, though cheap generation has made it worse. It is the older and more general problem of whoever acts first setting the default for everyone who acts later, and it applies just as cleanly to a human’s rushed pull request as to a model’s confident output.

What to Do Next

#

You cannot make objection free. You can make it cheap enough that it happens before the bad work hardens into the default, and that is where the leverage is.

Object in writing the moment you see it, even if you cannot fix it now. A single line saying “this shortcut will cost us in X” takes two minutes, costs almost no political capital, and does two things at once. It puts the author on notice that the decision was not unanimous, and it leaves a record so that when the cost arrives later, the pattern is traceable instead of invisible. The absence of objection is not consent. It is a measure of how busy everyone was, and writing it down stops that absence from being read as agreement.

Price the absorption out loud. When you absorb bad work to keep moving, say so, and say who will pay: “I am taking this as-is to hit the date, and we will redo it next quarter, and that rewrite is the cost of shipping it now.” Naming the tax prevents the team from pretending the absorption was free, which is the fiction that lets the pattern repeat.

Lower the cost of the conversation. A ten-minute “I would build this differently, here is why” is cheaper than a rework, and cheaper than the resentment that builds when you say nothing for six months. Most engineers respond well to a specific, early objection, and badly to a vague, late one, so timing matters more than wording.

Make the shipper own the consequences for a window. The person who shipped the shortcut stays on the hook for the bugs it produces, instead of routing them to whoever happens to be nearby. This does not require blame; it just re-attaches the cost of the decision to the person who captured the benefit of shipping it, which is the alignment the current default removes.

And if you are the one who shipped, treat silence as the weak signal it is. “Nobody objected” does not mean everyone agreed. It means everyone was busy, and the most accurate reading of a quiet merge is that you got away with it, not that you were right.

The standard on a team is set by what survives, and what survives is whatever was too expensive to undo. If you want a higher standard, do not ask people to object harder. Make objection cheap, make absorption visible, and make the cost of shipping bad work land on the person who shipped it, and the bar stops drifting on its own.

See also

#

• The Cost of Work You Did Not Choose - the inverse of this pattern: work handed to you to finish, where here the work is already done and you inherit the burden of supporting it
• Who Maintains the Slop? - the AI-era intensification of the same asymmetry, where cheap generation lets the producer capture the benefit and the maintainer pay the cost
• Distributed Product Management: Cheap to Decide, Costly to Undo - the same cost asymmetry at the level of product direction, where cheap decisions accumulate faster than they can be corrected
• Defects Flow Downstream, Fixes Must Flow Upstream - why the rework tax on absorbed bad work always exceeds the cost of fixing it at the source
• When a Closed Decision Reopens - how to make a decision durable in writing; here the decision never became durable because it never got properly made

References

#

• Wikipedia, “Status quo bias” - the cognitive preference for the current state, which is why shipped work survives even when everyone knows it is wrong
• Wikipedia, “Default effect” - the tendency to accept whatever is already in place, the mechanism by which the shipped version becomes the standard
• Wikipedia, “Principal-agent problem” - the split between the person deciding to ship and the people bearing the maintenance cost
• Wikipedia, “Technical debt” - the deferred, compounding cost of the shortcut, which arrives later as rework
• Wikipedia, “Loss aversion” - why the concentrated cost of objecting feels larger than the amortized cost of absorbing, even when the absorption costs more overall

Distributed product management is what happens when there is no dedicated product owner, and the people building the product also decide what the product should be. Each engineer, or each small team, makes product calls inside their own area, and those calls aggregate into the product without anyone coordinating the whole. The arrangement removes a real bottleneck, the single product manager, and it removes something less obvious at the same time: the friction that used to force independent decisions to agree with each other. In the age of LLMs that friction is already gone, which is why a structure that used to be merely risky has become quietly destructive.

What Distributed Product Management Actually Is

#

The dedicated product owner is a specific role: one person who holds the product’s direction, decides what gets built and what does not, and is accountable when the result is incoherent. Distributed product management dissolves that role and spreads its responsibilities across the engineers doing the work.

It shows up in a few familiar forms. Small teams that never hired a product manager and let the founders or lead engineer set direction. Open-source projects, where maintainers decide what to accept and what to build, with no owner above them. “Empowered teams,” in the sense Marty Cagan describes, where a cross-functional team is given a problem to solve rather than a feature to implement, and the team decides the solution itself. And, increasingly, engineering cultures where LLM-assisted development has made shipping so cheap that waiting on a product decision feels slower than just making one.

In all of these, the same property holds. The person deciding what to build is the person building it, and there is nobody whose job is to keep the pieces coherent.

The Case For It

#

The merits are real, and I do not want to understate them, because they explain why the arrangement is so common.

It removes a genuine bottleneck. A single product manager is a single point of coordination. When they are slow, blocked, or absent, the whole team waits. When there is no owner in the path, decisions move at the speed of engineering.

Decisions sit with the people closest to the problem. The engineer implementing the feature usually has more context about the technical reality and the user’s actual behavior than a product owner who learned the domain second-hand. Moving the decision to where the context already lives avoids a translation step, and it avoids the gap between a spec and what the spec was supposed to mean.

Ownership produces motivation. People who decide what they work on care about the work in a way that people handed a task do not, a cost I have felt directly in finishing work I did not choose. Distributed product management lets engineers keep that investment.

It scales without growing an organization. A dedicated product owner has a finite span of attention. As a product grows, either the owner becomes a bottleneck or you have to hire and coordinate more of them. Distributed product management scales with the number of engineers by default.

Each of these is a good argument. Together they explain why the structure keeps reappearing, and why it often works well for a while.

The Case Against It

#

The problems are also real, and they take longer to show up, which is why they are consistently underestimated.

The product loses coherence. A product is a system of decisions that have to agree with each other. When each decision is made locally and optimally, the result is a local optimum: every piece is reasonable on its own, and the whole is worse than any of its parts. Two engineers build two ways of doing the same thing. A new feature uses a pattern that contradicts the one shipped last quarter. The surface area grows, and nothing ties it together.

Nobody owns the whole. Coherence is not a side effect of good local decisions. It is a separate concern, the job of noticing the global pattern and sacrificing a local win when it would break that pattern. Without an owner, that job has no home, which means it does not get done. This is the tragedy of the commons applied to a product: the shared surface that everyone uses and nobody maintains.

Nobody is paid to say no. The hardest part of product work is deciding what not to build. A dedicated owner can kill a feature because they are accountable for focus. An engineer building in their own area has no incentive to decline their own idea, and no authority to decline anyone else’s. The result is feature accumulation, the same failure mode that turns a backlog into a dumping ground, except it ships directly into the product.

Cross-cutting decisions have no owner. Some decisions only make sense globally: the pricing model, the data model, the API conventions, the identity of the product. These decisions occasionally require one team to accept a worse local outcome so the whole can stay consistent. Distributed product management has no mechanism for that trade, because no one is authorized to impose a cost on one part to benefit another.

The strategy drifts, silently. When every team optimizes for the metric in front of it, the product as a whole drifts toward whatever those local metrics reward, and that direction is rarely the one the company would have chosen deliberately. This is Goodhart’s law at the level of the product roadmap: each local signal looks reasonable, and the aggregate stops pointing anywhere worth going.

The common thread is that distributed product management is excellent at producing decisions and bad at producing a coherent product. For a long time, that trade was manageable, because the cost of building kept the decision rate low.

Why LLMs Make the Trade Worse

#

Here is the part that has changed.

The friction that used to keep distributed product management tolerable was the cost of implementation. Building a feature took days or weeks, and that cost forced a conversation before the work started. An engineer who wanted to ship something had to justify the time, coordinate with the people whose work it touched, and get the change reviewed. The friction was accidental, but it was doing useful work: it throttled the rate at which independent decisions could accumulate.

LLMs have removed that friction. An engineer who wants to ship a feature can now spec it, generate it, and open a pull request in an afternoon, without asking anyone whether the feature should exist. The cost of making a product decision and the cost of the decision’s consequence have been decoupled. The first one collapsed toward zero. The second one did not.

This is what makes distributed product management destructive in the current era rather than merely inefficient. When decisions were expensive, an incoherent product was a slow problem that you could notice and correct. When decisions are nearly free, the incoherence arrives faster than any human can track it, and the cost shows up downstream: in a codebase nobody wants to touch, in a feature surface nobody can fully use, in the slow accumulation of a house of cards built from locally reasonable additions.

The deeper problem is that cheap decisions change who decides. When a product decision required a meeting, the decision belonged to whoever ran the meeting. When it requires only a prompt, the decision belongs to whoever types first. That is a change in governance disguised as a change in speed, and most teams have not noticed it happened.

It is worth saying what this argument is not claiming. It is not claiming that engineers are bad at product judgment. Many are excellent at it, and the bottleneck has moved toward exactly that judgment as implementation has been automated. It is claiming that good individual judgment, applied independently and at machine speed, with no coherence layer above it, produces a worse product than the same judgment applied inside a shared frame.

The Real Question Is Which Decisions to Distribute

#

The way out is not to bring back the single product manager as a gatekeeper. That would reintroduce the bottleneck distributed product management was right to remove. The way out is to notice that “product decisions” is not one category, and that the right structure differs by decision type.

A useful split comes from the one-way door versus two-way door distinction. Some decisions are reversible. If you ship the wrong notification wording, or pick the suboptimal layout for a single screen, you can change it next week with low cost. These decisions should be distributed, because distributing them removes friction without risking much.

Other decisions are effectively irreversible. What the product is, which problem it solves, which abstractions it commits to, how the pieces fit together, these set the trajectory of everything built on top of them. Once a thousand features depend on a data model, the model is no longer negotiable. These decisions need a single owner, not because the owner is smarter but because coherence requires that someone be able to choose the global over the local.

The failure mode of distributed product management is not that it distributes decisions. It is that it distributes the irreversible ones along with the reversible ones. Most teams that suffer from “no product owner” are actually suffering from no owner for the small set of trajectory-setting decisions, while the reversible ones are handled fine. Diagnosing which set is causing the pain is more useful than arguing about whether to have a product manager at all.

What to Do Next

#

If your team operates without a dedicated product owner and the product is starting to feel like a patchwork, a few concrete moves help.

Write the product direction down, in one place, and keep it current. This is the single highest-leverage action, and it is the same lesson as breaking the scope relitigation cycle: a direction that lives in heads cannot survive contact with the next person or the next quarter. A short, written north star, the milestones you are committing to now, and the constraints that forced the compromise, give distributed decisions something to check themselves against. Without it, every engineer is optimizing for a slightly different product that exists only in their head.

Separate the two questions explicitly. On every non-trivial decision, ask first whether it is reversible or trajectory-setting. Distribute the first. Force the second through a single decision-maker and a written record, even if that decision-maker is a rotating engineer rather than a hired product manager. The role matters less than the fact that someone owns it.

Encode product-level invariants the way you encode engineering conventions. The teams that keep coherence without a full-time owner are the ones that have externalized their standards into a form the work has to satisfy: style guides for the product surface, principles for which features are in scope, a definition of what the product is not. This is the same mechanism that lets a mature team scale its conventions into the model. A convention in a head is advice that gets ignored. A convention in a written principle is a constraint that gets enforced.

Keep a thin, intent-level review for product decisions, as a backstop and not a bottleneck. The point is not to gate every change. The point is to catch the small fraction of changes that are individually reasonable and collectively incoherent, the second implementation of an existing feature, the new pattern that contradicts the established one, the locally optimal choice that breaks a global invariant. This is the product equivalent of the intent check I keep on LLM-generated code: light by default, held back for the changes that carry real risk.

Reallocate the time you saved on implementation into judgment. The instinct, once implementation is cheap, is to ship more. The correct response is to decide more carefully, because the cost of being wrong has not come down even though the cost of acting has. Time spent on problem selection and direction now buys more than time spent on execution ever did.

The Dedicated Owner’s Real Job Was Coherence

#

Distributed product management is not wrong. It removes a real bottleneck, it puts decisions close to the context, and it scales without growing an organization. The mistake is concluding that because the dedicated owner was unnecessary, the thing the owner was doing is also unnecessary.

It was not. The owner’s real job was coherence: holding the whole product in one head, killing the features that did not fit, and choosing the global over the local when the two disagreed. Remove the person and you still have to keep the function, or accept that the product will be built faster than anyone can keep it coherent.

In an era when a product decision costs an afternoon and its consequences last for years, the scarce resource is no longer the ability to decide. It is the ability to decide in a way that still makes sense next to every other decision the team is making at the same time. That is the bottleneck distributed product management has to solve, and LLMs have made it urgent rather than theoretical.

See also

#

• The Shifting Bottleneck - why the constraint has climbed from implementation to deciding what to build, the exact layer where distributed product management lives
• Software Engineering Teams in the Age of AI - the team-level view of the same shift, and the case for specification as the highest-leverage skill once execution is cheap
• Feature Parity Is Not a Moat - the danger of accumulating shallow surface area, which undirected distributed decisions produce on fast-forward
• When a Closed Decision Reopens - the case for writing direction down so it survives the next conversation, the mechanism that lets distributed decisions stay aligned
• The Foundation Predicts the House of Cards - why encoded conventions and written judgment outrank tacit ones, applied here to product direction
• Backlog Management Best Practices - the discipline of saying no and keeping focus, the function a coherence owner was quietly performing

References

#

• Marty Cagan, “Inspired: How to Create Tech Products Customers Love” - the empowered-team model, the legitimate form of distributed product management, which pairs distributed execution with a strong shared vision
• Wikipedia, “Local optimum” - the formal version of the coherence problem: locally optimal decisions producing a globally suboptimal product
• Wikipedia, “Tragedy of the commons” - the dynamic by which a shared product surface, used by everyone and maintained by no one, degrades
• Wikipedia, “Goodhart’s law” - how optimizing local signals causes the product’s aggregate direction to drift away from any deliberately chosen target
• Wikipedia, “Disagree and commit” - the one-way door versus two-way door distinction that separates decisions which can be distributed from those which need an owner

The headline this month was llm-augmented-workflows carrying an issue all the way through to a human gate. Underneath the headline, the month spread into maturing the SDLC pipeline, reworking PR validation around visual proof, and shipping a wave of new skills.

What I Have Been Working On

#

Iterating on llm-augmented-workflows. The project is still rough, but it now moves an issue through real stages instead of demoing a single one. A cycle looks like this: an issue is created, it gets triaged, and the appropriate workflow runs until it hits a stage that requires a human. For feature requests, the workflow runs triage into a plan PR for review, and once the plan merges, continues to an implementation PR. For bug fixes, the flow goes from triage into a fix PR rather than stopping at reproduction. Triage is handled end to end, which closes a point I’d written about in earlier posts. I’m building it to support both human-gated and fully autonomous modes from the start, so the same flow can run with or without checkpoints.

Building github-board. github-board is a frontend-only web application, served directly via GitHub Pages, that lets you build columns and rows from any field on a GitHub issue or pull request. It turns issue and PR data into a configurable board view with no backend.

Adding the resolve-pr-conflicts skill. I now run the skill daily across the repositories I contribute to. It scans for my open pull requests that have merge conflicts and resolves each one in parallel, fanning out a separate agent session per PR into its own worktree. Each session merges the base branch, resolves the conflict markers, runs the project’s verification, and pushes, while ambiguous or verify-failing resolutions get aborted rather than guessed. The practical effect is that my PRs stay mergeable without me babysitting rebase loops.

Refactored the SDLC pipeline. Feature directories dropped the FEAT-NNNN- prefix for N-<slug>, and pending items now carry a p prefix with a promotion flow through create-placeholder-issue. The old questions.md drift log is gone, replaced by a review-verdict regression that sync-sdlc and backpropagate-sdlc track across phases. Review findings now persist to files instead of disappearing, and I slimmed the create-* family by roughly 750 lines by pointing each at templates and giving it a self-check checklist. Each phase skill is now explicitly loaded before it runs, and a needs-assessment template joined the pipeline.

Reworked PR validation around visual proof. Visual proof capture moved out of create-pr into a dedicated validate-implementation skill, which writes a proof manifest before the PR is ever opened, so recording happens before creation rather than during it. Bug fixes now capture before/after recordings via reproduce-issue and fix-issue. And validate-pr and verify-pr now check against the issue’s acceptance criteria rather than the PR’s own claims, with body and footer split for GitHub attribution.

Shipped a wave of new skills. Slack and memory support landed with slackx and sessions-memory, which turns archived sessions into PARA memory. Team docs gained create-team-api and create-team-charter. Codebase upkeep got improve-codebase, improve-skill, sync-documentation, and sync-opinions. Planning expanded with create-goals, create-service-levels and their review-* counterparts, create-mockups, and create-placeholder-issue. Issue triage gained check-issue-status, check-issues-status, and check-linked-pr. Demo tooling arrived with research-topic, record-asciinema, and record-playwright.

Tidied conventions. gh-cached was replaced by ghx and removed, with every skill reference switched over. The dot-claude directory was renamed to agents. The AGENTS.md vocabulary now avoids “shape”, “honest”, and “load bearing”. SDLC status pages went mobile-friendly.

Experimenting with article-to-video. I started generating short videos from the articles I write, to post on YouTube and TikTok. The pipeline combines text-to-speech narration with visuals that follow the article’s content. The experiment is early, but it’s a plausible way to reach a wider audience with the ideas I’ve been working through.

Resolved from last month. Scheduled issue-to-PR automation (#8) and automatic context clearing between execution and review (#9) both landed through llm-augmented-workflows. The automation was generalized beyond OpenChamber, and the context clearing came free because each phase runs in its own session. Skill usage tracking (#7) is handled after I extended agentsview to collect skill-usage statistics from its SQLite database. Because the data is queryable, an agent can search session logs for skill calls and extract which skill ran, and the same approach works across every harness agentsview supports. Reliable bug reproduction comments (#10) are handled by llm-augmented-workflows, which can enforce an expected outcome and, when the agent doesn’t deliver it, resume the last session and ask again. The llm-augmented-workflows flexibility rework is done. I’ve also fully switched to opencode, though support for other harnesses isn’t there yet.

Partial progress. The SDLC status report got significant improvements, but a status script in TomzxCode/sdlc now duplicates the report and drifts out of sync with the agents-repo skill. Loops only run at the start and end of day, week, and month so far. The lowest-hanging fruit I haven’t picked is auto-running validate-pr, verify-pr, and review-pr on PRs waiting on me. And validation of other people’s changes is now covered by validate-pr and verify-pr, but for my own changes I still default to manual testing instead of delegating to an agent.

What I Currently Need

#

Five needs from earlier months are still open.

• Memory that agents manage automatically, which I keep delaying for reasons I can’t pin down.
• The accuracy pass on daily summaries, where nothing has moved.
• Contextual Slack support, which still has no workflow.
• Automated triage follow-up conversations, untouched because I rarely use that skill.
• Routines and event-driven triggering, still unstarted.

Clarity on verdict propagation. I need to confirm how a verdict (approve, reject, needs-changes) made at one stage propagates to downstream stages. Until I can trust that the right decision always carries forward, I can’t confidently run the autonomous path without a human checking each handoff.

A full pass on flow definitions. The flow definitions still have issues I haven’t fully mapped. I need a round of end-to-end testing to find where the definitions diverge from intended behavior, so the defects get fixed rather than worked around.

A faster path to implementation. For feature work, I need to figure out which SDLC steps can be safely skipped or compressed to reach implementation faster. The full chain is thorough but slow, and it’s still unclear which steps are essential and which are ceremonial.

State tracking for an orchestrator-only llm-augmented-workflows. Resolving the context-clearing need surfaced a bigger question: the engine could run as its own orchestrator instead of always anchoring on a GitHub issue. The blocker is that without an issue to hold state, the engine needs another way to track where a run is, and I haven’t decided what that state store should be.

A set of PDLC skills, mirroring the SDLC ones. At work I’m spending a meaningful share of my time on product management work, and I want the same repeatability there that the SDLC skills give to engineering. I need a structured set of product development lifecycle skills for discovery, framing, prioritization, and measurement, so the product side gets done properly and the same way every time rather than ad hoc.

See also

#

• What I’ve built and what I need: June 2026 - the previous entry in this series; July builds directly on its open needs.
• The Self-Evolving Repository - the broader vision of automating a GitHub project end to end with LLMs that llm-augmented-workflows is now realizing.
• Loops as Files - the scheduling layer that runs skills unattended, which underpins daily runs like resolve-pr-conflicts.
• The Importance of Context When Interacting with LLMs - why isolating context between phases matters, the problem the per-session design solves.

References

#

• llm-augmented-workflows - the engine driving the issue-to-PR pipeline described throughout.
• agents - the skill library where the SDLC refactor, validation rework, and new skills landed.
• agentsview - the session archive extended to track skill usage across harnesses.
• TomzxCode/sdlc - the static SDLC status pages, whose report script now overlaps the agents-repo skill.
• github-board - the frontend-only issue and PR board view shipped this month.
• ghx - the GitHub CLI that replaced gh-cached across the skill library.

A colleague handed me a task last week. The job was to take their work, get it running, and get it merged. I did not volunteer for it, and nobody asked whether I wanted it. It took me almost three days.

I want to be careful here, because the easy reading of this story is a complaint about a colleague, and that is not the interesting part. The interesting part is why a piece of work that should have taken hours stretched into days, and what that says about how work gets assigned. Work you did not choose takes longer, not because it is harder, but because nothing pulls you through it.

The Task Was Not Hard. The Task Was Not Mine.

#

The work itself was not especially complex. What made it slow was that I had no investment in it. I had not chosen the problem, I had not designed the solution, and I stood to gain nothing from its completion except the relief of being done with it.

There is a motivation tax on work you did not choose, and it is larger than most people account for. When a task is yours, the friction of a confusing codebase or a failing test is a puzzle you want to solve. When a task has been dropped on you, that same friction is an obstacle between you and being somewhere else, and every obstacle feels twice as tall.

The three days were not a measure of the task’s difficulty. They were a measure of the distance between me and any reason to care.

Finishing Someone Else’s Work Is Not Half the Job

#

There is a common assumption that handing off nearly-finished work is cheap, because the hard part is done. This is almost always wrong. Code that someone else wrote carries their hidden decisions: names that made sense to them, assumptions they never wrote down, edge cases they handled in their head and nowhere else.

To get another person’s work to a mergeable state, you have to reconstruct a mind you were never inside of. You become an archaeologist of their intent, reading commits like strata. And unlike your own code, where you remember why you wrote each line, here every unfamiliar line is a small investigation.

“Get this merged” sounds like a small favor. It is a request to absorb someone else’s unfinished thinking, under a deadline you did not set, for a result you will not own.

Distractions Stick When There Is No Pull

#

I noticed something during those three days that I would have missed if I had been excited about the work. Distractions did not just interrupt me. They rescued me.

When you are working on something you care about, a notification is an annoyance you dismiss. When you are working on something you resent, a notification is a permission slip to step away, and you take it every time. The work expanded to fill three days in part because every ping, every message, every side question offered a more appealing place to put my attention, and nothing pulled me back.

Distractions are not the enemy of focus. They are the enemy of focus on work you do not want to do. On work you want to do, focus defends itself.

The Real Failure Was the Hand-off

#

The colleague is not the villain of this story. What failed was the assumption that a task could be moved from one person to another by declaration, without a conversation about whether it should be.

When you assign work without asking, you are gambling that the person receiving it has the context, the capacity, and the motivation to carry it. You have checked none of those things. You have simply moved an item on a board and assumed the work would move with it.

The cost of that gamble does not show up on the board. It shows up in the three days, in the half-attention, in the quiet resentment that makes the next hand-off harder to accept. A task assigned without consent arrives already taxed, and the tax is paid in time.

What I Will Do Differently

#

I am not going to pretend the lesson is that I should have said no. In a team, sometimes you absorb work that is not yours, and that is part of the job. The lesson is narrower and more useful.

When work arrives by declaration rather than by agreement, I will name the motivation cost out loud, early. I will ask for the context I am missing instead of reconstructing it silently. And I will be candid, with myself and with the person handing it off, about what “get this merged” actually entails, because the favor is rarely as small as it sounds from the side that is handing it off.

Work you did not choose takes longer, not because it is harder, but because nothing pulls you through it. The friction was not in the task. It was in the absence of a reason to care.

See also

#

• Task overload - the moment you have more on your plate than you can handle, and how to re-prioritize from scratch
• task-stack - a tool for managing the interruptions and context switches that compound when you have no intrinsic drive to push through

A coworker ships a feature this week. The demo goes well, the metric moves, the credit lands on them. Six months later the feature breaks, and the ticket is assigned to you. You did not write it, you did not ask for it, and the person whose name is on the commits cannot explain it to you, because they did not write it either. They prompted it, you inherit it, and that asymmetry is the whole problem.

The slop handoff is not the ordinary handoff, where someone moves on and leaves their code behind. It is a new and worse kind, because the thing being handed off carries less recoverable intent than human code ever did, and the person handing it off has less of that intent to offer than the author of human code ever had. The slop producer walks away with the reward. The maintainer is left with the cost, and was never asked whether they wanted to absorb it.

Generation Is Cheap. Understanding Is Not.

#

The economics of AI-assisted code are lopsided in a way most teams have not priced in. Generating code is now nearly free, a prompt and a few seconds. Maintaining code has gotten cheaper too, because you can now ask a model to explain the code to you, but it has not gotten cheaper by nearly as much. Maintenance is dominated by understanding, and understanding, even with help, is still time-consuming in a way generation is not.

When the cost of producing something collapses while the cost of owning it stays fixed, you get a predictable result. People produce a great deal more of it than they are willing to maintain. This is the same dynamic economists call a negative externality: the producer captures the benefit and passes the cost to someone else who never agreed to pay it. In software, the river the cost gets dumped into is the codebase, and the people downstream are the maintainers.

The old discipline that held this in check was effort. Writing a feature by hand cost days, and that cost forced a conversation about whether the feature was worth building and whether the author was ready to live with it. Remove that cost and the conversation disappears, because the friction that produced the conversation is gone. The feature still costs days to maintain. It just costs someone else, later, in a currency the original author never had to spend.

The Author Is No Longer the Cheapest Maintainer

#

For a long time, software engineering ran on a principle that aligned incentive and responsibility cleanly. Amazon stated it as you build it, you run it: the team that creates a service operates it, because they understand it best, and making them own the consequences makes them answerable for what they ship.

That principle worked for a specific reason. The person who wrote the code was also the cheapest person to maintain it, because the act of writing it left a durable model in their head. “You build it, you run it” was efficient as well as just. The accountability aligned with the economics.

AI slop severs that alignment. The person who generated the code did not build a model of it in their head, because they did not build it. They saw the output, checked that it ran, verified that it did what they wanted, and moved on. They are not the cheapest maintainer anymore. Often nobody is. The maintainer who inherits the code knows neither the original intent nor the code itself, and the author who might remember the intent has nothing to say about the implementation that would help.

So the natural loop closes wrong. Instead of the builder owning what they built, the code drifts to whoever is left, whoever is downstream, whoever still cares about the codebase staying healthy. Maintenance becomes a tax on the people who care, levied by the people who do not.

The Defining Feature of Slop Is Missing Intent

#

It is worth being precise about what makes slop slop. It is not only that the code is bad, because sometimes the code runs fine and passes its tests. It is that the code carries no intent anyone can recover.

Human code, even messy human code, is full of traces of the mind that wrote it. Variable names that betray a mental model, comments that record a half-thought, a function split in a way that reflects how the author decomposed the problem. These are imperfect signals, and they are often misleading, but they are signals. When you inherit human code, you are an archaeologist working through strata left by a civilization that existed. This is what The Code You Will Never Read describes from the maintainer’s side: a growing body of code whose internals are opaque by construction.

AI slop is archaeology without the civilization. The patterns in it were not chosen by a mind that held the problem; they were chosen by a model selecting the most probable next token. The names are plausible, the structure is conventional, and none of it is evidence of a decision you can reconstruct, because no decision was made in the way a human makes one. You cannot ask the code what it meant, and increasingly you cannot ask the author either, because the author’s answer is the same guess you would make yourself.

Missing intent is what makes AI slop harder to maintain than the human mess it resembles. The mess is not the hard part. The hard part is that the mess came with nobody attached to it.

The Missing Ingredient Is Consent

#

The sting in the slop handoff is not only that the work is hard. It is that the maintainer had no say in any of the decisions that produced it.

They did not choose to build the feature. They did not choose its scope, its boundaries, its dependencies, its tradeoffs. They did not choose the abstractions it imposes on the codebase, or the patterns it will invite the next generator to copy. All of those choices were made by a person and a model who will not be present when the consequences arrive, and they were made without the person who will carry the consequences in the room. The maintainer inherits a set of decisions they were never party to, and is asked to own outcomes they could not influence.

The missing consent is the part that goes beyond “the task is annoying,” and it is why slop handoffs corrode teams faster than ordinary ones. I wrote about the motivation tax on unchosen work in The Cost of Work You Did Not Choose. The slop version of that tax is heavier, because the work is harder to understand and the handoff is more frequent. When being handed other people’s AI output becomes the norm, the people who maintain the codebase start to feel like janitors in a building they did not design and are not allowed to redesign, and that feeling is a leading indicator of people leaving.

The Generator Is Rational, Not Villainous

#

It is tempting to tell this story with a villain, the lazy coworker dumping their slop on the team. That story is satisfying and it is mostly wrong, and believing it will stop you from fixing the actual problem.

The generator is responding rationally to the incentives the team has set. The team rewards shipping. It does not charge for maintenance. It does not require ownership to persist after a feature lands. It does not ask whether the maintainer consents to absorb the code before it merges. Given those incentives, generating fast, shipping fast, and moving on is the behavior that gets rewarded, so it is the behavior that happens. You do not fix an incentive problem by asking people to be better. You fix it by changing the prices.

The mistake is to moralize what is structural. The slop producer is not failing at professionalism. They are succeeding at exactly what the system measures, and the system measures velocity, not the maintenance debt that velocity leaves behind. Until the system charges for that debt, the generator who slows down to own their output is not virtuous; they are slower than the colleague who does not, and they lose.

What to Do

#

The fix is to move the price back to where the benefit was captured. A few concrete moves, each of which closes a gap the current default leaves open.

Make intent travel with the code. The maintainer should inherit a specification, acceptance criteria, and the decisions that matter, not just a diff. When a feature lands, it lands with a written account of what it was for, what it was not for, and where the hard choices were made. The code is downstream of the spec, as Defects Flow Downstream, Fixes Must Flow Upstream argues, and the spec is the part that lets a future maintainer fix the source instead of patching the symptom. If the generator cannot produce that account, that is the signal that the generator did not understand what they shipped, and the merge should wait until someone does.

Make the generator sticky. The person who generates the code owns it for a window after it ships, the same way a human author would under “you build it, you run it”. You prompt it, you run it. Bugs in that module route back to the generator for a quarter, not to whoever happens to be nearby. This restores the alignment that cheap generation removed: the person who captured the benefit now carries at least the first round of the cost, which is the cheapest place to charge it.

Require the maintainer’s consent. No AI-generated change lands on a surface someone else owns without their sign-off. This is the one that feels heavy and is the most important, because it is the only move that gives the maintainer a say in the decisions that will become their problem. The owner of the affected code reviews the intent and the boundaries, not the diff. If they would not have chosen to absorb the change, they should not be forced to, and forcing them is what produces the slop handoff in the first place. This is the same intent-source question that decides who is qualified to act on a change in Who Resolves the Merge Conflict?: the person who can back the decision with intent they actually hold.

Price the handoff. If a slop producer does hand work to someone else, they owe that person context, tests, and time, not a working diff. The handoff is not complete when the code runs. It is complete when the receiver could explain the code to a third person without the original author in the room. Charge the handoff in the currency the generator tried to skip, which is understanding, and watch how much less slop gets produced when understanding is the cost of walking away.

Gate generation on ownership. Before AI code can merge, there must be a named owner who will maintain it. No owner, no merge. This is a trivial rule and it eliminates the worst cases outright, the drive-by generation that lands in a shared module and becomes everyone’s problem and no one’s responsibility.

The Real Failure Is Upstream

#

The pattern underneath all of this is the one Rethinking Code Review in the Age of LLMs reaches from a different direction: real responsibility lives upstream, in the decisions that guided the work, not in the person left holding the diff at the end.

The slop handoff is what happens when responsibility is allowed to drift downstream and settle on whoever is standing there when the code breaks. The generator made the decision to generate. The model made the decisions inside the code. The maintainer made no decision at all, and gets to own every one of them.

That is not a sustainable arrangement, and the people who notice it first are the maintainers, because they are the ones paying the tax. They will not keep paying it quietly. They will either push the price back upstream, where it belongs, or they will leave for a codebase where someone else has already done it.

AI did not invent the handoff. It made generation so cheap that handing the result off became the path of least resistance. The slop producer is not a villain; they are a rational actor in a system that prices generation at zero and maintenance at full cost. The fix is not to scold them. It is to put the price back where it was captured, in the currency that was skipped, which is understanding.

See also

#

• The Cost of Work You Did Not Choose - the motivation tax on work handed to you by declaration, which the slop handoff makes heavier and more frequent
• The Code You Will Never Read - maintaining code whose internals are opaque, the condition that makes AI slop harder to inherit than the human mess it resembles
• Defects Flow Downstream, Fixes Must Flow Upstream - the rule that the durable fix is upstream, which is why the spec must travel with the code so the maintainer inherits the source and not just the symptom
• Rethinking Code Review in the Age of LLMs - the argument that real responsibility lives in the decisions that guided the work, not in the person scanning the diff at the end
• Who Resolves the Merge Conflict? - the intent-source test for who is qualified to act on a change, which is the same test that decides who should own the slop

References

#

• Wikipedia, “Slop (artificial intelligence)” - the term for low-effort, mass-produced AI content, extended here to code that ships without recoverable intent
• Wikipedia, “Externality” - the economic frame for a cost imposed on a third party who did not consent, the model for slop as pollution of the codebase
• Wikipedia, “Tragedy of the commons” - why a shared resource degrades when individuals capture the benefit and socialize the cost, the codebase as commons
• Wikipedia, “Technical debt” - the accumulated maintenance cost deferred by fast generation, the debt the slop producer leaves behind
• Wikipedia, “DevOps” - the “you build it, you run it” principle that aligned authorship with ownership, which cheap generation unaligns
• Wikipedia, “Free rider problem” - the dynamic by which those who benefit without paying overwhelm those who carry the cost, the maintainer’s trap
• Wikipedia, “Principal-agent problem” - the mismatch between the person deciding what gets built and the person bearing the consequences, the structure of the slop handoff

“Zero touch” has been a goal in software-adjacent fields for over a decade. Networks provision themselves, deployments ship on green, and operations teams have been shrinking toward a vanishing point. The one stage that resisted zero touch was the engineering itself: deciding what to build, writing it, and deciding it is good enough to ship. That is the part LLM agents are now closing.

Zero Touch Engineering (ZTE): a change travels from an observed signal to a deployed fix with no human keystroke, no human review, and no human approval in the path. Zero touch engineering has a clear lineage in networking and operations, and that lineage explains why software engineering was the last holdout and what it takes to close the gap.

Where “zero touch” already lives

#

The phrase has a precise home, and it is not software development.

Zero-touch provisioning (ZTP) remotely configures network devices (switches, routers, access points) with no per-device manual setup, standardized by the IETF as Secure ZTP in RFC 8572. Plug a device in and it fetches its configuration, authenticates, and joins the network on its own (Wikipedia, “Zero-touch provisioning”).

The telecom world generalized the idea into ETSI’s Zero-touch network and Service Management (ZSM), a standards group formed in 2017 with the explicit goal of “100% automation” of operational processes, now actively working on closed-loop, AI-agent-driven architectures.

Closer to software, two more ideas occupy the same ground. NoOps, coined by Forrester in 2011, is the vision that IT operations becomes so automated that developers never need to talk to an operations engineer again. Continuous deployment removes the last human gate from delivery: every change that passes its checks goes to production, automatically.

Notice what these four have in common. Every one of them automates a stage that is deterministic. Given a desired state and an event, the correct action is fully specified. Provision this device. Deploy this artifact. Page this on-call. There is no judgment left to encode, because the procedure was already mechanical and we just had humans performing it.

That is exactly why none of them touched engineering. Engineering is the stage that is not deterministic. Deciding what to work on, judging whether a change is worth shipping, choosing between two reasonable designs: these are judgments, not procedures. You cannot automate a judgment you cannot first write down.

What “zero touch” actually requires

#

Most discussion of AI in software focuses on the wrong stage. It focuses on the agent writing code. That is the easy part, and it was never the part that made a process touchless.

A touchless process is a closed loop.

graph LR
    Observe --> Decide
    Decide --> Implement
    Implement --> Verify
    Verify --> Ship
    Ship --> Learn
    Learn --> Observe

Every stage must run without a human, and the output of the last stage must feed the first. Continuous deployment automates Ship. NoOps automates the runtime half of Observe and Learn. ZTP automates a specific kind of Implement. ZTE is what you call it when the entire loop closes, including Decide, the stage that requires judgment.

The agent writing the code is one sixth of the loop. If you automate Implement and leave a human approving the result, you have an efficient assistant, not zero touch engineering. The “zero touch” claim only becomes true when a bug report can become a production fix with no human at the gate, and when the system decides for itself that the fix is worth shipping.

Why engineering was the holdout

#

The reason ZTE lagged ZTP by a decade is not that writing code was hard. Writing code was always the most automatable part of engineering, which is why templates, code generation, and scaffolding existed long before LLMs.

The holdout was Decide.

Deciding what to work on is a sequence of judgments: which problems are worth solving, which are urgent, which should be declined, which need an architectural change versus an incremental fix. As I argued in The Shifting Bottleneck, every time AI removes a constraint at one stage, the next constraint appears one level higher up the decision chain. Producing code dissolved into verification. Verification dissolved into deciding what to implement. Deciding what to implement dissolved into deciding what to build.

The bottleneck climbed until it landed on the one thing that could not be mechanized: judgment about direction. That judgment is the gate ZTE has to remove, and removing it is a different kind of change from removing a deploy button. A deploy button is a procedure. Direction is taste, context, and tradeoff.

So ZTE is not a tool you install. It is a measure of how much of your engineering judgment you have managed to make explicit.

ZTE is proportional to encoded judgment

#

The encoded-judgment measure gives a useful test for how close a team or project is to zero touch engineering. Measure how much of the decision loop is encoded versus sitting in someone’s head.

The projects closest to ZTE encode five things: the same five I described in The Self-Evolving Repository, because that article was about ZTE without using the word.

A machine-readable roadmap that lets the system distinguish work that matters from work that does not. Most triage decisions are not subtle architecture calls. They are straightforward: this bug affects users, fix it; this request is out of scope, decline it; this dependency has a vulnerability, patch it. If those decisions are written down, the system can make them.

A verification pipeline that replaces human review with multiple independent layers: tests, static analysis, property tests, mutation tests, scenario validation, adversarial probing. Human review of agent-written code is the lowest-leverage activity in the loop, as I argued in Rethinking Code Review in the Age of LLMs. You do not trust the code. You trust the verification system.

A decision policy that ranks competing work the way a competent maintainer would.

Guardrails that bound the blast radius: budget limits, rollback on regression, escalation when a fix loop appears.

A learning loop that turns every failed change into a future constraint.

When all five are in place, the loop closes and the process is touchless. When any one is missing, a human has to step back in at that gap. The degree of zero touch is exactly the degree of encoded judgment, nothing more.

Where the human re-enters

#

A fully closed loop still has a leak, and the leak is direction.

A ZTE system that only reacts to observable signals will optimize for whatever those signals measure. Bug reports as the only signal produce a system excellent at fixing bugs and terrible at anything else. Feature requests as the only signal produce a system that accumulates features and loses coherence. That drift is Goodhart’s law applied to engineering: when a signal becomes the target of an autonomous system, it stops being a good signal.

The roadmap is what counteracts the drift, but the roadmap itself goes stale. User needs shift; the ecosystem moves; a roadmap written in January can be wrong by July. Updating the roadmap means making a judgment about what the project should become, and that judgment is the one thing current models can approximate but not fully replicate.

The pragmatic answer is not to solve the direction problem perfectly but to bound it. Let the system make small direction adjustments based on observed signals. Require large directional changes to pass through a human. That split keeps the loop touchless for the vast majority of decisions while preserving human oversight for the small fraction that set long-term trajectory.

The human in a ZTE system does not write code, review changes, or approve deploys. The human authors the system that does all of those things, and intervenes only when the system’s judgment and the project’s direction diverge. That is a different job from the one most engineers have today, but it is the job ZTE leaves behind.

The real question

#

The networking world reached zero touch because the stages it automated were procedures. ZTE is the claim that the remaining stages, the judgment stages, can be made procedural enough to automate too.

That claim is only partly true. You can encode most engineering judgment, enough to close the loop for routine work. You cannot encode all of it, and the part you cannot encode is exactly the part that determines whether the project moves in a direction worth moving.

Zero touch engineering is not about removing humans from writing code. It is about discovering, precisely, which of your judgments were ever more than procedure, and which were just procedure you had not bothered to write down yet.

See also

#

• The Self-Evolving Repository - the end-state ZTE describes, explored as a GitHub project running every maintainer function on an automated loop
• The Shifting Bottleneck - why the constraint climbs toward judgment as each lower stage is automated
• Scaling the LLM Agent Company - what changes when the entire workforce, not just the pipeline, is automated agents
• Rethinking Code Review in the Age of LLMs - why human review is the gate ZTE has to remove, and how verification replaces it
• The Future of Code Review - the verification-system-over-human-trust framing ZTE depends on
• llm-augmented-workflows - a concrete engine for closing the observe-to-ship loop on GitHub

References

#

• Wikipedia, “Zero-touch provisioning” - the networking origin of “zero touch”, including ZTP and the ETSI ZSM lineage
• IETF RFC 8572, Secure Zero Touch Provisioning (SZTP) - the IETF standard showing “zero touch” as an established, standardized concept
• ETSI, Zero-touch network and Service Management (ZSM) - the standards body owning “zero touch”, now working on closed-loop, agent-driven automation
• TechTarget, “NoOps” - the Forrester-coined vision of fully automated operations, the prior art ZTE extends from ops into engineering
• Wikipedia, “Continuous deployment” - the established zero-touch last mile of delivery that ZTE carries backward through review and authoring
• Wikipedia, “Autonomic computing” - IBM’s self-managing systems vision, the intellectual ancestor of the closed-loop ZTE depends on

There is a kind of code growing around us, and growing fast. Code that no human wrote, line by line. Code that no human will read, line by line. Code that no human will review, because the verification system passed and the change shipped on green. If you are an engineer, this is supposed to make you uncomfortable. But the discomfort is something you can get past, because we have gotten past it before, in several fields next door, and their tricks transfer.

Machine learning practitioners have been comfortable with opacity for a decade. The trained neural network sitting behind your favorite model is, at the bottom, billions of floating-point numbers. Nobody reads them. Nobody can. There is no “go to definition” for a weight. You cannot trace a decision through the layers by opening the matrix in your editor and following the logic. The entire artifact is illegible to a human by construction, and the field that built it made its peace with that a long time ago.

The code now being produced by agents is heading toward the same property, and the comfort ML people found is the comfort software engineers need to find next.

The Model We Already Live With

#

How did machine learning get comfortable with a thing nobody can read?

Not by pretending to understand the internals. By refusing to need them.

The model is a black box. You understand it through what it does, never through what it is. You probe it with inputs and watch the outputs. You assemble a test set that captures the behaviors you care about, the happy paths and the adversarial ones. You measure accuracy, calibration, latency, and failure modes on the edge cases that would embarrass you in production. You characterize the artifact from the outside, and the characterization is the thing you trust.

Nobody on a model team ever says “let me read the weights to see if this is correct.” That sentence is nonsense in that world. It is becoming nonsense in ours, and the people who notice last will be the ones still trying to read code that no longer rewards reading.

Code Is Becoming That

#

The parallel is not exact, but it is close, and it is closing.

A neural network is opaque because its meaning is smeared across billions of parameters, none of which means anything alone. Agent-written code is opaque for a different reason and a more mundane one: there is simply too much of it, it was produced too fast, and no human has the hours to reconstruct what it does from the source.

The end state is the same from the operator’s point of view. You are handed an artifact that does something. You cannot hold its behavior in your head by reading it. You have to find out what it does the way you find out what a model does, by running it and watching.

This is already the lived reality for the engineers defending codebases where agents produce faster than humans can read (The Codebase Gardener describes that arithmetic). It will be the reality for everyone soon enough. The code you depend on, the code in your dependencies, the code that ships from the team across the hall, is increasingly code whose source you will never open, because opening it would tell you less than running it would.

Why Code Felt Different (And Why It Should Not)

#

Source code used to be the thing that made software tractable. That was the whole promise. Unlike a compiled binary, unlike a trained network, you could open the file and follow the logic. Reading was how you understood a system, how you debugged it, how you trusted it. The fact that code was legible was the foundation engineers built their competence on.

Machine learning never had that foundation, so it never grieved losing it. Software engineering did, and does, and that grief is most of what the discomfort is made of.

Strip the grief away and the practical question is simpler. If you could not read the code anyway, would you rather have no code, or would you rather have code you can probe, test, measure, and roll back? You would rather have the code, and you would build the same scaffolding around it that ML built around its weights. The only thing standing between you and that scaffolding is the feeling that you ought to be able to read it, and that feeling is a habit, not a requirement.

The Skills Transfer Directly

#

The practices machine learning developed for living with opacity are almost a one-to-one map onto opaque code. You already know half of them, because software engineering reinvented them under different names.

In ML, the test set captures the behaviors that matter. In opaque code, that is the acceptance criteria written before implementation, plus a characterization suite that records what the code actually does across the inputs you care about (Verifying Code Without Reading It is the full version of this system).

In ML, probing with held-out and adversarial inputs is how you find where the model breaks. In opaque code, that is property-based testing and fuzzing, generating inputs no human would think to write, exposing the edge cases reading would have missed anyway.

In ML, you measure accuracy and failure rate on a benchmark, not vibes. In opaque code, that is defect escape rate, rollback rate, time-to-detect, and change failure rate, measured per change, in production.

In ML, adversarial examples are how you stress the model before it ships. In opaque code, that is the adversarial pass: a separate agent whose only job is to break the change, with no incentive to approve (Verifying Code Without Reading It covers the separation that keeps it sound).

In ML, the model card documents what the model is good at and where it fails. In opaque code, that is the specification plus the issue, the artifact that tells you what the code was supposed to do, which matters far more than what any individual line does (Rethinking Code Review in the Age of LLMs).

Every tool you need to trust opaque code is a tool ML already built to trust opaque weights, renamed.

It Is Not Just Machine Learning

#

Machine learning is the most recent field to face this problem, not the only one. Depending on an artifact you cannot fully read is an old situation, and the disciplines that met it first each invented a piece of the answer. None of them solved it by making the artifact legible. They solved it by changing how they interacted with it, and every one of those changes is a tool we can pick up for opaque code.

Silicon. Once a chip is fabricated, you cannot read its logic from the silicon. The hardware field answered with design for test: boundary scan, built-in self-test, test vectors injected at the pins and observed at the outputs. The lesson is structural, and it is the one our field is slowest to learn: testability has to be designed into the artifact before it exists, not bolted on after. For code, that means the architecture carries probes, hooks, and test seams by default, so an implementation nobody reads can still be exercised by a system that does.

Pharmacology. A drug interacts with a body no one fully models. The field answered with phased clinical trials, a tiny reversible exposure first, then efficacy, then population scale, all run double-blind and followed by post-market surveillance. The transferable pattern is staged rollout with independent evaluation and production watchfulness, which is exactly canary deployments, feature flags, a verifier separate from the author, and monitoring that treats production behavior as the real verdict.

Behaviorism. Psychology met an opaque artifact earliest of all, the mind itself, and built a whole epistemology around it. Stimulus and response, operational definitions, the refusal to introspect what could not be opened. The stance is the one this article is arguing for: when you cannot inspect the internals, you understand the thing by characterizing what it does, and you stop treating that as a compromise and start treating it as the method.

Cryptography. A cipher is trusted not by reading it but by trying to break it, and Kerckhoffs’s principle says the system must stay safe even when its mechanism is fully public. The lesson is an inversion that cuts against the instinct to trust illegible code by hoping someone read it: obscurity was never what made it safe, and dropping the reading does not drop the safety if the adversarial testing holds. Trust comes from attack, not from inspection.

Optimizing compilers. The output of a modern optimizer is illegible to humans, and no one considers that a crisis. Compilers are trusted through conformance suites and fuzzing, not by reading the assembly they emit. Generated code is a new instance of a situation our own field has always been calm about, a transformation pipeline whose output you verify rather than read.

Legacy mainframes. Long before LLMs, our field operated systems no living person fully understood, COBOL cores kept alive by runbooks, golden-file tests, and behavior contracts. The practitioners did not resign over the illegibility. They built characterization tests that pinned observed behavior, and they ran the systems safely on those pins for decades. That is the exact toolkit an opaque, agent-managed codebase needs.

Each field contributed a distinct piece. Hardware taught us to design testability in beforehand. Pharmacology taught us staged exposure with independent oversight. Behaviorism taught us the epistemology of characterization. Cryptography taught us to trust by attack, not by inspection. Compilers taught us that illegible output is normal and suite-verified. Legacy systems taught us to operate on pinned behavior when comprehension is gone. Stack those techniques and you have the full practice for a codebase no one reads: instrumented by design, rolled out in stages, characterized by behavior, stress-tested by adversaries, suite-verified, and pinned by contracts.

What Understanding Means When You Cannot Read

#

Engineers are going to resist this, so it is worth being precise about what is lost and what is gained.

Reading code gives you one kind of understanding, causal and local. You trace a branch, follow a call, and build a mental model of why the code behaves the way it does on the inputs you happened to trace. It is deep, but it is narrow. It covers the paths you followed, and it depends on you being alert and unhurried while you followed them.

Characterizing behavior gives you a different kind of understanding, statistical and global. You cannot say why a specific input produces a specific output by tracing the logic. But you can say, with evidence, how the system behaves across thousands of inputs, including the ones no human would have thought to trace.

The first kind feels more satisfying because it produces a story. The second kind is more reliable because it does not depend on which story you happened to follow on the day you read it.

A reviewer who reads a diff understands a few paths well and the rest not at all. A test suite that runs on every change understands every path it covers, every time, forever, without getting tired. Reading gives you a vivid understanding of a tiny fraction of the behavior. Probing gives you a coarse understanding of all of it, and for software that has to keep working when you are not looking, the second is the one that compounds.

The Identity Problem

#

Here is the part nobody puts in the engineering blog posts.

This shift is hardest for the people it should be easiest for. The senior engineer, the staff engineer, the person whose entire professional identity is built on being able to open any file in the codebase and understand it, is the person being asked to surrender the exact skill that made them senior.

That is a loss, and it is real, and pretending it is not is why so many of the arguments against unread code sound rational but run on fear. It is not irrational fear. If the thing you are best at is reading code, and reading code stops being the valuable thing, then you are being asked to become a beginner again, and beginners are slow and uncertain and uncomfortable.

The way through it is the same way ML practitioners found. You do not stop being valuable. You move your value up a layer. The ML engineer’s skill was never reading weights, it was designing the training, choosing the objective, building the evaluation that decided whether the model was good enough to ship. The senior engineer’s skill, it turns out, was never really reading lines either. It was knowing which behaviors matter, what the failure modes are, where the blast radius lives, and what “done” actually means for this system. Those survive the loss of legibility intact, and they are exactly the skills the opaque-code world pays for.

You are not losing your competence. You are being asked to point it at the layer where it was always doing the most work.

How to Get Comfortable

#

Comfort is not an attitude you adopt. It is a confidence you earn by watching the safety net catch things. Each time a gate stops a bad change, each time a canary surfaces a regression a reader would have missed, each time a rollback undoes a problem in minutes, the illegible artifact gets a little less frightening, because the system around it is doing the job your eyes used to do.

Start where the stakes are low. Pick the changes you were never going to read carefully anyway, the small, reversible, low-blast-radius ones (You Already Review Code Without Reading It is the uncomfortable proof that this is most of them). Let those merge on green, with no human in the middle, and watch what happens. If nothing breaks, your nervous system learns faster than your opinions do.

Then build the probing muscles. Write the behavioral tests before you let an agent write the code. Add a fuzzer to the paths that carry real risk. Put a blast-radius classifier on the gate, and reserve your attention for the small set of changes that actually deserve a human, the irreversible and the trust-boundary-crossing. Measure the outcomes, and let the measurements argue for you when your instincts object.

The end state is not that you stop caring about code. It is that you stop needing to read it to trust it, the same way the ML engineer stopped needing to read weights to trust a model. You develop a feel for the system the way they developed a feel for the model, by living with its behavior, watching it under load, and letting the evaluation be the authority instead of your eyes.

The Disciplines That Already Did It

#

Machine learning is the closest mirror to what software is becoming, and it is worth noticing how comfortably it ended up.

Nobody in ML talks about the illegibility of weights as a crisis. They talk about evaluation, about distribution shift, about calibration, about the gap between benchmark and production. The opacity is settled ground, the same way it is settled ground in chip design, in pharmacology, in every field that learned to trust an artifact it could not open. The work happens entirely at the boundary, in the inputs you choose and the outputs you measure, because that is where understanding of an opaque artifact can live.

Software engineering is arriving at the same place, later and more reluctantly, because it had something to lose that those fields never had. The legibility of source code was a gift, and it was a gift that lasted a few decades, and it is ending, and the ending feels like a demotion when it is really a relocation.

The code you will never read is coming regardless. The only question is whether you learn to be comfortable with it the way half a dozen fields already are, by building the cage of tests and probes and staged rollouts and adversarial checks around it, or whether you keep insisting on reading until the volume of unread code makes the insistence irrelevant.

The first option is work. The second option is a feeling that does not scale. Pick the one that does.

See also

#

• You Already Review Code Without Reading It - the diagnosis that most review already happens without reading, which is the proof that the comfort is mostly already earned.
• Verifying Code Without Reading It - the concrete system of tests, critics, and gates that replaces reading, and that maps almost one-to-one onto ML evaluation practices.
• Rethinking Code Review in the Age of LLMs - the case for moving human effort from the diff to the specification, which is the layer where understanding of opaque code actually lives.
• The Codebase Gardener - the arithmetic that makes unread code inevitable, and the strategy for defending a codebase against entropy produced faster than you can read.
• The Acceptance Gap - the root insight that a model cannot vouch for its own output, which is why the external evaluation (the ML equivalent of a test set) is the part that has to be trustworthy.

When someone asks what my AI workflow looks like, the real answer is boring on the surface and surprising underneath. I use a couple of coding tools and a couple of models, and none of them is the thing I would miss. What I would miss is the body of skills I have been writing, collecting, and refining for the better part of a year.

This is a snapshot of that workflow as it stands today. The tools come first because they are the visible part, but the real argument is that the tools are the part I expect to replace, and the skills are the part I expect to keep.

I run two coding surfaces and two models, and neither is the interesting part of my setup. At home I use GLM 5.2 from z.ai, and at work I use GLM 5.2 fast from Fireworks. For editing I use Cursor at work and VS Code at home, and for anything agentic, multi-step, or long-running I use OpenChamber, which is built on OpenCode. I never open OpenCode directly; OpenChamber is the surface, OpenCode is the engine underneath. The part that actually determines the quality of my work is the library of skills I have been building and sharing in tomzx/agents, and those skills run inside all four of those tools. Everything else is interchangeable.

The setup, in one paragraph

#

Cursor or VS Code is where I read, navigate, and do small edits. The moment a task turns into a sequence of steps, create an issue, reproduce a bug, review a PR, open a PR, I move it to OpenChamber, because that is where the work can run to a natural stopping point without me holding the state. OpenChamber is built on OpenCode and is the control room on top of it: it gives me branchable sessions, worktree isolation, and a single surface to steer several sessions at once. The skills are not tied to any of these surfaces; because they follow the open Agent Skills format, the same skill runs in Cursor, VS Code, OpenCode, or OpenChamber, so I pick the surface that fits the moment and the workflow does not change. At home the editor is VS Code and the model is GLM 5.2 on z.ai, at work the editor is Cursor and the model is GLM 5.2 fast on Fireworks, and I switch between them without changing anything else about the workflow.

The model and the shell are commodities

#

A year ago I would have had a strong opinion about which model to use. Now the models are close enough that the choice is mostly about latency and price, which is why I let the environment pick: z.ai at home, Fireworks at work. The model stopped being the lever once the models got good enough to follow a well-specified workflow reliably.

The same is true of the agent shell. Cursor, VS Code, OpenCode, and Claude Code can all read a repository, edit files, and run commands, and because the skills follow an open format they run in any of them unchanged. I use several of them because they are good at different things, but I do not expect any one of them to be the source of my advantage. The shells will keep improving, the models will keep swapping in, and my workflow should not have to move when they do.

The skills are the workflow

#

Everything that matters lives in tomzx/agents, a library of composable skills written in the open Agent Skills format. A skill is a self-contained SKILL.md with step-by-step instructions for one repeatable task. A compatible agent discovers skills by name, loads them on demand, and invokes them as slash commands like /create-pr, /review-pr, or /end-day.

The backbone is the SDLC pipeline. A high-level skill like /sdlc orchestrates dozens of focused sub-skills into a full path from issue creation through requirements, specification, plan, implementation, tests, pull request, review, documentation, and learnings. Each sub-skill is small enough to read in a minute and to improve independently. When I improve the review-pr skill, every flow that calls it gets the improvement, and I never have to re-explain that step to a session again.

The versioned skill is the difference between prompting and engineering a workflow. A prompt is a one-off conversation. A skill is the same conversation, written once, versioned, reviewed, and incrementally improved. The agent performs it the same way every time, and the library gets better as the workflows mature.

Where the human time goes

#

The SDLC pipeline is long, but my time is not spread evenly across it. Almost all of my attention goes to the top: needs, requirements, and specification. This is where defects fan out the widest and where fixes compound the longest, as Defects Flow Downstream lays out, and it is where the work stays irreducibly human, deciding what to build and what “done” means. A precise specification is the input every downstream skill consumes, and Software Engineering Teams in the Age of AI argues it is now the highest-leverage skill in the field.

Everything below the specification, I automate as far as I can. The plan, the implementation, the tests, the PR description, the review, the deployment, each is a skill the agent runs, and each is a place I would rather spend a token than an hour. Once judgment is encoded into the layer every change passes through, fighting over each unit of output by hand stops paying for itself.

The downstream hour that used to go into reading diffs goes somewhere else entirely: into building high-fidelity test environments that approximate the production environment as closely as I can get them. I would rather spend an hour making the test environment catch the bug than an hour reading a diff hoping to catch it myself, because the test environment runs on every future change and the diff reading runs once. Spending the hour on the environment instead of the diff is the trade Verifying Code Without Reading It and Rethinking Code Review in the Age of LLMs both argue: review is a one-time signal, verification against a production-like environment is a compounding one.

The encoding loop

#

The hardest problem with any workflow is not doing it. It is remembering to do it, every time, in the right order, without skipping the boring step.

My rule is simple. Every time I catch myself remembering to do something, that is a skill that should exist. The reminder to check for an existing PR before starting work, the instinct to link an issue to its plan, the habit of running the linter before committing, the reflex to write a learnings note after a painful bug, each of these was once tacit knowledge that lived in my head and showed up only when I was fresh. Now each one is a skill, and the agent runs it whether I am fresh or not.

The trigger is the remembering itself. If I had to remember it, the agent should not have to. Encoding it converts a forgettable step into a reliable one, and a reliable one into an improvable one, because once the step is written down I can see it, review it, and make it better instead of re-deriving it from memory every session.

What changes when the workflow is versioned

#

Once the workflow lives in a repository, three things become true at once.

First, it is reliable. The agent triages the issue, plans the work, reviews the PR, and closes the loop the same way today as it did yesterday, because the steps are written down and not reconstructed from vibes.

Second, it is improvable. When a step is weak, I edit one file and every session that passes through it gets better. The compounding is real in a way that prompting never compounds, because the improvement is captured instead of evaporating.

Third, it is shareable. The skills are public, so anyone on my team or on the internet can run the same workflow against their own repository. The workflow became an artifact I can hand to someone else, which is the test for whether you actually have a workflow or just a habit.

What I expect to keep

#

If you asked me which parts of this setup I will still be using in two years, the answer is easy. Not Cursor, probably not OpenChamber in its current form, and almost certainly not GLM 5.2. The models and the shells are moving targets, and betting on any specific one is a bet against the field.

The skills are the part I expect to keep, but I do not expect to keep them as they are today. They will evolve, and the more interesting bet is that they will shrink. Every skill exists to encode a judgment the model cannot yet make reliably on its own: when to check for a duplicate PR, what a good acceptance criterion looks like, which steps belong in a retrospective. As the models get smarter, often smarter than me at the specific subtask, those judgments stop being mine to encode and start being the model’s to make. The skill for them becomes redundant and gets deleted.

What persists is the slower-moving part: how I decide what is worth working on, how the phases of a feature connect, where the human checkpoint belongs. The tactical skills will collapse into the model. The skills are not a fixed asset I am accumulating; they are a temporary scaffold for the gap between what the model can do today and what it will do on its own tomorrow, and a good chunk of the work is knowing which scaffold to take down next.

See also

#

• Defects Flow Downstream - why the hour at the specification pays back more than the hour at any later stage
• Verifying Code Without Reading It - the case for spending review time on a production-like test environment instead of a diff
• llm-augmented-workflows - the engine that runs these skills on GitHub events without a human in the loop
• The Self-Evolving Repository - the end state when every maintainer function is encoded as a loop
• The Codebase Gardener - why the layer everyone passes through is where you fight for consistency
• Managing Many Concurrent LLM Agent Sessions - the supervision problem OpenChamber solves and skills externalize
• AI tools I have used - the running list of tools, kept up to date

References

#

• Mathieu Larose, “My AI Coding Workflow” - the article that prompted me to write this one
• tomzx/agents - the skills library that is the subject of this article, public and installable
• Agent Skills format - the open skill format that makes the library portable across agents
• OpenCode - the terminal coding agent the skills target
• OpenChamber - the OpenCode-native control room for parallel sessions
• Cursor - the editor I use at work for reading and small edits
• VS Code - the editor I use at home for reading and small edits
• z.ai - provider of GLM 5.2, my home model
• Fireworks - provider of GLM 5.2 fast, my work model

Every code-generating LLM in production today was trained on code written by humans. That fact is easy to forget, because the same models are now writing most of the code. If humans stop reading, reviewing, and refining that code, the next generation of models will have to train on the output of this one, and the research on what happens then is not reassuring.

Models Were Trained on Human Code

#

The large code models learned from enormous corpora of human-written code: public repositories, Stack Overflow answers, patches, and documentation. None of that code was perfect. Much of it was buggy, redundant, or obsolete. But it carried something that model output cannot manufacture: the accumulated signal of millions of programmers solving real problems under real constraints, correcting each other in public, and converging over decades on patterns that actually work.

That signal is the fuel. When you prompt a model and it produces a working function, it is not reasoning from first principles. It is predicting the next token from patterns absorbed out of human code, and those patterns were selected by reality, not by another model’s preferences.

The Trend Is Pulling Humans Out of the Loop

#

I have spent the last year arguing that human code review should shrink, that we should verify code instead of reading it (Verifying Code Without Reading It), and that the specification, not the diff, is where human judgment belongs (Rethinking Code Review in the Age of LLMs). I still believe that, at the level of a single team shipping a single product.

But there is a consequence I have been slow to take seriously, because it does not show up in any one team’s metrics. It shows up in the corpus. As review becomes automated and engineers read less of what the model writes, the public record of code becomes a record of model output, lightly curated by machines. The very thing the next models need to train on, human-written and human-corrected code, is becoming a smaller and smaller fraction of what exists.

What Model Collapse Is

#

This feedback loop has a name. Researchers call it model collapse, and the clearest statement of it is Shumailov et al.’s 2024 paper, “AI models collapse when trained on recursively generated data”.

The finding is stark. When you train a model on data produced by another model, and then train the next model on the first model’s output, and repeat, the model degrades. It does not degrade the way a person gets tired. It loses information about the tails of the distribution first, the rare cases, the minority examples, the edge behavior, while its performance on the average case can look fine for a surprisingly long time. Model collapse is hard to notice precisely because the headline metrics keep going up while the long tail quietly disappears.

The mechanism is statistical, not mysterious. A model that fits another model’s output is fitting a smoothed, averaged version of reality. Each generation of training rounds off a little more of the texture, the weird inputs, the unusual-but-correct solutions, until what remains is a narrow, over-represented center.

The preprint that introduced the term, “The Curse of Recursion”, works through the mathematics, and the Wikipedia article on model collapse lays out the two stages, early and late, and the open disagreement among researchers about how severe the real-world impact will be.

Why Code Is Especially Exposed

#

General model collapse is a concern for text and images. Code is a sharper case, for three reasons that compound.

First, the useful part of code lives in the tails. The happy path is easy. The value is in error handling, concurrency, boundary conditions, security, the obscure API, and the input that should never arrive but does. These are exactly the minority examples that collapse erodes first. A model that handles the common case and breaks on the edge case is the literal definition of early model collapse, and it is also the definition of code that passes review and fails in production.

Second, code that looks correct is easy to generate and hard to filter out. A plausible-looking function that contains a subtle bug is not obviously wrong the way a garbled sentence is. If nobody reads it, and the tests do not cover the edge case, it merges into the corpus and becomes training data for the next model, carrying its bug forward as if it were a pattern worth repeating.

Third, the volume is exploding. When a model can draft a feature in minutes, the amount of model-written code committed every day is growing faster than anyone’s ability to curate it. Public repositories are filling with generated code, and that code is the raw material for the next training run. The dead internet theory, originally a half-joke about the web filling with bots, is becoming literal for code.

What Might Happen Next

#

No one knows exactly how this plays out, because the loop has not completed a full generation at scale yet. But a few hypotheses are worth stating plainly, because they are testable and they point at where to look.

The quality plateau

#

Models keep improving on benchmarks for a while, then flatten. The plateau will not look like running out of compute. It will look like running out of signal. The bottleneck moves from the size of the model to the quality of the data, and the data has stopped improving because it is no longer being written by anyone who understands it. This is the same pattern I described in The Shifting Bottleneck: each constraint you remove reveals the next one, one level up.

The long-tail erosion

#

While the common case improves, the edge cases get quietly worse. Security vulnerabilities, race conditions, and incorrect handling of unusual inputs become more frequent, not less, because the training distribution has thinned exactly where those lessons lived. Benchmarks that measure average correctness will miss this. Benchmarks that measure adversarial or edge-case correctness will catch it, and they will be the ones to watch.

The grounding premium

#

Code with verifiable grounding becomes valuable. What matters is not who typed it but whether it was selected by reality: it ran in production, it passed tests against inputs no one hand-picked, it survived real failures and was corrected by them. A human-written snippet that never ran carries no signal a model could not invent. A model-generated snippet that ran under real load and survived carries signal that no amount of recursive training can synthesize. Labels like “ran in production without rollback” or “verified against a fuzz corpus” start to mean something, the way “organic” became a label worth paying for in food. Grounding begins to matter as much as data volume, and the organizations that can prove their code carried a real outcome get better models. Eventually the most valuable training corpus is the one you can prove was selected by reality, not merely produced by a model.

The verification-as-data loop

#

The only new ground-truth signal that does not depend on model output is execution. The most valuable training data stops being code at all, and becomes (specification, implementation, test result) triples, where the test result is measured by reality, not inferred by another model. Reinforcement learning from execution, where the reward comes from actually running the code, replaces scraping repositories as the dominant way to improve code models. A model is, at inference time, a function of its context, as I argued in The Importance of Context When Interacting with LLMs; at training time it is a function of its corpus, and the corpus is the part that is degrading.

The split

#

A gap opens between organizations that keep humans in the loop and those that do not. The fully automated shops gain short-term velocity but slowly poison their own tooling, because their internal corpus drifts toward generic, model-flavored code. The shops that keep humans reading, correcting, and rewriting code retain a source of fresh signal, and their models, or at least their use of models, stays sharper over time. The competitive advantage flips from speed to the quality of the signal you feed back into the system, which is the same conclusion the foundation argument reaches in The Foundation Predicts the House of Cards.

The Case That Code Improves Instead

#

Everything above assumes the only training signal is “imitate the previous generation.” For text and images that is roughly true, which is why model collapse is a real worry there. Code is different in one decisive respect: it has an oracle.

Code runs. It passes tests or fails them, type-checks or does not, compiles or crashes, and a fuzzer can generate inputs no human would think to test. That execution result is a ground-truth signal that does not come from any model, and it is the one thing the self-consumption loop cannot synthesize. Where collapse assumes the model learns only from its own output, execution lets it learn from reality, and reality does not degrade between generations.

This changes the arithmetic in several ways that point upward rather than down.

First, reinforcement learning from execution replaces imitation as the engine of improvement. The training unit stops being “a file someone committed” and becomes a (specification, implementation, test result) triple, where the reward is measured by running the code. A model rewarded for passing tests it has never seen is being pushed toward correct behavior, not toward the average of prior outputs, and that pressure does not loop back on itself.

Second, selection effects push the surviving corpus upward, not toward the mean. When generation is best-of-N, or when an adversarial verifier tries to break each candidate, the code that survives into the corpus is the code that passed real checks. A repository built from verified survivors can be cleaner than the human corpus ever was, because GitHub and Stack Overflow were always full of bugs that nobody ran. Filtering is the antidote to unfiltered collapse, and code is the one modality where filtering is automatic.

Third, the long tail can get better represented, not worse. Humans are lazy about edge cases. Fuzzers, property-based tests, and generated edge-case suites are not. If the training signal includes execution across millions of rare inputs, the model sees more of the tail than human-written code ever covered, and the long-tail erosion hypothesis inverts into long-tail reinforcement.

So the optimistic thesis is precise: code is the modality least susceptible to model collapse, because it alone carries an objective, automatic, infinite ground truth. The thing that makes code hard, that it has to actually work, is also the thing that protects it.

The catch is that the oracle only checks what you ask it to check. A passing test suite proves the code does what the tests cover, not that the tests cover what matters. Let the same model write the tests and the code, or let the test suite stay shallow, and execution stops being an oracle and becomes a rubber stamp. The virtuous loop holds only while the verification is sound, separate from generation, and broader than the happy path.

What Breaks the Loop

#

Even the imitation-only loop has an escape hatch, if real data keeps accumulating. Gerstgrasser et al. showed in “Is Model Collapse Inevitable?” that collapse is avoided when synthetic data accumulates alongside real data instead of replacing it. Their result is the weaker version of the optimistic case: as long as we keep adding fresh human code to the corpus, the model does not have to train only on its own output.

The catch is the word “fresh.” The mitigation only works if real human code keeps flowing into the training set in meaningful quantities. And that is exactly the input the current trend is starving. Every hour engineers spend prompting instead of writing, every diff that ships unread, every answer on Stack Overflow that goes unposted because a model answered it privately, shrinks the stream of new human signal.

So the practical question is not whether model collapse is possible. The research says it is. The question is whether we keep enough humans writing, reading, and correcting code, in public, to keep the real data flowing.

The Verdict Hinges on the Oracle

#

I have argued, and still believe, that a single team should not force a human to read every diff if its verification system is strong enough. What I no longer believe is that this is automatically a tragedy of the commons. It is a tragedy only if the only signal the field feeds back into its models is imitation of prior output. Execution is a second signal, and for code it is the stronger one.

The two futures run on the same variable: the soundness of verification. If verification stays grounded in real execution, adversarial, and separate from generation, the loop improves on its own, and humans reading code matters less every year. If verification is captured, shallow, or graded by the same model that wrote the code, the loop degrades, and no amount of human reading at the end will save it.

So the instruction is narrower than “keep humans writing code in public.” It is: keep the oracle trustworthy. Run the tests, fuzz the inputs, separate the verifier from the author, and treat every passing suite as a claim about coverage rather than proof of correctness. Do that, and generated code can keep getting better long after humans stop writing most of it. Fail to do it, and the degradation arrives on schedule.

See also

#

• Verifying Code Without Reading It - the local practice this article complicates: stop reading diffs, start verifying them, and the global cost that practice imposes when everyone adopts it
• Rethinking Code Review in the Age of LLMs - the case for moving human effort from the diff to the spec, which is correct per-team and worth re-examining at the corpus level
• The Importance of Context When Interacting with LLMs - the inference-time version of the same claim: a frozen model reflects its context, just as a trained model reflects its corpus
• The Shifting Bottleneck - why removing the production constraint relocates it, which predicts the data-quality plateau
• The Foundation Predicts the House of Cards - why codebase health outranks tooling, and why the teams that keep human signal win over time

References

#

• Shumailov et al., “AI models collapse when trained on recursively generated data” (Nature, 2024) - the definitive empirical demonstration that training on model output degrades models across generations
• Shumailov et al., “The Curse of Recursion: Training on Generated Data Makes Models Forget” - the preprint that introduced model collapse and its mathematical treatment
• Gerstgrasser et al., “Is Model Collapse Inevitable? Breaking the Curse of Recursion by Accumulating Real and Synthetic Data” - the counterpoint showing collapse is avoided when real data accumulates alongside synthetic data
• Wikipedia, “Model collapse” - overview of the two stages of collapse and the disagreement over real-world impact
• Wikipedia, “Dead Internet theory” - the analogy for code repositories filling with generated content

The case for review without reading, and the system that makes it safe, can both be sound and still fail to ship. I am writing about the part that actually decides whether any of it lands: your team.

You can be right about review, right about the system that replaces review, and still lose, because you shipped the rollout as a decree instead of as a sequence. The rollout has its own logic, and it is not the logic of the technical argument. A system people do not trust is a system that does not run, regardless of how well it verifies.

Treat The Resistance As Information

#

The easy story is that skeptics are afraid of change, and that once they see the numbers they will come around. That story is mostly wrong, and believing it will cost you the rollout.

The people who push back hardest on automated review are often your most careful engineers. They have seen the bugs a tired reviewer caught by instinct. They have been the person blamed when something slipped through. Their objections are not noise to filter; they are a map of where your system is weakest. Calling their discomfort “fear” loses the argument before it starts, because they can tell you are not listening.

Three Concerns, Three Answers

#

Behind “I do not trust the bot” are usually three distinct concerns, and each needs a different answer.

The safety concern: automated review will let bad code through. You answer the safety concern with measurement, defect escape rate compared between the automated lane and the human lane.

The accountability concern: when something breaks, there is no one to point at. You answer the accountability concern with ownership that lives upstream, in the specification and in the people who own the rules.

The learning concern is the one nobody says out loud. Review is how juniors grow and how the team stays connected to its own codebase. This loss is real, and it is the concern that will sink the rollout if you ignore it, because no defect metric addresses it.

Sequence The Exposure

#

You cannot go from “a human reads every diff” to “no human reads any diff” in one step. Decompose the automation into three things people react to very differently.

A bot that comments is basically a linter, and almost no one objects. A bot that blocks is accepted once the rules are legible and owned. A bot that approves is the real flashpoint.

Ship them in that order, weeks apart, on a low-blast-radius lane first: documentation, tests, internal-only changes inside a single module. By the time you reach the approving bot, the team has weeks of evidence that the earlier layers work. You are extending trust that has been earned, not demanding it up front.

Make Every Decision Legible

#

People resist what they cannot inspect. Every automated action must state which rule fired, what it checked (the file and line, the threshold, a link to the rule definition), and who owns that rule.

“Complexity 18 over 15 in auth.py:42, rule COMPLEXITY_LIMIT, owner Priya” is something a skeptic can argue with. “Bot approved” is something a skeptic can only rage at. The first turns a black box into a reviewable system. The second turns your careful engineers into enemies.

Promote Humans To The Rules

#

This is the move that wins senior engineers over instead of displacing them. They stop reviewing code and start reviewing the gates: the security critic’s checklist, the complexity thresholds, the blast-radius classifier.

Their judgment now scales to every change instead of being spent once on a single pull request. A senior who owns the duplication rule has more leverage than a senior who reads ten diffs a day and remembers three. You are not removing them from the loop; you are promoting them to a loop where their work compounds. Give your skeptics the highest-leverage role in the new system, and most of them stop being skeptics.

Let Shadow Mode Persuade

#

The strongest argument is not yours; it is the comparison the team runs itself. Let a team keep their human review while the automated lane runs silently beside it, recording what it would have caught and what it would have flagged wrongly.

After a few weeks you have the only case that lands: “your reviewers missed these defects the gate caught; the gate’s false positives were these, and they are fixed.” Run it on a low-risk slice so the stakes match the trust level. And let the skeptics be the ones who present the results. Nothing converts a skeptic faster than being the person who found the data.

Measure What They Actually Care About

#

They are concerned about defects escaping, so measure defects escaping. Track defect escape rate, rollback rate, time-to-detect, and change failure rate, and compare the automated lane to the human lane on the same slice.

If the gate wins, the argument ends, and it ends in numbers rather than opinion. If the gate loses, you have a concrete gap to close, and you have earned the credibility to say so out loud. Never defend the system with “a human looked at it”; defend it with production outcomes. A human looking at it was always a proxy for those outcomes, and a weak one.

Keep The Escape Hatch, And Say So

#

Irreversible changes, trust-boundary changes, public API changes, and changes to the gating system itself still get a deliberate human read.

The message is never “you are out entirely.” It is “you are in where you add value, and out where you do not.” That framing is far easier to accept than abolition, because it is not abolition. You are reserving humans for the small, identifiable minority of changes where a careful read is still the best tool we have, and the rest of the pipeline moves at the speed the machines can sustain.

Rebuild The Learning Channel

#

The learning concern from earlier does not go away once the rollout succeeds. That loss is a genuine cost, and pretending otherwise breaks trust.

Replace the channel deliberately. Pair juniors with seniors on specifications, because that is where the judgment now lives. Rotate rule-owner duty, so learning to curate a check is itself the apprenticeship. Hold code-archaeology sessions that read well-chosen diffs as learning material, not as a gate. Move the learning off the critical path without deleting it, and name the loss plainly so people know you took it seriously.

The First Escape Is The Moment That Matters

#

When, not if, the gate lets something through, the instinct of the holdouts will be to say “see.” That is the moment the rollout is won or lost.

Run a blameless postmortem, find the gap, and add a rule. Then say the thing human review can never say: this exact defect class can never recur, because it is now checked on every change, for as long as the rule exists.

That guarantee is the property that dissolves resistance on its own schedule. The system gets strictly better over time; human review resets every morning. Each incident encoded into a rule is a permanent gain. Show people that compounding curve, and most of the holdouts come around, not because you argued them down, but because the system stopped being the thing they distrusted.

What to Do Next

#

Start with the commenting bot on a low-blast-radius lane, and add the blocking bot and then the approving bot weeks apart. Run shadow mode beside the human lane, and let the skeptics be the ones who present the comparison. From the first automated action, publish the rule, the threshold, the owner, and the numbers: defect escape rate, rollback rate, time-to-detect, change failure rate.

Keep the escape hatch explicit, and rebuild the learning channel deliberately. Reserve deliberate human reads for the changes with real blast radius. Pair juniors with seniors on specifications, and rotate rule-owner duty, so the apprenticeship continues off the critical path.

When the gate lets its first defect through, run a blameless postmortem and encode the fix as a rule. That rule is the permanent gain the rollout was for: checked on every change, for as long as the rule exists, while human review resets every morning.

See also

#

• You Already Review Code Without Reading It - the diagnosis this series starts from: review already does not involve reading.
• Verifying Code Without Reading It - the technical system this article is about rolling out.
• The Merge Gate - the principle behind the escape hatch: humans where they add value, by blast radius.
• Rethinking Code Review in the Age of LLMs - the upstream case that reading LLM-written code is the wrong tool.