Process

Human review

You might say: approval, owner review, code review

A person reads the diff or the changed files before the change merges. Reading the agent's account of what it did does not count. Human review is the slowest gate, so a factory starts with it on every pull request and, as checks and verification earn trust, keeps it for high-risk changes, one-way doors and changes to the gates. For the rest, the person checks the outcome and the evidence.

What it does

Supplies accountability and judgement for requirements and consequences that automated gates may miss, and teaches the factory what to check next.

Ask

Who owns the change, what did they actually read, and what can only a person decide here?

What to look for

1. A named reviewer and approval state on a pull request
2. A review comment or resolved conversation
3. A merge control blocked until required approval exists

Catalogue: Checkpoint

• Every pull request: A person reads every diff before it merges. A factory starts here, and what the reviewer catches becomes new checks.
• Plan before work: A person reads the spec or plan before the run starts, while a change of direction costs minutes.
• High-risk changes only: Low- and medium-risk changes merge on checks and evidence. A person reads the diff of high-risk changes, one-way doors and changes to the gates.
• None (dark factory): No person reads the factory's code. Automated checks and automated review are the only gates, and people judge the software by scenarios and outcomes. This is credible only where agents cannot game that evidence, as with holdout scenarios run against twins of outside services.

Connections

• Controls: Pull request
• See also: Autonomy level

Sources

1. Matt Pocock, AI Coding Dictionary, Human reviewReading the diff or the changed files counts; reading the agent's description of what it did does not
2. Matt Pocock, AI Coding Dictionary, Human reviewAgents raise the volume of code produced, so review becomes the bottleneck.
3. Matt Pocock, AI Coding Dictionary, Human reviewWhere you place the review checkpoint is a human-in-the-loop decision
4. Matt Pocock, software-factory skill (pull request #1316), Start slowa human reads the PR before it merges; what it catches becomes new automated checks and sharper automated review.
5. Addy Osmani, Beyond Vibe Coding: From Coder to AI-Era Developer, Human oversight (author's book site)Always maintain human oversight as the final reviewer and approver of all agent work
6. GitHub, About protected branches, Require pull request reviews before mergingIf you enable required reviews, collaborators can only push changes to a protected branch via a pull request that is approved by the required number of reviewers
7. Birgitta Böckeler, To vibe or not to vibe, A sliding scale of review effortHigh probability + high impact + low detectability High level of review is advisable. Assume the AI might be wrong and cover for it.
8. Titus Winters et al., Software Engineering at Google, Code ReviewCode review is a process in which code is reviewed by someone other than the author, often before the introduction of that code into a codebase.
9. Kent C. Dodds, You Own the Outcome: Product Engineering in the Age of AI, Shipping a feature without writing itI didn't read that diff line by line. I read the outcome: does it do what we decided it should do, and did the gates I trust pass?

Use it on your project

teardown-apply: hold "Human review" (human-review) from the teardown at https://teardownatlas.com/software-factory/ against my project

Paste it into a coding agent that has the teardown skills.

An AI agent wrote this map with the teardown skill. It can contain errors: check the sources before you rely on a part. About and legal