标签：#review

Every AI code reviewer claims it respects your team's standards. Very few can tell you what those standards actually are. The test is mechanical. Ask the tool, or the vendor, one question: where do my rules live? If the honest answer is "we loaded a generic style guide plus whatever your PR description happened to say", then your standards aren't in the model at all. The reviewer is running on vibes and hoping your repo looks conventional enough to pass. The tools that genuinely track your rules share a shape: the standards are an input, not a hope. They read your rule files, your linter config, your past review comments, sometimes your docs. The review is judged against that artifact, which means when a comment fires you can ask "which rule?" and get a config line back, not a paragraph of model reasoning. That last part is the thing worth testing for. If a reviewer can't point to the specific rule it applied, it is not following your standards. It is approximating what it assumes standards look like. Those two feel identical for the first six months, then diverge exactly when you've stopped proofreading its output. A short checklist when you trial one: Does it ingest a rules file, or only the PR context? Can it point to the exact rule that triggered a comment? Does it adapt to your historical review style, or reset every run? Is a "rule" something you can open, read, and edit in the UI? If the answer to all four is no, you bought a very chatty spellchecker that happens to be trained on GitHub. The eval that actually decides it: can your own reviewer reproduce one of your team's real past review decisions, given only your real rules file? Run that before you hand it a production PR.

This paper (arxiv 2607.24888) is worth a stop if you evaluate AI code review. It shows Ken Thompson's trusting-trust attack is not compiler-specific: the authors pull it off with GNU strip, a build utility that neither reads nor generates source, using only tampered finished ELF binaries. In the NixOS bootstrap, one malicious strip in the binary seed implants a payload that propagates to the next strip generation and survives into the final standard environment after the seed is gone. The uncomfortable part for anyone building or buying AI review: these tools read the patch text and the source, and none of them reads the build path or the binary seed. And that is not a limitation a bigger model fixes. Put the strongest reasoning model in the world on that source diff and it sees a clean PR, because the malicious code is not in the source at all. It arrived as a finished strip binary in the dependency closure. I keep bumping into the same split and this paper is the cleanest example yet. Two jobs get lumped together. One is "did this source diff introduce a bug or flaw", and AI is genuinely, surprisingly good at that. The other is "does the artifact your users run match the source you reviewed", and no diff-based review, human or model, can answer yes to that. That is an artifact provenance and build reproducibility job, not a code review job. So the rule for teams adopting AI review: use it for the first job, and do not let its approval make you feel covered on the second. If your acceptance criterion becomes "the model said the diff is fine", you have traded the compiler-trust problem for a strip-trust problem and called it a win.

Thanks to their ability to provide a smooth ride and quiet powertrain with ease, electric vehicles are a true shoo-in for the high-end luxury automotive segment. Rolls-Royce has the Spectre, Cadillac's Celestiq is taking bespoke to a whole new level, and Mercedes has given the EQS the full Maybach treatment. From Volkswagen Auto Group, Bentley […]

The bottleneck moved. For years the slow part was typing. Now four hundred lines arrive in nine seconds, and the slow part is you, reading them. We have not adjusted. We still measure a good day by how much appeared. But nothing counts until somebody understands it, and understanding did not get faster. So the pile grows. Code that runs. Code that passes. Code nobody has actually read. It works the way a stranger's directions work. Fine until the first turn you did not expect. Then you are debugging something you never wrote, in a shape you did not choose, at an hour you did not pick. The honest limit is simple. Do not accept more than you can review. Not more than you can skim. More than you can review, meaning you could defend every decision in it to someone who disagrees. If that takes an hour, then an hour is your budget, whatever the machine can produce. So ask for less. One function, not one module. One change, not one feature. A first draft you can argue with, rather than a finished thing you are tempted to trust because it is long and it is tidy. Tidy is not correct. It never was. The machine is simply better at looking finished than we ever were. Read it the way you would if a contractor handed you the keys and left the country. Because that is the arrangement. It will not be there when it fails. You will. There is a quiet cost, too. Every line you accepted without reading is a line you cannot reason about once the incident starts, and the incident does not care who typed it. The old skill was producing. The new skill is refusing. Not this. Not yet. Not in that shape. Generation is cheap now. Attention is not, and attention was always the whole of the job. Slow down at the only step that ever mattered. – Serguey Asael Shinder

The Fairphone 6 Plus feels like an extremely average midrange Android phone and I couldn't be more thrilled. The mission has always been admirable. Fairphone seeks out ethically sourced materials and offers a high degree of repairability for its devices. But the phones themselves required a lot of sacrifices, like putting up with underpowered processors […]

Mandatory AI checks paired with manual spikes for complex changes keep developers sharp. Teams can boost velocity by skipping peer reviews on low-risk PRs and using AI approvals, provided most developers are code owners and teams are small. By Ben Linders

I sat in on Margaret-Anne Storey's DORA community session last week, and she put a name on the thing I'd been circling since April. It isn't technical debt. Her ACM Queue piece splits software health into three debts. Technical debt is the familiar one: implementation choices that make tomorrow's change harder. Intent debt is the missing rationale, the goals and constraints that say what a system is even for, which now has to be legible to agents and not just to people. Cognitive debt is the one that stopped me. It's the erosion of shared understanding, the state where nobody on the team can confidently explain how the system works or predict what a change will break. Read that again if you review pull requests for a living. I closed a thirteen-post retrospective last month admitting I couldn't answer one question: how many AI-generated pull requests a week can a review process absorb before it stops working as a control? I still don't have that number. What I have now is a name for what you accumulate while you don't have it, and a way to find yours. Approval velocity measures motion Every metric most teams watch gets better as review collapses. Merge rate climbs. Time-to-approve drops. The throughput chart looks terrific right up until the incident review, because a reviewer who has quietly become a rubber stamp is indistinguishable from a fast reviewer in every dashboard you own today. Cognitive debt doesn't announce itself as a red number. It shows up as green ones, arriving faster. I know this failure mode from the inside. Two months of green CI on conformance checks that had never once passed , on my own project. A human audit caught it. No metric I was watching came close. What you need to measure is detection. Almost nobody does. Mutation testing, pointed at the reviewers We solved this once already, for test suites. Mutation testing injects known bugs into code and checks whether the tests catch them. A suite that passes everything might be thorough or migh

Last week, I powered on a 26-year-old copy of Pokémon Pinball, one of the best Game Boy games ever made. My save file was no more. The Charmander I'd caught for my daughter, the high scores we'd set together… gone. Before flash memory, Nintendo cartridges used tiny watch batteries to save their games, and those […]

Sonos unveiled a bunch of new stuff today at its open house event. There's the $699 Beam Ultra soundbar and the $449 Ace Ultra headphones, plus several under-the-hood app updates (some coming sooner than others). While the show floor was a less than ideal venue to judge audio quality of either new product, a private […]

The flagship headphones get up to 57 hours of battery life and have easily replaceable batteries.

It's the lightest Bentley in 85 years.

Director Dave Green's live action/animated hybrid captures smart, subversive weirdness of the classic cartoons.

I wouldn’t call it cheap, but this monitor from Asus brings proper HDR-capable video editing to creators who couldn’t previously afford an OLED display.

DoorDash has moved engineering agent workloads from developer laptops to its Flux cloud platform. The platform automated 130,000 engineering tasks in one month and supports more than 25,000 automated code reviews weekly. Flux uses isolated Firecracker microVMs, an MCP gateway, reusable playbooks, and multiple invocation surfaces to run agent workflows with scoped access and centralized auditing. By Leela Kumili

I recently dug out my CDs and started reripping them all. I've found a few forgotten gems in there, but few hit harder for me than the beautifully concise Professor Murder Rides the Subway EP. There was a period of time in the mid-aughts in NYC where it seemed like every indie band wanted you […]

For about a year, my AI code review setup looked like this: AI gets a PR, AI greps for related code, AI reads way too many files, AI says "looks fine." It mostly worked. Until the bugs that didn't show up in grep started shipping. The problem wasn't the model. It was the retrieval. Vector search and keyword grep are great at finding files that mention auth.py . They're terrible at finding files that depend on auth.py through three import hops, an event bus, and a decorator. That's where the bugs live. I rewired the retrieval layer with a code knowledge graph plugged in through MCP. Three bugs surfaced in the first week that vector search had been quietly missing. Here's what changed and the bugs themselves. Why grep + vector search missed these Vector search retrieves by semantic similarity . "Find code about authentication" finds auth.py , login.py , password_validator.py . Useful. Knowledge graphs retrieve by structural relationship . "What depends on auth.py ?" returns the call graph -- including event_handlers/login_event.py , which never mentions auth in its variable names but listens to a login event whose payload changes when auth.py changes. Both are valid. They answer different questions. The bugs that ship to production tend to live in the second question. The setup: code KG as an MCP server The Model Context Protocol (MCP), released by Anthropic in late 2024, lets you expose tools to a model in a standard way. By 2026 it's supported by Claude Code, Cursor, Windsurf, Zed, VS Code, and (as of GA in May 2025) the official MCP Registry hosts hundreds of servers. I used code-review-graph , an open-source tool that builds a property graph of your codebase and exposes it as an MCP server. The setup is a three-line ritual: pip install code-review-graph code-review-graph build ./my-project code-review-graph install # auto-detects Claude Code / Cursor / Windsurf The graph contains nodes for files, classes, functions, and tests, with edges for imports, calls, inheri

On 2026-08-25 at 21:27 EDT I pushed this to self-correcting-integration-maintainer: fix: repair...

A roundup of recent reviews from Engadget.

What do you want from a flip phone when it's closed? A simple interface, perhaps notifications and a widget or two, for handling the basics? Or a fully fledged Android experience shrunk down for the Flip form factor? For years, Samsung has insisted on the former, even as some fans - and Razr rival Motorola […]

Outstanding call quality and an excellent price point put these earbuds way ahead of pricier competition.