All learnings

Learning 02 · 1 min read

Never let an agent grade its own work

The agent that wrote the code is the worst one to test it. A fresh verifier changed how much we trust a PR.

The problem with self-review

An agent that built a feature carries the same assumptions into testing it. It checks what it meant to build, not what it actually built.

What we did instead

Our /prove-it step sends a fresh verifier agent that did not write the code. It tests the change in a real browser, like a careful human tester, against a checklist for roles, payments, personal data, accessibility and security. A separate implementer fixes each proven finding, starting with a failing test.

Two rules make it trustworthy: a step that could not run is marked blocked, and a gap is never counted as a pass.

What reviewers get

One clear verdict on the PR — pass, pass with notes, needs a decision, or fail — with evidence. Reviewers stop hoping someone clicked through the change.