Fixing the PR Bottleneck — Matt Pocock, AIHero transcript

All right, I'm here to talk about fixing the PR bottleneck. And this is kind of a grand title for trying to fix the thing that most organizations struggle with, I think, and have kind of historically struggled with before AI. You know, we have always had huge numbers of PRs just laying around that no one's bothered to review. And this has now increased massively because of the new strains on us because of AI imposing all these weird constraints.

And to do this, I'm going to use the rubric of my skills, which is you've kind of heard about, maybe you've used them. And I have a couple of new skills to announce that are going to hopefully improve the way that you do PRs, improve the way that or improve the speed at which you can review them and do them. Speed. Now, we're being pushed to do more with less essentially or more PRs, more work, more stuff. And this is kind of the central promise of AI that we're going to be able to use these agents to scale ourselves up to do more work.

And this has resulted in the software factory, probably the biggest buzzword of the day. Everyone's talking about software factory that I chat to. And I think of a software factory as primarily something where instead of the human initiating all of this work, we're going to pass some of that initiation, some of the initiation is going to be done by agents. And I think of there. Maybe from there you have a classifier like Jev come in and say, "Okay, let's turn that into a fix or turn that into a reproduction." Or maybe I ping people straight away.

And maybe you have other things. Maybe you have planet scale hooked up. So it gives you query reports on the slow queries on your database. Maybe that then triggers a different um thing of your software factory. All of this is not humans triggering it. It's uh deterministic code triggering it, right? And so these accelerate your software factory. They push more code through it. But then you need brakes, right? If you just have permanent acceleration pushing stuff through your factory, you're going to end up with a slop cannon, right?

You're just going to end up with a ton of slop crappy PRs that you're not going to be able to touch or review or even freaking look at. So, you need breaks. These are mechanisms that slow down, that increase quality, that make sure that your codebase doesn't turn into a software entropy nightmare because code is the environment your agent operates in. And if you have bad code in your codebase, that is going to be more bad code.

And so I'm going to talk about these three breaks in this talk and talk about how we can use them to counterintuitively go faster. So automated checks, these are the deterministic checks in your repo that we've had for thousands of years or you know since the 50s. Deterministic checks where we have linting and tests and type checking and code quality metrics. All of these things going together and they all work the same every time.

Layered on top of that we have automated review. So we have agents who look at our code and say okay you know these are for the things that the tests didn't catch or this is looking at the structure of the codebase in general and then on top of that the third layer the final layer is human review so people looking at the PR and these three layers form this kind of cake that we end up with when we get to human review and so more speed of course means more PRs and so the goal here is to make human review faster by leaning on those first two phases.

And we got to stop the slop. That's the first principle here, which is if you raise the quality of the code that you're shipping, you're going to end up doing less human review because it's just going to be better work. And so you're going to end up needing to uh make fewer interventions. So automated checks. Now, automated checks are cheap. That's the cool thing about them is that they don't cost tokens like automated review does.

They don't cost human effort. They just cost CPU cycles. So these are for instance you know you run your tests on every code change. Maybe those tests do incur some tokens because let's say um an agent uh creates a bug and the tests catch it then you need to spend some tokens to go and fix it but those are tokens pretty well spent in my opinion. So checks are cheap. That means you can layer on loads and loads and loads of them on your repos and you're probably not using enough of them or not being creative enough with your use.

But checks can lie. Does a green CI mean that the code is ready for merge? No, it does not. And so we've always needed on top of these checks some extra layer to figure out if there's anything catastrophically wrong with the code before we ship it. And so all of the other phases, the human review and automated review, these are lie detectors. These are for finding lies in the automated checks. Now I want to show you some of these lies first of all because this helps when we're thinking about code and thinking about automated checks to see how bad it is and how bad things can get.

The first is tortological tests. A test that just reasserts the implementation. Opus 5 got addicted to these. I don't quite understand why it would have for instance x post character limit equals 280. Can anyone guess the test that was written to test this behavior? Right? You've probably seen this a thousand times. This is real code from agents or from stuff that I found my agents doing. It said expect x post character limit to be 280.

So the implementation looked like that and the test essentially reasserted the implementation. That is a tortological test and tortological tests are bad because they're extremely structure sensitive. They're very sensitive to the actual internal workings of the system. So it means I cannot change that constant without a test failing but I cannot rename that constant without a test failing like I have to do is so tied into the structure of my system.

And I found another one which is even more egregious. I would say this is incredible uh test. What it's doing here is it's essentially testing whether two things in the UI appear in the right order. So it's checking that the pitch detail page uh or rather the video section comes after the content plan. What it does is it doesn't render it to a screen. It just reads the actual file the module into its own memory and then it's finds the right thing.

So finds content plan, finds videos, and then it expects the videos to be after it in the source material, which is crazy if you think about it because I can just like change the way the source material looks and this test will fail. It's too sensitive to the structure of my codebase. So that's another way that automated checks can fail. And there are also or sorry, automated checks can lie. There are also tests that literally cannot fail.

And this will feel familiar to you if you've abused mocking in the past or abused various things. For instance, here we have a use audio boost function. And this use audio boost function uh its internals use the audio context API in the DOM. Don't worry if you don't know any of this, but what we're doing here is we're just stubbing it out with some fake methods. And it turns out the audio context has some complicated error modes and it will fail if you use it under strange conditions.

And so just doing this means our tests cannot fail using those modes and we're going to hit strange errors in production that our tests can't fix. And so the question is then if you can cheat on automated checks if you know and even in good faith ways as well. The the AI isn't trying to write bad tests here. It's just taking our instructions and writing tests that are too tied into the structure instead of actually executing code.

So how do we make automated checks harder to cheat? If we can do that then we can increase the quality of those checks which means which increases our quality bar. And the first thing I really like about this is codebased design. So you can actually design your way out of these bad checks. So what does good codebased design look like? I've talked about this before in previous AI engineer talks I've given which are deep modules.

These are modules that hide complex behavior behind simple interfaces. This is a John ouster idea from the philosophy of software design. If we look at these two modules, we've got A which has a large implementation hiding behind a tiny little interface at the top. Okay? And then B is a large interface, lots of functions you can call and those functions individually don't do very much. Does that make sense? Yeah. Now, if you have a deep module like a here, you're going to have fewer structure sensitive tests because you're hiding more of the implementation behind that interface.

If it's just testing at that interface, you're going to get better tests. And so, your job here is to force the agent to use that little interface instead of reaching into the implementation to test these weird implementation details. So, I've got a skill for this. You can have like the weirdest vibecoded like codebase, the crappiest codebase that you've ever set your eyes on and you can run this skill on it and it will make it better.

What this does is essentially gives you opportunities for deepening modules and kind of looks like this. Raise your hands if you've used this skill. By the way, not sure how many of my folks are in this room. Yeah. Okay. It's really freaking nice. Essentially gives you a HTML document. So, I'll get out of the way here of all of the different um potential opportunities it sees. So, we can see here we have a before and we have an after where we're sort of like reducing duplication.

We're creating a nice deep testable module. And then you can go ahead and implement that. And attached to this, there's also this kind of language that I've put together for describing modules. Because like if you ever try and read up about how to structure a codebase, you're going to find 20 different approaches and they're all going to be called DDD. And like what you need is a consistent language that you can use in your team to talk about this stuff.

And so I have a little codebased design skill that defines what locality is, defines what leverage is, defines what a seam is. I was using seams before they were cool. And what locality means is kind of how uh well located together all of the code is. How can you change like a small change in one module and have it ripple out? And also leverage is what you get when you have a deep module because the caller, the person who's actually calling that module gets a lot of value of calling a simple function.

Both of those are very good in code bases and good for agents too, it turns out. But I'm sort of describing all of these highluting coding standards. But how do we actually make sure the agent does them right? How do you make sure the agent creates deep modules and creates good tests and doesn't write these crap to logical ones or structure sensitive tests? Well, I do think most people get this wrong. And my first piece of advice is don't put coding standards in your implement agent.

Okay, let me explain this. If you imagine the implement agent kind of looks like this where this is all of the things the agent needs to be able to do in its single context window. It needs to be able to explore like to look for the code that it's going to change. It then needs to actually change it. So make the updates to the files in the green and then it needs some budget for actually debugging the thing. So for running those uh automated checks, for actually checking and verifying that it works.

Now this is quite a lot of work it turns out. And if you try to impose your coding standards on it as well, it's going to perform worse. So implementation is overloaded. That's the mental model I want you to have. And so can we find a way to impose those coding standards in a way that isn't so overloaded? Well, this is my effort. This is my code review skill. And it receives a diff and it reads a file inside the repository called coding standards which you can write, you can customize and then it checks if the code follows those standards.

And so if we look at the reviewer agent here, it also crucially runs it in a sub agent. So it's got its own context window to kind of handle here. It's got its own budget. This one it needs to do some exploration, right? Because sure it receives the diff so it knows exactly where it's located, where the code is, but it should probably do a bit of exploration just so it has the wider context, understands the code, but it doesn't need to do any implementation, doesn't need to do any debugging.

So while implementation is overloaded, review is actually underloaded. So it doesn't have that many jobs to do. This means you can pile in a bunch of coding standards to it and it will do a much better job than if you try to do it with implement. So, I think of this, and this is uncomfortable, right? Because we we all want to be able to just get good code out the first time, but I think of this as the twopart process for writing good code, which is implement, you make it work, and then code review.

You actually make it good. You impose your coding standards. And for, you know, the retro developers among us, this is essentially a red green refactor approach. We use one context window to make it okay. Do the red green and then we do another context window to refactor it. That's at least how it works in my head and it's been very successful for me. This means that when you have coding standards, you don't put them in global scope.

You don't put them in agents.mmd because then they sort of drown out your implement. It may read them, it may not. You put them in coding standards.mmd and that way just the code review agent does it. Now, I've got another idea here, which is I've been talking to lots of people today. Lots of people saying, you know, I've been talking about review and automated review increased, you know, fixing the PR bottleneck. So many folks say, "Oh, yeah, we just use a third party service.

We use a cursor bug bot. We use code rabbit or something like that." I think that I've I've really tried to make a generic code review skill in the past that finds all the bugs and does security review and that kind of thing. It turns out it's really really hard because you either make it too general and it just gives you false positives that aren't actually relevant to your use case or you make it too specific. You say, "Okay, find all the TypeScript stuff and then Rust people can't use it." So I would say don't outsource automated review.

Build your own. Build up your own coding standards over time. Share them across your team. And if you have an opportunity to impose coding standards, if you've got some docs sitting around that no one reads, this is the place to put them in. And also when you have this automated reviewer, a really natural inclination for lots of people is to say, "Oh yeah, my code review agent, what it does is it reads the code and then it comments on the PR." So what your code review agent is doing in that case is it's providing more work for the human reviewer.

The human reviewer then has to read all of these verbose comments and figure out, okay, do we implement this? Do we implement that? The reviewer should commit. It should make fixes. So, it should actually change the things that it finds because then when the human comes around, you're reviewing a really nice artifact. If it finds anything that it has any questions over, then of course it can comment. But the default should be commits.

Stop trying to oneshot good code. Stop trying to make the implement agent the only thing that you do and go, "Okay, I'm going to force it to be amazing." It takes a little bit of, you know, thinking your way out of there, but once you realize it, it is fabulous. So, okay, with all of that process, we've run our automated checks. We've now run our automated review to make sure the automated checks aren't lying. How do we then maximize the PR's quality in terms of human review?

How do we get it like working the best it can? So, we need a human friendly PR. And this is a new skill uh coming into the repo which is currently in progress, but I'll be releasing it soon, which is the PR skill. This is one I've been mulling over for a long, long time. I haven't quite figured out what the state-of-the-art is. And I've realized the best way to make a PR skill is just to steal all the best ideas that everyone's got.

And it's very nice. Now, what does a good PR body look like? How would you recreate this skill on your own? Well, the first principle is some reviews are more important than others. Not every review is essential, right? And once you understand this, you realize, okay, that means I can focus my energy on the really important reviews. But how do we categorize that? Well, you got to think about the PR as using this AWS terminology, which is is it a one-way door or is it a two-way door?

Now, most PRs that you have will be two-way doors. You can merge the PR and then always pull it back later. It's the glorious benefit of being a software engineer as opposed to a civil engineer, right? Mostly when you're a civil engineer, it's a it's a one-way door, right? If you get something wrong, that bridge is going down. But if you have a two-way door, it means that you can easily revert the change. Now, that might be more um bit more nuanced than you might expect.

It might be that a very simple change accidentally blasts out an email to 60,000 people or something in which case that is a one-way door. You want to review that very very carefully. Involves expensive migrations or data loss. That is a one-way door. Review the hell out of that PR. But also tied on to that, we need to understand the blast radius of this PR. What can go wrong? And if things do go wrong, how bad is it?

And this means I end up with a nice little sort of summary right at the bottom of all of my PRs, which is the merge danger. I can see this one is a two-way door. It blast radius is localized. And so I can see, fantastic. I don't need to pay that much attention to this. I'm just going to sort of review it a little. That's really important. Next, we need to understand what the PR is even doing, right? And I've tried lots of different ways of figuring this out, and the best thing I've come up with is using pseudo code.

Now, a huge um point of gratitude here to the show me skill from the human layer skills repo by Dex Holley. This is a phenomenal skill that just essentially dispenses with most text and shows things to you in images and diagrams instead. This makes it a lot easier to grasp actually what's changing and why it's changing. So you get the kind of standard sort of set of like mermaid diagrams and UML for you know this is a sort of sequence of things that happened.

You also just get these lovely simple ones like this for instance. We can look at this and go okay we're working in a CLI. We can see a new command has been added and we've got two new things little flags up the top here. Just little summaries like this. It really does make a massive difference. It's hard to overstate. So you're trying to like make understanding the why as fast as possible. And I think a third principle here is something you should be thinking about whenever you do human review because because we're not doing like um because our processes now are so sort of streamlined and all we're all collaborating around these same skill files, these same steering files.

We're all building an environment for our agents to operate in together. You should think of the process that produces your code as just as important as the code itself. In other words, when you do a human review, you're not just reviewing the code, you're reviewing the system that creates it. And the theory here is that you never want to write the same comment twice, right? You never want to catch the agent doing the same thing over two PRs.

And so, what's the mechanism by which you can make your human review matter? Well, this is a new skill. This is called retro. Retro for retrospective. You essentially take a session that you've done. It can either be like a single um agent session or it can be a PR plus the session or you can just get it to look at okay look at all of the PRs that we've done over the last week. All of the reviews, pull them all in. Let's do a retrospective on them and it will suggest automated checks and coding standards to make the next one better.

So this is the compounding effect where you essentially by doing human review you're making the quality of the next human review higher and you're sort of saving less work from yourself next time. And retro is a really smart skill. It adds a bunch of stuff. So obviously it suggests automated checks. It suggests updates to coding standards.md. It does other smart stuff too. So it looks at navigation pointers. How easily did the agent find its information?

Can we provide a pointer inside agents.mmd to help it out next time? It looks at tool economy. Are there different tools that we're using in the session that can, you know, could be made more token efficient? It's amazing how many things this catches actually because those are often really hard to debug from the outside. It just looks at bloat as well. So, are there bloated steering files? Are there bloated skills that contribute to these bad results?

Can we make them more organized? So that's the goal is to make human review faster. We do that by layering up automated checks. We're layering up automated review. And we make the human review as painless, as simple, and as kind of optional as we need it to. You really don't need to review every single two-way door. Every single oneway door you do. And so these are my skills. Aihero.dev/skills. I'll be shipping version 1.3 this week.

It has been glorious hanging out with you. It's been a really nice conference. I'm going to be outside in the lobby if anyone wants to have a chat. Uh, thank you so much for having me. Thank you, Paris.