The Diff I Approved Without Reading

The scroll never slows down.

The diff slides up my screen at one even pace, the way a night guard’s flashlight sweeps an empty office. Every automated check has passed. I approve it, and the next one is already waiting.

None of the diff I just approved is mine: I described what I wanted, the agent built it, and I read its confident summary and nodded at the screen as if it could see me.

Hand a sprawling agent diff to the most careful senior engineer you know, and you can watch the same even scroll. Then he clicks approve. It isn’t carelessness, though I’m no longer sure what it is instead.

Two kinds of reading

There is a reading that builds a model in your head — you follow the data through the function, you hold the shape, you catch the off-by-one because you’re standing inside the logic. And there is a reading that scans for alarm. The second kind is faster. It’s the one you do when the code is already written, already tested, already green, and the only question left is whether anything smells wrong.

I’ve watched engineers do the first kind with a finger on the screen, mouthing variable names, following one value from where it enters to where it gets saved. It looks slow from the outside. It is how the floor plan gets into their heads.

Now the agent does the building, and engineers have been quietly promoted to the second kind without anyone telling them the title changed. I read the agent’s work the way you read a contract you’ve already decided to sign — looking for the clause that could hurt me, not the meaning of the whole.

The alarm-scan is a genuine skill, and on a good day it pays for itself: it catches the password pasted into a configuration file, the test that checks nothing, the query that runs once for every row. But it was designed to find alarms, and alarms are all it finds.

What it can’t detect is absence. A validation step that should exist and doesn’t looks like nothing at all — there’s no line to frown at, only a gap between two lines that both seem fine. That careful engineer’s even scroll would slide right past it, and so would mine.

Scanning for alarm only works if someone, somewhere, built the model you’re scanning against. That someone used to be whoever wrote the code, and now I finish a review knowing the change is probably fine and knowing almost nothing else about it.

What you stop knowing

A codebase you write is a place you live in. You know which room the light switch is in because you put it there. A codebase you approve is a place you visit — you can find your way around, mostly.

I notice it most in the pause before I can answer a question I used to answer instantly, the kind someone on a call asks in passing. Where does that get validated? I knew, once. Now I have to go and look, the way a stranger would.

The pause lasts a few seconds, and no one else on the call catches it. The delay is small, which is the trouble — it registers as being busy, one more thing to look up in a day full of things to look up.

The first thing to disappear isn’t the big picture — I can still explain what the system is for and roughly how it hangs together. What erodes is the middle distance: which component calls which, where a value gets cleaned up before it’s saved, the one odd rule that exists for a reason nobody wrote down.

When I go looking, I find the answer in a corner of the code I have no memory of, put there by a change I approved on an afternoon I also have no memory of. The agent probably had a good reason, and I never asked what it was. Nothing was hidden from me; I stopped carrying the floor plan, and I never noticed the day I put it down.

The harder version waits for that careful engineer some night, when an alert goes off and he gets up half-awake and goes straight to the code he’d have sworn is to blame. The wall has moved. It moved weeks ago, in a diff he approved on the way to lunch. He never learned why, so he learns it now, and the only one who ever knew was an agent session — long since closed. The fix is deployed by morning, and the write-up is short and polite. Nothing in it mentions what actually went missing.

Learning where to look

Sooner or later, in a coaching conversation about agents, someone reaches for the word trust. They trust the agent now, or they don’t trust it yet, or they’re stuck in the uncomfortable middle, waiting to feel certain. It’s usually the wrong word for what they mean. They think trust means not checking. It doesn’t. The people I trust most are the ones whose work I know exactly how to check. I’ve learned where they tend to be wrong, and I look there first.

The people I trust most are the ones whose work I know exactly how to check.

The best reviewers I know work this way: ask one of them which teammate she trusts like that, and she names him without a pause. He gets the happy path right and forgets what happens when the database is slow to respond, so she reads his error handling first — slowly, the model-building way — and skims the rest. She earned that skim by catching him, again and again, in the same place. From the outside, her skim looks identical to mine. It isn’t. Hers is paid for. Mine is borrowed.

Trusting an agent should be the same discipline, and it’s harder, because the agent has no tendencies I’ve had time to learn. It’s wrong in a different place almost every time. So the reading that scans for alarm has to get smarter, not lazier. I have to bring the model the code no longer builds for me.

That means changing the question: I can’t yet learn where the agent tends to be wrong, but I can learn where this particular system tends to hurt people. Every codebase has a few rooms like that — the place money moves, the place outside input gets validated, the place two parts of the system have to agree about who a user is. The agent’s mistakes wander. Those rooms stay put.

Before I scroll anything else, I find them in the diff and read them the slow way, however green the checks are. The agent will point at any of them if I ask, but I still have to be the one who knows to ask. Everything else gets the alarm-scan, and I’ve stopped pretending it’s more.

It doesn’t make me faster. It keeps those rooms lit.

The catch is that knowing which places are dangerous takes the floor plan, and the floor plan is the very thing fast approvals wear away. My approval goes through, the feature ships, and it works. It usually works. That’s the part that makes this hard to admit — nothing goes wrong often enough to scare anyone. The cost isn’t the outage. It’s the slow forgetting of where the walls are, one approval at a time.

Most days I still click fast, because there’s always another diff waiting behind this one. But before I do, I try to answer the question without looking. Where does that get validated?

Some days I know. The days I don’t, that diff waits until I can find the wall in the dark.