AI writes, AI reviews: independence needs to be demonstrated

Agents already occupy both sides of the pull request. One produces change; another comments, classifies or recommends. The flow can reduce latency and expand coverage. It can also manufacture a review appearance when authorship, criticism, verification and authority remain attached to the same circuit.

This Evidence Brief part of the paper AI-to-AI Code Reviews of GitHub Pull Requests to define a technical contract for segregation of authority. It does not state that revision IA-for-IA is bad, nor that different product proves independence.

What was observed

The authors used public events of GitHub between 01/01/2024 and 15/04/2026 and signatures attributable to agents. Among 2,830.284 PRs identified as agent-authored, 248,641 received at least one review attributed to AI — 8.8% of the attributable population.

• 45,269 received cross-product review;
• 208,145 received a similar-product review;
• 4,773 appeared in both categories;
• cross-product represented approximately 1.6% of the 2.83 million PRs attributed to agents.

O replication package publishes scripts, filtered cohorts, registration of signatures, tables and figures. This improves reproducibility, but remains a material of the same authors, not an independent replication.

Closed-loop is not no-human-loop

In paper, closed-loop only means that AI appears on both sides of the PR. The dataset does not allow determining whether a person has also reviewed, tested or approved. The absence of human event in the clipping does not prove absence of human judgment.

Counts are also lower limits: missing or removed signatures cause sub-allocation. Private repositories, GitHub Enterprise, other unrecognized platforms and agents stay out.

Four things the study did not measure

1. quality or correction of the code;
2. quality, severity or groundedness of comments;
3. causal effect of same-product versus cross-product;
4. presence or absence of human review.

Differences in volume and latency may reflect PR size, language, repository, integration, configuration and composition of reviewers. More comments are activity; they are not automatic evidence of defects found or reduced risk.

Different product is not independent authority

Independence requires separating at least five plans:

Changing the brand of the reviewer can diversify context, but different products can share model, dependencies, incentives or permissions. The same product can also call really different verifiers. The unit of independence is the authority and the mechanismNot the logo.

Different papers help create a counterpoint as long as the system preserves those who perform, those who check and those who accept. [R1-C3]

Pull request gate for agent streams

1. Diff identity and provenance

Record the agent/product when attributable, human executor, spec, base commit, changed files, dependencies, tools and limitations. Incomplete provenance must remain unknown, never become “human” by exclusion.

2. Review as a sign, not authority

The agent's comment enters as ending with explicit rule of severity, deduplication, resolution and false positive. Merge approval remains linked to an authorized authority.

3. Ownership by risk

Use CODEOWNERS or equivalent mechanism for identity, authorization, payments, migrations, infrastructure and data. An owner needs to review the property under his responsibility, not just confirm that the bot commented.

4. Safe checks

Require lint checks, types, tests, security, dependencies, negative tests, contract, migration, rollback and evals at risk. An agent can trigger and interpret checks; he should not be able to silently rewrite the policy that decides the merge.

Small and isolated changes increase revisitability, but separate workspace is neither sandbox nor security guarantee. [R1-C2]

5. Last push under new approval

A GitHub branch protection can invalidate approval after a new commit or require another person to approve the latest push. Without this, a later change can be merged based on a review of an old diff.

6. Explicit merge and bypass

Restrict who can push, merge, dispense review or change checks. Exception needs motive, authority, validity, and trail — especially when those who have generated change also control bypass.

7. Source and build linked to release

SLSA 1.2 defines provenance as verifiable information about where an artifact came from and where, when and how it was produced. Preserve the commit, inputs, builder, digest and promotion receipt to prove that what was reviewed is what operates.

Permissions and gates need to exist outside the model and be tested on the delivery system. [HARNESS31-C2]

Risk proportional authority matrix

The table is the author's professional analysis, not the paper's result. The goal is to calibrate authority, not impose a universal topology.

Evidence Packet of the merge

A governmentable merge must allow for reconstruction:

• which decision and spec started the change;
• who or what agent produced and reviewed;
• which exact diff was evaluated;
• which endings were accepted, corrected or dismissed;
• which checks have been run, in which commit and with which result;
• who approved the residual risk;
• which artifact by digest was promoted;
• which smoke test, monitoring and rollback sustain the operation.

If the answer exists only in the agent's summary, the organization has a narrative — not evidence.

What this brief proves — and what does not prove

The study proves that events attributed to agents on both sides of the PR are already numerous in public projects and that combinations exhibit distinct patterns. It does not prove that same-product is complacent, that cross-product is independent, that bots have replaced humans or that the resulting code has more or less quality.

The controls of this brief derive from the paper, official documentation and professional experience of the author. They are a proposal for technical governance, not a causal finding of researchers.

Direct sources

• Paper — AI-to-AI Code Reviews of GitHub Pull Requests
• Replication package
• CodAGE — dataset-base
• GitHub — pull request reviews
• GitHub — protected branches
• GitHub — CODEOWNERS
• NIST SP 800-218 — Secure Software Development Framework
• SLSA 1.2 — provenance

Conclusion

AI can write and review in the same stream. What she cannot do alone is create legitimacy for her own approval.

Independence needs to appear in separate authorities, verified properties, protected checks, provenance and a person accountable by merge and operation.