How the Claude Code team does code review

gist

Addy Osmani, Morgan Westlee Lunt and Qing Wang describe how the Claude Code team reviews code at the volume agents now produce. From June to September, they report, merged pull requests more than doubled while the share reverted fell by more than 40 percent. Their answer is layers: verification before a pull request, blocking AI bug and security reviews, risk-tiered human approval, a merge queue, flags and fast rollback. People keep the calls on direction, risky code, architecture, reading evidence and owning outcomes.

ideas

• Review moved before the pull request. Claude runs tests or a build and shows the output, then a fresh-context subagent reviews the diff; repeated reviewer findings get fixed at the source in CLAUDE.md, REVIEW.md, skills or lint rules.
• Findings are voted on before they post. Several agents hunt bugs in parallel and a separate group votes on each finding, with style-only findings dropped. The authors say substantive comments on internal PRs rose from 16% to 54% at the research preview, and every finding must be fixed or resolved with a reason.
• The change sets the risk tier, not the author. A classifier assigns zero, one or two human approvals; sensitive paths and CI workflow files always need a person, an agent's approval never counts as a human's, and approvals reset on commits the system can't vouch for.
• Past incidents became the reviewer's eval. Expert-confirmed incident and revert PRs form a set scored daily, and a change to the reviewer's prompts, tools or model stays only if the score rises. Noise is measured by how people respond to each comment.
• Review has to converge. After one PR ran more than fifty overnight rounds, the team added a three-round cap, diff-only re-review, bug-class flagging and no repeats; one-round passes rose from 65% to 78% and mean reviews fell from 2.08 to 1.32.

quotes