Code Review Is the Bottleneck Now
July 31, 2026
Code review is the bottleneck now. AI made writing cheap. High-output teams did not get a matching lift in human approval, and the queue is where the gains go to die. This is not a pitch to buy an AI reviewer. It is a redesign of the lane so generation speed stops rotting into rubber stamps and senior burnout.
Writing got cheap. Review did not.#
Sam Hogan put the shift in one public line in March 2026. Code velocity rose 3–5x, he wrote, and PR review had already become a bottleneck for high-output teams. Code, in that frame, is high-velocity data. The git checkout / branch / push / PR / review loop is the old pipe.
The measured gap is uglier than a vibe. Faros AI's telemetry across 10,000+ developers and 1,255 teams found high AI adoption teams complete 21% more tasks and merge 98% more pull requests, while PR review time rises 91%. Average PR size jumps 154%. Bugs per developer tick up 9%. Company-level DORA and throughput show no significant correlation with AI adoption. Amdahl's Law does not care how fast the author types.
CircleCI's 2026 State of Software Delivery (28M+ workflows) shows the same split in a different unit. Median feature-branch throughput is up 15%. Median main-branch throughput is down 7%. Teams write more. They ship less of it.
If the roadmap still crawls while PR count soars, the scarce resource is no longer keystrokes. It is someone who will stake their name on the merge.
The counter that almost kills the thesis#
The strongest pushback is honest. O'Reilly's synthesis argues coding was never the real shipping bottleneck. Product decisions, design reviews, QA, compliance, infrastructure, and release processes were always slower than typing. Speed up generation and more work-in-progress slams into those same walls.
Fiona Fung, talking about Claude Code at Anthropic, said writing, tests, and refactoring rarely slow the team now. Verification moved into the critical path, along with code review and security. CircleCI names the pile the same way.
- Review as the human approval queue
- Validation and integration in CI
- Recovery when green builds turn red
So the refined claim is not that review is the only constraint. CI is a machine queue. Product is a decision queue. Code review is the human queue people can name on Monday morning, and it is the first place AI generation visibly doubles the work. Fixing only CI while every PR still demands the same senior read still fails the week.
A sibling failure mode is skipping the gate entirely. That path is vibe coding into production. This post assumes the gate stays. The problem is the line at the gate.
Stop treating every PR like a full tribunal#
Equal review for every diff is how the queue grows. A README typo and a change under auth/ do not deserve the same ceremony.
Cloudflare's internal AI review system classifies merge requests into trivial, lite, and full risk tiers from diff size, file count, and security-sensitive paths. Trivial (about ≤10 lines) gets a thin pass. Full (large diffs, or anything touching auth and crypto-shaped paths) gets the whole specialist panel. In one measured month they ran 131,246 reviews across 48,095 merge requests in 5,169 repos. Median wall time was 3m 39s. Average cost about $1.19. Break-glass overrides hit 0.6% of MRs.
The point is not their bill. The point is the policy. Most volume should never reach a full tribunal.
Ask HN threads on AI PR load land in the same place. Risk-score auto-approve for low risk. Human attention reserved for impact. Reciprocal diligence for authors who actually read their own agent output.
PR size is part of the same lever. Faros saw average PR size up 154% under high AI use. Bigger diffs burn more review minutes per merge. Keep changes focused. Split the agent sprawl before it hits the inbox.
Specialists beat one giant prompt#
The naive AI review is a single model, a fat prompt, and a flood of "consider adding error handling" on code that already has it. Cloudflare tried that. Noise trained people to ignore the bot.
The pattern that scales is different. Up to seven specialists cover security, performance, code quality, documentation, release, internal codex, and AGENTS.md health. Each prompt has a tight what to flag and a harder ignore list. A coordinator on a stronger model deduplicates, re-ranks severity, and posts one structured comment. They average about 1.2 findings per review on purpose. Signal over firehose.
- Specialists for narrow domains, not one giant prompt
- Explicit ignore rules so theoretical nits never ship
- A stronger separate judge for severity and dedup
- Risk tiers so typo fixes never burn frontier tokens
Model routing matters. Specialist workhorses can run mid-tier. The judge stays frontier-tier because it has the hard job. A rebuild of the same shape as a local Claude Code workflow found the opposite failure. A batch verify step kept 43 of 43 findings. Verification theater. The fix was independent checks, a stronger model, and a refute-by-default stance per finding.
Steal the architecture, not a vendor logo. Open-source coding agents already sit under systems like this. The durable rules are specialists, ignore-lists, and a separate judge. Same-model self-approval is how noise reappears with a green checkmark.
What humans still own#
Even a tuned multi-agent pass is not a human replacement. Cloudflare is explicit about the miss list. Architecture direction. Cross-system impact. Subtle concurrency. Cost that scales with huge refactors. A static diff does not know why the system was shaped that way last year.
Human review should start from reasonable doubt, not skimming green CI. AI-generated diffs pass surface checks easily. Clean format. Matching style. Happy linter. The dangerous bugs sit under the polish. Ask what assumptions the model made that never appear in the diff. Ask which edge cases fail silently. Ask what this couples to that the author never loaded.
Ownership is non-negotiable. The person who prompted the agent owns the merge. If it breaks because nobody read it, that is on the author, not the model. For what to hunt inside AI diffs once eyes are on them, the pattern audit in eight months of AI-generated code pairs with this process view. For who actually ships with these tools without flooding the queue, see productive developers and AI tools.
Review bottleneck FAQ
Measured telemetry points at the queue, not only the complaint. Faros found high-AI teams merge 98% more PRs while review time rises 91%. CircleCI saw feature-branch activity climb while median main-branch throughput fell 7%. Community threads on HN match that pattern. The bottleneck is real even when CI and product also jam.
asked on faros.ai ↗No. Independent signal is the point. Teams that pushed style and secret scanning to automation still keep a separate human or separate-model judge for intent. A model grading its own batch of findings tends to keep everything that sounds plausible.
asked on news.ycombinator.com ↗Trivial low-risk diffs (docs typos, tiny non-security changes) can ride a lite lane. Security-sensitive paths, trust boundaries, large refactors, and anything that moves architecture direction need a human. Risk tiers exist so seniors are not the typo police.
asked on blog.cloudflare.com ↗Intent against the acceptance criteria, architecture direction, cross-system impact, subtle concurrency, and trust boundaries. Cloudflare's own system flags those as limits. The first pass clears noise so the person spends attention on judgment, not formatting.
asked on blog.cloudflare.com ↗Holding this position costs comfort. Review will feel slower than the demo promised. Some PRs will bounce that looked fine in a five-second skim. Seniors will spend more time on judgment and less time on nits, which is the job.
What would change the bet is simple. If generation doubles and review latency and change-failure rate both fall without triage, the thesis is wrong. Until that shows up in the telemetry, treat the queue as the product.
Writing is cheap now. Approval is not. Redesign the lane, or keep paying for both a faster author and a slower ship.