Agentic code review
Week 6 · Review what a model catches, misses and invents
Start with your own review
Read the contract and diff before any model output.
Write one boundary input, expected result, observed or traced result, and consequence.
The contract is the oracle
An account may edit exactly when it is active and is an owner or staff member.
All inactive accounts and active outsiders are denied.
The candidate
return owner or staff and active
Python binds and before or.
A happy path is one data point
active=True, owner=False, staff=True returns True.
That does not test an inactive owner.
Choose a separating input
active=False, owner=True, staff=False
Contract: deny · Candidate: allow
Name the consequence
An inactive owner can pass the guard.
A finding is useful when its consequence is reproducible.
Ask for bounded review
Give the model the contract, diff and only the files needed to inspect the claim.
Request locations, affected inputs and a check for each finding.
Keep the first review independent
Save your own review before opening the model result.
Agreement is not independent evidence.
Model reviews are hypotheses
A model can catch the precedence bug, miss it after a happy-path example, or invent string parsing.
Confidence does not change the evidence standard.
Three dispositions
Confirmed · reproduce the claim.
Refuted · show a counterexample or contract conflict.
Cannot tell · name the missing evidence and next check.
Confirmed needs a check
Record the input, expected result, observed result, location and consequence.
A source trace can be the check when execution is unsafe.
Refuted needs a reason
If the contract accepts booleans only, a request to parse "false" adds unsupported scope.
Quote the clause and show the relevant path.
Cannot tell is precise
"I checked the diff and public tests; no caller evidence is included."
Name the smallest safe check that would settle the question.
No finding is not no defect
A silent review establishes only that no comment was returned for the supplied context.
Search the diff and contract yourself.
Verification loop
Pin revisions → review unaided → request review → check each point → record evidence → decide.
Keep model text separate from executable code.
Safety while checking
Inspect commands before running them.
Follow the syllabus Tools and model access practices.
Stop when a command crosses the stated scope.
Who accepts a change?
The human with merge authority owns acceptance.
The author owns a truthful handoff; reviewers and models supply evidence and questions.
A review record
Finding | disposition | evidence | next decision
Add the four explanation answers: what changed, why, what could be wrong, and what you verified.
Studio
Bring a change from your first open-source contribution or project.
Review it yourself, request one model review, dispose of every finding, and decide accept, narrow, recheck or stop.
CP1
CP1 takes the first 30 minutes of the second session, on paper, without AI.