I refuse to open sloppy AI PRs. These eight blockers are the whole review.
Lint is green. The bot left forty comments about naming. Somebody typed LGTM. Then billing double-charged, or the migration locked the table, or the "internal" route was sitting on the public router. If you have been reviewing AI-authored diffs for more than a month, you already know this shape. The model is fluent. The linter is happy. The PR description is a file list. The thing that will page…
I refuse to open AI-authored PRs that lack clear blockers. An AI-generated PR that fails to name a rollback method is essentially a vibe check. The eight blockers I consider before even opening a PR are the whole review process. These blockers are the ones that can page someone, corrupt data, leak access, or ship a change that cannot be undone without a forward-fix.
Naming conventions, file length, and architectural preferences do not qualify as blockers. Every finding must cite the exact path and line number; otherwise, it is not considered a finding. Reviews are categorized into three buckets: BLOCKER, WARNING, and SILENT. A BLOCKER requires immediate fixing or a documented justification for acceptance before merge.
A WARNING is a one-sentence comment that does not delay the merge process. A SILENT finding is ignored entirely. A pass indicates zero blockers. A WarnBlocker is raised when the change is user-visible or writes data, with no way to turn it off or reverse it without a forward-fix. Examples include a missing feature flag on a risky path, an irreversible migration, or deleting an endpoint with no sunset.
When a PR changes request/response shapes, status codes, error codes, event payloads, or CLI flags in a way that current clients will mishandle, it is a BLOCKER. Similarly, ANY change that alters the schema or meaning of stored data, causing existing rows to be wrong, null, or unreadable, is a BLOCKER. New NOT NULL fields without defaults and without backfills are also BLOCKER issues.
An Enum value reuse, timezone or unit changes, and silent field name changes are also BLOCKER issues. Authz gaps are BLOCKER issues when a new or changed path reads or writes sensitive data without the same authorization checks as other resources. Internal endpoints newly reachable from the public router are BLOCKER issues if they do not call the existing guard.
Trusting client-supplied roles and missing tests that would fail in production are also BLOCKER issues. A warning is given when a TODO with an owner is present. However, a 4. Authz gap is a BLOCKER when a change introduces an authorization gap without proper testing. A missing happy-path test that would fail if a blocker were present is also a BLOCKER.
Finally, a warning is given for happy-path tests only, and the change is not security or data-related.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
