Urgent.News

What's breaking now, across thousands of outlets.

Tech

You Have a Review Ceiling. Measure It Before It Measures You.

I sat in on Margaret-Anne Storey's DORA community session last week, and she put a name on the thing I'd been circling since April. It isn't technical debt. Her ACM Queue piece splits software health into three debts. Technical debt is the familiar one: implementation choices that make tomorrow's change harder. Intent debt is the missing rationale, the goals and constraints that say what a system…

Margaret-Anne Storey identified a new software health issue called cognitive debt during a DORA community session. Cognitive debt refers to the erosion of shared understanding among team members, making it difficult to predict the impact of changes and maintain the system effectively. The author, who reviewed pull requests for a living, faced a retrospective where they couldn't answer how many AI-generated pull requests could be handled before the review process broke down.

Cognitive debt doesn't show up as a red number on dashboards; instead, it appears as green metrics improving as review collapses. To measure cognitive debt, the author suggests monitoring detection rates, similar to mutation testing for test suites. By seeding a small number of known-defective changes into the review queue, teams can detect when cognitive debt starts to accumulate.

The author recommends starting with one canary per twenty pull requests and increasing the number as needed. As AI-generated PR volumes increase, detection rates will initially remain stable but will eventually drop off a cliff, indicating the team's review ceiling. Measuring this ceiling can help teams understand when their review process is no longer effective and adjust accordingly.

The author invites teams to measure and publish their detection curves to contribute to the industry's understanding of engineering in the AI era.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

How I Grew Buildside to 130 Users in 2 Weeks by Building in Public

Two weeks after launching Buildside, 130 people had joined. I did not have an ad budget or a huge email list. There was no secret growth trick.

  • Buildside attracted 130 users in two weeks
  • Founder shared development process on X and LinkedIn
  • Honest feedback led to app improvements

Metrics Driven Security

Security teams have historically operated on instinct. A firewall rule feels right. A new tool seems like it will help. An audit finding gets patched because someone said it was important.

Server-Rendered Login Sessions: Creation, Verification, Refresh, Logout, and Phone Recovery

Short answer: for a server-rendered learning app, create a short-lived session only after the phone code is verified, keep refresh as a separate state transition, and make recovery a deliberate path…

  • Server-rendered login creates short-lived session after verifying phone code
  • Refresh and logout are distinct state changes, not account creation
  • Audit trail links learner, device context, and recovery status

More from Thursday 3 September →