Martin Gratzer now lets coding agents merge some pull requests, the proposed changes developers use to review code. He spends more time defining small, shippable issues and improving the checks around agents. His Forge skills separate implementation, preparation, and permission to merge.

Three stages, with separate responsibilities

  • Ship implements an issue, runs the app, exercises the changed behavior, and records observations in the pull request. Another agent session reviews the change with fresh context.
  • Guard handles automated checks, review feedback, and keeping the branch ready to merge. It cannot merge: the loop fixing a change should not also approve it.
  • Land assesses risk on the exact current commit. It checks change size, database migrations, security-sensitive paths, changes to automated checks, and weakened tests. Risky changes get a focused list of files and questions for a human. Explicit repository permission lets it merge low-risk changes, and only the commit it assessed.

Turn recurring mistakes into checks

Gratzer reports leaving 126 inline comments on 25 Colorburst pull requests in January, then none across 159 in September and October. Fresh-context reviewers caught tests using an imaginary pricing tier. An adversarial review found three sanitizer bypasses using 30 crafted inputs.

Green checks still missed a substantial failure. After an image-model swap, new templates lacked titles and tags for about five weeks. Tests had hardcoded the model’s response. The repair was a live test against the real model, checking that its output met the application’s expectations.

The workflow improves when a recurring mistake becomes a lasting check. Some belong in one repository; general working practices belong in reusable skills.

Domain knowledge remains human work

A civil-engineer friend used the setup to develop his own application. One review question asked whether the code interpreted a building regulation correctly. That decision needed his expertise, even when the software checks passed.

Caveat: auto-merge had been enabled only days earlier; two of its first six verdicts qualified, and the friend’s project had no users yet.

Gratzer also leaves team knowledge-sharing and compliance unresolved. His case supports moving human attention toward problem definition, targeted review, and better checks. It offers early experience with automated merging, rather than evidence that routine human review is dispensable everywhere.