Cole Gannaway, a solutions engineer at Qodo, discusses the review stage of AI-assisted software development in this 15-minute AI Engineer talk.

A tiny diff can have a large reach

  • His illustrative Bitwarden example changes one line in a server data model while builds, unit tests, and linters remain green.
  • Web, mobile, command-line, and MCP clients can still depend on the old contract. MCP connects agents to tools.
  • Review needs the affected interfaces across repositories, including the particular components linked by those interfaces.

Bring context into both writing and review

  • Qodo’s proposed software graph maps repositories and their integration surfaces so reviewers can inspect downstream effects.
  • Custom rules turn team judgment into explicit checks, such as requiring deprecation handling for public API changes.
  • Make those rules and dependency information available before code generation through the agent’s tools.
  • A comment on one pull request can become a proposed rule applied to later changes.

Give the reviewer its own job

  • A dedicated review agent can spend its context window on requirements, dependencies, and review-specific evidence.
  • Gannaway suggests varying the model and harness, the software that runs an agent’s tools, to reduce shared blind spots.
  • Agreement between reviewers can prioritize findings; disagreement deserves investigation. Neither establishes correctness on its own.

Check the ticket as well as the implementation

  • In Q&A, an audience member asks about code that follows the wrong intent, beyond simply overengineering a solution.
  • Gannaway shows Jira or Linear acceptance criteria feeding into a review that highlights missing requirements.
  • He suggests reviews around the 25%, 50%, and 75% stages of generation to catch drift before the final pull request.

“The agent that wrote the code, we don’t need him grading the code.” — Cole Gannaway, 7:30

Caveat: this is a vendor presentation with an illustrative cross-repository example. It provides no measured detection rate or evidence that autonomous merging is safe.