Agents Are Services

The third era is not a forecast. GitHub's coding agent authored over one million pull requests between May and September 2025. By March 2026 more than one in five code reviews on GitHub was a Copilot review, 60 million in total. By September 2026 GitHub was previewing AI review approvals that count toward required reviews. Anthropic said more than 80 percent of the code merged to its own production in May 2026 was authored by Claude. Treat every vendor figure as a self-report with its own definition of "authored," but the direction is not in dispute.

Era 2 practice - a human reads every line - does not scale to Era 3 volume. Era 3 practice, meaning plan approval, risk-tiered review, generated evidence, and mutation-scored tests, is not yet common. The rest of this piece is the part of that practice that applies to the agent itself.

These are not guidelines and they are not prompt text. Each one is a check in the workflow definition that fails the run when it is violated.

• The agent never pushes to a protected branch. It opens a pull request. There is no exception for "it was only a lockfile."
• The agent never modifies an assertion, deletes a test, or adds a skip to make a build pass - unless the pull request is labeled test-weakened and routed to a human. The cheapest path to green is almost always weakening a test, and a model under pressure will find it.
• Two repair attempts, then it pages a human and stops. A third attempt is a model guessing harder, not understanding better.
• Every repair pull request carries the original failure log. The reviewer sees what actually broke, not the agent's summary of what it thinks broke.
• If the agent cannot produce a failing test for a bug, it posts its analysis to the ticket and stops. No patch without a repro. A confident patch for a misdiagnosed bug is worse than no patch.
• Every agent pull request states its model version, its task source, and what it verified. Unpinned means unreproducible, and "it passed" is not a verification statement.
• The agent never approves, merges, or re-requests review on its own pull request. Every production change has a named human approver willing to own the outcome.

The part teams get wrong is where these rules live. Instruction files - CLAUDE.md, AGENTS.md - are advisory. They are the right place for conventions, build commands, and architectural context, and I keep them short and reviewed like code. But the model can and will deviate from them under pressure, because that is what a model optimizing for a green build does.

Anything that must never happen is a hook or a harness permission that blocks the tool call before it executes. A pre-tool hook that refuses a push to main is enforcement. A sentence in a markdown file asking the agent not to is a request. Put the never-events in hooks.

Inside Lane B, the pattern that keeps bug fixes honest is that the agent's first deliverable is a failing test, not a patch:

• An error surfaces in monitoring. The agent triages it from the session replay and the trace.
• Can it write a test that fails today? If not, it posts its analysis to the ticket and stops. A human picks it up with a head start instead of a wrong patch.
• If it can, it commits the failing test first. That commit is the proof the bug was understood.
• It fixes until that test passes, and only that test. No opportunistic refactoring on the way through.
• It opens a draft pull request carrying the before-and-after evidence, and the pull request enters risk-tiered review like anything else.

Without the failing-test rule you get confident patches for misdiagnosed bugs, which is worse than no patch. The patch looks finished, the ticket closes, and the actual bug is still there wearing a green checkmark.

The same discipline applies to self-healing pipelines. Auto-repair works on a narrow failure class - lockfile conflicts, formatting, type errors, snapshots, flaky tests, infrastructure retries - and is dangerous outside it. The workflow classifies the failure first. Anything outside the safe class pages a human. Inside it, the agent gets its two attempts, and any fix that weakens a test gets labeled and routed to a human instead of merged. A pipeline that heals itself by lowering its own bar is not healing.