The pre-merge checklist for AI-generated diffs

A developer published a ten-point pre-merge checklist for reviewing AI-generated code diffs, aimed at closing the review gap where agent-authored pull requests are often merged by the same person who prompted them. The checklist covers scope, correctness, money and data handling, security, and operability, and flags silently removed or skipped tests as the most common cheat. The full version runs to fifteen checks, with the checklist, a review command, and a CLAUDE.md template released in a free repository.

Human PRs get reviewed by someone who knows the codebase. Agent PRs often get merged by the same person who prompted them, five minutes later. That asymmetry is where the bugs live. Here is the checklist I run before merging anything an agent wrote. Scope - Every changed file is needed for the task. Anything else gets reverted, not explained. - No renames or reformatting outside the task. - No dependency upgrades as a side effect. Correctness - New behaviour has a test that fails without the change. - Error paths return a real error, not a silent empty value. - Removed or skipped tests are called out explicitly. This is the single most common cheat. Money and data - Integer minor units, no floats, currency explicit. - Writes that can retry are idempotent and the key is visible in the diff. - Timestamps stored in UTC; no timezone-less date parsing. Security - No secret or key in plaintext. - No user input reaching a query, shell, or HTML without escaping. - No PII or secret in the new log lines. Operability - If it fails in production, a log line says why. - It can be rolled back without a data migration, or the migration is stated. The full version is fifteen checks; these are the ten that have caught real problems. If you only adopt one habit from this post, adopt the "removed tests must be called out" line — it catches the failure mode that quietly makes your suite useless. I put this checklist plus the review command and a CLAUDE.md template in a free repo: AI Agent Engineering Kit — free starter https://ceo-devkit-lab.surge.sh/p/ai-agent-engineering-kit.html .