Phase 5 Review: The Ring of Constraints Around Agents in the SDLC
Episode "Phase 5 · Review" of the SFEIR series on the augmented SDLC, published the same day as the Addy Osmani LinkedIn post that it translates into a phase specification.
By SFEIR// Source sfeir.com ↗/Reading 2 min/.md// Auto-verified translation
#ring of constraints#constraints around agents#Review phase#phase 5#augmented SDLC#SFEIR 11-phase cycle#human gates#Define Plan Ship
Fifth episode in SFEIR's series on the augmented SDLC, devoted to the Review phase, published the same day as the Addy Osmani LinkedIn post it converts into a phase specification.
The starting observation: quality used to be read in the code; agents now produce more of it than anyone can review. It has therefore changed address — it now lives in the ring of constraints surrounding the agent, that is, in the harness. Seven dimensions make up this ring (correctness, security, performance, accessibility, maintainability, economic efficiency, comprehensibility), linked by the back-pressure rule: a loop is only granted the autonomy that can be verified cheaply and reliably. The corollary overturns the dominant intuition: the bottleneck has never been generation, it is verification — "generation is a wide mouth, verification a narrow neck; speeding up the mouth thickens the pile at the neck."
Hence the central architecture decision: in the eleven-phase cycle, Review is not a human gate, and this is deliberate. The three inviolable gates are Define, Plan, and Ship. Making Review carry the gate would put human attention — a finite resource — as the control point of a generation that itself scales: the neck would never widen. Review instruments, Ship decides; Review produces an opposable body of evidence, and the decision is made on the evidence, not the full diff. SFEIR retains from Monperrus that human inspection of every diff cannot withstand agentic speed, but rejects his conclusion: acceptance cannot be delegated.
The operational translation is a dimension-by-dimension table, separating what can be mechanized from irreducibly human judgment. The dimension systematically forgotten is comprehensibility, "because it doesn't break CI" — hence the cheapest remedy on the grid: having the agent log what it tried and discarded, since "intent is not lost, it is discarded."
The named failure mode is circular validation: the agent that writes the code writes the tests that validate it, CI is green, "you built a mirror, not a ring." Five countermeasures are drawn from Anthropic (independent gates, deterministic + agentic, shadow mode, risk-based tiering, SIEM logging), and Compare the Market warns that a reviewer built on vector RAG degrades review quality (~70% for an AST graph versus ~58%).
The firm's own extension is the ratchet, attached to Compound-1: every escape becomes a constraint. The ring thickens with every cycle — "the only asset in the chain that appreciates while the models depreciate" (−30% fix iterations after ten cycles, internal measurement). Only one question remains: what does my system refuse to let through?
Key takeaways
Date / source.July 30, 2026, SFEIR, unsigned (firm voice), tags sdlc, ia-agentique, software-factory, harness-engineering, code-review. Eight numbered sources with status labels.
Nature.framing article, not a primary source of results. Three original contributions; everything else is sourced synthesis. This fiche should not be re-cited for Anthropic's or Compare the Market's figures — go to the source fiches. ### The three original contributions 1. Review outside the human gates, with the split "Review instruments / Ship decides". 2. Attaching the ratchet to Compound-1 as the phase explicitly responsible for it. 3. The firm's own figure of −30%. ### The dimension-by-dimension grid Directly transposable into a Review phase specification: dimension → mechanizable constraint → residual human judgment. | Dimension | Mechanizable constraint | Residual human judgment | |---|---|---| | Correctness | unit, property, mutation testing, green/red oracle | functional acceptance | | Security | SAST/DAST, dependencies, secrets, dedicated agentic review | arbitrating residual risk | | Performance | performance budget, load, measured regression | defining the SLO | | Accessibility | axe, contrast, keyboard | the actually lived experience | | Maintainability | coverage, complexity, blast radius, component boundaries | assumed architectural debt | | Comprehensibility | the agent logs what it tried and what it discarded, decision log attached to the PR | reconstructing intent | | Economic efficiency | tokens/compute budget per task, cost per change | TCO, the CapEx/OpEx trade-off | The rule linking all seven: back-pressure — autonomy ≤ cheaply verifiable — whose residual judgment is where to place the switch. ### The architecture argument If Review carried the human gate, "the system's control point would be human attention, a finite resource that doesn't scale, facing a generation capacity that does scale": the neck would never widen, and "you would have built a pipeline whose maximum throughput is the number of diffs a senior can read before the end of the day." This is what justifies moving the gate to Ship rather than removing the human. Operative distinction: Review has a deliverable (an opposable body of evidence), Ship has a decision — "and that decision is made on the evidence, not the full diff." ### The forgotten dimension Comprehensibility is systematically omitted "because it doesn't break CI." The remedy is the cheapest on the grid and the least applied: asking the agent to write down what it tried and discarded, since "reviewing an agentic PR is the first time a human reconstructs the why." A phrase worth keeping: "intent is not lost, it is discarded." This is the structural guardrail that [[osmani-cognitive-surrender-comprehension-debt-2026-05-05]] called for. ### Circular validation The agent writes the code, the same agent writes the tests, CI is green: "a mirror, not a ring." The phenomenon is measured by DORA 2025 — AI adoption correlated positively with throughput and negatively with stability when the foundations don't keep up. The article's most cost-effective diagnostic question: "are your tests written by the agent that writes the code?" ### Qualifying criteria for an autonomous loop Control must be cheap, high-frequency, hard to bypass, immediate, and non-drifting. Qualifying: green/red oracle, type gate, property tests, an agentic reviewer with a real rubric. Corollary: short loops verify better than long ones — an agent holds up for 3 to 10 steps and loses the thread beyond about twenty; "a loop that sprawls hides its errors in the corners." Where to keep the light on: subtle bugs invisible to tests, wide blast radii, decisions structuring a year of work — namely authentication, billing, public API contracts. Governance warning: "the real risk is setting every switch the same way" — everything off leads to dismantling four months later, everything on halts delivery. ### The ratchet, SFEIR's own extension "Every escape becomes a constraint": a defect that has crossed the ring is not just fixed in the code, it is closed within the ring (test, lint rule, review rubric, harness guardrail), at Compound-1, with memory reloaded at the Plan of the next cycle. This is Osmani's ratchet principle wired into a phase of the cycle explicitly responsible for it. Two formulas: "a checklist is written once and goes stale, the ring thickens with every cycle" and "a bug seen twice is not a bug, it's a hole in the system." Associated investment argument: the ring is "the only asset in the chain that appreciates while the models depreciate." ### The firm's own figure −30% fix iterations after ten cycles, labeled Measured · SFEIR, first-party material, 2026. No protocol, scope, sample size, or definition of "fix iteration" is given. This is the article's only original figure and it supports its most commercially useful thesis. Do not reuse it without qualification. ### Economic efficiency in a quality grid "A per-task token budget is a constraint on the same footing as a performance budget, and it produces the same virtue: bounding autonomy by the cost of verifying it." A junction between FinOps and quality. ### A citation variance worth knowing SFEIR references Monperrus under the title "The End of Code Review: How AI Agents Supersede Human Code Review." The title carried by the corpus (arXiv 2606.13175) is "The End of Code Review: Coding Agents Supersede Human Inspection." Same paper, same date (June 11, 2026); it's SFEIR's label that drifts — use the arXiv title for formal citation. SFEIR takes the diagnosis from [[monperrus-end-of-code-review-agents-supersede-2026-06-11]] and rejects its conclusion. ### Cited sources absent from the corpus, candidates for addition Two Osmani texts: Set the constraints around your agents (LinkedIn, July 30, 2026 — the original diagram) and above all Software Factories, Light and Dark (addyosmani.com, July 2026), which alone carries three of the structuring concepts taken up here: the back-pressure principle, operationalized comprehension debt, and the exploitable length of loops. Also absent: Code review à l'ère de l'IA : du créateur au vérificateur (SFEIR, April 1, 2026). Watch-item to note: published the same day as the commented Osmani post.
Key figures
"AI adoption is positively correlated with delivery throughput and negatively with stability when foundations don't keep up"
"the structural knowledge graph built via AST analysis places a relevant inline comment in about 70 % of cases versus 58 % for vector RAG, across 79 merge requests"
software quality is no longer read in the code but in the ring of constraints surrounding the agent
— SFEIR
the bottleneck was never generation but verification: accelerating generation only thickens the pile at the verification neck
— SFEIR
"Review instruments. Ship decides." — Review delivers a contestable body of evidence, Ship decides on the evidence rather than the full diff
— SFEIR
"a loop is granted only as much autonomy as can be verified reliably and at low cost — not an inch more"
— Addy Osmani
placing the human gate on Review would make human attention the control point for a generation that scales, capping throughput at the number of diffs a senior can read in a day
— SFEIR
The knowledge graph extracted from this fiche — 9 entities, 30 relations.
In this graph :anneau de contraintes · back-pressure · phase Review (SDLC) · validation circulaire · cliquet de l'anneau · comprehension debt · Addy Osmani · Software Factories, Light and Dark · cycle à 11 phases