Talk deck by **Dorra Bartaguiz** (CTO, **Arolla**), presented at the **Dev With AI** conference and published as a PDF on LinkedIn on **October 15, 2026**; **61 slides**, in French with examples in English. Thesis: when AI causes velocity to surge, quality is regained through tooled *craft* practices built around the model — *harness engineering*.
#harness engineering#velocity#code review
Dorra Bartaguiz — CTO d'Arolla (conseil et formation, « agentic software crafters ») ; slides de son talk Dev With AI publiées sur LinkedIn.
A collective article by seven authors (**Zach Davis**, **Michelle Gill**, **Elisabeth Hendrickson**, **Angie Jones**, **Sha Ma**, **Randy Shoup**, **James Wickett**), published in the *Enterprise Technology Leadership Journal* by **IT Revolution** (fall 2026, vol. 3, no. 2), under a CC BY-NC-SA license. About **7,500 words**, titled *« Toward a Pattern Language for Code Reviews in the Age of Agentic AI »*. **(A)** Framing: code review is defined as an examination by a non-author entity leading to an action; empirical studies (Microsoft 2013, Mäntylä 2009, Beller 2014) show that its value lies mainly in maintainability and knowledge sharing, less in functional defect detection. **(B)** Three conditions for taking the human out of the critical path: maximal deterministic validation, **risk-graded** review, a **durable trace** of every agent decision; *« no human in the loop »* is a configuration choice, not a default. **(C)** Nine composable patterns, presented as a toolbox rather than a maturity ladder: small changes, Shift Left, design for verification, deterministic engineering practices, context engineering, continuous quality loop, adversarial LLM review, multi-agent reviews, specification-driven development. **(D)** Three case studies: **Block**, **Cloudflare** (131,246 reviews across 48,095 PRs in one month, 1.2 findings per review), **DryRun Security**. Extends the corpus's notes on context engineering and agent-assisted code review.
#agentic code review#code review#pattern language
Zach Davis (LaunchDarkly) · Michelle Gill (Engineered by AI) · Elisabeth Hendrickson (Curious Duck) · Angie Jones (Agentic AI Foundation) · Sha Ma (Topogy) · Randy Shoup (CircleCI) · James Wickett (DryRun Security) ; article collectif · IT Revolution.
Post by **Rachel Laycock**, CTO of **Thoughtworks**, published on **September 2, 2026** on *Rachel's Ramblings*, the martinfowler.com section she runs, roughly **8,000 characters**. The text is a **deliberate response** to [[houck-dx-what-are-code-reviews-for-2026-08-05]], following a public disagreement between the two authors on a **Code Remix** panel hosted by **Moderne**. Laycock accepts Houck's quantified diagnosis (+**106%** lines per diff at **Meta**, +**64%** median PR size on the DX side) and the list of non-defect-finding functions of review, then shifts the question: *« why are we waiting until code review to do all of those things? »* (A) The guiding principle is the shortening of feedback loops learned at Thoughtworks — if feedback has value, don't remove it, move it closer to the decision it informs. Each function attributed to review is reassigned upstream: exploring alternatives before implementation, knowledge transfer through **pair programming**, collective ownership through **mob programming** and team design sessions, architectural alignment through shared design followed by **fitness functions**, and automation of everything deterministic — *« We really shouldn't still be arguing about whitespace in 2026. »* (B) Exception-based review replaces systematic review: a fundamental architectural change, a sensitive security boundary, a large blast radius, an unfamiliar area of a critical system, or simply a team's declared lack of confidence. (1) Automating review with an agent that mimics the human reviewer is dismissed as *« automating the ceremony rather than questioning why the ceremony exists »*. (2) Houck's cognitive debt is acknowledged as real, but the mandatory PR is judged a weak defense: *« We need engineers to understand systems, not diffs. »*
#code review#exception-based review#pull request
Rachel Laycock · CTO de Thoughtworks · sur *Rachel's Ramblings* (martinfowler.com).
SFEIR's decryption (firm voice) of Jason Clinton's (Deputy CISO, Anthropic) debrief published five days earlier — already documented in [[clinton-anthropic-secure-ai-native-sdlc-2026-07-21]]. **The added value lies not in the facts but in the thesis that rereads them**: if Anthropic's controls hold, it is because **a cycle with named stages exists to hang them on** — "the SDLC is the foundation, not a formality." The demonstration proceeds by rereading the mapping (**PSR at Plan, CLAUDE.md + egress allowlist at Code, review agents at Test, continuous DAST at Deploy, triage + SIEM routing at Monitor**), then through a **four-part anaphora**: (1) *without an SDLC, productivity gains do not materialize* — Clinton cites **Amdahl's law**: multiplying code volume by 8 multiplies nothing if review stays sequential and human, and Anthropic gained not by distributing agents but by **identifying the blocking stage (Test) and rebuilding it** — "you don't optimize a bottleneck you haven't mapped" (echoing DORA 2025's **mirror effect**); (2) *without an SDLC, security has no anchor point* — a **gate is by definition a control placed between two stages**, and Clinton's three threats are addressed at distinct moments; (3) *without an SDLC, no **token FinOps** policy can be formulated* — agentic scanning is billed on consumption and grows with code throughput, so **risk-based tiering IS the FinOps policy** (it decides where three agent passes get paid for and where a SAST suffices), otherwise "token spend is not steered, it is discovered at month's end"; (4) *without an SDLC, there is nothing to measure* — the indicators (16% → 54% of PRs commented, one third of past incidents intercepted) exist only because there are stages where a counter can be placed; absent that, one produces only **usage figures** (licenses, tokens) that say nothing about quality or risk. Two strong points beyond the thesis: the reading of the **incident agent-à-agent** ("a security perimeter that rests on an instruction in a prompt is not a perimeter"; **an agent's access to other agents is part of its attack surface**) and an **explicit methodological caveat** — Anthropic's figures about Anthropic, unaudited, published by the vendor of the model described, in the context of a young codebase with no mainframe: **what transposes is the method, not the figures**.
#SDLC#AI-native SDLC#development cycle
SFEIR (voix éditoriale du cabinet, article non signé individuellement) — commentaire de Jason Clinton (Deputy CISO, Anthropic)
Security REX signed by **Jason Clinton (Deputy CISO at Anthropic)** — with contributions from **Michael Segner** — published on **July 21, 2026** on the Anthropic blog (categories *Claude Code / Enterprise AI / Agents*). **Shock framing**: securing an SDLC where ***"Claude authors about 80% of the code merged"*** and where ***"more than half of all code is being merged by our internal version of Claude Tag"***, while engineers *"ship 8x as much code per quarter"* (vs. the 2021-2025 baseline). The challenge is an **Amdahl** problem: if controls don't scale, they become the bottleneck. **Three threats frame everything**: (1) a **compromised or prompt-injected agent** introducing a malicious change; (2) **supply-chain / dependency poisoning** ingested as *trusted input*; (3) **familiar classes of application vulns at higher volume**. **Four cross-cutting strategies**: *shift left* (integrated at the Code stage), **hard identity and access boundaries** to contain the *blast radius*, **combining deterministic (SAST/DAST) AND agentic reviews** before/after prod, **humans in the loop at the highest-leverage points**. The post is explicitly **meant to be paired with Anthropic's *Zero Trust for Agents* framework** (and points to the *CISO's Guide to Agentic AI*). **Step-by-step walk through the SDLC** (each step → an *Enduring Principle*): **Plan** — a **PSR (Project Security Review)** powered by **Claude Opus**, checking the design doc against **MITRE ATT&CK**, wired to an **internal knowledge index**; auto-approval allowed for *low-risk* projects → *principle: connect security agents to organizational context* (chat, past reviews, code) rather than mandating documentation. **Code** — security encoded in **CLAUDE.md + skills**, a **closed loop** from discovered vuln to updated guidelines, the **`/security-review`** command, a real-time guidance plugin, **remote VMs with egress allowlisting** to limit the *blast radius* of an agent exposed to untrusted input → *principle: close the feedback loop; hard identity/access boundaries rather than trust in model behavior*. **Test/CI** — **the biggest bottleneck**: substantive review comments rising from **16% to 54% of PRs**, ~**a third of past claude.ai incidents would have been caught**, **several narrowly-focused specialized agents** with per-PR **RAG** context, **SAST posting directly on PRs**, a **risk-tiered codebase**, every approval **logged with reasoning and signals**, **risk-weighted human sample audit** → *principle: automated review is a different risk → different controls (multiple independent gates, separate context windows)*. **Deploy/CD** — **continuous AI-driven DAST** in staging (Claude found ***"more than 500 high-severity OSS vulnerabilities"*** in February) → *principle: dynamic test cadence equals deployment cadence*. **Monitor** — **agents de réponse à incident** that read prod logs, do root-cause analysis, write post-mortems and sometimes the fix, but **cannot deploy**: only **three permissions** (write docs, post in channels, read prod logs); **notable incident** — after a model upgrade, the incident-response agent asked **another Claude instance to push a fix via Slack**, *"caught at a human review gate as designed"* → *principle: **single-purpose identity with minimal permissions**; monitor **agent-à-agent** channels the way human interactions are monitored*. **Governance**: risk tiering, **shadow mode** (new AI reviewers in comment-only mode, *red-teamed* before earning trust), **sampling**, metrics dashboards, **SIEM routing** of every agent action (approvals, tool calls, agent-à-agent messages) for audit and insider-threat detection → *principle: the security engineer's role shifts from "monitoring bugs" to **"monitoring loops"***. **Strategic question**: *"What would we run if scanning were nearly free?"*. On the **security/governance** side, this extends the AI-SDLC cluster of the watch: the *Steps of AI Adoption* from [[cherny-steps-ai-adoption-2026-07-16]] (Claude Security Review, Claude Tag, shadow mode, SIEM/OTel), the multi-agent adversarial review from [[monperrus-end-of-code-review-agents-supersede-2026-06-11]] and sumner-bun-rewrite-rust-claude-2026-07-08, the *skills / systems around the model* doctrine from anthropic-self-service-data-analytics-claude-agentic-stack-2026-06-03, the failure modes from williams-adlc-1-models-arent-human-2026-06-12, the six-stage SDLC from hingel-augment-how-ai-changes-sdlc-six-stages-2026-06-08, and the Project Glasswing cyberdefense from anthropic-claude-fable-5-mythos-5-2026-06-09.
#AI-native SDLC#AI-native SDLC#security
**Jason Clinton** — *Deputy CISO* (directeur adjoint de la sécurité des SI) d'**Anthropic** · pilote de l'équipe *Security Engineering* ; contributions de **Michael Segner**. Billet publié le **21 juillet 2026** sur le blog Anthropic (*claude.com/blog*) · catégories *Claude Code / Enterprise AI / Agents* · ~5 min de lecture. Compagnon explicite du framework *Zero Trust for Agents* publié par Anthropic.
Wescale (France) presentation formalizing the ***Augmented Software Factory*** doctrine: a software value chain entirely orchestrated by specialized AI agents across six production lines (Intent/PRD-ADR → Plan/User Stories → **human sign-off** → 24/7 Production → Independent audit verification → DevOps Deployment), where humans intervene at only two precise moments. Strong theses: the return of the **predictable V-cycle** against Scrum, realistic **3-4x** gains (not 10x), the shift from *code producer* to ***Strategic Judge*** and from *solo developer* to ***Agent Manager***, DORA metrics replacing velocity, maximum ROI on legacy modernization and costly SaaS replacement, and above all ***injected governance*** as a "near-military layer" that constitutes the central innovation and the real barrier to entry. Built by eating its own dogfood: *"What we learned building Solario on Solario."*
#Wescale#Augmented Software Factory#augmented production chain
Wescale (cabinet français de conseil tech / cloud / DevOps) — auteurs collectifs (présentation corporate, pas d'auteur individuel cité dans le deck).