First 30 Days as the Only Human in an AI Dev Team

Praveen Vijayan

SubscribeSign in

First 30 Days as the Only Human in an AI Dev Team<br>How verification controls silently degrade when AI agents outpace human review — lessons from 212 merged PRs.

Praveen Vijayan<br>Jul 27, 2026

Share

AI agents produced 212 merged PRs and 111,000+ changed lines in 30 days — but human review and machine verification failed to keep pace.

Speed was never the constraint — verification was. 25–30% of all PRs were rework; stabilization now precedes every new feature.

Review is a budget, not a virtue. One human can properly review ~30 high-risk PRs a month, not 212. Risk-tiered sign-off replaces reviewing everything (badly).

Self-reported green is not green. Agents’ own success claims went uncorroborated for weeks — broken CI and skipped deploys stayed “green” for 16 days. Verification must be machine-enforced and independent.

Honesty needs a consumer. Agents disclosed their shortcuts in every PR; nobody acted. Disclosed debt now auto-converts into tracked work.

On July 11th, at 07:54:14 UTC, an AI agent opened a pull request against my repository: 9,397 lines added , 478 removed , 67 files changed . The PR body was two words: “version update.”<br>It merged at 07:54:22. Eight seconds later.<br>No CI ran on it. No human read it. I know, because the human was me.<br>This is a midway evaluation of an experiment I’ve been running for the past month: building a real, multi-tenant SaaS product almost entirely with AI coding agents, under a workflow I designed to keep them honest. The product isn’t finished. But the data from the first 30 days — 212 merged PRs , over 220 completed issues , 111,599 lines changed — taught me something more valuable than any feature I shipped:<br>When AI agents can produce work faster than you can verify it, every human-paced control in your process silently degrades to zero. And the system keeps reporting green the whole way down.<br>What I’m building

The product is a multi-tenant agentic SaaS platform for small-business owners: a place to hire digital workers. A business owner browses a library of AI employees — a quoter, a lead generator, an invoicing clerk, a dunning agent — hires one, connects their real business systems (Zoho Books, Google Workspace) through external connectors, and the digital worker does the job: drafts quotations from a real price list, chases unpaid invoices, generates UAE-compliant e-invoices, finds leads.<br>The stack is deliberately boring and production-shaped: a Bun + Turborepo monorepo, Hono API, Next.js 15, Drizzle/Postgres with pgvector, and Terraform on GCP — Cloud Run, Cloud SQL, Secret Manager, keyless deploys via Workload Identity Federation.

The delivery workflow is the interesting part. I defined a loop tightly coupled to GitHub: I write plan files; a sync process turns them into issues; AI agents claim issues via server-side branch refs, build to acceptance criteria, run a ladder of deterministic local gates, and open one PR per issue. Humans do exactly two things in this design: write plans and review PRs .<br>The agents held up their end. I didn’t hold up mine. That’s the story.<br>Thirty days, by the numbers

212 merged PRs (July 3–25), 111,599 lines changed

571 commits — all but a couple authored by agents

~19.6k lines of source code , ~11.4k lines of test code

Whole platform skeleton — monorepo, DB, API, web app, agents service, billing, notifications, CI — merged in the first 22 hours

Nine UI screen PRs (~4,700 lines) merged in 39 minutes

Peak day: 59 merges on July 4th

And the numbers I’m less proud of:<br>208 of 212 PRs have zero code review. Median time-to-merge: about 90 seconds. Nineteen PRs merged in under a minute.

~25–30% of all PRs were rework — fixes, remediations, or re-plans of work merged days or hours earlier.

The CI gates job was broken for 16 days — and PRs kept merging over the red check the entire time.

The staging environment, which every dashboard showed as deployed, was serving Terraform’s placeholder “hello” image the whole month.

What went right (this part matters)

Before the autopsy, fairness. The agent-written code is genuinely better than its reputation deserves.<br>Every implementation PR mapped acceptance criteria one-to-one to named tests. Several PRs mutation-checked their own tests — deliberately breaking the fix to confirm the test goes red. The database tests run against in-memory Postgres with real semantics, not mocks. The gate ladder grew from 6 to 12 deterministic checks, and some of them are ideas I’d carry to any team: a boundaries gate enforcing import direction, an identity gate that statically forbids an entire class of tenancy bug, a config gate that blocks committed cloud project IDs, a run-secrets gate asserting every runtime env var is mounted from Secret Manager.<br>The security engineering, on paper, is real: an AES-256-GCM credential vault with per-value IVs, HMAC-signed OAuth state, constant-time comparisons, deterministic...