My AI Agents Ship Code While I Sleep. Nobody Reviews It. — Goat Squad Studios

");background-size:240px 240px">

ENES<br>Start a project→

←All posts<br>I plan during the day, agents build overnight, and I review when I wake up. This is the system that decides what ships without me.

My morning starts with the board and last night's diffs. While I slept, an AI agent picked ticket SET-175 off the queue. Four cron jobs were running the same copy-pasted database scan. The agent pulled it into one shared helper, wrote six tests for it, ran the full 2,282-test suite, deployed to dev, and marked the ticket done. It even noticed a second ticket describing the same duplication and closed it.

Nobody reviewed any of that before it went out. I'm the review, the next morning: the diff, the activity log, the board.

The same agent left a different ticket unfinished. SET-184 flags appraisal-gap risk on pending deals using a property-data API. The code was built, tested, and deployed, and it shuts itself off safely if the API fails. It still didn't go live, because turning it on means paying for a data subscription, and no test can tell you if that's worth the money. That call waited for me.

A ticket field called autonomy decided which one could finish without me. The rest of this post is that field and the system around it. I also think most of the autonomy debate is about the wrong thing.

Plan all day, build overnight, review in the morning

The routine is simple:

Daytime is planning. Turning ideas into specs, writing acceptance criteria, making the calls agents will need before they need them.

Nights are loops. A background agent picks the top buildable ticket, builds it end to end, and either finishes or parks it with a question.

Mornings are code review.

Code moves the same way every day. Agents branch, merge to dev, and dev deploys to the dev Amplify site plus the backend. Once a day I review the PR from dev into prod. That daily PR is the only way anything reaches prod.

How code moves<br>Agents get everything up to dev. Prod goes through one PR a day, and I'm the reviewer.<br>agent brancheseach build on its own branch<br>merge to devloops land here, never further<br>dev deployAmplify dev site + backend<br>the daily PRdev → prod. I review it myself<br>prodships after my check

Here's the ticket from this morning:

id: SET-175<br>title: Extract shared scanActiveDeals(statuses) cron helper (api)<br>lane: done<br>size: S<br>autonomy: auto<br>commits: [0117e92]

WHAT: 4 EventBridge crons (chaseScan, weeklyDigest, deadlineReminder,<br>morningBriefingNotification) hand-roll the identical active-deal scan:<br>loop statuses -> paginated QueryCommand on GSI1 -> MAX_DEALS_PER_RUN cap.

EXTRACT scanActiveDeals(statuses, opts) into packages/api/utils; each cron<br>calls it and PRESERVES its EXACT status set (chaseScan includes 'prospect';<br>weeklyDigest excludes it).

ACCEPTANCE (behavior-preserving; verifiable): new scanActiveDeals unit test<br>(pagination across pages, MAX cap enforced, status param drives the GSI1<br>keys); existing handler tests stay green. api unit + tsc.

Promoted from IDEA-40 (janitor tech-debt; auto-promoted per attention-ledger<br>AL-3 — no product decision, verifiable by build-next).<br>Every call is made in the spec before an agent touches it. This one even says why it qualified for auto: no product decision, and every requirement can be checked by a test.

Planning at night and reviewing in the morning is common practice now.1 Plenty of people run this schedule and wake up to slop. The difference is what the agent is allowed to finish.

I main Claude Code as my coding agent. Every loop in this post is one of its sessions. The loops themselves are skills: instruction files in the repo, run like commands. I tweak them every time one goes wrong.

My toolbelt<br>My skills: instruction files in the repo, invoked like commands. Real names from my two repos.<br>The loopsthe autonomous passes that drain the board<br>/autopilot/build-next/housekeeping/harvest-ideas/rr-audit/board

Eyes on productionhow a build proves itself against the deployed system<br>/deploy-status/amplify-logs/api-logs/observability-triage/debug-doc-pipeline/debug-doc-chat/test-doc-pipeline

Test data on demandrealistic state without touching real clients<br>/seed-deal/seed-calendar/reset-deal/list-deals/inspect-deal

Auth and usersreal Clerk users and orgs for auth-boundary tests<br>/clerk-users/clerk-orgs/clerk-metadata/settle-auth

Docs and planningthe system of record stays current; decisions get a sitting<br>/docs-atlas/docs-review/plan-session

Why I don't code-review every AI commit

The debate right now is about how much to trust the agent. One extreme is YOLO mode: permissions off, guardrails off, agent runs free.2 Agents are cheap, so the pitch has legs; ship fast, revert whatever breaks. But a revert doesn't un-ship bad data or win back a client's trust. The other extreme reviews every diff, which works until the agent produces more than you can read.

Most people sit at the careful end. Only 8% are...