Pimp My IDE / Garage Dispatch
← Back to garage
September 16, 2026 · code health / AI review / ownership

Your green build can still be rotting.

AI makes edits cheap. It does not make accumulated structure cheap. A new merge gate tries to meter where change lands; a fresh security scanner widens coverage; a programmer’s letter asks the harder question: can you actually own the system when the magic stops?

THE TAKE: tests prove selected behavior. Security scans hunt selected vulnerabilities. Structural metrics flag selected pressure. Ownership is the human ability to explain, debug, and safely change the machine. A responsible merge gate needs all four—and must not pretend any one is the others.
Put the patch on the load bank ↓

AI creates edit liquidity.

When code arrives faster, the scarce resource moves. Typing is no longer the bottleneck; deciding where a change belongs, understanding the structure already there, and proving the new behavior become the expensive work. The danger is not uniquely “AI code.” It is ordinary maintenance pressure with a turbo bolted on.

ImpactGate, a new open-source CLI and CI gate, aims directly at that pressure. Its published formula multiplies files changed, cyclomatic complexity, added lines, and the pre-change weighted method complexity of the surrounding container. In plain shop talk: adding a branch to an already overloaded class costs more than putting the same behavior into clean new structure.[1]

A passing test can prove the patch works and say nothing about where the weight was welded.

A metric is a smoke alarm, not an architect.

The idea is sharp because it prices the neighborhood, not just the diff. ImpactGate can warn or block, rank files contributing to impact, and grade a change against a blend of its seed corpus and the project’s own landed history. The project also skips giant diffs above a configured ceiling as likely generated or vendored material and reports that skip instead of silently folding it into the score.[1]

But its formula is still one hypothesis about decay. A cohesive feature can legitimately touch many files. A nasty semantic shortcut can be tiny. A new file can be cheap under the measure and still duplicate an existing concept. The right rollout is warn, inspect misses, build a local baseline, then decide whether block has earned the keys. The HN thread immediately challenged the single-metric shape; that criticism is healthy, not fatal.[2]

Security coverage is expanding. Keep the labels honest.

GitHub’s September 16 changelog says AI Scan for pull requests can now run without CodeQL default setup, provided code scanning and AI Scan are enabled at the applicable repository, organization, or enterprise level. It is a public preview for GitHub Advanced Security customers on github.com; GitHub Enterprise Server is excluded from this release.[3]

That is broader access to another useful signal. It is not structural review, test coverage, or comprehension. “AI scan passed” should mean exactly what the product checked—not “the code is safe,” and definitely not “the team can maintain it.” Every green lamp needs a noun.

Ownership is the missing gauge.

Mark Seemann’s response to a reader with a substantial AI-built system lands on the uncomfortable center: people have always worked above abstractions they did not fully understand, but a practical rule was to understand the level directly below and above your own. His personal rule for model use is to prefer falsifiable questions—requests whose answers can be checked.[4]

That gives the merge gate a human test. Ask the patch author—or the operator accepting the generated patch—to narrate the failure path, name the state boundary, predict one plausible regression, and identify the fastest rollback. This is not an oral exam for prestige. It is a recovery contract. If nobody can steer after the model leaves, the repo has a passenger, not an owner.

Build a layered gate, not a magic number.

Use structural pressure to decide where to inspect. Use tests to exercise behavior. Use security analysis to hunt its own defect classes. Use a comprehension check where consequence or unfamiliarity is high. Save the base revision, tool versions, exceptions, and reviewer decision so the gate leaves a receipt.

The load bank below replaces the generic “all checks passed” badge with a staged review console. Its pressure score is an explicitly labeled teaching proxy—not ImpactGate’s formula, a security result, or production telemetry.

Interactive makeover / review load bank

Structural Decay Load Bank.

Traditional purpose replaced: one undifferentiated “green build” badge. Better version: declare where the patch lands, set its size, close three distinct evidence breakers, and print a review sheet. Native radios, checkboxes, and a range input preserve keyboard and screen-reader operation.

Stage the patch

The declared load below is a review-attention proxy. It does not reproduce ImpactGate or certify code quality.

Existing structural load
80 lines10300
Evidence breakers

Declared review load

ATTENTION / 100 · TEACHING PROXY

WORKING BAY · 80 changed lines · 0/3 evidence breakers closed. Review before merge; the console records declarations, not proof.

Open the four-source evidence bay
[1] OfficeFloor, ImpactGate repository and README, read September 16, 2026 — formula, warning/block modes, file ranking, generated-diff skip, baseline curve, and CI integrations. [2] Hacker News discussion, item 49726329, September 16, 2026 — contemporary criticism of the single-metric approach and maintainer explanation of the cohesion/erosion target. [3] GitHub Changelog, “Code scanning AI Scan no longer requires CodeQL default setup,” September 16, 2026 — enablement requirements, customer scope, preview status, and GHES exclusion. [4] Mark Seemann, “On learning programming in an age of LLMs,” September 16, 2026 — abstraction literacy, learning limits, ownership concerns, and falsifiable questions.

Source boundary: this dispatch compares distinct signals; it does not benchmark ImpactGate, GitHub AI Scan, or a model. The load bank stores no data, runs no scanner, and authorizes no merge.