AI creates edit liquidity.
When code arrives faster, the scarce resource moves. Typing is no longer the bottleneck; deciding where a change belongs, understanding the structure already there, and proving the new behavior become the expensive work. The danger is not uniquely “AI code.” It is ordinary maintenance pressure with a turbo bolted on.
ImpactGate, a new open-source CLI and CI gate, aims directly at that pressure. Its published formula multiplies files changed, cyclomatic complexity, added lines, and the pre-change weighted method complexity of the surrounding container. In plain shop talk: adding a branch to an already overloaded class costs more than putting the same behavior into clean new structure.[1]
A passing test can prove the patch works and say nothing about where the weight was welded.
A metric is a smoke alarm, not an architect.
The idea is sharp because it prices the neighborhood, not just the diff. ImpactGate can warn or block, rank files contributing to impact, and grade a change against a blend of its seed corpus and the project’s own landed history. The project also skips giant diffs above a configured ceiling as likely generated or vendored material and reports that skip instead of silently folding it into the score.[1]
But its formula is still one hypothesis about decay. A cohesive feature can legitimately touch many files. A nasty semantic shortcut can be tiny. A new file can be cheap under the measure and still duplicate an existing concept. The right rollout is warn, inspect misses, build a local baseline, then decide whether block has earned the keys. The HN thread immediately challenged the single-metric shape; that criticism is healthy, not fatal.[2]
Security coverage is expanding. Keep the labels honest.
GitHub’s September 16 changelog says AI Scan for pull requests can now run without CodeQL default setup, provided code scanning and AI Scan are enabled at the applicable repository, organization, or enterprise level. It is a public preview for GitHub Advanced Security customers on github.com; GitHub Enterprise Server is excluded from this release.[3]
That is broader access to another useful signal. It is not structural review, test coverage, or comprehension. “AI scan passed” should mean exactly what the product checked—not “the code is safe,” and definitely not “the team can maintain it.” Every green lamp needs a noun.
Ownership is the missing gauge.
Mark Seemann’s response to a reader with a substantial AI-built system lands on the uncomfortable center: people have always worked above abstractions they did not fully understand, but a practical rule was to understand the level directly below and above your own. His personal rule for model use is to prefer falsifiable questions—requests whose answers can be checked.[4]
That gives the merge gate a human test. Ask the patch author—or the operator accepting the generated patch—to narrate the failure path, name the state boundary, predict one plausible regression, and identify the fastest rollback. This is not an oral exam for prestige. It is a recovery contract. If nobody can steer after the model leaves, the repo has a passenger, not an owner.
Build a layered gate, not a magic number.
Use structural pressure to decide where to inspect. Use tests to exercise behavior. Use security analysis to hunt its own defect classes. Use a comprehension check where consequence or unfamiliarity is high. Save the base revision, tool versions, exceptions, and reviewer decision so the gate leaves a receipt.
The load bank below replaces the generic “all checks passed” badge with a staged review console. Its pressure score is an explicitly labeled teaching proxy—not ImpactGate’s formula, a security result, or production telemetry.