A five-person company banned human-written pull requests and published the numbers

In January, Paul Stack's team threw away a Rust codebase they had spent years building and rebuilt their process around agents from the start. The new rule: agents write every line of code, and a human-written pull request does not get merged, even an open source patch from an outside contributor. Work moves through a bounded state machine. One agent proposes a plan, a second agent attacks it for up to five rounds looking for security holes and missing requirements, and disagreements that survive go to a human arbiter. A file called CLAUDE.md acts as what Stack calls an executable contract, listing the constraints the agents must follow, and any failure that trips up a session is meant to become a permanent rule rather than a one-off fix. Over the previous 30 days the team opened 295 issues, shipped 217, and closed 81 as duplicates or work they weren't doing; median time from triage to ship was 1.6 hours. Five people spend roughly $3,000 a month on the workflow, most of it CI review. "Our rule is blunt: agents write every line of code," Stack writes. "If someone opens a pull request written by a human, we do not merge it."

Why it matters: Stack ties trust to five separate merge checks, including adversarial review and user-acceptance testing, rather than to the model doing the writing. A smaller team could adopt those gates one at a time, starting with a single constraint, without copying the whole policy.