---
title: 'In the News: October 28, 2026 (Midday)'
description: "Kiro's Crew team says it keeps 1,000 PRs a week stable by treating quality as a CI problem, and names over-engineering as the worst failure of an automated review loop."
canonical_url: 'https://darkfactory.dev/news/2026-10-28-midday'
markdown_url: 'https://darkfactory.dev/news/2026-10-28-midday.md'
collection: news
date_published: '2026-10-28T13:20:00-04:00'
date_modified: '2026-10-28T13:20:00-04:00'
---

# In the News: October 28, 2026 (Midday)


Two items cleared the bar. The first is a team's account of what broke when its agents started fixing their own review comments. The second is a release that lets teams define their own review and security agents as code.

## 1. Kiro's Crew team says an automated review loop grows a ten-line fix into a subsystem unless something forces it to stop

**[Keeping a software factory stable at 1,000 PRs a week](https://kiro.dev/blog/software-factory-stability/)** · Zejiang (Joe) Guo, Bolin Chen and Zezhen Xu, Kiro engineering · Kiro blog, October 26, 2026

This follows the team's earlier post saying three engineers and a crew of agents merged 1,000 pull requests in one week; we did not read that post. The authors say they tried reviewing every change by hand in early March and abandoned it in under a day. They then built five stages of checks: an automated reviewer, severity tiers for comments, open-source CI with role-split reviewers, a loop that drives each PR to green, and post-merge gates. The loop reads one "PR Readiness" verdict that has to mean every expected check has run and passed, because on a new pull request "no failing checks" and "nothing has run yet" look the same. They report test coverage above 90% and about 20% of the team's time spent on automation infrastructure.

The failure they spend longest on is over-engineering. In their words, a reviewer flags an edge case, the agent adds a mechanism, and the next review flags an edge case in that mechanism. "After five rounds, a ten-line fix has become a small subsystem that wasn't needed." Their fixes are a retrospective step that checks whether a change is growing instead of converging, a second "conductor" agent that makes the first call on what the retrospective recommends, and a rule that a finding must be fixed in proportion to the problem, except for a reachable crash, security hole or data loss. They describe the same pattern in security fixes, such as sandbox rules tightened until ordinary builds failed.

**Why it matters:** If you let agents fix their own review findings, build the stop condition before the loop: one readiness signal, tiered findings, and a proportionality check on each fix. These are the team's own account of its own open-source product. We did not open the repository, so the 90% coverage figure and the loop's effect on waste are unverified here.

## 2. Cursor makes its Agent SDK generally available, for defining review and security agents in code

**[Introducing the Agent SDK](https://cursor.com/blog/agent-sdk)** · Rustam Lalkaka, Cursor · Cursor blog, October 20, 2026

Cursor says the SDK is the framework behind its own managed agents Bugbot, Security Reviewer and Rollouts, and that it is generally available. An agent is a project directory: prompts in Markdown, tools as TypeScript functions, and evals, so changes go through the same version control and review as other code. It deploys with `agent-sdk deploy`, or runs as a single Node process in a container on a team's own infrastructure. It supports handing work to other agents and splitting a job across subagents, and ships evals and event replay.

The post's examples are vendor-reported. A Cursor team built "kb-reviewer" in about a day; it checks each pull request against a knowledge base of recorded lessons and cites the note behind each finding. A principal engineer at PGA America is quoted saying the SDK let them build every component of their software factory on Cursor's infrastructure.

**Why it matters:** This is a hosted way to build the kind of per-team review and risk-routing agent the Kiro item describes. The post gives no cost, rate-limit or failure figures, and the examples come from Cursor and a customer it chose to quote, so treat the "about a day" build time as an anecdote.