Claude Code Is 90% AI-Written. Here's the 7-Layer Code Review System That Keeps It From Collapsing

Anthropic says Claude writes about 90% of Claude Code's own code. From June to September, merged PRs more than doubled and reverts fell by over 40%.

Your first instinct is probably "sure." Mine too. But the write-up on how the team does code review hit the top of Hacker News for a reason: it's the first detailed look at what AI-generated code review at scale actually looks like. And some of it is genuinely good engineering.

Let's go through it, steal what works, and poke at what doesn't.

The old question was did a human read the diff? The new one is which check catches what could go wrong?

Review stops being a gate at PR time and becomes continuous, like a spellchecker running while you type. Humans are not removed. They're moved to where they add the most value.

That last question is the one to steal first.

The rules around it matter more than the table:

If you do nothing else, copy this. It's a CODEOWNERS file plus a branch protection rule plus a tiny classifier. A weekend of work.

# REVIEW.md (payments/) ## What a failure looks like - Any code path that can charge a customer twice - Missing idempotency key on retries - Float math on money ## Skip - generated/ **, *.snap, migrations that only add nullable columns ## Reporting rules - Cite file:line for every finding. No evidence, no comment. - Do not repeat a finding already posted on this PR. Enter fullscreen mode Exit fullscreen mode When a reviewer leaves the same comment three times, move it into REVIEW.md. That's the whole workflow.

When both author and reviewer are agents, they can ping-pong forever. One CLI PR went 50+ rounds overnight. The team found that 59% of repeated findings came from the original pass, not from new bugs. The reviewer just kept re-raising old stuff.

If you run any bot reviewer, add a round cap today. It's five lines of config and it saves you tokens and sanity.

This is the most underrated part. The team built an eval set from past incidents and reverts. Engineers confirm the real bug and where it lives. Every change to the reviewer (prompt, tools, model) is scored against the whole set, daily.

They also track what happens to comments: fixed, dismissed as wrong, flagged as intentional, or ignored. And they run the reviewer on known-clean PRs to measure false positives.

Most teams bolt an AI reviewer on, watch it get noisy, and mute it. Treat it like a classifier with a test set instead.

The HN thread was not a victory lap, and the skepticism is fair:

The interesting claim isn't "AI writes 90% of the code." It's that review is a system with layers, owners, and metrics, not a person reading a diff. Whether or not you let agents write your code, that framing is correct, and most teams are still running review as a vibe.

Source: How the Claude Code team does code review and the Hacker News discussion.

What does your team do when the author and the reviewer are both bots? Tell me in the comments.