We ditched code review at Duckbill (mostly)

Mike Julian’s team of five hit 60 open PRs and realised they were staring at two days of nothing but code review. Rather than automate the reviewing, they asked what happens if nobody reviews at all, then spent the effort on guardrails instead.

The replacement is a risk-based rule: human review is required only when a change touches the public API or MCP surface, auth, the design system, non-additive database schema changes, or agent skills. A shell script adds the GitHub label that enforces it. Around that they turned on nearly every rule in ruff, prettier, eslint and ty, put a floor of 85% under unit test coverage, and instrumented the customer-facing signals that tell them a bad time is coming.

Two details are worth more than the headline. They rewrote their agent skills, wrote evals for them, and then deleted the ones modern models had already absorbed, which is a rare account of pruning rather than accumulating. And they found doc-happy agents had scattered markdown until it started poisoning context, so docs now go in one folder and must be written by humans. Julian’s line on the shell scripts is the honest one: why use an AI for something that can be deterministic.

The numbers, before and after: PRs merged went from 353 to 684, about 80 a week to 154. Merges within an hour went from 28% to 45%. Human-reviewed PRs take a median 26 hours to merge; the ones with no human review take 1 hour. A reply asking what the SOC 2 auditor makes of it went unanswered in the thread, which is the obvious question. Sits alongside code reviews fading away and the stronger claim from exe.dev that peer review is already dead.