FAQ: Five Myths About Letting the Agent Approve the Diff

Did the sidebar just bless your pull request?

That blessing is not a code review.
A fluent yes still has no signer attached.

Why this FAQ exists

Agents now draft comments at scary speed.
Teams paste those comments into the forge.
Someone merges on vibe and a green emoji.

Sound familiar?

I keep hearing five claims treated as policy.
None of them survive a SHA and a hash.
This is a corrected mental model, not a tour.

What a review must still answer

A real review answers three boring questions.

• What commit did you actually read?
• Which commands ran against that tree?
• Who is accountable if this ships broken?

A model paragraph skips all three.
That gap is the whole article.
Chat cannot close it for you.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.
I sometimes run this drill on a throwaway box.
MonkeyCode offers free model access and a free server option.
Use the box to run commands, not to mint approvals.
The receipt still belongs in git.

Myth 1: Chat LGTM means the diff is reviewed

The claim

If the agent says LGTM, the patch is done.
People treat that string like a required reviewer.
They merge before anyone names a SHA.

What actually holds

LGTM is a sentence.
A review is a recorded decision about one commit.
Ask for LGTM, then ask for git rev-parse HEAD.

Do those two answers even match?
Usually the model never saw the tree.
It saw a pasted hunk, often truncated.

git rev-parse HEAD
git diff --stat origin/main...HEAD
git log -1 --format='%H %an %s'

If those lines are missing, it is not a review.
Save them beside the commit.
Do not trust a prose summary of them.

Corrected mental model

Treat chat LGTM as a draft question list.
Never as the required forge approval.
Questions are cheap. Accountability is not.

Myth 2: A risk list means you can skip the patch

The claim

The model listed risks, so reading is optional.
Auth files get a glance at most.
The comment thread looks thorough anyway.

What actually holds

Would you skip a patch after a colleague summarized it?
I would not, and neither should you.
Risk lists are cheap to generate.

Agents invent issues that are not in the diff.
They also miss the one-line footgun.
A list is a reading order, not a substitute.

git diff --name-only origin/main...HEAD
git diff origin/main...HEAD -- '*auth*' '*secret*' '*token*'

Open the files the first command prints.
Use the second command as a starting map.
Then read the hunks yourself.

Corrected mental model

The model may rank files to inspect.
You still inspect them.
No ranked list ships software.

Myth 3: Pasting git diff into chat is the artifact

The claim

The paste is the record.
If chat has the diff, history is covered.
The free box can vanish. No problem.

What actually holds

The paste is ephemeral.
The server may close without warning.
The chat log is not your object database.

Only git objects travel with the commit.
CI logs travel if you archive them.
Sidebars do not.

# Review receipt

- commit: REPLACE_WITH_SHA
- parent: REPLACE_WITH_PARENT
- diff_stat_sha256: REPLACE
- test_report_sha256: REPLACE
- reviewer: HUMAN_NAME
- agent_notes: draft only, not an approval

Commit that file, or attach it to the PR.
Chat may link to it.
Chat cannot replace it.

Corrected mental model

Artifacts live next to the commit.
Not in a transcript you cannot query next quarter.
If you cannot fetch it later, you never stored it.

Myth 4: A free model can be the required approver

The claim

Branch rules want "a review."
A model comment should count.
One human plus a chatbot looks like two reviewers.

What actually holds

GitHub, GitLab, and Gitea want an identity you control.
A free model has no durable reviewer identity.
It cannot hold a signing key you audit.

It cannot be paged at 2am.
It cannot sit in your access review.
It cannot own a broken production change.

Who is not the approver:

• A free model in a sidebar
• A comment that says ship it
• A green emoji in chat
• A summary of tests nobody ran

Who is the approver:

• The person named on the forge review
• The CI job whose logs you can fetch later

Corrected mental model

Models draft questions.
Humans and CI approve.
If policy says two reviewers, that means two humans.

Myth 5: The free server's opinion travels with the commit

The claim

The agent "looked at it" on the box.
That opinion sticks to the SHA.
Closing the session does not matter.

What actually holds

Kill the box. The opinion dies.
The commit remains either way.
Only recorded objects still exist.

SHA=$(git rev-parse HEAD)
git diff --binary origin/main...HEAD > /tmp/review.diff
sha256sum /tmp/review.diff
# copy the digest into REVIEW_RECEIPT.md, then copy the file off the box

If you cannot produce that digest later, you never reviewed it.
You only talked about reviewing it.
Talk is not transport.

Optional git note, still not an approval:

git notes add -m "review-receipt: $(sha256sum REVIEW_RECEIPT.md | awk '{print $1}')"

Notes help you find the file.
They do not replace a human click in the forge.

Corrected mental model

Copy evidence off the box before you close it.
Hash it. Push it. Then end the session.
The machine was a scratch space.

Decision table (workflow, not a study)

I am not publishing pass rates.
This table is a proposed checklist only.
Label it unmeasured on your stack.

Claim in chat	What you still do	What you record
Pasted LGTM	A human reads the diff	SHA plus reviewer name
Looks safe	Run tests in CI or locally	Test report hash
No secrets	git grep plus your secret hook	Command output path
Ready to merge	Check branch protection	Merge commit SHA
Tests passed, trust me	Open the report file	Exit code plus digest

Use the table when a comment feels complete.
If a cell is empty, you are not done.
Empty cells are the usual failure.

Artifact: review-receipt.sh

The script below is a template.
Treat it as unexecuted until you run it.
It does not call any model. That is the point.

#!/usr/bin/env bash
# review-receipt.sh — record what a human actually checked
set -euo pipefail

OUT="${1:-REVIEW_RECEIPT.md}"
BASE="${2:-origin/main}"

if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
  echo "Run this inside a git repo." >&2
  exit 1
fi

SHA="$(git rev-parse HEAD)"
PARENT="$(git rev-parse "${BASE}" 2>/dev/null || echo unknown)"
STAT="$(git diff --stat "${BASE}...HEAD" || true)"
STAT_HASH="$(printf '%s' "$STAT" | sha256sum | awk '{print $1}')"

REPORT=""
REPORT_HASH="not-run"
if [[ -f package.json ]] && command -v npm >/dev/null; then
  mkdir -p tmp
  set +e
  npm test > tmp/test-report.txt 2>&1
  TEST_EC=$?
  set -e
  REPORT_HASH="$(sha256sum tmp/test-report.txt | awk '{print $1}')"
  REPORT="npm test exit ${TEST_EC}"
elif [[ -f go.mod ]] && command -v go >/dev/null; then
  mkdir -p tmp
  set +e
  go test ./... > tmp/test-report.txt 2>&1
  TEST_EC=$?
  set -e
  REPORT_HASH="$(sha256sum tmp/test-report.txt | awk '{print $1}')"
  REPORT="go test exit ${TEST_EC}"
elif [[ -f pytest.ini || -f pyproject.toml ]] && command -v pytest >/dev/null; then
  mkdir -p tmp
  set +e
  pytest -q > tmp/test-report.txt 2>&1
  TEST_EC=$?
  set -e
  REPORT_HASH="$(sha256sum tmp/test-report.txt | awk '{print $1}')"
  REPORT="pytest exit ${TEST_EC}"
else
  REPORT="no known test runner; skipped"
fi

USER_NAME="$(git config user.name || echo unknown)"

cat > "$OUT" <<EOF
# Review receipt

- generated_at: $(date -u +%Y-%m-%dT%H:%M:%SZ)
- commit: ${SHA}
- base: ${BASE} (${PARENT})
- diff_stat_sha256: ${STAT_HASH}
- tests: ${REPORT}
- test_report_sha256: ${REPORT_HASH}
- recorder: ${USER_NAME}
- agent_notes: draft questions only; not an approval

## diff --stat

\`\`\`
${STAT}
\`\`\`
EOF

echo "Wrote ${OUT}"
echo "Commit this file or attach it to the PR."
echo "Do not paste it into a model and call that a review."

Run it on your laptop or on a free server.
Same rule either way.
The file is a review aid. The human still clicks approve.

A cheap extra pass for accidental secrets:

git diff origin/main...HEAD | grep -E 'BEGIN PRIVATE KEY|AKIA[A-Z0-9]{16}|api[_-]?key' || true

A hit is a stop, not a debate.
Rotate the credential outside this workflow.
Do not paste the match back into chat.

A workflow that still works if you delete the product

1. Generate or edit code however you like.
2. Run review-receipt.sh against origin/main.
3. Ask a model for questions, never for LGTM.
4. Read every path printed by diff --stat.
5. File unanswered questions under the receipt.
6. A human approves in the git forge.

Notice the model is optional in that list.
The script is not.
Remove the vendor name and the steps still hold.

Limitations

This does not replace CI.
It does not replace SAST or secret scanning.
It does not sign commits for you.

sha256sum proves a file existed.
It does not prove the tests were meaningful.
A skipped suite still hashes. Read the exit code.

The npm test and pytest branches are guesses.
Your runner may need different flags.
Treat an unknown flag as a failed receipt.

I am not publishing timings or pass rates.
Those numbers would be fiction in this article.
Copy the script, then measure your own repo.

Who should not use this approach

Do not treat chat as an approver on:

• Payment, auth, or privacy code
• Anything that can touch customer data
• Incident hotfixes in the middle of the night
• Repos with required human reviewers
• Changes that already need a change ticket

If your lawyer needs a name, use a name.
If your regulator needs logs, archive CI.
A free-model transcript will not help them.

One-page model to keep

Chat is a scratch pad.
The free server is a scratch machine.
The model is a question generator.

Git is the system of record.
CI is the repeatable gate.
You are the approver.

If those collapse into one blob, you are pretending.
Pretending is easy now. Receipts are still cheap.
Write the receipt. Then merge, or do not.

Closing

So, did the agent approve your diff?
It wrote a comment. You still have a job.

Keep the SHA. Keep the hash.
Keep your name on the forge review.
If you run the drill on a disposable box, take the receipt with you.