Scale the Judgment, Not the Model — Andrew Orobator, Reddit

AI Engineer · 19 min · 262 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

00:01[music]
00:12A friend told me about an engineer at another company who ran a recurring war room just to delete dead experiments.
00:20Every two weeks, the team would stop, gather, and clean up flags that everyone agreed should be gone.
00:28That's the bestase version of this problem.
00:32Someone burning political capital to make maintenance happen by hand.
00:37That's the part that I still can't get past.
00:42My name is Andrew Robbittor and I'm an Android engineer at Reddit.
00:46This is a talk about what's actually stopping us as an industry from scaling that work responsibly.
00:52Spin at the gate until green.
00:54the engineering primitives behind self-driving code bases.
00:59First, what I'm not going to do, I'm not going to stand up here and tell you that AI can write code.
01:06You're at the AI engineer world's fair.
01:08Half of you are running coding agents right now.
01:11So, let's skip the part where I sell you on AI writing code because you laugh me out of the room.
01:17For me, my only input is the chat box.
01:20I describe it builds.
01:23I review.
01:24Your mileage may vary.
01:26The point was never how the code gets written.
01:29It's about whether you ship good software, a product that people can actually trust.
01:36And every gate in that system is a human's call.
01:41I've watched this everywhere.
01:43You've got your own version of it.
01:44the war room that I opened with someone burning a week of hackathon freedom on lint cleanup.
01:52As an industry, we've built tooling that can change the shape of the work, and we still spend our scarcest resource on work like this by hand.
02:01Human creativity, human attention wasted.
02:06The job changed and most of us didn't even notice.
02:09We're harness engineers now.
02:11Our work is the system that helps produce and verify the code, the constraints, the gates, the skills, the verification.
02:23Think about how you got good for a second.
02:26Mentorship, code review, the water cooler chats, the incident that paged you at 3:00 a.m. You absorbed all of it without noticing, just by being there.
02:38Humans absorb judgment implicitly.
02:41Agents require judgment explicitly.
02:45An agent boots with a blank context window and no memory every session.
02:51Every piece of judgment you picked up by osmosis, it has to be made explicit or the agent simply never has it.
03:00Quick test.
03:02Swap in a smarter model.
03:04You get a slightly better answer.
03:06Now take away the tests, the gates, the review and the whole thing falls over.
03:12So the model was never really the bottleneck.
03:15The judgment around the model is the model is raw talent while the judgment is the organization.
03:26And this judgment already exists.
03:28It lives in scars, in post-mortems, in your most experienced reviewers.
03:34it just doesn't scale because it's trapped in one head.
03:39So step one is making it accessible to the whole org where one reviewer's taste can guide a thousand changes they'll never touch.
03:50Ask experienced engineers to clean up a feature flag and they they're going to think about a whole string of questions first.
03:57A flag is never just a flag.
04:00Is the rollout frozen?
04:01What about the flag right next to it?
04:03Which team owns it?
04:06That bundle of questions is judgment and it's the most valuable thing in the building.
04:12Right now, it's trapped.
04:14It surfaces once in a code review, then it's gone, and the next person relearns it the hard way.
04:22A skill is institutional judgment made executable.
04:26It's that bundle written down so that the agent refires it instead of guessing.
04:32A newer engineer can work with 10-year instincts at their elbow.
04:37In 1986, Marvin Minsky named this a knowledge line or a kine for short.
04:44It's the configuration of mind that solved a problem reused on the next one.
04:50So, a skill is a kine for a codebase.
04:55And skills aren't documentation.
04:58Agents drown in facts.
05:00What they lack is which facts matter and which decisions are dangerous.
05:06Documentation preserves facts while skills preserve judgment.
05:14Skills are judgment that you reuse.
05:17But often times work such as feature development or a refactor outlives a single session and the context window wipes clean every time.
05:28So you need the other half.
05:30A record of the work itself.
05:33The plan, the decisions, what you already tried, even the surprises along the way.
05:40That's a worklog.
05:42A plan is a prediction.
05:44A worklog is a record that starts with one.
05:48So new session, fresh agent, zero memory.
05:52You type one word, continue.
05:55It reads the work log and picks up at milestone 7 out of nine.
05:59No re-exaining and the work log is the context.
06:03This talk is living proof.
06:06I built it across a couple of sessions using a worklog.
06:09I came back to a half-finish presentation and a fresh agent read the work log and resumed exactly where I had left off.
06:18That's the only reason why you're seeing a finished talk and not me apologizing for one.
06:24And for my personal side projects, this isn't willpower.
06:28A git hook blocks any commit that doesn't update the worklog.
06:32This way, the memory keeps itself.
06:38Skills encode how to do something.
06:41Personas encode whose eyes look at it.
06:45I got this from a Carpathy tweet.
06:48There's no you when you prompt a model.
06:50It doesn't have an opinion to give.
06:52So don't ask it for one, ask for a perspective instead.
06:57What would be a good group of people to explore XYZ?
07:01What would they say?
07:03[snorts]
07:05On my personal side projects, it's just me.
07:08No security team, no designer, no one to bounce ideas off of.
07:13So I have the model review my code as a security lead as a UX reacher as a UX researcher as Mchavelli when I want to know something when I want to know how something gets abused.
07:25I even built a design panel of opposing philosophies my designs have to survive.
07:31Then I read the reports and act on them.
07:34Each persona loads a kind of judgment that I don't personally have on demand.
07:40Encode a domain's taste once and anyone can borrow eyes that they don't have.
07:46The engineer with no designer gets design judgment.
07:50The newer engineer gets a security reviewer's instincts.
07:54Push it to the whole org and every team can now encode its own taste for its own agents.
08:01The judgment that used to live in a handful of heads is suddenly everywhere at once.
08:10skills, work logs, personas, judgment out of our heads and into the repo, portable to a machine and to people that don't have it.
08:21But the second that this judgment lives in three different places, you've got a governance question.
08:28How does one team's judgment reach everyone else?
08:32Simpler than it sounds.
08:34Every gate that you already trust, whether it's CI or types or lint or the design system, is just institutional judgment pulled out of someone's head and made mechanical.
08:46We just never called it that.
08:48So, you don't mandate it.
08:50You make it legible and you let it spread.
08:55All right.
08:55So, now your judgment exists.
08:57It's encoded and it's governed.
09:00Great.
09:01But none of it matters if you can't actually trust what the agent did.
09:06So what actually separates a tool that helps you write code from one you can trust to run on its own?
09:13Verification.
09:15Verification is all that stands between you and software that you can trust.
09:20Everything before this slide is knowledge.
09:24Everything after this slide is trust.
09:27And trust is a human's call twice.
09:30Once on how it's built, once on the proof that it works.
09:38Verification is a ladder.
09:41Builds and tests.
09:42You've got those screenshot tests with a model reasoning over them can catch contrast and overlap a human a human ski.
09:52Then video the feature actually running.
09:55than telemetry in production.
09:58The more rungs you can run without a human, the more you can hand off.
10:02You earn autonomy one rung at a time.
10:06And the agent doesn't have to be right the first time.
10:10It just has to know when it's wrong and try again.
10:13Generate, test, fail, regenerate.
10:19Nobody yolos code to prod and neither should your agents.
10:23We all check our work.
10:25spin at the gate until it comes back green.
10:30I do this on my side projects.
10:32I give the agent its own QA.
10:34It maps the feature, drives the app like a real user, and records itself walking every flow.
10:41The agent that wrote the code will always tell you that it works.
10:46So, you make it hand back a recording of the thing actually running.
10:50Producing that recording forces it to make the thing work.
10:54You can't fake a passing run.
10:56And the recording is real proof.
10:58I watch it today.
11:00Down the line, you could have an LLM watch it first and send it back.
11:05Fix this.
11:06Redo that.
11:07But a human still makes the final call to merge.
11:11The requirement forces the work.
11:14The recording proves it.
11:18I got tired of watching old feature flags pile up.
11:22So I built an agent for cleaning up stale feature flags.
11:25It runs in my local workflow and it doesn't merge any code.
11:29The models the easy part.
11:31The judgment in front of it is the whole game.
11:34Every flag gets scored the way an experienced reviewer would analyze it.
11:39How many modules does it touch?
11:42Is it multivariant?
11:43Does it share a component?
11:45Then it checks the experiment data.
11:47Is the roll out frozen?
11:48Is there a sample ratio mismatch?
11:50Is there a variant already rolled out to 100%.
11:54Only the safe mechanical cleanups ever reach the model.
11:59Before I trusted this workflow, I back tested the scoring against months of cleanup history.
12:05Then I ran it live.
12:07Seven for seven PRs with green CI.
12:10Now it runs daily on my laptop and hands work back for me to review.
12:15$1.26 a pull request, a backlog of around 520 flags a year, runs for under $700.
12:24If you had engineers working on this by hand, at least $26,000 that you're looking at.
12:32This is the work that nobody was ever going to do.
12:36I've seen feature flags in the codebase that are three, four years old, and some are even older.
12:43The model wrote the code and I wrote the judgment.
12:49One hard lesson from my side projects.
12:52When you let an agent author the code, your guard rails are your code review.
12:57A machine doesn't feel a polite comment.
13:00It only respects a hard gate.
13:03I built a pre-commit hook so my agents couldn't write to main.
13:07Then I asked Codeex, would the hook even stop it?
13:10It told me flat out repo hooks are not sufficient protection against me.
13:16Its patch tool writes underneath the hook.
13:19The agent told me that my gate was worthless.
13:22So I moved the gate down to the OS level.
13:25Later I asked it to valid I asked it to list the valid reasons to unlock and it quietly slipped emergency recovery into the allow list.
13:35A self authorizing exception that nobody asked for.
13:39It even admitted it.
13:41CODEC said that's the kind of escape hatch that starts as safety and ends as self- authorized nonsense.
13:48The pit of success assumes people take the easy path.
13:52Agents do not.
13:55They will build ladders to climb out of the pit of success.
13:59They find every escape hatch that you leave.
14:02And if you leave none, they'll invent one.
14:05So gate the choke point.
14:07Make the bypass operator only.
14:10Never hand the agent a reason that it can grant itself.
14:14A gate with an escape hatch isn't a gate.
14:20Once judgment is verifiable, it's executable.
14:25A flag agent, a dependency agent, an accessibility agent.
14:30Each one is narrow.
14:33Each with its own encoded judgment pointed at a different chore.
14:38Remember Minsky from the Kline?
14:40That was just a footnote in his in his idea.
14:43He called it the society of mind.
14:46A swarm of small, simple specialists that compose into something that looks effortless at the top.
14:53No master brain anywhere.
14:56That's the fleet.
14:57specialists, each spinning at its own gate, and a self-driving code base emerges from the swarm.
15:05And that flag agent, that's the war room from the opening, turned into a specialist.
15:11The work somebody organized a whole meeting around is just one member of this agent society.
15:18Every one of them doing the same thing, spinning at the gate until green.
15:25Three stages.
15:26In the loop, you prompt.
15:29On the loop, you orchestrate.
15:32You review the outcomes.
15:34Off the loop, a trigger fires it.
15:37Craw an event.
15:39No human has to kick off that first draft, but humans still own the approval and the merge process.
15:47The unlock there is a cloud runtime the model vendor may or may not ship for you.
15:55Everything that I've shown you, skills, personas, the gates, you wrote it down once, but the codebase doesn't hold still.
16:05It moves every single day.
16:08A skill written for last month's architecture isn't out of date.
16:12It's wrong.
16:14And that's worse than nothing because the agents trust it.
16:18Encoded judgment rots.
16:20If the skills don't move with the code, then the whole thing falls over.
16:25So you keep it alive in two ways.
16:28When an agent fails, you don't just fix the bug.
16:31You run the postmortem and fold the lesson back into the skill so that failure can't happen twice.
16:38Failure becomes a constraint.
16:41But nobody is hand auditing 300 skills for drift.
16:45So, you give the agent a bedtime, a scheduled pass where it reads its own skills, finds the stale ones and the contradictions, and opens up drafts for review.
16:56The system sleeps, cleans house, and wakes up sharper, but that's a whole separate talk on its own.
17:04A self-driving codebase is a system that keeps its own judgment current in addition to writing code.
17:13Everything that I've shown so far fits somewhere along this judgment pipeline.
17:21And every mechanism in this talk, skills, personas, work logs, and the gates, the fleet, all of it was doing one job.
17:32Managing judgment.
17:34Every session, the model wakes up like Drew Barrymore in 51st Dates.
17:39Brilliant.
17:40and no memory of yesterday.
17:42No idea what it's built or what it's even for.
17:46The collection of primitives in this talk is the notebook that we hand it.
17:51The skills, the work logs, the judgment that let it do real work.
17:57We don't ship PRs that pass CI because the model is a genius.
18:01They pass because we built a harness that won't let it be wrong.
18:06Every gate in it is a human's call.
18:09That's harness engineering.
18:12Scale the judgment, not the model.
18:17So here's what I'm asking you to do.
18:20Don't just go write a skill.
18:22That's only that's only one implementation.
18:24Find the judgment your team always asks the same person about and make it explicit somewhere that an agent can reach it.
18:33It could be a persona, a lint check or a commit hook.
18:37That's the job.
18:38Now less product engineering and more harness engineering and the method demonstrates itself.
18:45The flag agent produces PRs that pass CI.
18:48This talk resumed from a worklog.
18:52We started here.
18:54Humans absorb judgment implicitly while agents require it explicitly.
19:01Self-driving code bases will exist the moment we get that judgment out of our heads and into the codebase.
19:08Then we point the agents at the gate and let them spin until it's green.
19:13Thank you.
19:31[music]