Scale the Judgment, Not the Model — Andrew Orobator, Reddit
https://www.youtube.com/watch?v=6MudaeKdBSk
AI Engineer · 19 min · 262 sentences · sentence-level transcript from YouTube's caption track; each line begins at the time shown

[00:01] [music]
[00:12] A friend told me about an engineer at another company who ran a recurring war room just to delete dead experiments.
[00:20] Every two weeks, the team would stop, gather, and clean up flags that everyone agreed should be gone.
[00:28] That's the bestase version of this problem.
[00:32] Someone burning political capital to make maintenance happen by hand.
[00:37] That's the part that I still can't get past.
[00:42] My name is Andrew Robbittor and I'm an Android engineer at Reddit.
[00:46] This is a talk about what's actually stopping us as an industry from scaling that work responsibly.
[00:52] Spin at the gate until green.
[00:54] the engineering primitives behind self-driving code bases.
[00:59] First, what I'm not going to do, I'm not going to stand up here and tell you that AI can write code.
[01:06] You're at the AI engineer world's fair.
[01:08] Half of you are running coding agents right now.
[01:11] So, let's skip the part where I sell you on AI writing code because you laugh me out of the room.
[01:17] For me, my only input is the chat box.
[01:20] I describe it builds.
[01:23] I review.
[01:24] Your mileage may vary.
[01:26] The point was never how the code gets written.
[01:29] It's about whether you ship good software, a product that people can actually trust.
[01:36] And every gate in that system is a human's call.
[01:41] I've watched this everywhere.
[01:43] You've got your own version of it.
[01:44] the war room that I opened with someone burning a week of hackathon freedom on lint cleanup.
[01:52] As an industry, we've built tooling that can change the shape of the work, and we still spend our scarcest resource on work like this by hand.
[02:01] Human creativity, human attention wasted.
[02:06] The job changed and most of us didn't even notice.
[02:09] We're harness engineers now.
[02:11] Our work is the system that helps produce and verify the code, the constraints, the gates, the skills, the verification.
[02:23] Think about how you got good for a second.
[02:26] Mentorship, code review, the water cooler chats, the incident that paged you at 3:00 a.m. You absorbed all of it without noticing, just by being there.
[02:38] Humans absorb judgment implicitly.
[02:41] Agents require judgment explicitly.
[02:45] An agent boots with a blank context window and no memory every session.
[02:51] Every piece of judgment you picked up by osmosis, it has to be made explicit or the agent simply never has it.
[03:00] Quick test.
[03:02] Swap in a smarter model.
[03:04] You get a slightly better answer.
[03:06] Now take away the tests, the gates, the review and the whole thing falls over.
[03:12] So the model was never really the bottleneck.
[03:15] The judgment around the model is the model is raw talent while the judgment is the organization.
[03:26] And this judgment already exists.
[03:28] It lives in scars, in post-mortems, in your most experienced reviewers.
[03:34] it just doesn't scale because it's trapped in one head.
[03:39] So step one is making it accessible to the whole org where one reviewer's taste can guide a thousand changes they'll never touch.
[03:50] Ask experienced engineers to clean up a feature flag and they they're going to think about a whole string of questions first.
[03:57] A flag is never just a flag.
[04:00] Is the rollout frozen?
[04:01] What about the flag right next to it?
[04:03] Which team owns it?
[04:06] That bundle of questions is judgment and it's the most valuable thing in the building.
[04:12] Right now, it's trapped.
[04:14] It surfaces once in a code review, then it's gone, and the next person relearns it the hard way.
[04:22] A skill is institutional judgment made executable.
[04:26] It's that bundle written down so that the agent refires it instead of guessing.
[04:32] A newer engineer can work with 10-year instincts at their elbow.
[04:37] In 1986, Marvin Minsky named this a knowledge line or a kine for short.
[04:44] It's the configuration of mind that solved a problem reused on the next one.
[04:50] So, a skill is a kine for a codebase.
[04:55] And skills aren't documentation.
[04:58] Agents drown in facts.
[05:00] What they lack is which facts matter and which decisions are dangerous.
[05:06] Documentation preserves facts while skills preserve judgment.
[05:14] Skills are judgment that you reuse.
[05:17] But often times work such as feature development or a refactor outlives a single session and the context window wipes clean every time.
[05:28] So you need the other half.
[05:30] A record of the work itself.
[05:33] The plan, the decisions, what you already tried, even the surprises along the way.
[05:40] That's a worklog.
[05:42] A plan is a prediction.
[05:44] A worklog is a record that starts with one.
[05:48] So new session, fresh agent, zero memory.
[05:52] You type one word, continue.
[05:55] It reads the work log and picks up at milestone 7 out of nine.
[05:59] No re-exaining and the work log is the context.
[06:03] This talk is living proof.
[06:06] I built it across a couple of sessions using a worklog.
[06:09] I came back to a half-finish presentation and a fresh agent read the work log and resumed exactly where I had left off.
[06:18] That's the only reason why you're seeing a finished talk and not me apologizing for one.
[06:24] And for my personal side projects, this isn't willpower.
[06:28] A git hook blocks any commit that doesn't update the worklog.
[06:32] This way, the memory keeps itself.
[06:38] Skills encode how to do something.
[06:41] Personas encode whose eyes look at it.
[06:45] I got this from a Carpathy tweet.
[06:48] There's no you when you prompt a model.
[06:50] It doesn't have an opinion to give.
[06:52] So don't ask it for one, ask for a perspective instead.
[06:57] What would be a good group of people to explore XYZ?
[07:01] What would they say?
[07:03] [snorts]
[07:05] On my personal side projects, it's just me.
[07:08] No security team, no designer, no one to bounce ideas off of.
[07:13] So I have the model review my code as a security lead as a UX reacher as a UX researcher as Mchavelli when I want to know something when I want to know how something gets abused.
[07:25] I even built a design panel of opposing philosophies my designs have to survive.
[07:31] Then I read the reports and act on them.
[07:34] Each persona loads a kind of judgment that I don't personally have on demand.
[07:40] Encode a domain's taste once and anyone can borrow eyes that they don't have.
[07:46] The engineer with no designer gets design judgment.
[07:50] The newer engineer gets a security reviewer's instincts.
[07:54] Push it to the whole org and every team can now encode its own taste for its own agents.
[08:01] The judgment that used to live in a handful of heads is suddenly everywhere at once.
[08:10] skills, work logs, personas, judgment out of our heads and into the repo, portable to a machine and to people that don't have it.
[08:21] But the second that this judgment lives in three different places, you've got a governance question.
[08:28] How does one team's judgment reach everyone else?
[08:32] Simpler than it sounds.
[08:34] Every gate that you already trust, whether it's CI or types or lint or the design system, is just institutional judgment pulled out of someone's head and made mechanical.
[08:46] We just never called it that.
[08:48] So, you don't mandate it.
[08:50] You make it legible and you let it spread.
[08:55] All right.
[08:55] So, now your judgment exists.
[08:57] It's encoded and it's governed.
[09:00] Great.
[09:01] But none of it matters if you can't actually trust what the agent did.
[09:06] So what actually separates a tool that helps you write code from one you can trust to run on its own?
[09:13] Verification.
[09:15] Verification is all that stands between you and software that you can trust.
[09:20] Everything before this slide is knowledge.
[09:24] Everything after this slide is trust.
[09:27] And trust is a human's call twice.
[09:30] Once on how it's built, once on the proof that it works.
[09:38] Verification is a ladder.
[09:41] Builds and tests.
[09:42] You've got those screenshot tests with a model reasoning over them can catch contrast and overlap a human a human ski.
[09:52] Then video the feature actually running.
[09:55] than telemetry in production.
[09:58] The more rungs you can run without a human, the more you can hand off.
[10:02] You earn autonomy one rung at a time.
[10:06] And the agent doesn't have to be right the first time.
[10:10] It just has to know when it's wrong and try again.
[10:13] Generate, test, fail, regenerate.
[10:19] Nobody yolos code to prod and neither should your agents.
[10:23] We all check our work.
[10:25] spin at the gate until it comes back green.
[10:30] I do this on my side projects.
[10:32] I give the agent its own QA.
[10:34] It maps the feature, drives the app like a real user, and records itself walking every flow.
[10:41] The agent that wrote the code will always tell you that it works.
[10:46] So, you make it hand back a recording of the thing actually running.
[10:50] Producing that recording forces it to make the thing work.
[10:54] You can't fake a passing run.
[10:56] And the recording is real proof.
[10:58] I watch it today.
[11:00] Down the line, you could have an LLM watch it first and send it back.
[11:05] Fix this.
[11:06] Redo that.
[11:07] But a human still makes the final call to merge.
[11:11] The requirement forces the work.
[11:14] The recording proves it.
[11:18] I got tired of watching old feature flags pile up.
[11:22] So I built an agent for cleaning up stale feature flags.
[11:25] It runs in my local workflow and it doesn't merge any code.
[11:29] The models the easy part.
[11:31] The judgment in front of it is the whole game.
[11:34] Every flag gets scored the way an experienced reviewer would analyze it.
[11:39] How many modules does it touch?
[11:42] Is it multivariant?
[11:43] Does it share a component?
[11:45] Then it checks the experiment data.
[11:47] Is the roll out frozen?
[11:48] Is there a sample ratio mismatch?
[11:50] Is there a variant already rolled out to 100%.
[11:54] Only the safe mechanical cleanups ever reach the model.
[11:59] Before I trusted this workflow, I back tested the scoring against months of cleanup history.
[12:05] Then I ran it live.
[12:07] Seven for seven PRs with green CI.
[12:10] Now it runs daily on my laptop and hands work back for me to review.
[12:15] $1.26 a pull request, a backlog of around 520 flags a year, runs for under $700.
[12:24] If you had engineers working on this by hand, at least $26,000 that you're looking at.
[12:32] This is the work that nobody was ever going to do.
[12:36] I've seen feature flags in the codebase that are three, four years old, and some are even older.
[12:43] The model wrote the code and I wrote the judgment.
[12:49] One hard lesson from my side projects.
[12:52] When you let an agent author the code, your guard rails are your code review.
[12:57] A machine doesn't feel a polite comment.
[13:00] It only respects a hard gate.
[13:03] I built a pre-commit hook so my agents couldn't write to main.
[13:07] Then I asked Codeex, would the hook even stop it?
[13:10] It told me flat out repo hooks are not sufficient protection against me.
[13:16] Its patch tool writes underneath the hook.
[13:19] The agent told me that my gate was worthless.
[13:22] So I moved the gate down to the OS level.
[13:25] Later I asked it to valid I asked it to list the valid reasons to unlock and it quietly slipped emergency recovery into the allow list.
[13:35] A self authorizing exception that nobody asked for.
[13:39] It even admitted it.
[13:41] CODEC said that's the kind of escape hatch that starts as safety and ends as self- authorized nonsense.
[13:48] The pit of success assumes people take the easy path.
[13:52] Agents do not.
[13:55] They will build ladders to climb out of the pit of success.
[13:59] They find every escape hatch that you leave.
[14:02] And if you leave none, they'll invent one.
[14:05] So gate the choke point.
[14:07] Make the bypass operator only.
[14:10] Never hand the agent a reason that it can grant itself.
[14:14] A gate with an escape hatch isn't a gate.
[14:20] Once judgment is verifiable, it's executable.
[14:25] A flag agent, a dependency agent, an accessibility agent.
[14:30] Each one is narrow.
[14:33] Each with its own encoded judgment pointed at a different chore.
[14:38] Remember Minsky from the Kline?
[14:40] That was just a footnote in his in his idea.
[14:43] He called it the society of mind.
[14:46] A swarm of small, simple specialists that compose into something that looks effortless at the top.
[14:53] No master brain anywhere.
[14:56] That's the fleet.
[14:57] specialists, each spinning at its own gate, and a self-driving code base emerges from the swarm.
[15:05] And that flag agent, that's the war room from the opening, turned into a specialist.
[15:11] The work somebody organized a whole meeting around is just one member of this agent society.
[15:18] Every one of them doing the same thing, spinning at the gate until green.
[15:25] Three stages.
[15:26] In the loop, you prompt.
[15:29] On the loop, you orchestrate.
[15:32] You review the outcomes.
[15:34] Off the loop, a trigger fires it.
[15:37] Craw an event.
[15:39] No human has to kick off that first draft, but humans still own the approval and the merge process.
[15:47] The unlock there is a cloud runtime the model vendor may or may not ship for you.
[15:55] Everything that I've shown you, skills, personas, the gates, you wrote it down once, but the codebase doesn't hold still.
[16:05] It moves every single day.
[16:08] A skill written for last month's architecture isn't out of date.
[16:12] It's wrong.
[16:14] And that's worse than nothing because the agents trust it.
[16:18] Encoded judgment rots.
[16:20] If the skills don't move with the code, then the whole thing falls over.
[16:25] So you keep it alive in two ways.
[16:28] When an agent fails, you don't just fix the bug.
[16:31] You run the postmortem and fold the lesson back into the skill so that failure can't happen twice.
[16:38] Failure becomes a constraint.
[16:41] But nobody is hand auditing 300 skills for drift.
[16:45] So, you give the agent a bedtime, a scheduled pass where it reads its own skills, finds the stale ones and the contradictions, and opens up drafts for review.
[16:56] The system sleeps, cleans house, and wakes up sharper, but that's a whole separate talk on its own.
[17:04] A self-driving codebase is a system that keeps its own judgment current in addition to writing code.
[17:13] Everything that I've shown so far fits somewhere along this judgment pipeline.
[17:21] And every mechanism in this talk, skills, personas, work logs, and the gates, the fleet, all of it was doing one job.
[17:32] Managing judgment.
[17:34] Every session, the model wakes up like Drew Barrymore in 51st Dates.
[17:39] Brilliant.
[17:40] and no memory of yesterday.
[17:42] No idea what it's built or what it's even for.
[17:46] The collection of primitives in this talk is the notebook that we hand it.
[17:51] The skills, the work logs, the judgment that let it do real work.
[17:57] We don't ship PRs that pass CI because the model is a genius.
[18:01] They pass because we built a harness that won't let it be wrong.
[18:06] Every gate in it is a human's call.
[18:09] That's harness engineering.
[18:12] Scale the judgment, not the model.
[18:17] So here's what I'm asking you to do.
[18:20] Don't just go write a skill.
[18:22] That's only that's only one implementation.
[18:24] Find the judgment your team always asks the same person about and make it explicit somewhere that an agent can reach it.
[18:33] It could be a persona, a lint check or a commit hook.
[18:37] That's the job.
[18:38] Now less product engineering and more harness engineering and the method demonstrates itself.
[18:45] The flag agent produces PRs that pass CI.
[18:48] This talk resumed from a worklog.
[18:52] We started here.
[18:54] Humans absorb judgment implicitly while agents require it explicitly.
[19:01] Self-driving code bases will exist the moment we get that judgment out of our heads and into the codebase.
[19:08] Then we point the agents at the gate and let them spin until it's green.
[19:13] Thank you.
[19:31] [music]