AI code review — what it catches and what it misses

An agent is useful in code review but does not replace human review — because the two catch different classes of error.

The agent catches well: - Pattern violations: code that doesn't match the project's conventions. - Forgotten cases: null checks, error handling, empty collections. - Mechanical problems: resource leaks, an unclosed Cursor, a stream never close()d. - Consistency: how the same thing is done elsewhere in the project. - Volume: it reads a 40-file PR to the end without tiring.

The agent catches poorly: - Correctness of business logic — the code works "correctly" but the requirement was different. - Architectural decisions — is this abstraction right, does this module belong here. - Contextual risk — the production impact of this change, whether a migration is needed. - Priority — which finding blocks the merge and which can wait.

Practical arrangements:

1. Locally, before opening the PR — the developer has the agent review their own change. Fastest feedback, cheapest fix.

2. In CI, as a PR comment — automatic review on every PR. Gives consistency, but risks noise.

3. As a skill, on demand — something like /compose-review, when the developer asks.

The noise risk deserves attention: if the agent posts 30 small findings on every PR, the team stops reading them and the mechanism dies. So a review skill needs a priority requirement: "report only blocking and medium-severity problems; skip style notes".