The vouch
A while back I reviewed a pull request that nobody on the team could explain, including the author. Two hundred odd files. "Copilot generated most of it," he said. "It compiles and the tests pass." It merged the next day. I've written about it before as a story about understanding, and it is one. But the detail that has stayed with me is smaller. He didn't say it as a confession. He said it as reassurance. He put the PR up the way you hand over finished work.
A pull request is a claim, not a delivery mechanism. When I open one I'm saying: I did this, I understand it, I believe it's right, and I want you to check my belief. Review works because that claim does most of the lifting. The reviewer samples. The author vouches. That's the deal, and it's why a review can take twenty minutes instead of the three days it took to build the thing.
He was vouching for code he couldn't explain. The more I look, the less that seems like one developer's bad day and the more it looks like the default posture of the industry.
Where the confidence came from
Before the tools, trust in your own PR was a by-product of writing it. Typing every line drags you through every decision, whether you want it to or not. You know which corner you cut because you cut it. You know the error handling is thin in one place because you remember deciding it could wait. When a reviewer asks "what happens if this is null", you have an answer, because at some point your cursor sat on that line while you thought about exactly that.
The confidence wasn't always justified. I have fourteen years of bugs with my name on them. But it was attached to something real: hours of your own attention, spent on this exact diff. Arrogant developers existed long before AI. At least their arrogance was about their own work.
The labour left, the confidence stayed
Now the model writes the diff and the confidence turns up anyway. That's the part I find remarkable. Understanding per line has collapsed, and belief per line hasn't moved. Developers open PRs at a volume they could never have typed, skim what came back, and present it with the same "check my work" posture as before, when the honest posture is "check the machine's work, I haven't finished doing that myself".
Confidence is supposed to track understanding. It has started tracking output instead. The diff is big, the tests are green, the code reads well, so it must be good, and I made it happen, so I must be good. Every step in that chain is broken. AI produces plausible output without understanding, and the author is the first person the plausibility fools. The reviewer is only the second.
Trusting a PR you wrote is ordinary professional risk. Trusting a PR you prompted is a different move. It's certainty about work you didn't do, borrowed from a machine that doesn't have any. The model isn't confident the code is right. The model isn't confident of anything. It predicted tokens, and you signed them.
The chain has gone circular
Review assumed human authorship in ways nobody wrote down. A human writes a few hundred considered lines a day, so a reviewer can hold a day's work in their head. A human author has uneven confidence, more sure here, less sure there, and a good one flags the difference in the description. All of that was load-bearing, and all of it is gone.
I've written before about a deployment approval gate I audited: a month of production approvals, not one rejection, most of them signed off in under a minute. That was review of human-sized changes. Feed the same ritual a few thousand generated lines a day and the minute doesn't stretch to compensate. It stays a minute. The reviewer trusts that the author checked it. The author trusts that the model got it right. The model trusts nothing, because there's nobody in there. The chain of trust that review depends on now terminates in a next-token predictor, and everyone in the chain assumes the understanding happened somewhere behind them.
What vouching should cost
None of this is an argument against the tools. I use them daily. It's an argument about what you're allowed to claim afterwards.
The test I use: could I explain this diff with the code closed? Not reproduce it line for line, but walk the reasoning, say why this approach and not the other one, name the case it doesn't handle. If yes, I'm the author and the PR is mine to vouch for, whoever typed it. If no, I'm not the author. I'm the sponsor, and the PR description should say so. "The model wrote the retry logic, I've traced the happy path and the timeout case, I have not verified the backoff maths" is a weaker claim than the old one, and it's the true one. A reviewer can work with a true weak claim. A false strong one is how two hundred files merge in a day.
That costs something. Writing "I haven't verified this" on your own PR feels terrible, which tells you how much of our confidence was social rather than technical all along. The alternative is a team of people vouching for each other's machine output in a circle, at speed.
To finish
A pull request is a claim of understanding, made by the person best placed to have it. Making that claim about code you can't explain isn't confidence. It's hubris, and no amount of green ticks changes that.