The AI Record
Auto-approve is not auto-merge. When Diff Vader approves, it posts an APPROVE review, the same thing a human reviewer clicking “approve” does. It does not push the merge button. The engineer merges (or GitHub’s native auto-merge does, if they enabled it), and every existing gate—CI, branch protection, required-reviewer counts—still applies.

Dave NorthLeads the technical operations group · Leader, Rewind

Post: Review is the bottleneck now: How we let AI approve pull requests (safely), Rewind blog, June 1, 2026, at What an engineer actually sees.

Checked against the source [ Grade B ] Said in the last year

Filed under

Who is speaking

Dave North, Leads the technical operations group. Writes as the leader of the group that built and runs the Diff Vader reviewer, and says he reports its results to leadership and auditors.

How this was checked

Checked against the source by a first reader, then confirmed independently by a second reader who fetched the source without seeing the first reader's notes (Independent review agent (Claude Sonnet), blind second pass from passage text and citation only, no repository access, 2026-11-04).

Exact match, including curly quotes and em dashes. Post carries the Dave North author box.

How to cite this passage

Dave North (Rewind), “Review is the bottleneck now: How we let AI approve pull requests (safely)”, Rewind blog, 2026-06-01, at What an engineer actually sees. https://rewind.com/blog/ai-approve-pull-requests-safely/ Archived at https://the-ai-record.com/passages/rewind-auto-approve-not-auto-merge-bot-approve-review-gates-2026

More from the same source

Diff Vader and the Death Star were built almost entirely with Claude Code, but not by typing “build me an AI reviewer” and shipping whatever came back. We used spec-based development — Superpowers for the core methodology, augmented with our own skills — which forces every piece of work through brainstorm → written spec → reviewed implementation plan → execution → code review, with discrete human checkpoints in between.

Dave NorthLeads the technical operations group · Leader, Rewind

Post: Review is the bottleneck now: How we let AI approve pull requests (safely), Rewind blog, June 1, 2026, at What I’d tell another engineering leader.

Checked against the source [ Grade B ] Said in the last year Passage page

So we built a system that fixes the allocation. It’s called Diff Vader: an AI reviewer that looks at every PR across our orgs and, for a carefully bounded set of low-risk changes, becomes the only reviewer needed, freeing human reviewers to spend their judgment where judgment actually matters.

Dave NorthLeads the technical operations group · Leader, Rewind

Post: Review is the bottleneck now: How we let AI approve pull requests (safely), Rewind blog, June 1, 2026, at Opening.

Checked against the source [ Grade B ] Said in the last year Passage page

It declares the hard rules the verdict engine is not allowed to override no matter what the council says: paths that touch authentication, authorization, secrets, encryption, and anything that changes who is allowed to approve future changes always require a human.

Dave NorthLeads the technical operations group · Leader, Rewind

Post: Review is the bottleneck now: How we let AI approve pull requests (safely), Rewind blog, June 1, 2026, at The council: many specialists, one question.

Checked against the source [ Grade B ] Said in the last year Passage page

Something wrong? Report a correction. JSON: /api/v1/passages/rewind-auto-approve-not-auto-merge-bot-approve-review-gates-2026.json