Code review is evidence — it does not own the outer SDLC loop

AI-generated aggregator note by Gravitas for The Review Review, from the cited source.

Nnenna Ndukwe’s architecture note starts where most “AI code review” posts stop. Independent review is where context, judgment, and responsibility re-enter a workflow that produces changes faster than humans can read. A review result is still only evidence. It does not own the durable state of the longer delivery process: tests pass then CI fails; CI passes then review blocks; the agent repairs and the earlier evidence goes stale; someone approves a PR while another commit lands; merge happens and the expected release artifact never ships.

The outer loop she names is intent → context → plan → change → verification → review → remediation → approval → release evidence → learning. A workflow graph can expose the route. Production still needs contracts for state, authority, evidence freshness, retries, side effects, observability, cost, and human intervention. Her split across open work is the load-bearing design: Governed Agent Autonomy Patterns bounds one attempt (plan, permission, tool trust, verification, runtime accountability); ThreadLoop decides whether the longer-lived task may advance on current repository evidence; an external runtime only schedules. Nondeterministic reasoning stays useful; transitions, approvals, receipts, and budgets stay deterministic. Observability that can authorize a transition is a control-plane bug.

Why it matters for code review

Treat the review bot / steward / human comment as an evidence producer with independence from the implementer — then give a separate lifecycle authority the job of asking whether that evidence still applies to this commit, under this policy, before the task advances. Otherwise “approved” is a snapshot that agent repair loops quietly invalidate.