*Published August 12, 2026* --- *Part one of a three-part set on how I work with agents day to day. Part two: The Scanner That Feeds the Pipeline. Part three: The Ledger That Stayed Empty.* --- ## TL;DR Nine open findings from a security audit on a Go CLI tool. I assigned each issue to an autonomous background agent running a full plan-to-PR pipeline. I wrote zero lines of code. I merged all nine pull requests in one afternoon. The review gates caught real, subtle flaws before merge. One agent coordination deadlock taught me how to structure nested agent loops. --- ## The Hand-off An agent-run security audit on [`nowshowing-pp-cli`](https://github.com/ph-commons/nowshowing-pp-cli/issues/6), a Go command-line tool, turned up ten issues — how that audit itself got dispatched is Part 2's story. One was already fixed before I started; the nine still open are what follows: four High, four Medium, and one Low severity. Two were documentation gaps; seven were logic and network security vulnerabilities. In a traditional workflow, this backlog sits. You fix the high-severity items and let the medium items age. Instead of manual triage, I handed all nine issues to an automated workflow called `change-pipeline`. Each issue ran through seven strict phases: 1. Generate an implementation plan. 2. Adversarial red-team review of the plan. 3. Isolate the environment in a dedicated `git worktree`. 4. Write code and tests. 5. Static code review. 6. Security and vulnerability review. 7. Open a pull request and verify the final diff. The typical failure mode with AI pipelines is babysitting. You prompt, wait, inspect the output, tweak the code, and prompt again. That is just typing with extra latency. Here, each background agent received a self-contained brief: the issue description, the repository style guide, worktree naming rules, and strict guardrails. Each agent ran the entire seven-phase lifecycle independently, spawning its own nested review agents along the way. I set a concurrency limit of two active pipelines at a time. The dispatching session touched zero application code. --- ## The Reviews Were Not Decoration If an agent review gate only rubber-stamps output, it is useless. The adversarial review gates repeatedly rejected early drafts and caught genuine flaws: - **TOCTOU DNS Rebinding:** A bind-address fix required five red-team rounds on the *plan alone*. The first draft validated the IP address once, then re-resolved the hostname when the process bound to the socket. An attacker with DNS control could swap the record between check and bind. The reviewer forced a redesign that pinned the resolved IP address before binding. - **SSRF Denylist Bypass:** A webhook-hardening patch passed initial code review. The security reviewer flagged that IPv4-mapped IPv6 addresses (`::ffff:127.0.0.1`) bypassed the hostname denylist. The agent patched the parser and re-verified. - **Scheme Downgrade:** A URL redirect check validated the destination host against an allowlist, but ignored the protocol scheme. A separate, independent review layer run after the pipeline finished caught that a redirect from `https://trusted.com` to `http://trusted.com` passed the filter. - **Brittle Diagnostics:** A shell diagnostic script would have failed silently under its own `set -e` flag during test error states — caught during plan red-teaming before any code was written. These were subtle logic bugs, not syntax errors — the kind that slip straight past single-pass generation. --- ## Where the System Deadlocked Autonomous delegation works until agent communication breaks down. During one run, a parent agent spawned a nested sub-agent to review a revised plan. When the sub-agent finished, it attempted to return its verdict to `"general-purpose"` — the agent *type*, not a valid conversation address. The message dropped into the void. The parent agent sat idle, waiting indefinitely for a verdict that would never arrive. I caught the hang only because I was actively polling the run's status — nothing surfaced on its own. I relayed the verdict to the parent agent by hand. The failure forced a structural fix. Inner agent loops must be synchronous and blocking. When an agent spawns a review sub-agent, it must wait for a direct return value. Only the top-level orchestration job should run asynchronously in the background. I codified this rule into the shared pipeline documentation immediately. --- ## The Boundary That Held Across nine issues, the agents held full authority to branch, write, test, critique, and open pull requests. None of them had authority to merge. Every agent report concluded with the same boundary. No merge action was taken, and the PR awaited human review — the pipeline agents would not even mark their own branches merge-ready, deferring that call to a separate review loop. That boundary is where engineering judgment belongs. For well-specified audit and maintenance backlogs, writing code is no longer the bottleneck. The real discipline of agentic software engineering lies in: 1. Designing adversarial verification gates that catch non-obvious logic flaws. 2. Hardening agent orchestration topology against deadlocks and lost messages. 3. Holding the merge gate as the final human checkpoint. A backlog that would have consumed a week was cleared in an afternoon. I spent the time reviewing diffs, verifying CI runs, and reading review verdicts instead of writing boilerplate.