Developers
An AI that opens pull requests,and a person who has to approve them
Reports arrive with the console, the network calls, a replay and the element that broke. Errors from your tracker open an investigation before anyone writes in. What reaches you is a branch, a diff and the evidence behind it, reviewed like any other pull request.
Before you go further
The public versioned API answers a version check and nothing else today. Every other path under it returns not found. Keys, scopes and webhooks are real and working; the read and write routes are being opened one at a time. If you are evaluating on the strength of the API, evaluate on the webhooks.
Webhooks
Events arrive at your endpoint seconds after they happen
Which means the five minute cron job and the queue of nothing it kept fetching can be deleted.
Signed over the exact body
A hash signature and the event name in headers, so you verify what arrived rather than trusting that it came from us.
Three attempts with backoff
And every attempt kept with its status code and error, so a delivery question is a lookup instead of an argument.
It cannot be pointed inward
Redirects are not followed and addresses that are not publicly routable are refused, so a webhook is not a way to make our servers fetch something on your internal network.
API keys
Scopes, set when the key is made
You decide at creation what a key can reach, which means revoking one later is a decision rather than an incident.
Live and test modes
Separate keys, so a script pointed at the wrong one fails loudly instead of writing to production quietly.
Hashed at rest, rotated with an overlap
You never see a key again after creation. Rotation gives you a window where both work, and a key can never be rotated into a wider scope than it started with.
What the AI is allowed to touch
Five classes of change are locked out of automation entirely
Not discouraged in a prompt. Refused in the code, before anything is drafted.
It works on a branch
Never your default branch, and never merged by anything other than a person.
The evidence comes with it
The fingerprint that grouped the errors, the files it read, and why it thinks the cause is the cause.
You review it like any other pull request
Same tools, same checks, same approvals. Nothing about the review is special because a machine wrote it.
Connect a repository and a tracker, then break something
That is the honest evaluation. Cause a real error in staging and see what arrives, how long it takes, and whether the diff is one you would have written.