reviewing-ai-authored-code

Does this carry the AI-authored failure signature? Hallucinated/typosquatted packages, invented APIs, confident-but-wrong constants, over-helpful scope.

When to use

Reviews a change for the failure signature of AI-/machine-authored code, independent of who wrote it: hallucinated or typosquatted dependencies (slopsquatting), invented or misused APIs and parameters, plausible-but-wrong constants and logic that reads fluently, hallucinated internal references to symbols that don't exist here, over-helpful unrequested additions (scope creep as a generation artifact), the weak-default security signature, tests that assert the implementation instead of the spec, fabricated comments/citations, and duplication instead of reuse. Flags the signature and hands the deep verdict to the owning lens (#18 supply-chain, #14 security, #1 correctness, #11 restraint). Use when reviewing AI-generated or AI-assisted code, a large or unfamiliar diff, or any change that adds dependencies or confident-looking constants and APIs — the defects are attribution-agnostic, so you need not know a model wrote it.

Shape: diff. Written for concrete code; not meant for design docs or plans.

Reviewer discipline

Report only real problems. If the code correctly handles the case, reply "No findings" and stop — do not invent issues. This guards against false positives on correct code; still report every genuine issue you do find, with its full detail.

Defects are the default; improvements are opt-in. By default this lens is defect-only: do not suggest changes to code that is already correct. When the team has opted up into improvement suggestions, a finding on already-correct code is admissible only as nit-severity, route: implementer (the author applies, defers, or ignores), and must clear the non-configurable anti-churn floor: it must genuinely improve — never offer a merely equivalent alternative — and must converge (once a dimension is as good as you can confidently make it, stop; never oscillate A→B then B→A, never re-order to an equivalent state). Defects keep the strict bar above regardless of this setting.

Team preferences. If the reviewed repo has .code-quality-atlas/preferences.md, apply it before reporting: a repo's .code-quality-atlas/preferences.md may set/tune this lens's thresholds or selection, and — being preference-tier — may suppress one of its findings outright (it never surfaces). Its improvement-valence directive is also what decides whether the "opted up" improvement-suggestion behavior above is active for this review. Absent the file, apply this lens's defaults exactly as written above.

Pre-existing defects in touched code are surfaceable, not yours to fix. When you notice a genuine defect this change did not introduce but that sits in the code this PR actually touches — the edited function or immediately adjacent lines — you may surface it, tagged "pre-existing — not introduced by this change." Like improvements it is opt-in and default-quiet (off unless the team opts up), route: implementer, and non-blocking: it informs the author's fix-now / file-a-ticket / ignore call and never sets this PR's verdict, because the diff did not cause it. Stay scoped to code the change touches — a repo-wide hunt is the audits' job, not this review — and never let it expand the PR's scope.