How to let an AI coding agent move fast without breaking things. An opinionated harness of classic engineering guardrails — enforced automatically against the agent's workflow — proven daily in production on Aurum. Works with Claude Code, GitHub Copilot, Codex, or whatever agent comes next.
The promise is real: an AI agent doesn't tire, doesn't lose focus, and will
happily refactor a module at 2am. But leave one unguarded for three days
and you'll find what we show in the talk: 247 untyped
anys, a secret key committed to git,
78 dead exports, and a GPL dependency
quietly poisoning your license position.
The agent isn't malicious — it's a junior developer who never sleeps, never complains, and never remembers the last PR review. Infinite capacity with zero institutional memory. Without automated enforcement, your codebase reflects the agent's defaults, not your standards.
The answer isn't reviewing harder — human review doesn't scale with agent velocity. The answer is a harness: classic engineering guardrails, wired so every one fires automatically at the right moment in the agent's workflow. The agent makes mistakes; the harness corrects them; no human intervenes.
Lint + format with agent-tuned rules (noExplicitAny,
noConsole — the exact drifts agents make under ambiguity),
TypeScript strict mode as a push gate, API clients generated from
the OpenAPI spec so they're always typed and always in sync, and dead-code
detection that finds every export the agent orphaned while iterating.
Four scan categories: hardcoded secrets (agents do this constantly "for testing"), license violations (GPL/AGPL blocked automatically), known CVEs in dependencies, and infrastructure misconfiguration. Critical findings block the push, interactively, before anything reaches main.
Beyond lint: cognitive-complexity limits (agents love deep nesting), cross-file duplication detection (agents copy-paste instead of abstracting), and a coverage gate — new code under 75% coverage fails the PR. The agent must ship tests, not just features.
Unit tests with full type inference, E2E across three browser engines, AI-aware timeouts for AI-powered flows. The agent can't remember past PR reviews — tests encode those lessons permanently.
A git-hook gauntlet (auto-fix on commit, branch-aware gates on push), enforced commit conventions that become the changelog, changesets for self-documenting releases, and ticket discipline with one golden rule: no ticket, no work. Every change traces to a task — the agent keeps its own paper trail.
Error tracking with source maps to the agent's exact line, product analytics to see whether shipped features actually get used, a health monitor that pages your phone at emergency priority — and automated publishing: release notes flow to Slack and social automatically, because the enforced commit format makes changelogs human-readable.
Same agent, same codebase, same velocity — measured with and without the harness on Aurum, where this entire system runs in production today, from the ETL pipeline to marketing analytics and automated release publishing.
any — a type is a contract; any breaks it silentlyWe install this harness — tuned to your stack — and train your team to run with it.
info@oandaconsult.com