AI coding agent output verification in 2026: read the diff, vibe check it, merge

Not judging, I am in this with everyone else. We read the diff, understand roughly 70% of what we see. The other 30% looks plausible. Tests pass. Merge. What we are not doing: checking what the agent actually did during the session beyond the PR diff. How many files it read. What commands it ran. Whether it touched anything outside the stated task. I did a quick count on my own setup: * Sessions run this month: somewhere around 40 * Sessions where I pulled the full log: 2 The ratio is horrible, but prolly not unusual. The part I keep coming back to: we built code review culture specifically because it looking right is not the same as it being right. Right? Adding agents in the mix changed the speed, but not the reason. The diff is still not a session audit. At some point the vibe check comes due.