GitHub Copilot code is a "beta": human review required

The repo's design reflects a specific worry: an AI agent will report "implemented" or "tests passed" when, in fact, a function does not exist or a test checks nothing. To counter that, requirements, code, and tests are tied together in a mapping table, and a requirement's status can only climb from pending to implemented or proven if the referenced files and assertions actually exist and are verified by a CI check called spec-trace. A design document's hash is recorded after a human approves it, so if the doc later changes, the hash mismatches at CI and affected requirements are reset to pending. The rules that govern all of this live in a single guidelines/ directory that both AI and people cite, and the agents are told not to invent rules absent from that folder. The agents themselves are split by role — planner, coder, tester, reviewer, orchestrator — and the coder is deliberately kept from writing tests, because the same AI doing both tends to bend tests toward its own implementation. Before any merge, deterministic gates D1 through D11 must pass, covering compilation on Java 17, Checkstyle, unit tests, branch coverage, SpotBugs, and the existence of code and assertions; AI review, labeled N1 through N6, is explicitly only a supplement. For teams already letting coding agents touch production repositories, the interesting question is whether this kind of scaffolding — not a stronger model — is what determines whether AI-written code can be trusted at scale.