The Morning Review Queue: Triaging Eight Hours of Unattended Agent Work

The pitch for overnight coding agents is seductive: you go to sleep, the fleet works, and you wake up to finished pull requests. What actually happens is subtler and more expensive. You wake up to a queue — six branches, two failed runs, a dependency bump you didn't ask for, and a refactor that is either brilliant or subtly wrong. The agents did produce code. But the deliverable that landed on your desk isn't code. It's a triage problem, and most teams have no workflow for it.

The numbers say this isn't a niche complaint. A telemetry study of more than 10,000 developers across 1,255 teams found that high-AI-adoption teams merged 98% more pull requests — while review time rose 91% and average PR size grew 154%. Follow-up data from 2026 is worse: production incidents per PR roughly tripled, and 31% more PRs now merge with no human review at all. The bottleneck didn't disappear when agents started working the night shift. It moved to 9 a.m., concentrated into the first ninety minutes of your day, and got a name: the morning review queue.

Treating that queue like a stack of ordinary code reviews is the root mistake. A PR from a colleague arrives with context you already share — you know why they took the ticket, you talked about the approach at standup, and you trust them to have run the tests they claim they ran. A branch from eight hours of unattended agent work carries none of that. The review isn't "is this diff correct?" It's "what did this thing decide while I wasn't watching, and do I agree with those decisions?" Those are different questions, and they need different tooling, different artifacts, and a different definition of done.

Trust Tiers: Deciding What Runs Unattended in the First Place

The first design decision happens before any agent runs overnight: what work is allowed to happen without a human awake. Teams that skip this step end up with the worst version of the morning queue — a pile where a typo fix and a schema migration sit side by side, demanding the same scrutiny because nothing distinguishes them.

The fix is a graduated autonomy ladder, and the industry has converged on roughly the same rungs independently. At the bottom, agents run read-only: they investigate, summarize, and propose, but touch nothing. One rung up, they produce diffs that a human must apply. Above that, they commit to isolated branches with mandatory review. At the top — a tier most teams should treat as earned, not default — they merge autonomously behind strong gates like full test coverage, canary deploys, and automatic rollback.

Two properties make a ladder like this work in practice:

• Autonomy is earned per task type, not per agent. An agent that has landed fifty clean dependency bumps has earned unattended dependency bumps. It has earned nothing about database migrations. Promotion follows accumulated evidence — approval rates, revert rates, incidents traced back — and demotion is automatic when quality slips.
• The tier is assigned at dispatch time, not review time. When you queue overnight work, each task carries its tier with it. That single decision is what makes morning triage tractable, because the queue arrives pre-sorted by how much you agreed to trust it.

The overnight cutoff usually lands in a predictable place: mechanical, well-tested, easily reverted work runs unattended; anything touching auth, payments, data models, or public APIs waits for daylight. The precise line matters less than the line existing before the agents start, because the alternative is deciding it at 9 a.m. for every branch individually — which is just the triage time sink wearing a different hat.

The Artifacts an Agent Owes Its Reviewer

Reviewing unattended work goes from miserable to manageable based on one variable: what the agent left behind. A bare diff plus a cheery auto-generated summary is the floor, and it's not enough — LLM-generated code reliably looks plausible on a casual read, which makes shallow review actively dangerous. The reviewer's real job is auditing decisions, so the agent has to surface its decisions.

The tempting maximalist answer — dump the full session transcript into the PR — fails in the opposite direction. Raw transcripts are enormous, noisy, occasionally contain secrets, and no one reads them. What works is a compact provenance receipt, a few structured sections the reviewer can absorb in under a minute:

• Intent: the task as the agent understood it, in one or two lines. Half of overnight failures are goal misinterpretation, and this line catches them before the reviewer reads a single hunk of the diff.
• Decision log: forks in the road, with a one-line rationale each. "Chose to bump the major version of X because the vulnerability fix wasn't backported." These are exactly the judgments the reviewer would want to veto.
• Verification evidence: not "tests pass" as a string the model generated, but actual test output, actual lint results, actual commands run. Agents claiming to have run tests they never ran is one of the best-documented failure modes in the field.
• The deferred list: everything the agent chose not to do — ambiguities it punted on, adjacent bugs it noticed and left alone, assumptions it made when the spec ran out.
• Anomalies: retries, dead ends, tool failures, self-reverted approaches. A run that thrashed for three hours before converging deserves more suspicion than its clean final diff suggests.

Loading…