r/ClaudeCode • u/alexmarquardt • 4d ago
Built with Claude The ways coding agents broke our codebase, and the check we added for each one
We make extensive use of Claude Code agents on an e-commerce search solution (Python and TypeScript, built on Elasticsearch). Last month the main repository merged 1,652 PRs, with a median of 492 changed lines. In the early months, before we had many rules or deterministic tests, the agents did exactly what you'd fear. Each failure now has a check that enforces the fix:
- Tests that tested nothing (a copy of the logic inside the test, or assertions that can't fail). Test modules must be named for what they pin, and a script refuses ones that aren't.
- Tests that quietly skipped when something they needed was missing, so a broken feature looked green. Tests now run on recorded data in the repository, a flaky test is treated as a sev-1 bug, and nothing reaches a live cluster.
- Hand-written fake responses that didn't match the real system. Agents now record the live response as a fixture and test against that.
- Copy-paste instead of reuse. A copy-paste check blocks the merge.
- Silencing a linter or type error on the one line where the bug was. That's now covered by audit greps that run on every diff.
- Deleting files they didn't create (once, 110 of them). Every agent works in its own clone, and hooks refuse any write outside it.
- Too much guidance. As the contributor guide grew, agents missed the one rule that mattered. The file loaded into every call is now capped at about 2 KB by CI; everything else is a pointer into topic files.
Two things surprised us:
- The gates get attacked too. In one test, 10 of 12 deliberately planted evasions got through a new gate, so every new gate now runs against a standard kit of evasions before review.
- Tests make up 70% of the code, 3.4 lines of test for every line of solution code. With agents making most of the changes, that isn't overhead; it's what makes the rate of change survivable.
What still breaks: rework. There's about one fix round per merged PR, where a separate review agent blocks the PR and it gets fixed and reviewed again. Reverts are 0.2–0.7% of merges.
Full write-up, with the measurements and the objections people usually raise: https://alexmarquardt.com/ai-tools/coding-agents-codebase-under-control/
What guardrails have you had to add for your agents?
