AI code rework
AI Code Rework answers a question no linter can: of the code coding agents wrote, how much did a person have to go back and fix, and what did that cost?
It joins two things Shield360 already has. The coding-agent hooks on developers’ machines see every edit an agent makes. A scanner connector already holds a GitHub repository and a token. Put together, the platform can recognise an agent-written line when a later commit changes it.
How a line is recognised
Section titled “How a line is recognised”When an agent edits a file, the hook fingerprints each line it added: trim the line, collapse whitespace, SHA-256 it, keep 16 hex characters. Lines shorter than 8 characters or made only of punctuation are skipped. The fingerprints go on the edit-decision span as coding_agent.edit.line.fingerprints. The line itself never leaves the machine, in any capture mode.
The platform copies those fingerprints into a provenance ledger: repository, file, fingerprint, session, who, when. Then it walks the repository’s commits and fingerprints every line each commit removed and added, the same way. A removed line whose fingerprint is in the ledger is an agent-written line somebody changed.
What counts as rework
Section titled “What counts as rework”A person touching agent lines is not always a fix. It is also how a feature grows. So every event carries a tier, and the report never presents the lowest tier as “had to fix”.
| Tier | Shown as | When |
|---|---|---|
| high | Reverted | The commit reverts the change |
| medium | Fixed | The commit message says it is a fix, or references an issue |
| low | Changed | The lines changed, and nothing says why |
Only reverted and fixed lines feed the rework rate, effort and cost. Changed lines are shown as churn.
Changes older than the rework window (30 days by default) are evolution, not rework, and are left out. A session changing its own lines is the agent iterating, not rework. A later commit by an agent to another agent’s lines is shown separately as agent fixed agent.
Who made the change
Section titled “Who made the change”A commit is attributed to an agent when a hook saw the commit happen inside a session, or when at least half of the lines it adds carry agent fingerprints. Otherwise it is attributed to a person. Inline tab completions are not captured by the hooks, so agent-written lines are a floor, not a ceiling.
What the money means
Section titled “What the money means”Two settings drive every money figure, and the page shows them beside the total:
- Minutes per reworked line: the engineering time to find, understand and fix one agent-written line. Default 3.
- Loaded hourly rate: what an engineering hour costs. Default 0, which shows hours only.
Rework cost = reworked lines × minutes per line ÷ 60 × hourly rate. It is an estimate under stated assumptions, and it says so. Nothing on the page estimates cloud spend in money: a static pattern cannot know how often the code runs.
Expensive patterns
Section titled “Expensive patterns”Alongside rework, the walk runs a small set of rules over the lines each commit adds, tagged with who wrote the line. The rules are checkable shapes in the text, each with the line of the cloud bill it lands on:
| Rule | Cost driver |
|---|---|
| Query inside a loop | Database I/O |
SELECT *, query with no limit, leading-wildcard LIKE | Database I/O |
| Whole file read into memory, cache with no bound | Memory |
| Cloud client constructed inside a function, retry loop without backoff, blocking sleep | Compute |
| List call without pagination | Egress |
| Logging inside a loop | Log ingest |
Tests, vendored code and data files are skipped.
Setting it up
Section titled “Setting it up”- Install the Shield360 CLI on developers’ machines with the coding-agent hooks (see Coding agents). Hooks from this release onward stamp fingerprints; older hooks do not, and their edits cannot be matched.
- Under Connectors, add a scanner connector with the GitHub repository URL and a token that can read it. Every scanner connector that points at GitHub is walked.
- Open Develop → AI Code Rework. The first walk runs within fifteen minutes, or press Walk repositories now. Each repository is walked at most every six hours after that.
Permissions
Section titled “Permissions”| Permission | Allows |
|---|---|
ai_code.read | Viewing the page |
ai_code.run | Walking repositories now |
ai_code.configure | Changing the cost assumptions |
Administrators, analysts, members and viewers can read the page. Only administrators can run a walk or change the assumptions unless a role grants it.
Where the data lives
Section titled “Where the data lives”Four tenant-scoped ClickHouse tables: shield360_ai_code_provenance (fingerprints, never lines), shield360_ai_code_rework, shield360_ai_code_findings (one bounded line of code per finding, from the customer’s own repository) and shield360_ai_code_settings. Rows expire after a year. The GitHub token stays on the connector and is only ever read to call the GitHub API.