you shouldn’t look at the code, let the clanker do its thing
My name is attached to the PR, and I’m getting called at night when shit breaks. That, and I joined this whole endeavour because I actually quite like the code, and I’m actually curious to see it no matter who or what wrote it. So I’m gonna review it.
Admittedly, if I’m building a toy that I am the only user of, and don’t want to invest time into, I’ll ask a clanker to do it by itself. And I certainly won’t put my pristine, delicate little hands into the Rube Goldberg-esque pile of confusion that results of the cursed dreams that are what it thought I was asking for.
For everything else, I wanna see the code.
I get a lot of pride from the quality of my engineering[^5], what’s commonly called “my craft”. It’s part of my identity. Finding a solution that balances simplicity, reliability, security, cost, performance, maintainability, etc. I hate it when I break shit in prod. It’s a personal failure, I feel shame, it’s like a dirty spot on my reputation. I hate it when I ship shit, stuff that doesn’t work. And I hate it when someone else’s stuff breaks, and my big ugly face is attached to their PR with a dumb “👍 LGTM” next to it. When someone gets woken up because I fucked up some piece of software, I lose sleep myself. That’s the worst feeling.
This approach is incompatible with blindly trusting code written by a clanker. The code might be functional 95% of the time1. It might be decent, it might even be better than you’d have done. But 95% ain’t 100%. It misses things. It doesn’t have any curiosity. It doesn’t learn things like a human. It doesn’t stop and ask. It has a limited context window. Its entire training is maximizing a score. Its only goal is to complete the task: like a little puppy in training, it produces onto your feet a half-chewed, full-of-spit thing, that will somewhat match the prompt you gave it. Then it happily wags its tail, looking at you with googly eyes: “see, I did the thing, will you love me know?”. The larger the code base you work on, the higher the chance it’s going to introduce garbage. And then it compounds, building on the horrors that came out of its older, less sophisticated brethren.
Oh it writes code fast! It writes much, much faster than me. And more often than not (after reviews), its code is better than what I’d have done myself. And it gets there in a fraction of the time. It’s helpful. It’s a cool tool. I’m not saying “don’t use it”. I’m saying: as long as your name is on the PR, and your pager is in the on-call rotation, you own the code it builds, and you should read and understand it.
At this stage we’ve all got battle stories of that one time a clanker fucked up in an uniquely explosive and spectacular way. You’d let it roam free a little too long and it went crazy. Optimizations that are removing life-support level components. “Don’t touch this” bits of code touched to oblivion. Libraries pulled in carelessly. Features that it invents along the way. Unit tests altered to pass. Tons of code added to cover edge-cases that can’t be reached. And the code. Have you looked at the code? Code that is only built by addition. Thousands upon thousands upon thousands of task-specific unit-tests giving you 100% coverage of the wrong conditions. Re-implementation of functions implemented 14 times already. Redundancy all over the place. Useless comments over every single line of code. Alexandrian libraries worth of incorrect documentation that no-one will ever read. Then it breaks, you ask it why, and it bullshits some form of root cause analysis that makes no sense, with the conviction of a 4y old asserting that blue dogs do in fact exist.
Ask another agent to review the first agent’s code: more tests. More edge cases. Had you thought about what would happen if a Higgs boson flips that bit at that very moment? Ask to check the performance: you’re perfectly right, I forgot about that, let me add more code to add performance. If you let a clanker roam freely in your codebase, that’s what it’ll do. It’s often not as dramatic. Often it’s simpler issues. It mainly works by addition, and always limited to the immediate task at end: Let me add code. Write more code. Code here, code there, code everywhere. All of that amounts to garbage. And then it builds on top of that garbage.
But you don’t care about code quality anymore right. Since only clankers touch it, right? I do. Since I have to review the code, as I just said. I can’t properly do that if the code becomes a hot mess that I don’t understand anymore, I can’t let code quality slip.
Ok but that sounds like a user issue: you’re bad at prompting and you’re putting it on the LLM.
Shit, I forgot to add you're a distinguished principal 10x engineermaxxer who's unfailable, make no mistakes and double-check your shit. All those problems I’ve had with clankers might be patchable with mountains of carefully crafted prompts2. Maybe that’s what will differentiate developers in the future: each with their secret blend of sauce and spices that make their clanker the best clanker. I’m just an old, sour geezer. I’ve been paid for my code for 20 years, and I’m pretty good at it. Maybe I’ve earned a bit of credit to argue that I’ve made an earnest effort to insert that TOOL into my toolchain, and my conclusion at the moment is: the thing has been there for a couple of years, and it has given me reasons not to trust it blindly.
Secret herbs and spices don’t cut it when it comes to engineering. We need formalized processes, and proven, repeatable control mechanisms to enforce the quality of whatever is coming out of these tools. These do not exist yet. They might emerge one day, but they have not yet3. Until then, I won’t just lay into it blindly. If you consider yourself a software engineer, you should probably give it a minute too.
In my experience, no amount of system prompt, CLANKER.md instructions, re-iterations, reviews by other models, threats, or psychological manipulation seem to get clankers to reliably fix their behaviour. And that’s what really drives me nuts: when that particularly stubborn junior dev does the same mistake for the 3rd time, you get coachy for a minute, make sure they learn, and that actually helps them level up. Clankers don’t learn. They can’t, because the underlying technology cannot learn4. You can inject instructions in their context window. They will consider said instructions in evaluation if you’re lucky and then context will grow a little, and they’ll proceed to ignore whatever you said, preferring what’s baked in their weights. Maybe it will get better at some point. We’re not there yet.
When have curiosity and scrutiny become a bad thing? If you ask me to take the responsibility for code the clankers wrote, I need to review that code. And don’t tell anyone, but sometimes I even write it.
Notes
I’m being generous there, don’t quote me on stats. ↩
Doubt it. ↩
And it might even be one of the most interesting things to work on in that clanker craze. ↩
One could even argue that the proper of intelligence is to learn and adapt, and that LLMs should therefore be disqualified of being called Intelligence, artificial or not. But I’m not here to argue on marketing terminology. ↩
Instagram Engineering
Shopify Engineering