ZTHR – what replaces code review when AI agents write all the code

ZTHR, short for Zero Trust, High Reliability, is a published framework by Russ Little for delivering software that AI writes, not a tool you install. It is a version 1.0 request for comments dated October 29, 2026, made up of 33 patterns in six families, released under CC BY 4.0 and archived with a DOI. Its starting point is that generating code has become cheap while deciding whether code is correct has not. Its answer to the headline's question is that people stop reading every diff: the site says enforced independent human review of each code change is not a control ZTHR relies on.

In its place, quality is meant to come from the environment the code is built in. No author, model, reviewer or report gains authority by claiming success; only evidence the claimant does not control counts. AI generators produce candidate changes and fixtures, the automated checks the framework is built around, judge them, with rejected candidates retried as often as needed. Required checks cannot be skipped, and each named safety gate must be shown to fail on a deliberately planted defect. Mutation testing, which plants small faults to see whether tests notice, replaces code-coverage targets. User journeys with goals and forbidden outcomes are locked so the author cannot edit the test that judges its own work. At least three models from different families review each change before commit, and a fourth reviews it in place before it is fully promoted. Deploys are identified by content hash so the system can confirm that what is served is what passed, and every defect that escapes becomes a new fixture.

People keep three jobs: defining intent, owning the gates and thresholds, and signing off on destructive, multi-step or self-modifying changes. The evidence so far comes from the author. The site says ZTHR is in production use for greenfield systems in a regulated industry and has proven highly effective there, but it names no organization and gives no figures. Its public example is a student-support app that, according to the case write-up, agents built in days under ZTHR's checks, with 1,192 passing tests and 23 gates each proven able to fail; the same page says multi-family model review is designed but switched off there until providers are configured. The paper proposes measures such as intent completion rate, revision rate, time to restore and cost per accepted change, and asks adopters to report them, but reports none itself. It also names its own risks: the checks are only as good as their fidelity, and a bad specification gets built faithfully. The example's source is on GitHub.