Large refactor PR review
An agent opened a 1,400-line TypeScript PR that refactors your auth middleware, adds a rate limiter, and updates 40 call sites. The description is confident and the CI is green. You have 45 minutes before you need to approve or push back. You can't read every line. Describe your review strategy: what you look at first, where you assume the risk concentrates, and what 'green CI' does and doesn't buy you here.
rank_review_targets(changes: list[str]) → list[str][["src/auth/middleware.ts|120|80","src/routes/users.ts|600|300","src/auth/session.ts|10|2"]]out["src/auth/middleware.ts","src/auth/session.ts","src/routes/users.ts"][["db/migrations/001_add_limits.sql|40|0","src/lib/ratelimit.ts|150|20","src/ui/button.tsx|5|5"]]out["db/migrations/001_add_limits.sql","src/lib/ratelimit.ts","src/ui/button.tsx"][["src/auth/token.ts|30|10","src/auth/token.test.ts|400|0"]]out["src/auth/token.ts","src/auth/token.test.ts"]Treat the AI’s output as a draft to verify, not an answer to trust. Name the specific flaw and the input that triggers it, say how you’d catch it (tests, edge cases, reading critically), and how you’d re-prompt or decompose to get it right.
Vibe & agentic: describe the solution in plain language (or narrate it) and the coach grades your approach.