Review is the pipeline's final step and its only hard human gate. Everything upstream can run at agent speed; this step deliberately cannot. It's the point where a person looks at the finished work and decides whether it ships.
By the time work reaches review it arrives with everything needed to judge it: the pull request with its spec and tickets linked, a QA plan written as a manual checklist, the end-to-end verification evidence produced during implementation, and green continuous integration. Review isn't where quality gets added — it's where quality gets confirmed.
How it runs
The human reviews in a dedicated window rather than the instant a pull request appears. Batching review into set times keeps deep work from being shredded by interruptions, and makes review attention a deliberate expense — which is exactly why PR boundaries were sized back at the issues step.
The human runs the QA plan against the actual behavior, reads the diff, and either comments or merges. The agent answers review comments, but the merge itself is off-limits to it. On a large diff the human can trigger a heavier automated review pass as an assist — but the decision to merge stays human.
What gets settled here
The only question left: does this ship? Merging is the act of publication, and the pipeline reserves it for a person on purpose. An agent that could merge its own work would close the loop on itself — the human gate exists precisely so that closing the loop takes a deliberate human decision.
Built on
This step has no skill of its own — it belongs to the human. It consumes what the earlier steps produced: the verification evidence and code-review findings from implementation, plus green CI. A deeper automated review pass is available as a human-triggered assist for large changes.