What happens when your autonomous coding agents need to navigate your core infrastructure? Do you hand them the keys and hope for the best? (gulp!) This week on Dev Interrupted, 1Password CTO Nancy Wang teaches the golden path for agentic security: just-in-time secrets that grants AI "access without custody." She also shares her CTO playbook for measuring true agentic ROI beyond raw PR volume, explains why 1Password has officially replaced traditional coding interviews with agent builder tests, and confesses she’s shipping PRs again with her own fleet of agents between meetings. Like many CTOs we’ve had on the show, Nancy reminds us that code is cheap now, and review is what’s expensive now. We get into tactics for addressing that bottleneck.
1. Climbing past the first rung of AI ROI
Luis Morales, Head of AI at Super.com, stopped tracking token consumption back in April, and his reasoning is the cleanest I’ve read on AI ROI. He likens adoption to rungs on a ladder. The value arrives in three stages: utilization, output, and outcome. His sharpest shot lands on our industry’s favorite metric, calling the percentage of AI written code “a utilization number in a suit.” What makes the post credible is that he publishes counter-evidence beside his wins. Merges per engineer are up 90 percent year-over-year, with the production bug rate falling from 7.33 to 3.4 percent per task. The gates went in before the velocity arrived, and that order is the whole lesson.
Read: We Stopped Counting Tokens
2. When the status page looks like a bell pepper blend
GitHub degraded for over seven hours last week, with roughly 20 percent error rates across Issues, Pull Requests, Actions, and Copilot. As I joked on the podcast, status pages used to be fully green, but now they are starting to look like a bell pepper mix. The trigger was one misconfigured watch, an Istio sidecar that hit its concurrency limit and failed to autoscale because the policy watched the host service and not the sidecar. Retries then did the real damage, with a latent VS Code bug amplifying traffic tenfold. Here’s the detail I haven’t seen quoted anywhere: Data Residency customers went down too, because their Actions workflows depend on public step definitions hosted on GitHub.com. Your data residency promise has a github.com dependency.
Read: Incident Report for GitHub
3. The forge that ships while the giant is down
Cursor began rolling Origin out to paid users roughly three and a half hours before GitHub’s status page lit up, and a Cursor employee got the line of the week: “We were going to ship this earlier, but GitHub was down.” The architecture is the actual wedge. Origin doesn’t ask you to leave, GitHub stays the source of truth, and pull request conversations sync both directions, which is why it approves itself in a security review where a migration would not. Depot and Buildkite run your existing Actions unchanged. It defaults on for paid orgs, and I’d note that pricing, retention and training terms are all still unpublished.
Read: Cursor launches Origin code hosting platform as GitHub outage exposes opening in AI coding race
4. The duct tape reality of self hosting
A one-sentence question on Hacker News drew hundreds of comments about leaving GitHub, and the sheer volume is the real story. However, the top reply is a warning about the alternative rather than an endorsement of leaving. A team that self-hosted GitLab for six years catalogs real toil, broken major upgrades and near-weekly critical patches, and still puts their own downtime at about 1.5 working days across those years. What people are buying is control, the ability to choose when upgrades and incident response happen. The two questions nobody answered are the ones I’d want settled: what replaces Actions, and whether self-hosting Enterprise is the only exit once you’re deep in GitHub Apps.
Read: Ask HN: Alternatives to GitHub
5. So you wanna build a software factory?
Are you ready to let agents triage, spec, implement, review and ship your code with humans entirely outside the loop? Before you automate your SDLC, you need to understand how to know it’s working.
Time is running out to join our August 27th roundtable. I’ll be sitting down with Zach Lloyd (Warp), Dex Horthy (HumanLayer), and Dan Lines (LinearB) to uncover what happens when you turn an automated factory on, how to ensure agents compound value instead of debt, and which parts of the PR lifecycle to automate first.
6. Factory as code, foreman included
Warp put Warp Factories into early access, and the framing tells you who it’s for. The problem it names is heterogeneity rather than capability, arguing that different models and harnesses scattered across a team make security, access, cost and ROI impossible to monitor. So the factory centralizes those choices per step, with agents for triage, spec writing, implementation and review, coordinated by a factory foreman and each declared in its own config file. Two pieces deserve more attention than the launch gave them: scorers that judge other agents against a rubric you define, and cost per pull request on the dashboard. That last one is the feature I would steal.
Read: Introducing Warp Factories
7. The last 10 percent still costs everything
James Stanier argues that finishing demands a different leadership mode than starting, and he names the failure precisely as a quiet death. Nobody decides to stop, people get absorbed into other work, tickets sit untouched, and someone archives the board months later. That’s the failure mode I recognize. His best line is that “95 percent done is the most expensive state a project can be in,” because you’ve made the maximum investment and delivered zero value. Now, the “ideas guy” can sling an idea into code that gets 90 percent of the way there instantly. But scope creep peaks at the worst possible moment once a working demo exists. Agents made the first 90 percent cheap, but they do absolutely nothing for the final landing.
Read: Landing the plane
