CI throughput up 59%, main-branch success at 70.8%: the 2026 paradox

Three independent datasets published this week reach the same conclusion through different methods: AI coding tools moved the bottleneck downstream without shrinking it. Code gets written faster. Less of it reaches users in stable shape. The gap between those two facts is where 2026 engineering budgets are quietly disappearing.

The numbers, in one place#

CircleCI's 2026 State of Software Delivery report analyzed 28,738,317 CI workflows. Average throughput rose 59% year over year, the largest single-year jump since the report began in 2019. Feature-branch activity for the median team grew 15%. Main-branch throughput fell 7%. Main-branch success rate dropped to 70.8%, the lowest in more than five years, against a published benchmark of 90%.

LinearB's 2026 Software Engineering Benchmarks Report, drawn from 8.1 million pull requests across 4,800 organizations in 42 countries, adds the review dimension. Teams with heavy AI adoption merged 98% more PRs while review time climbed 91%. Net organizational productivity gain: roughly 10%. AI-generated PRs wait 4.6× longer for reviewer pickup than unassisted PRs. At the 75th percentile, agentic PRs run 408 lines versus 157 for unassisted work. Acceptance rate for bot-authored code is 32.7%, versus 84.4% for human-authored code.

Faros AI's telemetry, covering 22,000 developers across more than 4,000 teams comparing each organization's lowest AI adoption period against its highest, found epics completed per developer up 66.2% and task throughput up 33.7%. Incidents per pull request rose 242.7%. Monthly incidents rose 57.9%.

Three datasets, nine figures, one shape.

Why the review queue is now the constraint#

Amdahl's law has a software delivery corollary: compressing one stage of a pipeline makes the next stage the ceiling. AI coding assistants compressed the write stage dramatically and left review almost untouched, because review is bounded by human attention rather than compute.

The LinearB data makes the ceiling explicit. Of a seven-day median cycle time from first commit to production, four days sit in review. That is 57% of the clock spent deciding whether something is safe to merge. Agentic PRs wait 1,055 minutes for a reviewer to pick them up versus 201 minutes for unassisted PRs. Once a reviewer does engage, they reject bot-authored code more than two-thirds of the time.

Larger diffs are part of it. Missing context is the rest. A 408-line PR from an agent that has no commit history, no linked issue, and no test coverage delta asks a human reviewer to reconstruct intent from output alone. That is harder than reviewing code from a colleague who explained what they were doing before writing it. Reviewers respond rationally: they delay, or they decline.

What Cloudflare's enforced RFC system demonstrates#

Cloudflare published on August 4 that its AI code reviewer flagged approximately 250,000 violations of its internal engineering standards and blocked 16,000 merges across 60-plus standards in four months. Its spec reviewer agent evaluated close to 600 technical designs before implementation began. Both systems draw from the Cloudflare Codex, a governed set of engineering standards built for people and agents alike.

The architectural detail worth noting: approved RFCs produce non-blocking findings. Only after an RFC moves from approved to enforced does a violated MUST requirement block a merge. That two-stage promotion gives teams time to adapt, and it means enforcement is a deliberate organizational decision, not an accident of tooling.

This distinction between advisory and enforced review is what separates a quality signal from a quality gate. Advisory review tells engineers about a problem. Enforced review stops the problem from compounding in the main branch. The 16,000 blocked merges are not a failure metric. They are the system working.

The review bottleneck as an autonomous code governance problem#

The review queue is backed up for identifiable reasons, and most of them are addressable before the PR reaches a human. Large diffs with no context signal are fixable at authorship time. Missing test coverage delta is detectable during verification. Codex violations, security findings, and API contract drift are all things a system can surface and fix before the PR enters the human review queue.

Hyrax reads the full codebase across six agent domains, security, code quality, reliability, API and data, ops, and UX, runs 13 verification steps, then submits the PR. The human reviewer sees a diff that has already been checked against the standards that Cloudflare's data shows take 250,000 manual flags to enforce. That changes what the review is for. Instead of catching what the agent missed, the reviewer is making a judgment about direction.

The 4.6× wait time is a symptom. The cause is that agent-authored PRs arrive without the context that makes a reviewer confident. Autonomous code governance that writes fixes rather than comments is the structural response, not a larger review team.

What advisory-only tooling cannot fix#

The LinearB acceptance rate split is clarifying. Bot-authored code is accepted 32.7% of the time. Human-authored code is accepted 84.4% of the time. One interpretation is that AI coding tools produce worse code. A more precise interpretation is that reviewers cannot quickly assess whether the code is correct, because the authoring context is missing and the diff is large.

Advisory tooling adds more findings to a queue that is already the constraint. Cloudflare's enforced RFC approach shows what it looks like to treat the review queue as infrastructure rather than a cultural artifact: define standards, make them machine-readable, promote them to enforced, and let the system block violations before a human has to.

That pattern generalizes. A 70.8% main-branch success rate against a 90% benchmark is not a people problem. It is a pipeline problem, and pipeline problems respond to pipeline fixes.

The datasets published this week do not predict whether the 2026 numbers will improve. They do show precisely where the pipeline breaks, and what it costs to leave it there.

Hyrax is live at hyrax.dev.