Copilot Can Review Copilot. That Is Not a Second Reviewer.

GitHub closed a coverage gap on bot PRs and opened a governance one. Copilot can now review Copilot. That is not a second reviewer.

On 27 August 2026, GitHub shipped a changelog that reads like hygiene and is actually a governance decision.

Copilot code review can now review pull requests authored by bots, including Copilot cloud agent, when the review is auto-requested. Cloud agent PRs used to fall back to a limited experience. They now get a full agentic review. The old size cap (300 files or 20,000 lines) is gone. And when you resolve a Copilot review comment, you can pick a reason: Addressed, Won't fix, or Incorrect.

I read that twice.

The first read is: good. Agents open pull requests now. Those PRs should not skip review because the author is a bot and there is no licensed human to pin the bill to. GitHub even wired org billing, under the “Allow members without a Copilot license to use Copilot code review” policy, so the review can run and the organization pays. That is the correct product instinct.

The second read is the one that matters. Copilot can now open the PR. Copilot can now give it a full review. A human can dismiss the comments with a dropdown. Nothing in that loop has to sit on the merge button.

GitHub closed a coverage gap. They opened a governance one.

What shipped, and why the coverage fix is right

Three product changes, one billing change, one comment UX change. I want to be precise about all of them, because the rest of this essay only works if we do not invent extra sins.

Bot-authored pull requests can now be reviewed by Copilot code review when the review is requested automatically. Previously there was no Copilot-licensed account to attribute that review to, so the auto-request path did not cover the PR. With the unlicensed-member policy on, usage bills to the organization.

Copilot cloud agent pull requests are the sharp version of that. Auto-requested review used to degrade into a limited experience. It now gets the full agentic review.

The size cap is gone. A 400-file agent dump, or a 30,000-line refactor, can be reviewed. That used to be an implicit skip. It is not anymore.

Resolution reasons sit next to “Resolve conversation.” Addressed. Won't fix. Incorrect. GitHub says the selection gives the product team feedback.

I am going to say this without hedging: covering bot PRs was the right move. Unreviewed bot PRs were a hole. Very large PRs skipping review were a hole. GitHub found both and filled them. Credit where it is due. The product team did the coverage work.

The remaining question is not “should this PR be reviewed.” It is who is allowed to certify that it can merge, and what that certification is actually allowed to do.

Agents opening PRs is now the normal path

A year ago, a bot-authored pull request was a special case. Dependabot. A Renovate bump. A codegen job somebody wired up on a Friday and forgot about. You could argue, badly, that those PRs were small and mechanical, and that a human would look before merge.

That argument is dead.

Copilot cloud agent opens PRs as part of the product. So do Cursor agents, Claude Code, Codex, and the internal bots every reasonably large engineering org has already stood up. The author field on a growing share of diffs is not a person. It is a service account with a mandate to ship.

If your review policy is “auto-request Copilot on every PR” and then bot PRs silently fall out of that policy, you have a hole shaped exactly like your new authoring path. The PRs most in need of a second look—the ones no human sat with while they were written—are the ones that skip the review you thought you turned on.

GitHub is right about that. A review product that cannot see bot PRs is a review product for a 2024 workflow. The limited fallback on cloud agent PRs was worse than a clean skip, because it looked like coverage. A limited review is how a team learns to trust a check that was never doing the job.

The size cap belonged to the same era. Human PRs rarely hit 300 files. Agent PRs do. If the tool stops at the exact volume where an agent is most likely to dump a tree, you have not built a review for agentic work. You have built a review for the PRs that were already easiest to read.

So yes. Cover the bots. Cover the large diffs. Bill the org if that is what it takes to make the auto-request path real. I will not pretend this was a cynical feature. It was a hole, and they closed it.

Same-vendor review is still self-certification

This is the part I need to be careful about, because the lazy version of the argument is wrong.

I am not claiming that Copilot generation and Copilot code review use identical models. I do not know that, and GitHub has not said that. The cloud agent and the reviewer may well be different systems, with different prompts, different tools, different loops. “Full agentic review” even implies the reviewer is doing more than a second pass of the same completion engine.

That is not the point.

The point is who owns both sides of the merge, what they are paid to optimize, and what the review is allowed to do when it disagrees with the author.

Copilot cloud agent is a GitHub product. Copilot code review is a GitHub product. They live in the same billing family, the same policy surface, the same changelog, the same staff meeting where someone asks whether review is slowing agent adoption. When the author is Copilot and the reviewer is Copilot, the merge is being certified inside one product line.

I wrote about the incentive version of this in May, in AI Reviewing Its Own Code Is a Conflict of Interest, before Copilot review was allowed to sit on Copilot-authored PRs. What changed this week is not the argument. What changed is that GitHub productized the loop.

A second reviewer is supposed to be able to cost the author something. Time. A change. A blocked merge. A reviewer owned by the same vendor as the author is structurally discouraged from costing that vendor's agent its win. Every blocked Copilot PR is a story that the agent didn't work. Every dismissed comment is a story that the agent just needed a nudge. Guess which story the product org would rather tell at the next launch.

This is not a claim about malice. GitHub is not a cartoon villain. It is a claim about incentives. Generation products live on accepted work. Review products that live inside generation products are graded, quietly, on whether they slow that acceptance down. The gradient runs one way. Toward comments. Toward reasons. Toward a review that can always be resolved.

You can put two different models on either side of that gradient and still not have independence. Independence is not a sampling of weights. Independence is a reviewer who does not lose if the author looks bad.

Watch the merge button, not the comment thread.

A Copilot review comment is a suggestion. Resolving it is a conversation action. The new reasons make that conversation tidier. They do not change the authority of the comment. Addressed, Won't fix, and Incorrect are all a click on a dropdown. One of those clicks even sends GitHub's product team a training signal.

None of those states is “this PR cannot merge.”

If your branch protection does not require a blocking check from someone other than the authoring product, the Copilot review can be thorough, agentic, billed to the org, and still be theatre. The bot opens. The bot's sibling reviews. A person—or another bot—marks the comments Incorrect. Merge. The audit trail says there was a review. The harbour says the ship was cleared by the shipyard that built it.

GitHub is explicit about what the reasons are for. Feedback to the product team. That is a fine thing to want if you are improving a commenter. It is an odd thing to want if you believe the commenter is the review of record. A merge gate does not ask the author to rate the finding so the vendor can tune the product. A merge gate asks whether the change is allowed to ship.

The size cap coming off makes this sharper, not softer. The PRs that most need a real second look are now eligible for a same-vendor full review. Coverage went up. Independence did not.

What independent has to mean now

“Independent” has gotten sloppy. People use it to mean a different prompt, or a different model, or “we asked the same vendor twice.” After this changelog, that usage should retire.

Independent means three things, and all three have to be true at the same time.

The reviewer has to run the change, not just read it. Sandbox execution. Clone the PR, install what it claims to need, run the suite against the base branch, watch what actually happens. A full agentic review that never leaves the diff is still a reading of the manifest. Plenty of bad cargo looks fine on paper. The whole class of bugs that show up only when the code runs will not be caught by a reviewer that does not run the code.

The reviewer has to resolve dependencies against a real registry. Agents invent packages with complete confidence. A commenter that pattern-matches import names will bless a hallucinated library because the name looks like a library. A gate that talks to npm, PyPI, crates.io, or Maven Central will not. Phantom cargo is not a style nit. It is a supply-chain hole with a plausible README.

The reviewer has to return a verdict that can hold the merge. Pass, warn, or block. Not a comment. Not a reason code. A status check a ruleset can require, with an override path that is explicit, logged, and owned by a human. If the finding cannot stop the merge, it is advice. Advice is what gets scrolled past at 4:47pm on a Friday.

Those three are the job. A better comment is not the job. A fuller agentic pass from the same product line as the author is not the job. Org-billed auto-review of bot PRs is coverage of the comment job. It is not the gate.

I want to be honest about the pushback, because it is the one I would make if I worked on Copilot.

“We added a review where there was none. That is strictly better. You are complaining that the reviewer is ours.”

Yes. Adding a review where there was none is strictly better than silence. I already said that. The mistake is treating “strictly better than silence” as the same thing as “sufficient to merge.” A same-vendor commenter on a bot PR is better than an unreviewed bot PR. It is not a second reviewer. It is the authoring product checking its homework in public.

“The reviewer is agentic now. It is not a rubber stamp.”

Agentic means it can use tools. It does not mean it is allowed to cost the parent product a merge. If the output is still a comment you can mark Incorrect, the agency is in service of a suggestion. Suggestions do not govern.

“Teams can wire Copilot review into a required check themselves.”

They can. They could last year. The changelog did not ship that. It shipped broader comments, broader billing, and a dropdown. If enforcement were the point, the heading would have been about branch protection, not resolution reasons.

Audit one PR

Do not take any of this as a slogan. Take it as a procedure.

Pick one pull request from this week. Preferably one opened by a bot or an agent, but a human PR will do if that is what you have.

Look at the author. Is it a person, Copilot cloud agent, Dependabot, an internal bot, something else?

Look at the reviewers. Which of them are the same vendor as the author? Which of them are humans who actually read the diff? Which of them posted comments that were resolved without a corresponding change?

Look at the merge. What was required? A passing CI job you wrote? A Copilot review that can be dismissed with Won't fix? A status check that can block? Anything that would have held the button if the finding was real?

If the author is Copilot and the review is Copilot and the merge is green because someone resolved comments, you do not have two reviewers. You have one product line, talking to itself, with a human as the notary.

That is the whole essay, in one pull request.

Building Autter in public. We do not write your code, we do not sell you a coding agent, and we do not get paid more when more diffs ship. We run the change in a sandbox, we check the cargo against real registries, and we sit on the merge until the verdict is pass. Before you take my word for any of that, go audit the PR. The harbour is only as honest as the last ship you actually inspected.

P.S. Tanvi read this and said I should lead with “GitHub did the right thing” so nobody thinks we needed Copilot to be wrong in order to be right. She also said if the CTA is “audit one PR” I am not allowed to bury a demo link under it. I cut the demo link. She is, as usual, insufferably correct.