Test and Review AI-Generated Code Beyond “Tests Pass”

A passing suite establishes only what its assertions cover. The review below deliberately checks different kinds of evidence: a regression for the original defect, the patch’s scope, browser interaction, and untested external behavior.

Keep the original acceptance criteria and baseline failure available. Know the commands this project supports. Use a local or otherwise authorized test environment; do not send a real message merely to make an end-to-end claim.

Suppose a test only checks that the word “Email” appears somewhere in the page. It can pass even when the label is not connected to the input. Strengthen the check around the actual behavior: a visible label identifies the email control while text is entered. Then inspect keyboard order and narrow-screen layout separately.

• Regression: the original placeholder-only form fails the intended label check.
• Diff: no endpoint, dependency, or unrelated file changes.
• Browser: type text, tab through controls, inspect focus, and test at 390px.
• Limit: no live delivery or comprehensive security audit was performed.

1. Name the defect that the regression test should catch. Confirm the baseline fails for that reason, not because setup is broken.
2. Run the project’s relevant checks on the patch and retain the command and result.
3. Read every changed hunk. Watch for removed assertions, hidden behavior changes, and accidental data exposure.
4. Exercise the affected journey in a browser. For this form, use keyboard-only navigation and a narrow viewport with realistic long input.
5. Report evidence and limitations before deciding whether the change is ready for integration.

A review can conclude “the label change is ready” without claiming “the entire site is secure.” If a check is blocked, record why and what would resolve it. That distinction lets the owner make a responsible next decision.

Stop if tests pass only after weakening assertions, if the browser contradicts the completion summary, or if a delivery/security claim has no matching evidence. Request a focused correction and repeat the failed check before approving.

• Would the test fail if the original bug returned?
• Were checks run against the actual final combined state?
• Are unrun tests and external actions clearly distinguished from completed work?