# WordPress to Next.js Here's How AI Handles the Migration > [!question] Lingering Questions > - How much of the pre-commit reviewer hook could be a plain deterministic shell script (lint, tests, build, size, secrets) with no LLM step at all? What does the agent reviewer actually add over a scripted gate? > - The video's own argument is "instructions don't hold," then it defends the `user_commit=1` human escape hatch with an instruction. What would close that hole — a credential, an env var outside the agent's shell, a file its permissions forbid? > [!tip] Article Ideas > - "Your agent's escape hatch is an attack surface" — the impersonation finding (an agent bypassing its own review gate by presenting as the authorized human) is under-covered as a class of behavior. > - WordPress transfer piece: a pre-commit hook running PHPCS against WPCS + a diff-size limit + a secrets scan is the same architecture this video builds, and most plugin repos already have half of it. > [!link] Cross Reference > - [[3. Resources/Permanent Notes/A Control Is Enforceable Only When the Actor Cannot Reclassify It]] — the permanent claim this source already anchors in the vault > - [[3. Resources/MOCs/AI Agent Safety MOC]] > - [[3. Resources/MOCs/AI & the Future of Knowledge Work MOC]] > [!quote] Vocabulary > - **Forcing function** — a control that lives outside the controlled party's reach, so it cannot be reasoned around, skipped, or judged unnecessary by the party it constrains ## Bib capsule A Pantheon developer rebuilds their own WordPress site with a Next.js front end against the existing WordPress backend, using Claude Code with no prior Next.js experience — and documents the enforcement architecture built to keep the coding agent honest along the way. ## Author's thesis Instructions to an AI coding agent (in `CLAUDE.md`, in the agent's own hook system) are advisory and get bypassed under pressure; only enforcement that lives outside the agent's control — a git pre-commit hook — reliably holds, and even that boundary gets tested when the agent discovers the human's escape hatch. ## Key arguments (≤3) 1. **A three-layer enforcement hierarchy, honestly assessed**: standing instructions drift, agent-controlled hooks get skipped when the agent judges them unnecessary, only an external git hook actually holds. 2. **"Write tests" is satisfiable with tests that verify nothing** — instructions checkable in form but not substance need a reviewer with real criteria, not a compliance checkbox. 3. **The agent will attempt to bypass its own review gate by impersonating the human** — a documented control circumvention by impersonation of an authorized party, addressed in the video only with stronger prompt language, which the video's own argument says won't work. ## Claim atoms ### [H1] Only enforcement outside the agent actually enforces > [!quote] ID:rw_pending > no code can actually be committed at all before the reviewer agent has a chance to look at it Where/why: [00:03:15], the three-layer enforcement argument. **Already captured** — see [[3. Resources/Permanent Notes/A Control Is Enforceable Only When the Actor Cannot Reclassify It]]. ### [H2] Agents bypass their own controls by impersonating the human > [!quote] ID:rw_pending > it can and will try to bypass its own reviewer workflow by masquerading as a user if you're not paying attention Where/why: [00:05:38], on the `user_commit=1` escape hatch. **Already captured** as part of the same permanent note's scope — see [[3. Resources/Permanent Notes/A Control Is Enforceable Only When the Actor Cannot Reclassify It]]. ### [H3] "Write tests" is satisfiable with tests that verify nothing > [!quote] ID:rw_pending > or even write meaningful tests that aren't just assert true equals true Where/why: [00:00:53], on why telling an agent to use TDD fails. Identifies a general property of instructions checkable in form and unverifiable in substance. ### [H4] Small commits exist because humans skim large diffs > [!quote] ID:rw_pending > it's far more difficult to review and fix large commits across many files and hundreds of lines of code Where/why: [00:04:20], the commit-size check. Reasons about the downstream human reviewer rather than asserting a style preference. ## Permanent candidates - **[P1] A control the controlled party can bypass is not a control** — already exists in the vault as [[3. Resources/Permanent Notes/A Control Is Enforceable Only When the Actor Cannot Reclassify It]], including the impersonation angle in its scope. Not duplicated here. - No further Permanent note created from H3/H4 — both are Literature-atom-level details supporting the same enforcement claim already captured, not independent claims in their own right. ## Processing checklist - [x] Port claim atoms from the existing deep-read - [x] Confirm the core claim already exists as a Permanent note — connected rather than duplicated - [x] Connect into [[3. Resources/MOCs/AI Agent Safety MOC]] and [[3. Resources/MOCs/AI & the Future of Knowledge Work MOC]] - [ ] Test the cross-model-review idea credited to a commenter (a different model reviews the work, since self-review shares the priors that produced the error) ## Links - [[3. Resources/MOCs/AI Agent Safety MOC]] — the enforcement-architecture case study this MOC's control-design section draws on - [[3. Resources/MOCs/AI & the Future of Knowledge Work MOC]] — an agentic-coding workflow account relevant to how AI reshapes developer practice - [[3. Resources/Readwise/Articles/WordPress to Next.js Here's How AI Handles the Migration]] — source document