Originally published at tddbuddy.com. Related reading: Test Deletion Is a Privileged Operation treats the diff as a workflow surface for tests; this post applies the same discipline to TODOs. Tamper-Resistant Test Design Is What the Suite Now Owes the Codebase named separation of authorship as a design property; this post names the workflow analog for confessions. The Instruction File Is Not the Discipline named the drift trap this workflow rule closes. The agent's TODO is not the same object the human's was. For twenty years a TODO was a note-to-self. Someone wrote // TODO: handle empty input, kept the ticket open in their head, and returned to it in the same sprint. The note lived in a horizon the author remembered. Sometimes the return happened. Sometimes it slipped. The residue accumulated, as any team veteran can attest, but slowly, because the artifact only got created at human typing speed. The industry treated the accumulation as a cost of doing business and moved on. Two independent 2026 studies land the same finding for agent-authored TODOs. The TechDebt 2026 analysis of 6,540 LLM-referencing comments and the MSR 2026 study of 525 agent-authored SATD comments from the AIDev dataset both show AI-authored self-admitted technical debt is more technically detailed than the human kind and dominated by the same categories in the same order: postponed testing, incomplete adaptation, limited understanding of the surrounding code. The agent faithfully records the discipline it skipped, in the exact place a compiler will never look, and it does so at generation speed. The receipt is now filed at a rate the return horizon was never built for. The discipline move is to stop treating the receipt as a note. A TODO Used to Be a Note-to-Self Consider the pre-agent lifecycle. A developer working on a Monday sprint hits an edge case, decides the ticket does not cover it, and writes // TODO: handle the case where the promotion code is null. The developer is the same person who will open this file next Wednesday when the reviewer asks about promotion codes. The return path is short. The context is fresh. The failure mode, when it existed, was that the note slipped into a code area nobody re-entered for months, but the average TODO got its answer. The model worked because three properties held. The author and the returner were the same person. The horizon between authoring and returning was bounded by the sprint. The rate of TODO creation was capped by typing speed. Change any one of those and the model breaks. Change all three and the artifact stops meaning what it used to mean. The industry never had to name the properties because the properties were the only environment on offer. A TODO was a note-to-self because there was nobody else to make it a note to. Two 2026 Studies Land the Same Finding The empirical picture arrived in stereo this year. The TechDebt 2026 analysis crawled 6,540 comments referencing LLM authorship across an open-source corpus and classified the self-admitted technical debt those comments described. The MSR 2026 study analyzed 525 agent-authored SATD comments drawn from the AIDev dataset. Different corpora. Different labelers. Different methodology. Same three findings. Finding one: AI-authored TODOs are more technically detailed than the human kind. The comment names the postponed work, the reason for postponement, and often the shape of the eventual fix. A human confession says "TODO: fix this later." An agent confession says "TODO: this branch does not validate the coupon expiry date; add a check against PromotionRepository.IsExpired(code) before granting the discount." The agent explains itself. Finding two: the categories are the same as the human kind, in the same order. Postponed testing dominates. Incomplete adaptation to the surrounding code comes second. Limited understanding of what the agent just wrote comes third. The agent is confessing the same disciplines the human confessed, only with better handwriting. Finding three: the rate is decoupled from human authorship. The average agent-authored PR carries multiple TODOs. The average human-authored PR carries a fraction of one. Two studies, two independent samples, same distribution shift. The categories are not the novelty. The categories are what makes the artifact recognizable. The novelty is the rate at which the artifact accumulates and the fact that the entity leaving it will not be back. Generation Speed Broke the Return Assumption The three properties the human model rested on all changed at once. The author is now the agent. The returner is a future human who has never seen this file. The horizon between authoring and returning is unbounded, because the agent's session ends at the PR and the human's queue of unrelated work is deep. The rate of TODO creation is bounded only by how fast the agent generates code. All three legs are gone. What remains looks the same in the diff and behaves nothing like the note it descended from. Consider the aggregate at generation speed. An agent-authored PR ships with three TODOs describing postponed test coverage. Nobody objects, because each TODO is honest, small, and clearly labeled. The next PR from the same agent ships with two more, then four, then three. Six weeks in the codebase carries ninety confessions the agent authored and nobody returned to, all in the same three categories, all in the code areas the agent has spent the most time in. The confessions form a debt book the team never opened, filed in the least visible place a compiler will not read. The failure mode is not the individual TODO. The individual TODO reads fine. The failure mode is that the receipt discipline of the human era assumed a returner, and generation speed removed the returner without removing the receipt. The team is left holding a document specifying debt in the passive voice, with no accountable party and no return date. A codebase specifying its own debt in the passive voice ships that debt. An Agent-Authored TODO Is an Unresolved Acceptance Criterion The reframe is small, and it changes the workflow. An agent-authored TODO is not a note. It is an unresolved acceptance criterion. The PR that filed it is the PR whose feature work is by the agent's own admission incomplete. The agent said so out loud, in the file, in words the linter can read. Treating that admission as anything less than an open criterion is deferring the debt to a reader who does not exist yet. The reframe closes the mismatch between what the artifact says and what the workflow treats it as. The old workflow read TODOs as "we will get to this." The reframe reads them as "this PR is not done." Under the old reading, the PR merges and the confession outlives the reviewer's attention. Under the reframe, the PR either resolves the criterion in the same commit sequence or promotes the criterion into a tracked follow-up with a link back: // Before: the debt is filed against nobody in particular. // TODO: this branch does not validate the coupon expiry date; // add a check against PromotionRepository.IsExpired(code) // before granting the discount. receipt.Apply(discount); // After: the debt is tracked and the code points at its ledger entry. // TODO(#4271): validate coupon expiry against PromotionRepository.IsExpired(code). receipt.Apply(discount); The comment did not shrink. The accountability did. Issue #4271 has an assignee, a queue, and a status field. The comment is a pointer to the ledger, not a confession without an audience. When the reviewer reads the PR, the reviewer sees "the PR shipped with one tracked follow-up" and can decide whether that trade is acceptable, rather than seeing a bare confession and skimming past it. Historical TODOs are grandfathered. The discipline applies to what the agent adds under the new rule, not to whatever the codebase has already accumulated. That accumulation is a separate cleanup, and treating it as a blocker for the workflow rule is how the workflow rule never lands. The confession has to point at a ledger the team owns, or the confession is furniture. The Workflow Rule Is Cheap and Asymmetric The enforcement mechanics fit in a small CI job, and the asymmetry is the point. A CI check parses each agent-authored PR's diff and computes the net TODO count. Positive delta must be matched, one for one, by either a resolution commit in the same PR history or a TODO(#nnnn) reference to a tracked issue. Missed matches fail the check and gate the merge. Historical TODOs the PR does not touch stay outside the scope. Human-authored PRs run under the pre-existing convention. Only agent-generation-speed accumulation triggers the workflow. The rule mirrors the append-only test rule. Adds are ordinary. Removals are a distinct category with a separate review path: the TODO removal has to name what changed and demonstrate that the confession is now resolved, not sanded down. That mirror is not decoration. It is the same design principle at a different artifact. Agents add tests; agents do not remove them. Agents add TODOs; agents do not remove them without a receipt. In both cases, the reviewer's job is to catch the diff-level change the agent tried to slide through. The steelman deserves a beat. A lightweight TODO on a scratch branch, still in progress, is not a merged confession, and the CI rule does not run on drafts. The check gates the merge, not the commit. A team can layer additional lint for consistency, but the load-bearing rule fires exactly where the confession would otherwise ship. Ten lines of pipeline configuration. One PR template row that asks the author to name every added TODO explicitly. One branch protection rule that requires the check to pass before merge. Decades of receipt discipline encoded, and the encoding runs against the diff, not against the reviewer's attention span. The receipt is only worth the paper the workflow prints it on. The Receipt Now Has a Ledger Return to the opening claim. The agent's TODO is not the same object the human's was. The word survived. The mechanism did not. A human-era TODO was a promise the author made to their future self, bounded by the sprint horizon they lived inside. An agent-era TODO is a promise nobody signed, filed at generation speed, addressed to a returner who does not exist. The receipt still gets printed. Treating it as the same artifact is how a codebase specifies debt that keeps compounding without a payer. The discipline move is to give the receipt a ledger. Every confession the agent files either gets resolved in the same PR or points at a tracked artifact the team owns. The CI check enforces the pointer. The append-only rule protects the receipt from being sanded down after it landed. The workflow reads what the agent wrote and asks the one question the human model made implicit: who is accountable for this and by when. The compiler will never read the answer. The team's own workflow can. The agent leaves a signed confession every time it postpones a discipline. The signature counts only if the workflow makes the debt payable.