Custom AI PR Reviewer Stops Legacy Auth and Duplication Bugs

A recent pull request added three new API endpoints that passed all tests, yet the agent used the legacy v1 authentication middleware backed by MongoDB instead of the new v2 middleware backed by MySQL. The migration had been completed a quarter earlier, but because user records still existed in both databases, the tests passed and the code appeared correct. The same pattern of subtle mistakes surfaced repeatedly: agents duplicated code by writing inline fetch calls, used literal status strings instead of the shared Status.Completed enum, and created new dropdown components in a wizard rather than reusing the design‑system folder. In backend repos, agents bypassed the app layer and called repository functions directly, violating a strict four‑layer architecture. To fix this, the author built a custom AI PR reviewer that reads team memory files—AGENTS.md and CLAUDE.md—containing rules such as “new endpoints must use v2 middleware” and “always use design‑system components.” The reviewer flags violations before human review, reducing the need for manual context gathering and preventing the erosion of architectural discipline. This approach demonstrates that moving the team’s collective rules into code‑readable files can turn AI assistance from a bottleneck into a safeguard.