On June 23, 2026, New Relic launched AI Coding Observability and released its 2026 State of AI Coding Report. It confirms, at billion-dollar incumbent scale, what the merge-gate governance category has been arguing for close to a year. New Relic’s Chief Product Officer Brian Emerson put it cleanly: you cannot manage what you cannot see.
He is right. And visibility is exactly half the answer. Tomosu has been building the other half.
Tomosu scores every pull request for reliability, operational risk, security exposure, and policy compliance — against the production system the change is about to enter.
What New Relic’s report actually says
The 2026 State of AI Coding Report surveyed 200 U.S. enterprise technology decision-makers at the manager level and above. These are the leaders making the AI-coding-tool buying decisions, signing off on the SDLC policies that govern them, and answering to boards when production breaks. The headline finding is a contradiction sharp enough to belong in a board memo.
Ninety-four percent of leaders rate AI-generated code as higher quality than human-authored code at the time of review. Then the code ships. Seventy-eight percent report more incidents after AI code reaches production. Eighty-six percent report senior staff spending more time fixing it. Seventy-four percent report at least 25% of AI code requires significant rework. Eighty-two percent have suffered at least one production failure tied to AI-generated code in the past six months.
Sixty-two percent admit teams trust AI-generated code enough to ship without line-by-line manual verification. Eighty-eight percent of organizations have written vibe coding into formal production policies. The practice is mainstream now. The verification discipline that used to accompany it is not.
New Relic’s Chief Technical Strategist Nic Benders coined a phrase for the resulting condition: agent debt. The rapid accumulation of unvetted architectural logic that triggers production incidents down the line. The framing is useful and accurate.
The Faros AI Acceleration Whiplash telemetry found incidents per pull request rose 242% over a two-year horizon, AI-co-authored PRs averaged 10.83 distinct structural issues against 6.45 for human-only PRs, and roughly 31% of changes shipped with no human review. The Faros numbers describe what the telemetry shows. The New Relic numbers describe what leaders say is happening to them. Both methodologies, one finding: the gap between what the dashboard celebrates and what the on-call rotation pays for is now a permanent feature of every organization running AI coding tools at scale.
What New Relic’s product actually does
AI Coding Observability is an open-source extension to New Relic’s observability platform. It normalizes telemetry across the major AI coding assistants — Claude Code, Cursor, GitHub Copilot, Windsurf, and Amazon Q. It tracks cost, usage patterns, security signals, and performance. It runs in a local-only zero-outbound mode for organizations with data sovereignty requirements. It is built on OpenTelemetry and the Model Context Protocol for vendor neutrality.
This is real infrastructure. Visibility into AI coding assistant behavior at the platform layer has been a genuine blind spot for enterprise organizations, and a billion-dollar incumbent shipping open-source telemetry for it is a category-defining move.
"The product tells you what your AI coding assistants did. It is not designed to refuse the merge."
Observability records actions. A merge gate decides whether the action should happen. Both are necessary. They are different products.Where Tomosu sits
Tomosu sits above your existing GitHub or GitLab as the verifier the architecture has been missing. Every pull request — especially AI-generated ones — gets scored before it lands on main. The score is the Production Reliability Index: a single trendable number composed of signals you can name to a board.
The four core dimensions of the Production Reliability Index:
Change scope. The blast radius of the diff. What services, what data paths, what downstream systems this change can affect. The cache invalidation that looked harmless in isolation gets surfaced because its blast radius touches the legacy auth service the agent did not know about.
Service criticality. What it costs if the service this change touches goes down. A change to the payments path scores differently from a change to the marketing site, even if the diffs look identical.
Compliance exposure. Whether the change touches regulated paths. PCI, HIPAA, SOC 2, the audit-bearing systems. The change the CFO will be asked about by a regulator gets flagged before it ships, not after.
Policy adherence. Whether the change conforms to the organization’s declared engineering and security policies. CODEOWNERS satisfied. Required reviewers actually reviewed. Branch protection respected. Dependency allowlists honored. Together these answer the SOC 2 CC8.1 audit question: was this change made under the controls the organization said it operates under.
AI-origin is a cross-cutting modifier on all four dimensions. An AI-generated change with high blast radius scores worse than the same change written by a senior engineer who can defend it. AI-origin sharpens each of the four headline signals; it does not stand alone.
What the report actually measures, and what Tomosu actually does
The New Relic report measures perception and outcome. Ninety-four percent of leaders say AI-generated code reads well at review. Eighty-two percent then watch it fail in production. The gap between those two numbers is the operational tax that the merge-gate category was built to address.
Tomosu does not measure that gap. Tomosu narrows it. The PRI score is computed before the merge, against the surrounding production system, with the signals that would have made the leader’s confidence at review match the system’s behavior in production.
"Agent debt is the symptom New Relic named. The verification gap at the merge gate is the structural cause. Observability shows the symptom growing. The merge gate is where the cause can be addressed."
What changes for the people in the chain
The on-call engineer is no longer responding to incidents on changes they did not review and cannot defend. The verifier filtered out the changes that should not have shipped without a human looking at them. When the pager does ring, the call is for a change the on-call engineer can actually trace, against a score the team understood, with the policy that permitted it named.
The senior engineer reviewing forty pull requests a week is not reading all forty. The low-risk ones merge with the receipt attached. The engineer’s attention goes to the surfaced ones, with the score and context visible. The forty-clicks-a-week problem is not solved by reading faster. It is solved by being asked to read only the changes that need a human, and being given the context to make a real call when asked.
The CFO and General Counsel have the same upgrade. Every high-risk merge has a named reviewer who attested to the score and the basis. The policy is named, by every receipt, as the policy that permitted the merge. When a regulator asks about the change that produced the loss, the answer is a document that was produced when the decision was made, by the system that made the decision possible.
The 86% senior-staff-fixing-AI-code statistic in the New Relic report describes a specific person on a specific team being asked to do verification work the merge gate should have done. The merge gate is where that work belongs, with full context, in business hours, before the change ships.
A 90-day pilot
We are partnering with three to five engineering organizations in regulated industries this quarter. The pilot is measurable, not vibes.
Week one. Read-only integration with your GitHub or GitLab, observability stack (including New Relic if you run it), and ticketing. No agents added to the merge path. No rip-and-replace. The PRI starts scoring your existing PR flow against your existing services and policies.
Day 30. Visible risk ledger. Every pull request in the last 30 days has a score and a reason. The board number is now trended for the first quarter your team has ever had it. The fragility that has been accumulating becomes visible in advance.
Day 60. Closed loop. Policy is set. Surfacing rules are tuned to your services. AI-origin modifiers are calibrated to your codebase. Escalation paths route to the right reviewers.
Day 90. Board-ready PRI trendline. The production reliability number is a metric your team owns. The merge decision is on the record. The on-call rotation is no longer being asked to do verification work the merge gate should have done.
The line
The 2026 State of AI Coding Report is the strongest external signal the merge-gate category has yet received that the gap is real, measurable, and accumulating at the board’s expense. New Relic shipped observability for that gap. The visibility layer is now real infrastructure at billion-dollar scale.
The decision layer is still mostly empty. We have been building it.
New Relic may see it. Tomosu will decide it.
Book a 30-minute conversation: calendly.com/manil-tomosu/30min
Tomosu builds merge-gate governance infrastructure for teams where AI coding agents have outpaced the audit trail. This post engages directly with the New Relic 2026 State of AI Coding Report (Hanover Research, 200 U.S. enterprise technology decision-makers, June 2026) and the New Relic AI Coding Observability launch (June 23, 2026). Book a call →