AI / quality
AI built the interface: what a human must review
A convincing interface may still be insecure, inaccessible, and fragile. Final review is not distrust of AI; it is ordinary engineering responsibility.
Begin with behavior
Walk through the flow as a user: with a mouse, with a keyboard, on a narrow screen, and on a slow network. Test duplicate form submission, empty data, long names, API failure, and back navigation. AI often implements the happy path while leaving edges undefined.
Inspect the source of state as well as the result. Duplicated server state, effects for derived values, and unstable keys may survive a demo but fail under real interaction.
Security and dependencies
Pay special attention to innerHTML, URL parameters, Markdown, postMessage, localStorage, and user-provided data. An unescaped string in an HTML sink can create DOM XSS. Complex HTML needs proven sanitization, CSP, and Trusted Types where appropriate.
Every dependency should exist, be maintained, and be necessary. Check the lockfile, advisories, and license.
A screenshot cannot prove accessibility
Use semantic elements, accessible names, a correct heading order, visible focus, sufficient contrast, and keyboard support. Automated scanners find only part of the problem; no tool alone can certify complete accessibility.
At minimum, use the form without a mouse and listen to the main flow with a screen reader.
Performance and the final diff
Check bundle size, requests, fonts, images, and behavior on a low-powered device. Compare before and after instead of trusting an optimistic description.
Finally, read the entire diff. It should not contain project-wide formatting, disabled lint rules, secrets, commented workarounds, or unrelated configuration changes.