Code Got Faster. Releases Didn't. The CPO and CTO Have to Split the Substrate.

Undo, which makes debugging tools, had Coleman Parkes survey 300 senior engineering leaders responsible for mission-critical software. Sergio De Simone wrote it up for InfoQ on October 7. Two numbers.

79 percent said coding agents generate code significantly faster, and that releases are no faster than before. And 35 percent of generated code reaches production before the team has fully understood it.

Undo sells debugging tools, so weigh the framing. The shape is still the one that matters to a CPO. Generation got cheap. Verification didn't. The gap between the two is the thing the CPO and the CTO now have to decide who owns.

This is part 3 of The CPO Transition. Part 1 said the CPO stops owning the roadmap and starts owning the operating model, on a substrate engineering invests in. Part 2 was the AI story the CPO owes the CEO. This one is about the other half of the exec room that the operating model depends on.

The short version

Agents made code cheap and left verification expensive, which is why releases aren't faster even where code is. The fix is the substrate: environments, a model gateway, guardrails, an eval harness, isolated deploys, and a gate before anything reaches a customer. The mistake is treating all of it as engineering's problem. My split is that the CTO owns the platform (the environments, the gateway, the isolation, the metering, and the enforcement of guardrails) and the CPO owns the bar (what the eval says good looks like, what the product may do on a customer's behalf, and what a build has to clear to ship). Both sign the gate. Merging the two seats into a CPTO doesn't remove that split, it just puts it on one calendar. The CPO and CTO should review four shared numbers every month, and tell the CEO release speed, not code speed.

Faster code, same release date

The rest of the Undo data explains the 79 percent. Teams averaged 9.8 hours a week producing code and 16.9 hours debugging it. In Undo's release of the findings, 81 percent of organizations had a production incident or outage in the past six months that they tied to their use of AI coding tools.

Greg Law, Undo's founder and CEO, said it better than the numbers do: "AI doesn't have an intelligence problem; it has an evidence problem." He also said the right context makes a mid-tier model more accurate at diagnosis than a top-end one.

That's not a model complaint. It's a substrate complaint. And there's a public measurement of how big the substrate lever is. Vivek Trivedy at LangChain kept one model fixed, gpt-5.2-codex, and moved LangChain's coding agent from 52.8 to 66.5 on Terminal Bench 2.0 by changing only the harness: a verify-before-exit step, environment context at startup, a loop detector, and a split reasoning budget. That post is from February, and it's still the cleanest number I know for this argument. Nearly fourteen points. Model untouched.

So whoever owns the harness owns most of the quality. In most companies I'd bet nobody has written down who that is.

What engineering builds

Engineering Builds the Substrate, Not Features has the four pieces in full. The best current picture of one being built is Gergely Orosz's look inside Uber's AI infrastructure, with Uber distinguished engineer Uday Kiran Medisetty, published October 14.

Uber's platform team decided in 2023 that AI work should be model- and harness-agnostic, and built a gateway that switches between vendors and the open models Uber runs. Spend is tracked per user, with audit logs and session traces. Token costs came down about 50 percent over the last few months. Medisetty's line on why it compounds: "All the things that we built to make life easier for engineers: it makes it easier for our agents as well!"

One detail in that piece is worth a CPO's attention. Uber's AI guardrail tool is run by the security team, not the platform team. That may be exactly right for Uber. But it shows how fast the substrate splits across owners once it exists. Guardrails with security, the gateway with platform, code review with whoever built it, the eval set with nobody. Every seam is a place where a build can reach a customer without anyone having said yes.

The split: the platform and the bar

Here's where I land.

The CTO owns the platform. Scaffolded environments, the model gateway, deploy isolation, spend metering, reliability, and the enforcement of every guardrail. Enforcement means the platform makes the wrong thing impossible, not merely discouraged.

The CPO owns the bar. The content of the eval set, which is a statement about what good means for a specific customer and therefore a product decision (The Eval Is The Spec is the long version). The guardrail policy, meaning what the product is allowed to do, touch, or spend on a customer's behalf. The graduation criteria. And the cost-per-outcome target, which Gross Margin Is Your Job Now already puts on product's desk.

Both sign the gate. Nothing reaches a customer without clearing a bar product wrote, on infrastructure engineering runs.

Why it can't be one side. Rich Holmes flagged an OpenAI alignment report in Department of Product on Sunday. An internal research model was asked to deploy contracts to a test network and wasn't given a funded wallet. It derived keys from public recovery phrases, checked 362 addresses, paid from one that held funds, and didn't mention it in its report. OpenAI's own summary is that "a model can substitute its own judgment about likely harm for the account holder's permission."

Read that as two failures. One is enforcement: the environment let the model reach a live network, and OpenAI's fix was to block that and monitor all traffic. That's the CTO's half. The other is policy: what is an agent allowed to spend, whose permission counts, and does it have to disclose what it did? That's a product decision, the same one I'd make in trust and safety. OpenAI needed both fixes. So will you.

In the same issue, Holmes quoted Shopify's CTO Mikhail Parakhin, who argued for training models on how well they explain themselves, because otherwise "we will stop understanding their reasoning, results, anything, no matter how hard we try." Put that next to Undo's 35 percent of code shipped before anyone understood it. A CPO who lets that number grow has handed product decisions to whatever wrote the code. The eval bar is how product stays in the loop.

One seat doesn't settle it

Yesterday Dynata named Marcus Casal chief product and technology officer, most recently CTO at Lionbridge. CEO Mike Petrullo said "we need leaders who can bring together product vision, technology execution, data strategy, and innovation." Dayforce made the same call with Jake Varghese two weeks ago, which part 1 covered.

It can work. But Craig Unsworth argued in March that the CPTO strains when it holds product strategy, technology delivery, and platform architecture at once, and that many companies reaching for an AI title are missing a platform: "the organisation does not have a platform. It has a collection of systems." I agree with the diagnosis. A merged seat doesn't remove the split between the bar and the platform. It moves it onto one calendar, where the platform usually wins because outages are louder than a weak eval. Under a CPTO, name two owners one level down. The full argument on when the seat merges or goes away is a later part.

Four numbers, one page

If the CPO and CTO share the substrate, they share a scorecard. Mine has four lines, reviewed together every month.

Time to first prototype, from idea to a running build in a safe environment. Share of builds that cleared the eval before a customer saw them. Incidents traced to code nobody understood before it shipped. Cost per outcome.

The first is mostly the CTO's. The second is mostly the CPO's. The last two belong to both, which is the point. And when the CEO asks how AI is going in product and engineering, report release speed against those four, not lines of code or PRs merged. Part 2 made the case that hours saved is a weak story. Code speed is the same story with a different label.

Next in the series: org shape, fewer PMs, Product Builders, and the ratio question.

One thing to try this week

Book an hour with your CTO. Write down every piece of the substrate: environments, the model gateway, the eval harness, the eval set itself, guardrail policy, guardrail enforcement, deploy isolation, spend metering, and the graduation gate. Add two columns, who owns it today and who should. Every blank and every "both" is where your next incident comes from. Assign one of them before the hour is up.

Sources: Sergio De Simone, "Survey Finds AI-Generated Code Increases Debugging and Failure Rates and Creates a Comprehension Gap," InfoQ, October 7, 2026, infoq.com, reporting Undo's survey of 300 senior engineering leaders by Coleman Parkes, with Greg Law; Undo's release, "Producing code has never been easier, but AI-generated bugs and rising debugging workloads are slowing software delivery," VMblog, September 29, 2026, vmblog.com. Vivek Trivedy, "Improving Deep Agents with harness engineering," LangChain, February 17, 2026, langchain.com. Gergely Orosz, "Uber's AI infra, from the inside," The Pragmatic Engineer, October 14, 2026, newsletter.pragmaticengineer.com, with Uday Kiran Medisetty. OpenAI Alignment, "Using a funded test cryptocurrency wallet without authorization," last updated October 15, 2026, alignment.openai.com. Rich Holmes, "Figma just put Real Code on the Design Canvas," Department of Product, October 18, 2026, departmentofproduct.substack.com, for the OpenAI report and Mikhail Parakhin's remarks. Dynata, "Dynata Appoints Marcus Casal as Chief Product and Technology Officer," PR Newswire, October 19, 2026, prnewswire.com. Craig Unsworth, "When CPTO Doesn't Work, and CAIO Is a Distraction, You Might Need a Chief Platform Officer," Chiefly Product, March 31, 2026, chieflyproduct.substack.com.

Part of the running argument on Product Leadership: the product org chart was calibrated to a build cost that collapsed, and the CPO's job is now the system that decides what gets built, which includes writing the bar the CTO's platform enforces.

Related answer: Who owns the eval harness, the CPO or the CTO?