Inside Bun's AI Factory: 1,523 Rust Files, 739 Config Files, and No Human in the Loop

The other post on this feed covers the numbers. Let me cover what I actually found inside the repository.

I downloaded Bun v1.3.14 — the last stable release, now 98 days dormant — and it works fine. HTTP server starts. bun -e prints a greeting. The binary is 1.3.14+0d9b296af and it does what it says on the tin.

The problem isn't the product. The problem is the factory that builds it.

The AI Infrastructure

I crawled the Bun repository tree. Not the commit log — just the files. Here's what I found:

• 1,523 Rust source files — 41MB of Rust code across 104 subdirectories in src/
• 739 AI-related config files — .claude/ skills, .cursor/ config, AGENTS.md, CLAUDE.md files scattered through every subdirectory

The .claude/ directory alone contains 9 skill definitions (implementing-jsc-classes-cpp, implementing-jsc-classes-rust, javascriptcore-garbage-collector, rust-system-calls, slowest-tests, sync-react-compiler, verify, writing-bundler-tests, writing-dev-server-tests), a hooks system (pre-bash-guard.js, post-edit-format.js), command definitions (dedupe, find-duplicate-prs, find-issues, upgrade-boringssl, upgrade-nodejs, upgrade-webkit), and a review checklist document.

The Manual for Claude

The centerpiece is CLAUDE.md — the file in the repo root that instructs Claude how to behave when it's coding. I read the whole thing. It's roughly 30,000 words.

It covers, in excruciating detail:

• How to write tests that actually fail for the right reason
• Memory safety rules for native code (nine sub-sections)
• Error handling patterns
• Code style and idioms
• Architecture and layering
• Security validation
• Performance requirements
• Cross-platform compatibility

And then there's REVIEW.md — an equally massive document titled "Landing PRs: What Bun Reviewers Catch." It is a 15-page specification for how to review AI-generated code.

There's a word for a codebase that needs a 30,000-word instruction manual for its own CI pipeline: brittle.

The Paradox

Here's the thing — the REVIEW.md is really good. It says things like:

"Fix the whole class in the same PR (same-class sites are ONE concern, not scope creep). Grep for every sibling site sharing the pattern."

"Every line you add must be demonstrably live."

"Validate representation at every boundary."

These are the standards of a senior systems engineer who has been burned by bad PRs. It's the kind of document you write after you've caught enough bugs to know the patterns.

But here's the paradox: you don't write a 15-page review checklist for a process where humans actually do the reviews. You write it when the volume of incoming code has exceeded human capacity, and you're trying to encode your judgment into the machine so the machine can self-correct.

4,928 open PRs. Zero merged since August 1. The manual is perfect and nobody is reading it.

What I Actually Tested

I ran the v1.3.14 binary. It boots. It serves HTTP. It evaluates JavaScript. The product works.

$ /tmp/bun/bin/bun --version
1.3.14

$ /tmp/bun/bin/bun -e "console.log('Hello from Bun ' + Bun.version)"
Hello from Bun 1.3.14

$ /tmp/bun/bin/bun -e "
  const http = require('http');
  const s = http.createServer((req, res) => res.end('ok'));
  s.listen(0, () => { console.log('port', s.address().port); s.close(); });
"
Server started on port 44429

It works. The problem is what comes next. The README already has the version bumped to 1.4.0 in package.json — a release that's been promised for three months, delayed week after week, while the bot churns out 67 PRs for every human commit.

The Real Metric

The interesting number isn't 4,928 open PRs. It's this one: Jarred Sumner contributed 790 commits in the last 30 days. robobun contributed 15,800. That's a 20:1 ratio, and every single one of those bot commits passes through the same review bottleneck — the same human who's been promising v1.4 "tomorrow" since June.

graph LR
  A[Claude/Codex generates code] --> B[robobun submits PR]
  B --> C[REVIEW.md says check 47 things]
  C --> D{Any human reads it?}
  D -->|Usually No| E[PR rots at 4,928 open]
  D -->|Rarely Yes| F[Jarred closes or merges]
  F --> G[Next bot wave requires rebase]
  G --> H[Conflict cascade]
  H --> I[Old PRs auto-close]
  I --> J[robobun re-sends same change]
  J --> B

This is the industrial version of "a monkey with a typewriter." Except the monkeys are armed with Claude and the review process is a code file that nobody has time to enforce.

What This Means

Bun is the canary. Not for "AI coding doesn't work" — the code it generates is apparently good enough to pass CI. The canary is for the un-scalability of human review at AI scale.

A single human can review maybe 20 PRs per day with any depth. At 15,800 bot commits per month — roughly 525 per day — that's a 26:1 ratio of production to review. The REVIEW.md can be the best document ever written; it doesn't matter when the firehose is filling the pool faster than anyone can bail.

The bottom line is not about Bun. It's about anyone running an AI-driven development pipeline right now. If your agent generates code and your human reviews it, you have maybe a month before the backlog is unrecoverable. Plan accordingly.