AI Can Write the Code. Who Verifies It?

salawat

Traditionally, that'd be a joint effort between a dedicated QA team, partially supported by the engineering team, that no one wants to pay for...

jhack

The same people that verify what a compiler spits out?

thisisthenewme

AI: - writes the code - reviews the code - designs it - productizes it - advertises it - consumes it

simianwords

I was talking to some friends about how CI/CD should be used in $current_year if you have fully committed to agents. The industry is surprisingly slow to adapt and I'm writing two capabilities I'd like standardised in the industry. I'd like standardisation of Agentic tests (I know, it sounds terrible) but these are tests that are broader and capture fuzzy intent of the system. Unit tests, e2e tests are focused and hard to maintain. An Agentic test (or a behaviour test) is where the agent understands the underlying behaviour intent and creates scenarios on the fly and executes them. For example, I'd imagine that Claude Code goes through multiple Agentic tests where Claude itself tries to use the software using desktop control. This would capture a much broader range of bugs and its much easier to maintain because you only need the test to have a description of the intent and not all the hardcore plumbing required in e2e tests and unit tests (like mocks ughh). I'd like a framework where I could simply have something like SCENARIOS.md and the framework runs the scenarios by spinning up the common environment required for the test. The industry is severely lacking in this kind of capability. The next thing missing is Agentic deployment verification. So image that you are deploying your service and you'd need to verify multiple metrics are in shape before you promote it to all servers. Traditionally this was done either by manual checks by the developer (tiresome and prone to errors) or just having alerts on a few key metrics (not extensive). Concretely, I'd like the agent complete access to all my metrics and logs and have it make the judgement to either promote it or not promote it or notify the developer. You'd argue this is not required, but in my experience, having this capability gives me a lot of sanity. There are greybeards who love to gatekeep their responsibilities and would argue something like "just have good unit tests!!11!!" but that's silly. Why these are not becoming standard or even required practices is beyond me. I'm guessing that there's a cohort of developers whose mindset is risk aversion and they are not great at intuiting what an LLM is good at and what they are bad at. Unfortunately, a lot of arguments are just silly like "but hallucination", "but just have deterministic tests", "don't overcomplicate things".

ChicagoDave

If you build guardrails on what is generated, verification is done at the same time as generation.

alcomatt

Perhaps the question here should be, "Who takes the blame when it all goes south?"

pianopatrick

One idea I am thinking through is that I might want to use a linter to restrict the AI to only use a subset of various languages which would not need as much review. For instance, if I wrote a web front end that only allowed certain HTML tags and certain CSS properties and no Javascript, I could avoid certain classes of errors entirely. Or for instance, in C, if you disallow dynamic memory allocation you also avoid entire classes of errors. These are checks I think I can configure with linters and would give me more confidence that AI generated code did not have certain errors.

karmakaze

Unless it's a personal project that you vibe coded, any production code that is the primary asset to a real company should have a person who understands what gets deployed. The best way I know how to do that is to co-design it with the AI. Reading code to match a spec can get the job done but the structure can be all kinds of horrible, and the more it gets iterated upon with features only makes it sprawl. Two signals I use: do I ever push back and find places where the draft version was incorrect, incomplete, or otherwise not up to par and do I feel comfortable if something goes wrong with in production and I have to debug it at any hour of day or week.

bvcp

1,000 devs write the code. Who verifies it?

nirui

> AI Can Write the Code. Who Verifies It? > Simple: automated software verification > .... With the same clever tools, skills, and harnesses we use as AI engineers to push code at breakneck speed, we can build elaborate testing and verification automations. So, in short, AI is going to verify it? Not picking on ads, I'm sure the tools mentioned are useful, but exactly how effective they are? How many bugs it has discovered/reduced (compare to tests + human verification)? And how much time it saved? Without these info, the article is not that useful.