The article discusses how AI agents are transforming software development by autonomously creating pull requests, selecting dependencies, refactoring code, interpreting test failures, and managing infrastructure across the SDLC. It highlights the lack of accountability for these transient processes, noting that traditional tools like git logs and governance frameworks assume human decision‑making, which no longer applies. To address this, the authors propose Agentic Process Evidence (APE), a signed, tamper‑evident, machine‑readable attestation that links AI agent sessions to their outcomes, enabling policy‑as‑code controls and human oversight only when necessary.
By Yuval Kainan, Carmit Hershman
The article discusses how AI agents are transforming software development by autonomously handling tasks across the SDLC, yet their actions are fleeting and lack traceability. It highlights the emerging security risks—intent mismatch, injection, and supply‑chain vulnerabilities—and the absence of standards for agentic provenance and governance. To address this, the authors propose Agentic Process Evidence (APE), a signed, tamper‑evident, machine‑readable attestation that links AI agent sessions to outcomes, enabling policy‑as‑code control and human oversight only when necessary.
The paper introduces Skeleton Coding, a method where developers jointly specify a program’s structure—its data types, modules, and functions—alongside behavioral tests. This approach allows the agent to first commit to a structure, narrowing the search space of possible programs, and then use tests to select the correct implementation. Empirical results across multiple models and benchmarks show that skeletons can dramatically reduce the number of required tests, improve accuracy, and lower implementation costs.
By Aditya Golatkar, Alessandro Achille, Renos Zabounidis, Vlad Sobal, Yangruibo Ding, Baishakhi Ray, Jonathan Buck, Guy Van den Broeck, Maryam Fazel, Pietro Perona, Wei Xia, Stefano Soatto
The paper discusses the need for independent assurance when coding agents produce both software and its correctness evidence. It identifies four gaps—requirement, conformance, evaluation, and model—between stakeholder intent and production, and proposes a verification framework that separates building from verifying. The framework introduces a Verification Contract, a specification-first phase, and an implementation-aware phase using mutation analysis, property-based testing, and fuzzing, and is evaluated in a study showing that an external verifier detected more seeded faults than the builder’s own tests.
By Sion Israel Sion, Alain April
The paper introduces rebuild‑dossier, an open‑source tool that locks an application’s real interface before code is written and enforces one‑test‑at‑a‑time building through automated checks. In experiments, a compliant agent failed a held‑back test while a rule‑breaking agent passed, showing that a passing test suite can be gamed. The study also demonstrates that the automated check mechanism, rather than interface‑locking alone, is crucial for reliable rebuilds, and that multi‑level verification catches errors that single‑level checks miss.
By Parker Fawcett
The article discusses how generative models increasingly act as builders, defenders, and breakers of software, challenging the assumption that full autonomy is the ultimate goal. It introduces a framework that defines measurable independence between lifecycle roles based on shared generative substrates, and proposes five autonomy levels, three human roles, and five decision criteria to guide oversight. The authors argue that human authority should focus on specification, accountability, and emergency intervention, and they outline testable hypotheses and protocols to evaluate independence and oversight effectiveness.
By Mohamed Chahine Ghanem