Ideas & Insights – AutotomyExploring AI-first development, coding guardrails, and the architecture of disposability.https://autotomy.dev/enYour main branch is broken. You have 200 commits to search through.https://autotomy.dev/blog/git-bisect-binary-search-commit/https://autotomy.dev/blog/git-bisect-binary-search-commit/Git bisect turns a manual commit hunt into an automated binary search.Tue, 25 Aug 2026 00:00:00 GMTYour error tracker knows where it died. That won't help you reproduce it.https://autotomy.dev/blog/production-crash-capture-replay/https://autotomy.dev/blog/production-crash-capture-replay/Stack traces tell you where a crash happened, not what caused it.Mon, 24 Aug 2026 00:00:00 GMTSymbolic Execution Found an Integer Overflow My 94% Test Coverage Missedhttps://autotomy.dev/blog/symbolic-execution-integer-overflow-coverage/https://autotomy.dev/blog/symbolic-execution-integer-overflow-coverage/Your unit tests check specific inputs. Symbolic execution checks every possible input. Here's how it works, what it costs, and where to start.Sun, 23 Aug 2026 00:00:00 GMTYour logs are leaking PII, and grep won't save youhttps://autotomy.dev/blog/pii-tracking-code-pipeline/https://autotomy.dev/blog/pii-tracking-code-pipeline/Most teams find PII leaks after a customer complaint. Here's how to track sensitive data from ingestion to output with code examples you can use today.Sat, 22 Aug 2026 00:00:00 GMTYour API broke in production because CI was testing code, not contractshttps://autotomy.dev/blog/api-contract-testing-ci/https://autotomy.dev/blog/api-contract-testing-ci/Most CI pipelines catch syntax errors and logic bugs. They miss the API contract breaks that actually take down production. Here's how to fix that.Fri, 21 Aug 2026 00:00:00 GMTCrash Correlations Lie. Here Is How to Make Them Point at the Real Bug.https://autotomy.dev/blog/crash-correlation-triangulation/https://autotomy.dev/blog/crash-correlation-triangulation/Statistical debugging finds predicates correlated with crashes, but correlation is not a file and line number.Thu, 20 Aug 2026 00:00:00 GMTSentry's Seer Can Read Your Traces. That Doesn't Mean It Always Finds the Root Cause.https://autotomy.dev/blog/sentry-seer-trace-root-cause/https://autotomy.dev/blog/sentry-seer-trace-root-cause/Seer ingests trace trees, connected errors, and profiling data to diagnose distributed issues.Wed, 19 Aug 2026 00:00:00 GMTStatistical debugging was supposed to end printf debugging. Most teams never got it to work.https://autotomy.dev/blog/statistical-debugging-adoption-challenges/https://autotomy.dev/blog/statistical-debugging-adoption-challenges/Statistical debugging promised to pinpoint bugs by correlating program behavior with failures.Tue, 18 Aug 2026 00:00:00 GMTYour tests passed. Your data is still wrong.https://autotomy.dev/blog/statistical-debugging-production-data-anomalies/https://autotomy.dev/blog/statistical-debugging-production-data-anomalies/Statistical debugging treats your production data as a signal and bugs as anomalies.Mon, 17 Aug 2026 00:00:00 GMTMetamorphic testing found 147 compiler bugs and a self-driving car defect. Here's how it works.https://autotomy.dev/blog/metamorphic-testing-production-bugs-compiler/https://autotomy.dev/blog/metamorphic-testing-production-bugs-compiler/Metamorphic testing has uncovered real bugs in GCC, LLVM, Vulkan shader compilers, and ADAS simulators.Sun, 16 Aug 2026 00:00:00 GMTLLMs Can Suggest Metamorphic Relations. They Just Can't Guarantee Them.https://autotomy.dev/blog/llm-metamorphic-relations-brainstorming/https://autotomy.dev/blog/llm-metamorphic-relations-brainstorming/Large language models are decent brainstorming partners for discovering test oracles, but they hallucinate properties and miss domain constraints.Sat, 15 Aug 2026 00:00:00 GMTMost Metamorphic Relations Are Useless. Here's How to Pick the Good Ones.https://autotomy.dev/blog/metamorphic-relation-quality/https://autotomy.dev/blog/metamorphic-relation-quality/Not all metamorphic relations catch bugs. Weak relations give false confidence while strong ones find real faults.Fri, 14 Aug 2026 00:00:00 GMTHow do I test code when I don't know the right answer?https://autotomy.dev/blog/metamorphic-testing-oracle-problem/https://autotomy.dev/blog/metamorphic-testing-oracle-problem/Metamorphic testing lets you verify code correctness without knowing the exact expected output.Thu, 13 Aug 2026 00:00:00 GMTTypeScript Won't Let You Make That Call: Encoding Protocol State in the Type Systemhttps://autotomy.dev/blog/typescript-phantom-types-protocol-state/https://autotomy.dev/blog/typescript-phantom-types-protocol-state/How to use phantom types and `this` parameters to turn illegal protocol transitions into compile-time errors instead of runtime bugs.Wed, 12 Aug 2026 00:00:00 GMTOpenAPI Gives You the Alphabet. Session Types Need the Grammar.https://autotomy.dev/blog/openapi-session-types-protocol-gap/https://autotomy.dev/blog/openapi-session-types-protocol-gap/OpenAPI specs describe request and response schemas, but they don't specify valid message sequences.Tue, 11 Aug 2026 00:00:00 GMTSession types work. Most languages just refused to implement them.https://autotomy.dev/blog/session-types-research-to-production/https://autotomy.dev/blog/session-types-research-to-production/Session types encode communication protocols in the type system, turning runtime protocol errors into compile-time failures.Mon, 10 Aug 2026 00:00:00 GMTHow session types turn deadlocks into compiler errorshttps://autotomy.dev/blog/session-types-deadlock-compiler-errors/https://autotomy.dev/blog/session-types-deadlock-compiler-errors/Session types encode communication protocols in your type system, turning message-passing mismatches into compiler errors before your code ever runs.Sun, 09 Aug 2026 00:00:00 GMTAbstract interpretation sounds like a PhD requirement. It isn't anymore.https://autotomy.dev/blog/infer-abstract-interpretation-ci/https://autotomy.dev/blog/infer-abstract-interpretation-ci/How to run formal static analysis in your CI pipeline using Infer, with working configs and realistic trade-offs.Sat, 08 Aug 2026 00:00:00 GMTLLMs Can Rank Your Static Analysis Warnings. They Just Can't Explain Why.https://autotomy.dev/blog/llm-static-analysis-triage/https://autotomy.dev/blog/llm-static-analysis-triage/Large language models can help triage static analysis false positives, but they don't understand program semantics the way abstract interpretation does.Fri, 07 Aug 2026 00:00:00 GMTFacebook parallelized Android with abstract interpretation. Here's how it works.https://autotomy.dev/blog/facebook-android-abstract-interpretation-races/https://autotomy.dev/blog/facebook-android-abstract-interpretation-races/How Facebook used abstract interpretation and intentional unsoundness to find race conditions at scale in millions of lines of Android code.Thu, 06 Aug 2026 00:00:00 GMTMeta found 100,000 bugs in production code with a static analyzer that never runs the programhttps://autotomy.dev/blog/meta-infer-100000-bugs-static-analysis/https://autotomy.dev/blog/meta-infer-100000-bugs-static-analysis/Meta's Infer uses abstract interpretation and bi-abduction to find null dereferences, memory leaks, and race conditions by reasoning about code structure,...Wed, 05 Aug 2026 00:00:00 GMTStatic Analysis Can't Prove Your Airplane Won't Crash. It Can Prove Something More Useful.https://autotomy.dev/blog/static-analysis-aviation-abstract-interpretation/https://autotomy.dev/blog/static-analysis-aviation-abstract-interpretation/Abstract interpretation over-approximates every possible program state.Tue, 04 Aug 2026 00:00:00 GMTHow to prove your code has no runtime errors (and why you'll probably give up trying)https://autotomy.dev/blog/abstract-interpretation-runtime-error-proof/https://autotomy.dev/blog/abstract-interpretation-runtime-error-proof/Abstract interpretation lets you prove runtime errors impossible before execution.Mon, 03 Aug 2026 00:00:00 GMTYour C code can run on capability hardware without a full rewritehttps://autotomy.dev/blog/cheri-c-porting-hybrid-abi/https://autotomy.dev/blog/cheri-c-porting-hybrid-abi/CHERI's hybrid ABI lets you port C code to capability hardware incrementally.Sun, 02 Aug 2026 00:00:00 GMTCapability hardware didn't fail. It arrived 40 years early.https://autotomy.dev/blog/capability-hardware-cheri-history/https://autotomy.dev/blog/capability-hardware-cheri-history/Memory safety at the hardware level has been possible since the 1970s.Sat, 01 Aug 2026 00:00:00 GMTYour C dependency can segfault your entire process. WebAssembly can stop it.https://autotomy.dev/blog/c-library-wasm-sandbox/https://autotomy.dev/blog/c-library-wasm-sandbox/Containers are overkill for isolating a single C library.Fri, 31 Jul 2026 00:00:00 GMTYour Phone Already Has Hardware That Catches Memory Corruptionhttps://autotomy.dev/blog/mobile-memory-tagging-extension/https://autotomy.dev/blog/mobile-memory-tagging-extension/ARM Memory Tagging Extension and GWP-ASan make production memory safety detection possible on modern mobile devices.Thu, 30 Jul 2026 00:00:00 GMTBuffer Overflows Keep Happening Because We Fix Them in Softwarehttps://autotomy.dev/blog/cheri-hardware-buffer-overflow-prevention/https://autotomy.dev/blog/cheri-hardware-buffer-overflow-prevention/CHERI is a hardware extension that turns every pointer into a bounded capability.Wed, 29 Jul 2026 00:00:00 GMTLLMs Can't Prove Your Code Correct, But They Can Write the Boilerplate That Doeshttps://autotomy.dev/blog/llm-cleanroom-proof-obligation-automation/https://autotomy.dev/blog/llm-cleanroom-proof-obligation-automation/Cleanroom verification requires generating and discharging proof obligations.Tue, 28 Jul 2026 00:00:00 GMTCleanroom Delivers 0.1 Defects per KLOC. You Don't Need the Full Religion to Get There.https://autotomy.dev/blog/cleanroom-pragmatic-subset/https://autotomy.dev/blog/cleanroom-pragmatic-subset/Cleanroom software engineering cuts defect rates by 100×, but full adoption requires separate test teams and formal proofs.Mon, 27 Jul 2026 00:00:00 GMTIBM's Zero-Defect Process Delivered 0.1 Bugs Per KLOC. The Industry Abandoned It Anyway.https://autotomy.dev/blog/ibm-cleanroom-zero-defects-disappearance/https://autotomy.dev/blog/ibm-cleanroom-zero-defects-disappearance/IBM's Cleanroom engineering achieved defect rates 100× better than industry average, then faded into obscurity.Sun, 26 Jul 2026 00:00:00 GMTDid anyone actually verify 10,000 lines with zero defects? IBM did, and the methodology is stranger than the result.https://autotomy.dev/blog/ibm-cleanroom-10000-lines-zero-defects/https://autotomy.dev/blog/ibm-cleanroom-10000-lines-zero-defects/Cleanroom software engineering promised zero-defect increments through mathematical verification instead of debugging.Sat, 25 Jul 2026 00:00:00 GMTYour Module Has Three Layers. You Probably Only Wrote One.https://autotomy.dev/blog/cleanroom-box-structure-three-layers/https://autotomy.dev/blog/cleanroom-box-structure-three-layers/Box structures force you to define what a module does, what it remembers, and how it works as three separate, verifiable layers.Fri, 24 Jul 2026 00:00:00 GMTIBM shipped software with 0.1 defects per KLOC by banning developers from running their own codehttps://autotomy.dev/blog/ibm-cleanroom-01-defects-per-kloc/https://autotomy.dev/blog/ibm-cleanroom-01-defects-per-kloc/IBM's Cleanroom engineering process achieved defect rates 100× better than industry average by preventing bugs instead of finding them.Thu, 23 Jul 2026 00:00:00 GMTYour literate program is broken until CI can tangle it without youhttps://autotomy.dev/blog/ci-literate-programming-tangle/https://autotomy.dev/blog/ci-literate-programming-tangle/Literate programming promises a single source of truth, but manual weave and tangle steps break the CI/CD pipeline.Wed, 22 Jul 2026 00:00:00 GMTExplaining Code to an LLM First Cut My Bug Rate by 85%https://autotomy.dev/blog/llm-rubber-ducking-bug-rate/https://autotomy.dev/blog/llm-rubber-ducking-bug-rate/I spent 30 days writing design explanations before asking an LLM for code. The results changed how I think about rubber-ducking.Tue, 21 Jul 2026 00:00:00 GMTI stopped copying code into docs by keeping tests, code, and prose in one Markdown filehttps://autotomy.dev/blog/literate-programming-markdown-python/https://autotomy.dev/blog/literate-programming-markdown-python/Literate programming keeps documentation, tests, and implementation in sync by making a Markdown file the single source of truth.Mon, 20 Jul 2026 00:00:00 GMTYour Claude Thread Is Already Documentation. It Just Dies in Twelve Hours.https://autotomy.dev/blog/claude-thread-to-documentation/https://autotomy.dev/blog/claude-thread-to-documentation/LLM conversations contain intent, rejected alternatives, and working code. That's exactly what documentation should be.Sun, 19 Jul 2026 00:00:00 GMTText Editors Let You Write Invalid Code. Tree Editors Wouldn't.https://autotomy.dev/blog/structured-editing-ast-text-editors/https://autotomy.dev/blog/structured-editing-ast-text-editors/Every compiler sees your code as a tree, but your editor lets you edit raw text.Sat, 18 Jul 2026 00:00:00 GMTDonald Knuth Wanted Programs to Read Like Literature. The Compiler Had Other Ideas.https://autotomy.dev/blog/knuth-literate-programming-history/https://autotomy.dev/blog/knuth-literate-programming-history/Literate programming promised that code should be written for humans first and machines second. Four decades later, almost nobody writes that way.Fri, 17 Jul 2026 00:00:00 GMTFixing the Bug Is the Easy Part. Figuring Out Why It Exists Is What Matters.https://autotomy.dev/blog/fagan-causal-analysis-defects/https://autotomy.dev/blog/fagan-causal-analysis-defects/Most teams fix defects and move on. The same defects come back.Thu, 16 Jul 2026 00:00:00 GMTPull Request Reviews Catch 15-30% of Defects. The Data Has Said So for 50 Years.https://autotomy.dev/blog/pr-reviews-catch-15-to-30-percent-defects/https://autotomy.dev/blog/pr-reviews-catch-15-to-30-percent-defects/Multiple studies across IBM, AT&T, HP, and Microsoft confirm informal code review catches roughly a quarter of defects.Wed, 15 Jul 2026 00:00:00 GMTA Generic Checklist Catches Nothing. A Structured One Catches 60% of Defects.https://autotomy.dev/blog/fagan-structured-checklist-defect-detection/https://autotomy.dev/blog/fagan-structured-checklist-defect-detection/Most review checklists are copy-pasted lists of good intentions.Tue, 14 Jul 2026 00:00:00 GMTAn LLM Can Pre-Inspect Your Code. It Cannot Run the Meeting.https://autotomy.dev/blog/llm-fagan-inspection-preparation/https://autotomy.dev/blog/llm-fagan-inspection-preparation/Fagan inspections need four to six people and two hours to review 250 lines.Mon, 13 Jul 2026 00:00:00 GMTFagan Inspections Found 90% of Defects Before Testing. Then We Stopped Doing Them.https://autotomy.dev/blog/fagan-inspections-disappearance-ibm/https://autotomy.dev/blog/fagan-inspections-disappearance-ibm/Michael Fagan's structured inspection process at IBM caught nearly all defects before they reached a compiler.Sun, 12 Jul 2026 00:00:00 GMTYour Best Reviewer Misses Most Defects. Fagan Measured It at IBM in 1976.https://autotomy.dev/blog/fagan-reviewer-defect-detection-variance/https://autotomy.dev/blog/fagan-reviewer-defect-detection-variance/Even senior engineers catch only a fraction of defects in unstructured review.Sat, 11 Jul 2026 00:00:00 GMTMost Code Reviews Catch 20% of Defects. Fagan Inspections Catch 90%.https://autotomy.dev/blog/fagan-inspections-90-percent-defects/https://autotomy.dev/blog/fagan-inspections-90-percent-defects/Informal code review catches 15-30% of defects. Fagan inspections, a structured 50-year-old process, consistently report 60-90% removal rates.Fri, 10 Jul 2026 00:00:00 GMTAutoVerus turns 40 hours of proof writing into 3 LLM calls. The trick is knowing when to give up.https://autotomy.dev/blog/autoverus-llm-rust-verification/https://autotomy.dev/blog/autoverus-llm-rust-verification/AutoVerus uses a network of LLM agents to generate Verus correctness proofs for Rust code, automating over 90% of proof obligations through a...Thu, 09 Jul 2026 00:00:00 GMTLLMs can generate Rust code. Formal proofs are a different problem entirely.https://autotomy.dev/blog/llm-rust-formal-proofs-hallucination/https://autotomy.dev/blog/llm-rust-formal-proofs-hallucination/Large language models write surprisingly good Rust, but when you ask them for a formal proof they hallucinate invariants and invent syntax that no verifier...Wed, 08 Jul 2026 00:00:00 GMTWaiting for race conditions is a terrible testing strategyhttps://autotomy.dev/blog/model-checking-race-conditions/https://autotomy.dev/blog/model-checking-race-conditions/Why model checking beats days of production runtime for finding concurrency bugs, and how to apply it to your own code.Tue, 07 Jul 2026 00:00:00 GMTYou Can Model-Check Code Without Learning Temporal Logichttps://autotomy.dev/blog/is-there-a-model-checker-that-doesnt-require-learning-temporal-logic/https://autotomy.dev/blog/is-there-a-model-checker-that-doesnt-require-learning-temporal-logic/Bounded model checkers like Kani and relational model finders like Alloy let you verify properties with ordinary assertions and constraints.Mon, 06 Jul 2026 00:00:00 GMTYou can prove Rust code correct without writing a single proof, but the state space is the billhttps://autotomy.dev/blog/rust-model-checking-kani-state-space/https://autotomy.dev/blog/rust-model-checking-kani-state-space/Model checking tools like Kani let you verify Rust properties with assertions instead of formal proofs.Sun, 05 Jul 2026 00:00:00 GMTYou can't unit test a distributed protocol, but you can model check ithttps://autotomy.dev/blog/distributed-protocol-model-checking-tla/https://autotomy.dev/blog/distributed-protocol-model-checking-tla/Distributed bugs are expensive to fix after deployment. Model checking lets you find them before you write a single line of implementation code.Sat, 04 Jul 2026 00:00:00 GMTCopying `.env` files across environments is not a config strategyhttps://autotomy.dev/blog/infrastructure-config-dsl-per-context/https://autotomy.dev/blog/infrastructure-config-dsl-per-context/How infrastructure teams manage configuration across dev, staging, and production using per-context DSLs that make environment differences explicit and...Fri, 03 Jul 2026 00:00:00 GMTGrammar-constrained decoding: forcing LLMs to output valid syntax at the token levelhttps://autotomy.dev/blog/grammar-constrained-decoding-llm/https://autotomy.dev/blog/grammar-constrained-decoding-llm/LLMs hallucinate syntax because they sample tokens probabilistically.Thu, 02 Jul 2026 00:00:00 GMTEnglish-to-theme translation is easy. Making it deterministic is the real problem.https://autotomy.dev/blog/english-to-theme-deterministic-design-tokens/https://autotomy.dev/blog/english-to-theme-deterministic-design-tokens/You can generate design tokens from plain English descriptions, but only if you treat the description as a bounded-context DSL with a schema contract and...Wed, 01 Jul 2026 00:00:00 GMTDitch the grammar file: write your DSL parser in plain TypeScripthttps://autotomy.dev/blog/typescript-parser-combinators-dsl/https://autotomy.dev/blog/typescript-parser-combinators-dsl/Parser generators are overkill for most bounded-context DSLs.Tue, 30 Jun 2026 00:00:00 GMTRuntime config errors are production failures you chose to allowhttps://autotomy.dev/blog/config-validation-build-time/https://autotomy.dev/blog/config-validation-build-time/How to catch configuration mistakes before your application starts serving traffic, using schema validation and build-time checks.Mon, 29 Jun 2026 00:00:00 GMTYour dependencies can read your environment variables. JavaScript lets them.https://autotomy.dev/blog/javascript-capability-security-lockdown/https://autotomy.dev/blog/javascript-capability-security-lockdown/Ambient authority means any code in your Node.js process can touch the filesystem, network, and environment.Sun, 28 Jun 2026 00:00:00 GMTNetwork Proximity Is Not Identity: How Services Authenticate Without Ambient Authorityhttps://autotomy.dev/blog/service-authentication-without-ambient-authority/https://autotomy.dev/blog/service-authentication-without-ambient-authority/Most service-to-service trust comes from network location, not cryptographic proof.Sat, 27 Jun 2026 00:00:00 GMTYour dependencies can read any file on disk. cap-std makes them ask permission.https://autotomy.dev/blog/rust-cap-std-capability-filesystem/https://autotomy.dev/blog/rust-cap-std-capability-filesystem/Rust's standard library grants ambient filesystem authority to every dependency.Fri, 26 Jun 2026 00:00:00 GMTYour Service Is an Unwitting Accomplice: How Confused Deputy Attacks Workhttps://autotomy.dev/blog/whats-a-confused-deputy-attack-and-how-do-i-prevent-it/https://autotomy.dev/blog/whats-a-confused-deputy-attack-and-how-do-i-prevent-it/A confused deputy attack tricks a privileged service into using its authority against itself.Thu, 25 Jun 2026 00:00:00 GMTYour permission checks are lying to youhttps://autotomy.dev/blog/typescript-capability-based-security/https://autotomy.dev/blog/typescript-capability-based-security/Capability-based security replaces scattered role checks with unforgeable tokens of authority.Wed, 24 Jun 2026 00:00:00 GMTWhat If Every Function Had to Receive Permission Instead of Assuming It?https://autotomy.dev/blog/capability-based-security-permissions/https://autotomy.dev/blog/capability-based-security-permissions/Most code runs with ambient authority: every function can touch everything.Tue, 23 Jun 2026 00:00:00 GMTStop Throwing Errors Your Type Checker Can't Seehttps://autotomy.dev/blog/should-i-stop-throwing-errors-and-start-returning-them/https://autotomy.dev/blog/should-i-stop-throwing-errors-and-start-returning-them/Thrown exceptions hide failure paths from your type system.Mon, 22 Jun 2026 00:00:00 GMTRust newtypes make wrong states unrepresentable at compile time, for freehttps://autotomy.dev/blog/rust-newtypes-zero-cost-safety/https://autotomy.dev/blog/rust-newtypes-zero-cost-safety/A single-field wrapper struct catches unit-mixing bugs and type confusion without adding a single byte of overhead.Sun, 21 Jun 2026 00:00:00 GMTSwitch statements leak bugs at compile timehttps://autotomy.dev/blog/is-there-a-better-way-than-switch-statements-for-type-safe-matching/https://autotomy.dev/blog/is-there-a-better-way-than-switch-statements-for-type-safe-matching/TypeScript switch statements silently let you forget cases.Sat, 20 Jun 2026 00:00:00 GMTThe compiler should catch missing state cases, not your QA teamhttps://autotomy.dev/blog/typescript-exhaustiveness-state-machines/https://autotomy.dev/blog/typescript-exhaustiveness-state-machines/Adding a new state to your machine is easy. Remembering to update every switch statement is not.Fri, 19 Jun 2026 00:00:00 GMTYes, But Your Type System Needs to Know What a Dollar Ishttps://autotomy.dev/blog/typescript-currency-types/https://autotomy.dev/blog/typescript-currency-types/TypeScript sees all numbers as identical. Here's how to teach it the difference between USD and EUR so the compiler catches currency conversion bugs before...Thu, 18 Jun 2026 00:00:00 GMTA number is not just a number: how to make the compiler catch unit bugshttps://autotomy.dev/blog/typescript-unit-types-compile-time/https://autotomy.dev/blog/typescript-unit-types-compile-time/Passing milliseconds where seconds were expected is a bug that passes every test.Wed, 17 Jun 2026 00:00:00 GMTTypeScript let me pass a user ID where an order ID belongshttps://autotomy.dev/blog/typescript-branded-types-newtypes/https://autotomy.dev/blog/typescript-branded-types-newtypes/Type aliases don't create distinct types in TypeScript. Branded types do, and they can save you from mixing up identifiers at compile time.Tue, 16 Jun 2026 00:00:00 GMTDifferential Testing Works Without a Formal Proof, but Common-Mode Failures Are the Catchhttps://autotomy.dev/blog/differential-testing-common-mode-failures/https://autotomy.dev/blog/differential-testing-common-mode-failures/Differential testing lets you find bugs without knowing the correct answer. The problem is that correlated mistakes look like agreement.Mon, 15 Jun 2026 00:00:00 GMTTesting Won't Prove Two Functions Are Equivalent. Here's What Will.https://autotomy.dev/blog/function-equivalence-smt-solvers/https://autotomy.dev/blog/function-equivalence-smt-solvers/N-version programming assumes your implementations agree.Sun, 14 Jun 2026 00:00:00 GMTWhat If My LLM Variants Disagree? Which One Is Right?https://autotomy.dev/blog/llm-variant-disagreement-resolution/https://autotomy.dev/blog/llm-variant-disagreement-resolution/Running multiple LLMs in parallel catches errors that any single model will confidently ship.Sat, 13 Jun 2026 00:00:00 GMTFive Implementations and No Majority: How to Actually Pick the Best Onehttps://autotomy.dev/blog/n-version-implementation-selection/https://autotomy.dev/blog/n-version-implementation-selection/N-version programming sounds simple: run multiple implementations and pick the best answer. In practice, 'best' is a lot harder to define than 'most common.'Fri, 12 Jun 2026 00:00:00 GMTThe Same LLM Can Write Five Versions of Your Function. Here's How to Make Them Actually Different.https://autotomy.dev/blog/llm-n-version-diverse-implementations/https://autotomy.dev/blog/llm-n-version-diverse-implementations/N-version programming with LLMs doesn't require multiple models.Thu, 11 Jun 2026 00:00:00 GMTNASA Ran 27 Copies of the Same Program. The Bugs Voted as a Bloc.https://autotomy.dev/blog/nasa-n-version-programming-knight-leveson/https://autotomy.dev/blog/nasa-n-version-programming-knight-leveson/N-version programming promised that independent teams would make independent mistakes.Wed, 10 Jun 2026 00:00:00 GMTHalf Your Cucumber Scenarios Are Skipped. Here's Why That Status Is Lying to You.https://autotomy.dev/blog/cucumber-skipped-scenarios-diagnosis/https://autotomy.dev/blog/cucumber-skipped-scenarios-diagnosis/Cucumber's 'skipped' status hides three completely different problems. Here's how to diagnose which one is eating your test suite, and how to stop it.Tue, 09 Jun 2026 00:00:00 GMTYour Gherkin specs are lying to youhttps://autotomy.dev/blog/gherkin-specs-automated-sync/https://autotomy.dev/blog/gherkin-specs-automated-sync/Gherkin specs drift out of sync the moment you trust humans to update them manually. Here's how to automate the checks that keep feature files honest.Mon, 08 Jun 2026 00:00:00 GMTYour Compiler Checks Syntax. Your Tests Should Check Architecture.https://autotomy.dev/blog/architecture-tests-ci-enforcement/https://autotomy.dev/blog/architecture-tests-ci-enforcement/Most teams document architecture rules in wikis. Here's how to write them as executable tests that fail CI when your dependency graph drifts.Sun, 07 Jun 2026 00:00:00 GMTYour domain layer imports Postgres. Your CI doesn't care.https://autotomy.dev/blog/clean-architecture-domain-infrastructure-ci/https://autotomy.dev/blog/clean-architecture-domain-infrastructure-ci/Clean architecture diagrams look great on a whiteboard.Sat, 06 Jun 2026 00:00:00 GMTYour Architecture Diagram Is Already a Liehttps://autotomy.dev/blog/architecture-docs-code-generated-diagrams/https://autotomy.dev/blog/architecture-docs-code-generated-diagrams/Architecture documentation rots the moment you save it. Here's how to keep docs honest using code-generated diagrams, ADRs, and automated architecture tests.Fri, 05 Jun 2026 00:00:00 GMTYour retry loop assumes the first request failed. It probably didn't.https://autotomy.dev/blog/idempotency-keys-api-retries/https://autotomy.dev/blog/idempotency-keys-api-retries/A timeout or crash does not mean your API request was lost.Thu, 04 Jun 2026 00:00:00 GMTA lock that outlives your process: how distributed leases actually workhttps://autotomy.dev/blog/distributed-leases-fencing-tokens/https://autotomy.dev/blog/distributed-leases-fencing-tokens/In-memory mutexes vanish when your server restarts. Here's how distributed leases with fencing tokens and TTLs prevent duplicate work across crashes, and...Wed, 03 Jun 2026 00:00:00 GMTA circuit breaker with no goroutines, no timers, and no background overheadhttps://autotomy.dev/blog/circuit-breaker-lazy-recovery-no-goroutines/https://autotomy.dev/blog/circuit-breaker-lazy-recovery-no-goroutines/Most circuit breaker libraries spawn background threads to probe for recovery. You don't need them.Tue, 02 Jun 2026 00:00:00 GMTYour Web Service Has a Graceful Shutdown Path. That's the Bug.https://autotomy.dev/blog/crash-only-software-web-services/https://autotomy.dev/blog/crash-only-software-web-services/Crash-only software treats every failure as a crash and every startup as a recovery.Mon, 01 Jun 2026 00:00:00 GMTHow to Kill a Surviving Mutant When You Don't Understand What It Changedhttps://autotomy.dev/blog/killing-surviving-mutants/https://autotomy.dev/blog/killing-surviving-mutants/Mutation testing found a survivor and you have no idea what the mutation even does.Sun, 31 May 2026 00:00:00 GMTAuth code needs 90% mutation coverage. Your string utils don't.https://autotomy.dev/blog/mutation-score-per-module-risk/https://autotomy.dev/blog/mutation-score-per-module-risk/Why enforcing a single mutation score across your entire codebase is a mistake, and how to set per-module thresholds that match actual risk.Sat, 30 May 2026 00:00:00 GMTYour Tests Pass. Your Mutation Score Is 40%. Here's What Surviving Mutants Are Actually Telling You.https://autotomy.dev/blog/my-tests-pass-but-my-mutation-score-is-40-whats-a-surviving-mutant/https://autotomy.dev/blog/my-tests-pass-but-my-mutation-score-is-40-whats-a-surviving-mutant/Code coverage says you're safe. Mutation testing says your tests are mostly decoration. Here's how surviving mutants expose the gap, and how to close it.Fri, 29 May 2026 00:00:00 GMTMutation Testing in Rust Works, but Your Compile Times Will Hate Youhttps://autotomy.dev/blog/rust-mutation-testing-cargo-mutants/https://autotomy.dev/blog/rust-mutation-testing-cargo-mutants/cargo-mutants finds the tests that only pretend to verify your code.Thu, 28 May 2026 00:00:00 GMTThe Validation Spectrum: Why AI Codes Backend Besthttps://autotomy.dev/blog/ai-coding-validation-spectrum-backend-web-mobile/https://autotomy.dev/blog/ai-coding-validation-spectrum-backend-web-mobile/AI coding follows a validation gradient. Backend validates in milliseconds. Web takes minutes. Mobile takes hours. The feedback loop determines where AI coding works.Wed, 27 May 2026 00:00:00 GMTMonkey, Machine Gun, Aimbot: AI Governance for Coding Teamshttps://autotomy.dev/blog/monkey-machine-gun-aimbot/https://autotomy.dev/blog/monkey-machine-gun-aimbot/AI code governance isn't about taking tools away from junior developers and AI agents. It's about installing guardrails that make every shot hit the target without collateral damage.Wed, 27 May 2026 00:00:00 GMTMutation testing takes 4 hours. How do teams actually use it in CI?https://autotomy.dev/blog/mutation-testing-takes-4-hours-how-do-teams-actually-use-it-in-ci/https://autotomy.dev/blog/mutation-testing-takes-4-hours-how-do-teams-actually-use-it-in-ci/Most teams don't run full mutation testing suites on every commit.Wed, 27 May 2026 00:00:00 GMTYour unit tests pass, but your data still disappearshttps://autotomy.dev/blog/database-persistence-testing-mocks/https://autotomy.dev/blog/database-persistence-testing-mocks/Mocked database tests verify your SQL syntax, not whether rows survive crashes, concurrent writes, or schema mismatches.Tue, 26 May 2026 00:00:00 GMTFear vs. Steamroll: The Two Realities of AI Codinghttps://autotomy.dev/blog/fear-vs-steamroll-ai-coding-divide/https://autotomy.dev/blog/fear-vs-steamroll-ai-coding-divide/AI coding works for elite teams who recover from any mess. Everyone else gets fear, failed CI, and abandoned experiments. The gap isn't the model.Tue, 26 May 2026 00:00:00 GMTTesting Redux without drowning in mock actionshttps://autotomy.dev/blog/redux-testing-real-state-transitions/https://autotomy.dev/blog/redux-testing-real-state-transitions/Mocking every Redux action turns your tests into a changelog validator. Here's how to test your store with real state transitions instead.Mon, 25 May 2026 00:00:00 GMTAI Coding in Production: Why Most Teams Quithttps://autotomy.dev/blog/ai-coding-in-production-autotomy-framework/https://autotomy.dev/blog/ai-coding-in-production-autotomy-framework/Most teams try AI coding, ship code that fails QA, and quit. The problem isn't the model—it's the absence of guardrails that make AI output trustworthy.Sun, 24 May 2026 00:00:00 GMT100 Test Runs Is a Lie: How to Actually Size Your Property-Based Testshttps://autotomy.dev/blog/property-based-testing-run-count/https://autotomy.dev/blog/property-based-testing-run-count/The default 100 examples in property-based testing is a social compromise, not a statistical strategy.Sun, 24 May 2026 00:00:00 GMTFuck-u-code: The Deterministic Quality Gate Your AI Pipeline Forgothttps://autotomy.dev/blog/fuck-u-code-deterministic-quality-gate-ai-pipeline/https://autotomy.dev/blog/fuck-u-code-deterministic-quality-gate-ai-pipeline/You have type checking, linting, and architecture rules. But your deterministic stack is blind to complexity, duplication, and naming disasters. Here's the $0 fix.Sat, 23 May 2026 00:00:00 GMTProperty-Based Tests in Rust Find the Bugs Your Unit Tests Misshttps://autotomy.dev/blog/rust-property-based-testing-quickcheck/https://autotomy.dev/blog/rust-property-based-testing-quickcheck/Example-based testing only covers the inputs you thought of.Sat, 23 May 2026 00:00:00 GMTWhy Version One Is Never the Problem: AI Coding and Long-Term Maintenancehttps://autotomy.dev/blog/ai-coding-why-version-one-is-never-the-problem/https://autotomy.dev/blog/ai-coding-why-version-one-is-never-the-problem/AI coding tools excel at generating version one. The real engineering challenge starts at version four, when the team needs to change something without breaking everything else.Fri, 22 May 2026 00:00:00 GMTAI-Generated Code and the Replaceability Principlehttps://autotomy.dev/blog/ai-generated-code-replaceability-principle/https://autotomy.dev/blog/ai-generated-code-replaceability-principle/The real measure of AI-generated code quality is not whether it works on day one. It is whether you can replace it on day thirty without rewriting everything else.Fri, 22 May 2026 00:00:00 GMTDeterministic Guardrails for AI Codebaseshttps://autotomy.dev/blog/deterministic-guardrails-ai-codebases/https://autotomy.dev/blog/deterministic-guardrails-ai-codebases/Human review is inconsistent. AI review is worse. The only scalable defense for AI-generated codebases is deterministic enforcement: rules that fail the build, not suggestions that get ignored.Fri, 22 May 2026 00:00:00 GMTYour Unit Tests Pass. Your Production Code Is Still Broken.https://autotomy.dev/blog/i-write-unit-tests-why-do-bugs-still-slip-through/https://autotomy.dev/blog/i-write-unit-tests-why-do-bugs-still-slip-through/Code coverage metrics create a false sense of security. Here's why unit tests miss the bugs that actually cost you sleep, and what to test instead.Fri, 22 May 2026 00:00:00 GMTRust Runtime Contracts Can Be Free in Release Builds, but the Compiler Won't Do It for Youhttps://autotomy.dev/blog/rust-zero-cost-runtime-contracts/https://autotomy.dev/blog/rust-zero-cost-runtime-contracts/Rust strips debug assertions automatically, but real design-by-contract needs more than debug_assert!.Thu, 21 May 2026 00:00:00 GMTZero, One, or Twelve: How Many Assertions a Production Function Actually Needshttps://autotomy.dev/blog/production-assertion-decision-framework/https://autotomy.dev/blog/production-assertion-decision-framework/Developers either scatter assertions like confetti or avoid them entirely.Wed, 20 May 2026 00:00:00 GMTYour validation layer is bigger than your business logichttps://autotomy.dev/blog/declarative-runtime-contracts-validation/https://autotomy.dev/blog/declarative-runtime-contracts-validation/Manual validation bloats your codebase and still misses edge cases. Here's how to enforce runtime contracts with declarative schemas that stay out of your way.Tue, 19 May 2026 00:00:00 GMTTypeScript strictNullChecks Is a Compile-Time Guard, Not a Runtime Shieldhttps://autotomy.dev/blog/typescript-strictnullchecks-runtime-nulls/https://autotomy.dev/blog/typescript-strictnullchecks-runtime-nulls/strict mode catches the nulls you write, not the nulls that arrive at runtime from APIs, DOM queries, and JSON.parse.Mon, 18 May 2026 00:00:00 GMTIn the AI Era, Code Review Becomes Specification Reviewhttps://autotomy.dev/blog/code-review-becomes-specification-review/https://autotomy.dev/blog/code-review-becomes-specification-review/When AI can generate implementation, tests, and contracts from a spec, the highest-leverage human work moves upstream.Sun, 17 May 2026 00:00:00 GMTThe AI Safety Stack: Types, Contracts, Property Tests, and Mutation Gateshttps://autotomy.dev/blog/ai-safety-stack-types-contracts-property-tests-mutation/https://autotomy.dev/blog/ai-safety-stack-types-contracts-property-tests-mutation/If you want AI-generated code to survive production, do not rely on code review alone.Sat, 16 May 2026 00:00:00 GMTMeteor Development Is Real. Your Codebase Does Not Have to Collapse With Ithttps://autotomy.dev/blog/meteor-development-is-real/https://autotomy.dev/blog/meteor-development-is-real/The meme is funny because teams really do build against moving targets, fixed launch dates, and half-decided scope.Sat, 16 May 2026 00:00:00 GMTStanford CS146S Is Right About AI Coding. The Missing Subject Is Architecturehttps://autotomy.dev/blog/stanford-cs146s-ai-architecture-gap/https://autotomy.dev/blog/stanford-cs146s-ai-architecture-gap/A Stanford CS146S review and critique: the inaugural Fall 2025 course gets AI coding right, but the missing lesson is AI architecture and replaceability.Sat, 16 May 2026 00:00:00 GMTWhy Great Engineering Ideas Stayed Niche Until AI Made Them Economicalhttps://autotomy.dev/blog/engineering-ideas-ai-economics/https://autotomy.dev/blog/engineering-ideas-ai-economics/Design by contract, property-based testing, mutation testing, and model checking were not bad ideas. They were too expertise-heavy to sustain.Fri, 15 May 2026 00:00:00 GMTFrom Vibe Code to Production: Why Your AI-Coded React Native App Needs Guardrails to Scalehttps://autotomy.dev/blog/ai-react-native-guardrails-scaling/https://autotomy.dev/blog/ai-react-native-guardrails-scaling/AI can ship your React Native MVP fast, but without guardrails each small change can break unrelated flows.Thu, 14 May 2026 00:00:00 GMTThe Vibe Coder's Guide to React Native App Lifecyclehttps://autotomy.dev/blog/app-lifecycle-resume-status/https://autotomy.dev/blog/app-lifecycle-resume-status/Your app works fine in dev, but users get a blank screen when they return after lunch. Here's the resume status pattern that handles native lifecycle properly.Thu, 14 May 2026 00:00:00 GMTWhy Your Vibe-Coded React Native App Crashes on Launch (And How to Stop It)https://autotomy.dev/blog/dependency-tiers-hard-soft-optional/https://autotomy.dev/blog/dependency-tiers-hard-soft-optional/If optional SDKs initialize like core infrastructure, they can crash your app on launch.Thu, 14 May 2026 00:00:00 GMTWhy Vibe Coding with NativeWind in Cursor Will Break Your React Native App at Scalehttps://autotomy.dev/blog/nativewind-vs-stylesheet-contract/https://autotomy.dev/blog/nativewind-vs-stylesheet-contract/You shipped an MVP in a weekend with Cursor, but now changing one color breaks 47 files. Here's the styling contract that stops the bleeding.Thu, 14 May 2026 00:00:00 GMTWhy Claude Code Should Not Review Your Code (And What to Use Instead)https://autotomy.dev/blog/o1-guards-vs-llm-reviews/https://autotomy.dev/blog/o1-guards-vs-llm-reviews/LLM code review is non-deterministic, slow, and misses architectural violations. Here's the O(1) guard stack that actually keeps your code clean.Thu, 14 May 2026 00:00:00 GMTDelete, Do Not Migrate: The Refactoring Strategy for Vibe-Coded React Native Appshttps://autotomy.dev/blog/refactor-by-replacement/https://autotomy.dev/blog/refactor-by-replacement/Refactoring AI-generated code means reverse-engineering intent you never had. Here's the interface-driven replacement pattern that makes deletes safe.Thu, 14 May 2026 00:00:00 GMTHow Cursor and Claude Code Destroy Your React Native Architecture (And How to Fix It)https://autotomy.dev/blog/service-boundaries-composition-root/https://autotomy.dev/blog/service-boundaries-composition-root/AI-generated auth feels fine until a new feature reaches into the wrong service.Thu, 14 May 2026 00:00:00 GMTWhy Deep Links Crash Vibe-Coded React Native Apps (And How to Validate Them with Zod)https://autotomy.dev/blog/url-validation-expo-router/https://autotomy.dev/blog/url-validation-expo-router/Deep links, push payloads, and shared URLs are all untrusted input.Thu, 14 May 2026 00:00:00 GMTuseSyncExternalStore: The React Hook That Saves Your Vibe-Coded App From State Bugshttps://autotomy.dev/blog/useSyncExternalStore-pattern/https://autotomy.dev/blog/useSyncExternalStore-pattern/Stop writing useEffect subscriptions that leak memory and miss state updates. Here's the React 18 pattern for bulletproof external state.Thu, 14 May 2026 00:00:00 GMT