Verification and durable tool boundaries are becoming core engineering work for AI coding systems

Security papers keep adding explicit checks before an agent acts on a diagnosis. Verify Before You Fix requires execution evidence before repair. That cut unnecessary repairs by 73.13% and removed 61.24% of false positives in the full pipeline, while resolving 69.74% of vulnerabilities end to end. VulWeaver improves the earlier analysis step itself by repairing missing program semantics and extracting wider context; it reports F1 0.75 on PrimeVul4J, F1 0.78 on C/C++, and 26 true vulnerabilities found across nine Java projects, with 15 confirmed by developers.

One of the clearest engineering results is below the model layer. Resilient Write treats file mutation as a failure-prone system boundary and adds six protections: risk scoring, atomic writes, resumable chunking, typed errors, scratch storage, and cross-session handoff. In the reported case study, write attempts fell from 6 to 2. Recovery time dropped to 2.0 seconds from 10.0 for a naive baseline, estimated data-loss probability fell to 0.1%, and self-correction rose to 65%. This fits the recent pattern in the corpus: agent quality depends on the reliability of the harness around the model, not only on better prompting.

Another strong theme is verification through generated tests. The specification-inference paper uses an LLM to write counterexample JUnit tests for suspicious postconditions, then reruns inference on the expanded test suite. On 43 Java methods, GPT-5.1 removed 1,877 invalid assertions and improved precision to 74.17% with no recall loss; DeepSeek-R1 removed 2,173 invalid assertions. A broader review paper makes the same point at the discipline level: software engineering work now centers more on intent, orchestration, and systematic verification, because code generation is easy to trigger but hard to trust without checks.