PDD Kit moves review of agent-written code from lines to specifications

Microsoft Research and GitHub Next demonstrated a prototype that turns developer intent into a Verus specification and builds machine-checked proofs for Rust code. The stronger assurance applies only inside an explicitly defined trust boundary.

Five thousand lines of Rust became the test case

PDD Kit runs inside the Chopin planning environment. It asks developers questions, turns their answers into a readable intent map and formal specification, then has an agent write both code and proof. Verus and the Z3 solver deterministically decide whether the proof holds.

The team demonstrated the process on Pet Store, a web app of about 5,000 lines of Rust. It formally verified login logic and its relationship to accounts and roles. A 2-sentence request became 8 conditions on the main login flow. The authors say checks usually take seconds for a small module and minutes for larger code.

People review the contract instead of every generated line

The practical change is where review happens. Developers approve intent, ambiguous interpretations, and the formal specification. An agent writes implementation and proof, but another model does not judge validity. Verus does that during the build and later in CI.

This could help when agents produce more code than line-by-line review can absorb. PDD Kit also plants one mutation for every specification clause. If the verifier fails to reject it, the clause is too weak and returns for repair.

The proof stops at databases, cryptography, and clocks

Calling the whole application formally verified would overstate the result. Verus currently verifies Rust only, and the demo cannot inspect bcrypt, SQL queries, token signing, or the system clock. The developer approved 6 trusted components covered by tests rather than proof. Every guarantee also depends on the specification being correct.

The authors label PDD Kit a research prototype. The demonstration covers login logic in one app and provides no measurement of the long-term cost of maintaining proofs in a large product.

A foreign Rust codebase will reveal the price of assurance

The key test is whether other teams can maintain specifications during rapid change and keep the trust boundary from growing faster than verified code. Availability outside Chopin and support for more languages will matter too.

Good first targets are narrow areas with expensive failures, such as login, permissions, or payments. If PDD Kit reduces regressions without making developers spend most of their time explaining programs to the verifier, this review model has a chance.

Lilith's verdict

An agent can produce 100,000 lines behind a closed door. PDD Kit asks a person to inspect the contract first, then makes the verifier stop any code that breaks it.