Prove: Review, Tests and Verification

All courses / AI Developer / Module 2 / Chapter 9

Learning objectives

After the lesson the participant can:

• Explain which question each layer of checking answers and who should write it
• Apply the three rules of an independent oracle: authorship, source and protection
• Design review so that it stays real under rising volume, using size limits, budgets, queue caps and seeded defects
• Draft a verification plan with an independent oracle and a named steward

Key concepts

The strength of the oracle

Testing is a set of layers (static analysis, example-based tests, property-based tests, mutation score, formal models, human review), each answering a different question. The strength of any pass is the strength of the oracle behind it.

Authorship, source and protection

The three rules of independence: the oracle is written or approved by someone other than the author of the change; it is derived from a source the implementation was not derived from; and the tool that produces the change has no permission to edit the oracle, review rules or gates.

The volume problem

When generation is cheap, review capacity bounds the merge rate. The chapter's own arithmetic leads to a choice between a visible cap on what is merged and an invisible thinning of the review each change receives.

Seeded defects

Known defects added by the quality function to a sample of changes, to measure how many each check catches. They are how independence and review quality are shown rather than asserted, and they are reported in aggregate.

AI as reviewer

A system that reads a diff and writes comments. Three limits are architectural: blind spots correlated with the generator, context it cannot see, and comments that look like approval. It is a useful additional check when evaluated like one and never counts as the human review.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The chapter says the value of review for the stewardship principle is that it creates a second person who can explain the change. How often does your review achieve that?
2. Between a visible cap on merges and an invisible thinning of review, organisations tend to drift to the second. Who in your organisation would have to agree to the first?
3. Oversight-quality figures such as approvals within seconds are reported in aggregate and agreed with staff representatives. Why does the chapter insist on both conditions?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. What does the rule of protection require of an independent oracle?

   1. That the oracle is stored in an encrypted repository with restricted read access
   2. That the oracle is rewritten whenever the model behind the tool changes
   3. That the tool producing the change cannot edit the oracle, the review rules or the gates
   4. That the oracle is reviewed by a second AI model from a different provider before each merge
   Show the answer

   C. That the tool producing the change cannot edit the oracle, the review rules or the gates
   Protection is the third rule after authorship and source: the generator of the change cannot edit what checks it. The rules make the oracle's errors different from the generator's, which is what independence means.

2. What does the duplicated-settlements incident at Hansa Mutual (INC-HM-2029-0207) show, according to the chapter?

   1. That generated COBOL is less reliable than generated Java in payment paths
   2. That a review without independence fails even when nobody used AI at all
   3. That mutation testing would have been too slow for the quarter-end batch
   4. That two approvers are always sufficient for a security-critical change
   Show the answer

   B. That a review without independence fails even when nobody used AI at all
   The reviewer was the only other person who knew the module, so reviewer and author shared the same knowledge and the same gaps. The review passed and 312 claims were paid twice, with no AI involved.

3. In the chapter's division of labour, who should write a property-based test?

   1. A person, working from the specification and not from the code
   2. The assistant that generated the change, in the same session
   3. The platform team, once, as a fixed rule for all repositories
   4. A specialist in formal methods, together with the product owner
   Show the answer

   A. A person, working from the specification and not from the code
   The table assigns property-based tests to a person who derives the rule from the specification, not from the code. The platform team writes static analysis rules, and a specialist writes formal models.