Formally verifying agent-written full-stack web apps with PDD Kit

Coding agents now dump features measured in tens or hundreds of thousands of lines. Line-by-line review does not scale, and agent-written tests often certify what the agent built rather than what you asked for.

Proof-Driven Development Kit, running inside GitHub Next's Chopin planner, works with teams in plain language, records an intent artifact, emits Verus formal specs where possible, proves agent code against those specs, and labels empirical tests as evidence rather than proof for the trusted computing base left outside the verifier.

On Pet Store — a ~5,000-line Rust Axum/SQLite/Leptos full-stack app — researchers verified login so a token requires the right password and only admin accounts get admin tokens, without the developer reading generated code line by line.

We're watching this as one of the few serious answers to agent code volume that is not "add more reviewers."

PDD Kit's discipline is the decision cards. "Only with the right password" is satisfied by a login that refuses everyone; the converse — the right password always works — closes the hole. Formal methods specialists always knew that; everyday engineers rarely get asked. Intent maps, mental models, and explicit trust cards for bcrypt, sqlx lookups, JWT signing, and the clock make the Trusted Computing Base visible instead of vibes.

Verus proves login_flow and its pieces for every input under the contracts; mutation testing plants one bug per ensures clause so weak "vibe verification" specs that prove nothing get caught. CI gains a Verus check via pdd-ship and can prune tests that only rehash proved properties. That is how review shifts from diffs to intent — and how agents are finally forced to keep the plan.

I want this path for login, payments, and permissions first. The downside is honest in the post: Rust-only today, proofs still cost effort, and guarantees are only as strong as the trusted wrappers. Overclaim "fully verified" and you recreate the false confidence problem with prettier math. Useful agent coding needs contracts with teeth. This is a research prototype pointing the right way.

PDD Kit is a collaboration across Microsoft Research Catalyst, GitHub Next, and RiSE, building on Verus co-developed with a wide academic consortium. Spec Kit is the Spec-Driven Development cousin; PDD adds mechanical enforcement.