Heseltine Tutu

Attest Code Independent Verification for AI-Generated Code AI coding tools can generate code, identify vulnerabilities, and propose fixes, but a critical problem remains: how do we independently establish that the generated code actually works and satisfies its security requirements? Attest Code addresses this trust gap by introducing an independent verification layer for AI-assisted software development. Its core principle is simple: a generator cannot be its own verifier. Developers define and approve explicit software requirements, called invariants. Attest Code evaluates code against these human-approved requirements and produces evidence-backed outcomes: PASSED, FAILED, or INCONCLUSIVE. A reproducible violation results in FAILED, while crashes, timeouts, and incomplete execution produce INCONCLUSIVE rather than being incorrectly treated as proof of failure. The project also integrates Meta Muse Spark to diagnose verification failures and propose potential code changes. However, the model cannot approve requirements, determine verification outcomes, or apply repairs automatically. Its suggestions are explicitly marked as unverified proposals. A human must review any proposed change, after which Attest Code independently verifies the resulting code again. The demonstration uses controlled application fixtures to illustrate this process, including a vulnerable implementation, a repaired implementation, and an execution failure. Attest Code aims to make AI-assisted software development more accountable by separating code generation from verification and grounding trust in explicit requirements and independently evaluated evidence rather than AI-generated assurances.