How to verify AI-generated code

To verify AI-generated code, start from the requested behavior and finish with reproducible evidence. Do not begin by asking a second model whether the patch looks good. That can help triage risk, but it cannot establish that the software works.

1. Freeze the task and revision

Write down the requested outcome, the repository revision before the run, and the exact agent change. If the task is ambiguous, record the ambiguity instead of allowing the verifier to silently choose a friendlier interpretation.

2. Identify the behavioral boundary

Name what users or callers can observe: a browser state transition, an API response, an authorization denial, a persisted record, or a regression that must remain fixed. Prefer checks against this boundary over checks that merely mirror the implementation.

3. Run the smallest authoritative checks

Use repository-owned tests and commands first. Add a focused browser or API check when the existing suite does not exercise the changed behavior. Capture the command, environment, exit state, and bounded output. A passing command without identity or context is weak evidence.

4. Separate failures

Distinguish an agent regression from an existing repository failure, an environment problem, a timeout, and an unverified requirement. This prevents infrastructure noise from becoming a false product verdict.

5. Package the evidence

Bind the task, change, checks, outputs, artifacts, and verdict into a machine-readable bundle. A reviewer should be able to answer: what ran, against which revision, what changed, what failed, and what remains unknown?

6. Re-check after a fix

A fix is not complete because the diff changed. Re-run the failing check and the smallest relevant regression set. Preserve both the failure and the later pass so the evidence shows closure rather than only the final state.

CodeVetter follows this task-to-evidence shape and is designed to fail closed when required evidence is absent. Its current public benchmark demonstrates a narrower recognition task and publishes its own limitations; it should not be read as a production-wide guarantee.

CTA: Use the checklist with your next agent patch, then inspect how CodeVetter structures verification evidence.