Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
YouTube Security VideosAndroid Police: Samsung is smashing records! #shorts #tech #phones(21.09.2026 um 13:55 Uhr)
YouTube Security Videosheise & c't: Bundesnetzagentur wollte diesen Futterautomaten verbieten(21.09.2026 um 13:53 Uhr)
YouTube Security VideosNeil Patel: Your Google Traffic Isn't An Asset It's A Loan #shorts(21.09.2026 um 14:05 Uhr)
Windows Tipps & SecurityF-14 A Tomcat Top Gun endlich als Revell Klemmbausteinmodell erhältlich(21.09.2026 um 14:27 Uhr)
Sichere ProgrammierungShow the Hand-Back Sample Before Approving an Agent Score(21.09.2026 um 14:15 Uhr)
Sichere ProgrammierungHybrid retrieval in one Postgres query: RRF over tsvector + pgvector(21.09.2026 um 14:15 Uhr)
YouTube Security VideosAndroid Police: Samsung is smashing records! #shorts #tech #phones(21.09.2026 um 13:55 Uhr)
YouTube Security Videosheise & c't: Bundesnetzagentur wollte diesen Futterautomaten verbieten(21.09.2026 um 13:53 Uhr)
YouTube Security VideosNeil Patel: Your Google Traffic Isn't An Asset It's A Loan #shorts(21.09.2026 um 14:05 Uhr)
Windows Tipps & SecurityF-14 A Tomcat Top Gun endlich als Revell Klemmbausteinmodell erhältlich(21.09.2026 um 14:27 Uhr)
Sichere ProgrammierungShow the Hand-Back Sample Before Approving an Agent Score(21.09.2026 um 14:15 Uhr)
Sichere ProgrammierungHybrid retrieval in one Postgres query: RRF over tsvector + pgvector(21.09.2026 um 14:15 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

What a real AI-assisted PR looks like

Ahnii! A lot of AI coding content ends too early. The model writes a patch. The patch looks plausible. A few tests pass. Someone posts a screenshot and calls it proof. That is not the part I care about. What I want to know is whether…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Ahnii!



A lot of AI coding content ends too early.



The model writes a patch. The patch looks plausible. A few tests pass. Someone posts a screenshot and calls it proof.



That is not the part I care about.



What I want to know is whether an AI-assisted change can survive the whole engineering process: audit, review, CI, static analysis, contract repair, docs drift, and merge.



PR #1022 was the first pull request in Waaseyaa where that full chain played out end to end.






The Invariant



The bug looked small: pipeline navigation in the admin SPA was non-deterministic.



Whether the pipeline link showed up depended on whether a mount-time request happened to succeed. If a board-config request failed for incidental reasons, the UI could act like the entity type had no pipeline at all.



That is not just a UI bug. That is a contract problem.



The invariant was simple:




Pipeline navigation visibility must be a pure function of runtime.catalog actions.




If the catalog entry declares board-config, show pipeline navigation. If it does not, do not. Request failures do not get to define capability truth.






The Workflow



The first step was not refactoring. It was audit.



I had the model inspect only the affected surfaces, identify exactly where visibility depended on incidental request failure, state the minimal deterministic invariant, and identify the contract boundary that had to be restored.



That exposed the real issue quickly: the problem was not only in the component. The admin runtime was also dropping actions when it built the runtime catalog. Once that contract data disappeared, the UI fell back to probing with runAction().



After that, the first patch was straightforward:




  • remove mount-time probing from NavBuilder.vue

  • preserve actions in the runtime catalog

  • add tests proving visibility comes from declared catalog actions



If this were a typical AI coding story, that would have been the end.



It was not.






Where The PR Got Interesting



Review found another component, EntityViewNav.vue, still violating the same invariant. So the first fix was only partial.



Then CI started surfacing deeper inconsistencies:





  • nuxi typecheck exposed an admin catalog type surface that no longer matched runtime reality


  • build:contracts failed because the admin contract build crossed a package boundary it should not have crossed

  • PHPStan failed on a dispatcher contract mismatch elsewhere in the repo

  • spec drift failed because the architecture docs now lagged behind the code



This is the part I think people miss about AI-assisted development.



The value is not that the model gets you to the first patch faster. The value is whether you can keep following the consequences after that patch lands.



A serious workflow does not treat those as annoying side failures. It treats them as the remediation chain.






What Merged



By the time PR #1022 merged, it had gone through:




  • invariant audit

  • deterministic refactor plan

  • initial implementation

  • review-discovered residual drift

  • follow-up invariant enforcement

  • runtime contract restoration

  • type-surface repair

  • contract build repair

  • PHPStan repair

  • spec drift repair

  • merge



That is why this PR matters to me.



It is the first one in this workflow that exercised the whole model instead of just one slice of it.



The model is not “AI writes code and I tidy it up.”



The model is:




  • define the invariant

  • constrain the agent to the governed surface

  • audit before refactor

  • keep the refactor minimal

  • review adversarially for drift

  • treat CI failures as evidence

  • repair every broken surface the change exposes

  • merge only when the whole chain is green






What I’m Learning



The biggest lesson is that the first answer is rarely the interesting one.



The interesting part is whether the system can keep reasoning correctly after the easy fix is in. Can it preserve the invariant through review? Can it repair the contract without weakening it? Can it follow the consequences into docs and verification instead of pretending those are separate tasks?



That is where trust gets built.



AI is awesome. More awesome than a lot of people realize. But not because it can one-shot production code from a prompt.



It is awesome when you put it inside a disciplined engineering model and it helps you push a real change all the way through the system without losing the thread.



That is what I am trying to build in public right now.



Not a demo.



An operating model.



Baamaapii

Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten What a real AI-assisted PR looks like

Thematisch verwandte Begriffe: What, real, AIassisted, looks · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-94097 | A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. Th…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick