Development

July told you verification was the throughput limit. August did something less romantic and more useful: it built the machinery. Vercel published an actual operating manual for a software factory - specialised agents in isolated sandboxes, and every run terminating in one of four states: success, flawed, blocked, manual. Only `success` ships. The other three are not failures, they are routing instructions, and each points at a different repair: better prompts and evals, a missing environment, or a boundary drawn in the wrong place. Addy Osmani took that taxonomy and named the thing it measures - a verification budget - and made the trade explicit: when agent velocity outruns your capacity to check the work, you have exactly three levers, and two of them are unpleasant.

The month's sharpest reversal is in testing. Birgitta Böckeler ran TDD inside the agent loop and found that non-TDD solutions consistently beat TDD ones, at three to eight times fewer tokens - because an agent told to write the test first makes locally-minimal decisions around that first test and hardens a bad design early. TDD's real benefits, she argues, are human ones: fear management, forced pacing, permission to relax. Machines do not feel fear. Her sample is five batches and she says so plainly, so take it as a provocation rather than a verdict - but the direction it points is already supported: stop mandating the *process* and measure the *outcome*. Mutation testing is the obvious instrument, and the number that should end the coverage argument is a component with 100% line coverage and 61% mutation strength. Meanwhile 31% of accepted AI completions are deleted within fifteen minutes, so acceptance rate joins coverage in the vanity pile.

One correction to last month's edition, because it matters. July's news was Claude Code flipping its default permission mode to Manual. On August 14 it flipped back to auto - but the honest reading is not "the industry gave up on control". Developers approve 97% of permission prompts; humans caught 13.6% of dangerous commands where a classifier caught 89%. What replaced the human click was not the classifier alone but a declarative ruleset that outranks it: `permissions.deny` cannot be overridden by the classifier or by stated intent, and auto mode stays opt-in on Enterprise and the API. The maturity signal moved accordingly. It is no longer whether a human is in the loop, and it is not the classifier either. It is whether your autonomy policy is written down, version-controlled and reviewed like any other production config.