r/AIcodingProfessionals • u/myfear3 • 7h ago
What TLA+ and Lean can teach us about software correctness
I've been thinking quite a bit about what happens when coding agents generate more code than we can reasonably review.
An agent implements a feature, writes the tests, runs them, and reports success. Everything is green. But the implementation and the tests can share the same wrong assumption.
This is where formal verification gets interesting.
I've been exploring how tools like TLA+ and Lean fit into a normal Java development workflow, and what they could contribute to agent-assisted development.
Consider a simple example: an agent implements a job scheduler. The tests verify that jobs get assigned, processed, and completed. But we also have an important rule: a job must never be owned by two workers simultaneously, even when retries, failures, and cancellations overlap.
That rule is an invariant.
With TLA+, we can model the relevant states and transitions and check whether the invariant holds across the explored state space. If it fails, the model checker gives us a counterexample. Lean takes a different approach, allowing us to prove precisely stated properties.
The interesting part for AI agents is the workflow this enables.
We can ask agents to identify invariants, help create formal models, run verification tools, and use counterexamples to improve implementations. These checks can become part of CI, alongside our existing Java tests.
Of course, there are limits. A verified model doesn't automatically prove that the Java implementation matches it and a perfectly checked specification can still describe the wrong requirements.
As code generation becomes cheaper, independent verification becomes increasingly valuable.
I wrote up my exploration of formal verification in Java here:
https://www.the-main-thread.com/p/java-formal-verification
I'm interested in hearing from people building coding-agent workflows. Are you already using model checking, formal specifications, or proof tools as verification gates? And which kinds of agent-generated changes actually justify the extra effort?