Verification playbook
AI code review checklist: verify generated code before it ships
A practical checklist for reviewing AI-generated code: contracts, edge cases, state ownership, tests, failure paths, and the smallest safe fix.
6 min read · Updated August 2026
Start with the contract, not the syntax
Generated code is often locally plausible and globally wrong. Write down what the function must accept, reject, preserve, and return before editing it.
- Which inputs are valid but unusual?
- Which values are intentionally empty, zero, false, or null?
- Which caller assumptions must remain stable?
Run the original code once
Do not fix on sight. Run the current tests first so the failure becomes evidence, not a guess. Record the first failing case, expected value, and received value.
A strong review distinguishes the observed failure from the suspected cause.
Check the AI-era failure modes
- Truthiness: valid values such as
0,false, or an empty string are rejected. - Async ownership: an older response overwrites newer state.
- Silent defaults:
value || fallbackreplaces an explicit value. - Partial validation: the happy path is checked while malformed or missing fields pass through.
- Scope expansion: the patch changes more behavior than the request required.
Prove the smallest safe correction
Add or identify a test that fails for the bug and passes after the correction. Then make the narrowest change that restores the stated contract without rewriting unrelated code.
Re-run the full public suite. A passing new test is useful only if existing behavior still passes.
Start with evidence