research · v0.1 · Active — Wave 1.9 adoption landed (mutation rung, format rung, per-repo verify commands); pareto preregistered, not yet executed

Latency to Quality — the Classical Toolchain, Adapted for the AI Era

Optimizing latency to quality code through the primary operations of read, analyze, and write — and everything else that happens around the code. The checkpoint stack human developers built (lint, format, typecheck, hooks, CI gates, security, supply chain, mutation, SDD) is not obsolete under AI authorship — it is the verification substrate the AI era depends on. Catalog + DAG economics + transfer matrix + the Wave 1.9 verify-stack adoption.

published 2026-08-02 · updated 2026-08-02
authors: Nexartis
tags: classical-tooling · CI-CD · quality-gates · verify-ladder · mutation-testing · linting · typecheck · git-hooks · SDD · latency-to-quality

Thesis

Human developers spent forty years building a checkpoint stack around the edit loop — formatters, linters, type checkers, git hooks, CI quality gates, security scanners, supply-chain automation. That stack is not obsolete when AI writes the code; it is the verification substrate the AI era depends on. AI code violates conventions (models default to mainstream patterns from training data), references methods that don’t exist, writes tests that game line coverage, and ships 3× faster than review can keep up. Mechanical gates are the only thing that scales with that velocity.

Speed and quality are not a trade-off at the current frontier — they come from the same architectural moves (batch edits, fast-apply, deterministic codemods, parallel search; see /research/agentic-velocity). What the classical catalog adds is the verification half: the gate order, the gate thresholds, and the verify ladder that turns generated code into shipped code with measurable confidence.

Optimizing latency-to-quality therefore means two things: (1) put every check at the cheapest layer that can catch its error class, and (2) make the checks deterministic where determinism works, and reserve LLM judgment for exactly where it doesn’t — with no silent fallback between them (workspace §2).

The classical toolchain — curated catalog

Eleven categories, each with the canonical tools, purpose, and the AI-era verdict. The full per-tool latency classes and optimal applications live in the workspace doc _WORKSPACE-DOCS/ROADMAP-20260802-classical-tooling.md.

CategoryToolsPurposeAI-era verdict
Linting & static analysisESLint (+ typescript-eslint), Biome, Oxlint, Ruff, golangci-lint, semgrep, actionlintRule-based error/convention catching; the cheapest first gateNon-negotiable; the Rust consolidation (Biome 56×, Ruff, Oxlint) matters doubly for agents — sub-second gates keep the agent loop fast. Zero errors on changed lines, auto-fix what is auto-fixable.
FormattingPrettier, Biome format, Black, gofmt, rustfmt, clang-formatCanonical formatting, review-noise eliminationPurest "deterministic where determinism works" case. Adopted in Wave 1.9 as the write-mcp format rung (runFormatStep) so morph-routed writes land canonical before the lint rung.
Type checkingtsc --noEmit, svelte-check, pyright/mypy strict, compilersCross-file invariants; catches hallucinated method/argument referencesVerify-ladder rung 1 — already first-class. Full-project tsc in pre-push/pre-merge, not pre-commit (staged typecheck is misleading).
Git hooks & commit disciplinehusky, lint-staged, lefthook, pre-commit, commitlint, gitleaksAuthor-time checkpoint; seconds not CI minutesTransfers directly — and for agents it is the first teachable gate (commit → hook tells it what to fix). Typecheck to pre-push; parallel hooks (lefthook) cut wall-clock.
Testing & test-quality measurementvitest/jest/pytest, c8/istanbul, Stryker/PIT/Mutmut, property-basedBehavioral verification; honest test-quality sensingLine coverage is gameable by AI-generated tests (tests that "assert nothing throws"). Mutation score is the truth-teller. Wave 1.9: mutation-score rung (rungs_1_5) with survivors routed back to the subagent as targeted test-fix input. Baseline: roadmap-data.ts 63.21%.
Build & task orchestrationMake, Just, go-task, Mise, Turborepo/Nx affected, Nix flakes, Bazel, act/actrun, EarthlyDAG substrate; reproducible local/CI parityTask DAG is machine-readable — double value for agents. act-style local CI lets the agent reproduce the gate before opening the PR. Hermetic builds (Nix/Bazel) fix "the model changed" drift.
CI/CD pipeline & quality gatesGitHub Actions, Addy Osmani 9-step, Autonoma 5-layer, Motomtech 5-gate, Tomoda mechanical gates, Shiplight behavioral gate, FutureAGI 4-stage, Zylos 5 gatesThe gate ordering economics: cheapest rung that catches its error class firstThe consensus shape: keep classical gates, add a PR-time behavioral verification gate (an agent writes code AND its tests from the same misreading — a green suite proves self-consistency, not correctness), gate on merge_group, and for agent codebases lint prompts-as-code + offline eval gates + cost regression.
Security & supply chaingitleaks, semgrep/CodeQL, trivy/grype, osv-scanner, dependabot/renovate, syft SBOM + cosign, SLSA/EPSSCode security + dependency provenanceSame gates, 3× code → 3× gates. The pipeline is now the attack surface (2026-03 trivy-action compromise: pin actions to commit SHAs). Plus new: pin models, pin eval sets, SBOM for prompts.
Diff, review & structural toolsgit diff / apply_patch V4A / udiff, difftastic, mergiraf, ast-grep/comby/jscodeshift, ctags/LSP/SCIP, reviewdog/danger, CodeRabbit/Copilot Review/GreptileThe language of change; structural rewriting; review plumbingStructural tools are the load-bearing deterministic core; agentic code review is a complement, not replacement (empirical caveat: arXiv 2607.03316). mergiraf structural merge is the top AI-era merge tool (ozzydev D2 build track).
Terminal & data power toolsripgrep, fd, fzf, bat, jq/yq, direnv, mise, watchexec/entr, hyperfine, GNU parallelRead-side accelerationAlready called as shell commands; the gap is routed wrappers with receipt + rollback (edit-power-tools class 9).
Spec / requirements as code (transitional)AGENTS.md/CLAUDE.md, SDD, EARS-style criteria, GitHub Spec Kit, Kiro spec modeThe read-side input AND the verify-side contractThe bridge to the agent-native world: spec is the sovereign artifact with verification criteria first (maps 1:1 onto tests). 96% of devs distrust AI code but only 48% verify (Sonar 2026); specs make review "compare against a documented contract".

The pipeline as a DAG — ordering economics

The classical stack composes into a DAG with one invariant: each stage is the cheapest gate that can catch its error class, and every stage’s output feeds the next.

pre-commit (ms–s)        pre-push / merge queue (s–min)    post-merge (min)        scheduled (nightly)
lint-staged (staged)      full tsc --noEmit                  integration tests         full mutation sweep
format --check            lint (full) + security (fast)      perf-regression gate      full vulnerability scan
secret scan (gitleaks)    commitlint                         behavioral/agentic E2E    SBOM + SLSA re-verify
commitlint                coverage + mutation (changed)      cross-repo contract       renovate bump PRs
                          SAST (semgrep/CodeQL)              smoke + deploy gates      action SHA-pin audit
                          build (hermetic)
                          agentic code review

The reference DAGs in the wild (Addy Osmani 9-step no-skip; Autonoma 5-layer with path-filtered risk; Motomtech 5-gate; FutureAGI 4-stage agent CI; Zylos 5 agent-native gates) all converge on the same rule, restated as this paper’s thesis above.

AI-native analysis — what transfers, what breaks, what is new

Three shifts change the calculus when the author is an agent:

  1. Authorship assumption breaks. "Traditional code review assumes the author understands the diff. With vibe-coded PRs, that assumption breaks" — gates must catch what review can’t (type errors, unverified behavior, regressions).
  2. Volume triples. "AI ships three times more code, so you run three times more gates" — gates must be cheap per unit of code (Rust-toolchain consolidation, staged scoping).
  3. The writer and the tester are the same model. Code and tests are authored in the same pass from the same misreading — a green suite proves self-consistency, not correctness. The behavioral gate and mutation score are the antidotes.
Classical categoryAI-era verdict
Lint / format / typecheckTransfer — more important (deterministic rungs 1–2)
Git hooksTransfer — author-time checkpoint, teachable gate
Line coverageTransfer but demoted — baseline only, gameable by AI tests
Mutation testingTransfer — promoted: the honest test-quality sensor
CI quality gatesTransfer — extended with behavioral gate + merge_group
Task runners / hermetic buildsTransfer — DAG substrate; reproducibility
Security scanningTransfer — 3× code → 3× gates; pipeline is attack surface
Supply chainTransfer — renovate drip, SBOM, + pin models/eval-sets
Structural diff/mergeTransfer — promoted: mergiraf, rerere-as-a-service
Agentic code reviewNew category — LLM complement with measured fix-rate
Spec-as-code (SDD)New category — the sovereign artifact
Prompt-as-code lintingNew category — prompts are code: lint, version, eval-gate

The through-line: deterministic where determinism works (format, lint, type, codemods, structural merge, mutation, secret scan), LLM where determinism structurally fails (review judgment, eval rubrics, behavioral testing, spec synthesis), never silent fallback, and receipts and provenance everywhere — because when "the model changed" is the bug, the record of what ran, on what inputs, by which model/skill version is the only trustworthy review input (ADR-009).

Wave 1.9 measurements

MeasurementValue
Mutation baseline (Wave 1.9, first scoped run)roadmap-data.ts → 63.21% (280 killed / 163 survived / 443 mutants), 56s, report at console/reports/mutation/mutation.json
Toolchain latency (console/, 5 warm runs each)ESLint median ~3.00s vs Oxlint v1.76 median ~0.87s (~3.4×) — DECISION: keep ESLint (Oxlint lints 0 .svelte files, 0 diagnostics vs configured rule set)
Verify-ordering paretoEXECUTED (2026-08-03): n=30 synthetic-but-measured corpus (real commands/durations, simulated error distribution). Verdict: current ordering ON the frontier — best arm (lint-first) 1.279 err/s vs current 1.246 err/s (+2.6%, below the 15% displacement threshold). Null parity; no reorder. Live corpus (165+ receipts) still all incomplete — a corpus-readiness watchdog (`bench/check-pareto-corpus.mts`) now reports usable-count vs the n≥20 target.
Behavioral verification rungLANDED 2026-08-03 (rung 6, `rungs_1_6`, Shiplight pattern): behavioral gate in the verify ladder (`rung6_behavioral_cmd` per-repo config; Playwright smoke surface for the console). Open operator questions before making it a default harness rung: port isolation, task-class default scope, env-vs-impl failure classification.

Wave 1.9 adoption (roadmap wave 1.9 — verify-stack SoTA)

  • Per-repo verify command resolution in the write-router — config.verify.verify_commands[<repo>] with basename normalization and top-level fallback; rung3/rung4 no longer hardcoded null (unlocks full-suite experiment verdicts). Applied in both the primary and splice-preflight ladder paths.
  • Format rungrunFormatStep runs a configured format_cmd with {paths} substitution after apply, before the ladder (the morph→prettier friction fix); recorded in stage latencies, never a verify rung.
  • Mutation-score rung — new 5th rung (rungs_1_5 ladder), rung5_mutation_cmd + mutation_report_path + mutation_threshold; parses both classic and Stryker 9 report schemas, fails loudly on missing report or below-threshold score. extractSurvivors() returns structured survivors (file, line, mutator, replacement, reason) as prompt-ready evidence for test-fix agents — closing the loop between mutation score and actionable test work.
  • Console Stryker wiring@stryker-mutator/core + vitest-runner, stryker.conf.json (vitest runner, src/lib/** mutate, incremental, json reporter), test:mutation script, gitignore/eslint ignores for the sandbox. Baselines: roadmap-data.ts 63.21%.
  • Behavioral verification rung (Wave 1.9 follow-up, Shiplight pattern) — rung 6 behavioral in the write/harness verify ladder (rungs_1_6 ladder), rung6_behavioral_cmd per-repo config with a Playwright smoke surface for the console; honors continue_on_failure and haltOnFailure like the other rungs. The "agent writes code AND its tests from the same misreading" gap now has a gate.
  • Corpus-readiness watchdogbench/check-pareto-corpus.mts reports usable vs the n≥20 pareto target against the live receipt corpus (live smoke: NOT-READY, 0/200 usable — all historical runs recorded pre-continue_on_failure).

Next steps

  1. Execute the verify-ordering pareto (preregistered, paper_slug verify-ordering-pareto) on the LIVE corpus once it reaches n≥20 usable (complete per-rung) receipts — the corpus-readiness watchdog bench/check-pareto-corpus.mts reports the shortfall. Synthetic-but-measured execution (2026-08-03) already returned current-on-frontier null parity.
  2. The behavioral verification gate (Shiplight pattern, merge_group-triggered) is LANDED as verify rung 6 (rungs_1_6) with a Playwright smoke surface; the remaining work is the operator decision on making it a default harness rung (port isolation, task-class default scope, env-vs-impl failure classification).
  3. Wire survivor → subagent feedback into the harness dispatch prompt (extractSurvivors output as targeted test-fix input), gated on the mutation rung below threshold.
  4. Prompt-as-code linting + offline mini-eval gates for the skills/KYM artifacts (Zylos Gate 1–3, FutureAGI Stage 1), mapped onto the AgentDefinition schema.
  5. GitHub Actions audit — SHA-pin actions, scope tokens, review pull_request_target (the 2026-03 trivy-action compromise is the live warning). The three third-party actions in validate.yml were SHA-pinned on PR #18; the audit of the remaining workflow surfaces is the follow-up.

Sources

  1. Autonoma — Quality Gate for Vibe-Coded PRs (5-layer reference stack, YAML)
  2. Shiplight — CI/CD for Agent-Written Code (PR-time behavioral gate)
  3. Motomtech — Quality Gates for AI-Generated Code (5-gate stack)
  4. Tomoda Hinata — Designing quality gates for AI-driven development (mechanical gates)
  5. FutureAGI — CI/CD for AI Agents: Best Practices 2026 (4-stage agent CI, pinning)
  6. Zylos — Agent-Native CI/CD (5 gates, prompts-as-code)
  7. AgentMarketCap — Agent Gates Are Reshaping CI/CD
  8. Microsoft Foundry — CI/CD for AI Agents (reference architecture)
  9. Addy Osmani agent-skills — quality gates in CI/CD automation (9-step pipeline)
  10. Biome — single Rust toolchain (56×; 0.8s vs 45.2s lint, 0.3s vs 12.1s format)
  11. ESLint v10 (2026-02, flat-config-only)
  12. PkgPulse — husky vs lefthook vs lint-staged (2026 adoption + parallel hooks + tsc caveat)
  13. Imperialis — Mutation Testing: Beyond Code Coverage in 2026
  14. Augment Code — Mutation Testing for AI-Generated Code (score as acceptance gate)
  15. Codex KB — Mutation Testing with Codex CLI (survivors-as-prompt pattern)
  16. Stryker docs — thresholds (high/low/break), incremental
  17. Snyk — Trivy GitHub Actions Supply Chain Compromise (2026-03, pin-to-SHA)
  18. AI Wisdom — Dependency Scanning: Securing the Software Supply Chain (3-layer, EPSS, SBOM)
  19. Mehdi Hadeli — Make vs Just vs Mise vs go-task for .NET Apps in 2026
  20. xNok — The Holy Grail of Dev Environments: My Journey to Nix (flake + direnv + CI parity)
  21. Bazel — Hermeticity (same input → same output)
  22. Reptile Haus — Spec-Driven Development: Why Your AI Coding Agents Need a Blueprint (96%/48% verification gap; 4.6–5.3× review delay)
  23. Shiplight — Spec-Driven Development with AI Coding Agents (4-move loop, EARS criteria)
  24. arXiv 2607.03316 — Is Agentic Code Review Helpful? CodeRabbit in the Wild (first empirical study)
  25. promptlint — lint, version, and test prompts as code with a CI gate
  26. PromptLayer — Continuous Integration of prompt evaluations