My AI-built app had 7 recurring bugs from one disease. I open-sourced the cure.

Varun Chennuri — Sun, 30 Aug 2026 17:55:45 +0000

My production app was built almost entirely by AI coding agents. It worked —
and then the same bugs kept reopening. Seven tickets, again and again. The test
suite was green the whole time: 46 passing tests, several of which asserted the
buggy behavior, because the AI had generated them from the code it just wrote.

When I root-caused all seven, they were one disease wearing four costumes:
business rules living inside individual screens instead of shared contracts.
Every AI session is an amnesiac contributor — locally competent, globally blind.
Whatever meaning isn't written down between sessions fragments. Duplication
isn't a shortcut AI takes under pressure; it's its default gait.

So I did an experiment with a known answer key (my 7 tickets):

Mechanical scanners (clone detection, dependency rules) caught 1 of 7 — useful, but the disease is semantic, not textual.
Writing every business rule's definition down ONCE, in a human-owned registry, and forcing every session to consult it: covered 7 of 7.
After curing the codebase... the cure itself started drifting within weeks (the fix rule grew a second implementation; new features started cloning routes again). Drift is fractal. Only a continuous audit loop bounds it.

I turned the whole protocol into an open-source CLI: asdlc.

asdlc plan — read-only, tells you what governance would look like in your repo
asdlc init — installs the registry, agent rules (AGENTS.md), and a CI gate
asdlc check — five gates, one exit code; legacy repos baseline existing debt so only NEW drift blocks
asdlc audit — scheduled re-diagnosis, because the drift never stops

It wraps jscpd, dependency-cruiser, and Semgrep rather than reinventing them.
The interesting parts are the trust rules, enforced in code:

A crashed check reports ERROR, never PASS
Silenced warnings expire — suppression ends on a date, and the finding comes back red
An AI cannot approve its own shortcuts: baselines and waivers physically require a human's name plus a pointer to where approval was given

It was also built the way it preaches: the protocol was authored by two AI
models adversarially reviewing each other with me as judge, the CLI was
cross-reviewed by a rival model (which found 3 real verdict-integrity bugs
before release), and the tool's own validation caught a spec-conformance bug
in itself. Full pilot numbers are in the case study in the repo.

Honest limits, because this space is drowning in overclaims: gates prove the
absence of known, expressible violation classes — not correctness, and not all
drift. Clone detection sees textual similarity, not semantic equivalence. The
human-authored registry is the load-bearing part; the tool is the enforcement.

Repo: https://github.com/chennurivarun/asdlc · npx asdlc-cli plan is
read-only and changes nothing — that's the whole trial cost.

DEV Community: Varun Chennuri

My AI-built app had 7 recurring bugs from one disease. I open-sourced the cure.