Generating structured artifacts with Large Language Models - e.g.\ database queries, threat framework mappings, entity schemas - is relatively straightforward; however, making them reliable enough for production deployments presents challenges. We present TAG, a lightweight framework based on a core principle: \textit{LLMs generate, we validate}. This reframing shifts responsibility from generation quality to validation rigor. The framework rests on three key attributes: First, \textbf{test driven generation}: when tests fail, the LLM receives indicative error messages that expose why the output failed, enabling the LLM to understand its mistakes and refine subsequent attempts. Second, \textbf{deterministic and LLM-based tests}: deterministic tests catch heuristics that can be programmatically verified (schema, syntax, cross-reference), while LLM-based tests evaluate nuanced semantic and delicate features that resist programmatic inspection (intent alignment, logical consistency, domain correctness). Third, \textbf{expert-distilled judges}: LLM-based tests are calibrated to distill and replicate human expert decision distribution, transforming manual human quality gates into scalable, reusable evaluation proxies that reflect professional-grade validation standards. We demonstrate the framework on three artifact types in the security domain - KQL query generation, MITRE ATT\&CK mapping, and entity mapping - deployed in production at Microsoft Sentinel. We believe this framework can be applied beyond security to other artifact generation tasks, providing a path to reliable, high-quality outputs without sacrificing the efficiency gains of LLM generation.
This work proposes TraceDev, a multi-agent framework for automated software development grounded in use cases that contain multiple functional points and complex semantics, and demonstrates the effectiveness of TraceDev in repository-level code generation from requirements.
Mingyu Chen, Yakun Zhang, Zihao Xie et al.· 0 citations
Unit testing is crucial for software reliability in JavaScript, yet constructing comprehensive suites remains costly and error-prone. JavaScript’s dynamic features, flexible typing, asynchronous execution, and reliance on third-party libraries, pose persistent challenges for automated test generation. Although large language models (LLMs) show promise in code reasoning and synthesis, existing methods often miss the multilayer contextual information required for executable, semantically correct tests. This paper introduces JSTestCraft, an agentic, multi-layer framework for adaptive JavaScript unit test generation. JSTestCraft reconstructs missing context via three enrichment agents: library, structural, and semantic. These agents capture inter-function topology, third-party API semantics, and inferred type constraints in a shared contextual memory for reasoning-driven test synthesis. A testing and optimization layer generates, executes, and iteratively refines test cases. Evaluated on 20 real-world Node.js repositories, JSTestCraft outperforms state-of-the-art baselines, improving test pass rate by 60.9%, statement coverage by 14.2%, and branch coverage by 47.3%. Ablation analysis confirms each agent’s contribution to contextual completeness. Beyond metrics, JSTestCraft discovers 13 previously unknown bugs across 5 repositories, 6 of which received substantive acknowledgment from maintainers or community contributors. These results demonstrate that context reconstruction and agentic collaboration enable LLMs to perform more reliable and adaptive testing in dynamic JavaScript environments.
TestAgent, a multi-agent tool implemented as a VS Code extension that automates the generation of high-quality unit tests for Java projects using repository-level Code Knowledge Graphs, demonstrates its practical utility for regression testing and bug discovery.
Ye Shang, Quanjun Zhang, Zheng Zhan et al.· SIGSOFT FSE Companion· 0 citations
Deployed large language model (LLM) agents are now being used to interface with external tools, fetch information, run code, interact with user data and help with decision making at the workflow level. Therefore, their safety issues are not only related to the underlying model, but also to tool permissions, prompt design, retrieval sources, policy constraints, evidence validity, and varying operational contexts. While Goal Structuring Notation (GSN) has become a popular means of structuring safety arguments, many GSN-based safety cases are still reliant on manual inspection and can suffer from unsupported goals, incomplete evidence paths, undischarged assumptions, circular arguments, unaddressed defeaters, or insufficient coverage of hazards. This paper introduces MCSafe-GSN-HOL, a formal assurance framework for creating machine-checkable safety cases for deployed LLM agents that overcomes these disadvantages. The proposed framework translates the structured GSN arguments into Isabelle/HOL proof obligations, and formalizes the typed GSN elements, the hazard contracts of LLM-agents, the evidence-completeness conditions, the assumption-discharge rules, the defeater-resolution rules, and the incremental re-verification rules after deployment changes. The prototype was tested with 25 safety-case fragments from five representative scenarios of LLM-agents. Results demonstrate that MCSafe-GSN-HOL has 97.3% defect detection, 97.2% evidence coverage, 96.4% hazard-control coverage, and 62.7% reduction in review time compared to manual GSN review. The mean Isabelle/HOL checking time was 2.53 s/safety case, showing that theorem-prover supported assurance can still be practical for medium scale safety-case checking. The results overall support the conclusion that formally checked GSN safety cases can help with the traceability, auditability, consistency and maintainability of assurance processes for deployed LLM-agent systems.
Aakash Abhay Yadav, Shashank Shelat, B. Hinduja et al.· International Conference on...· 0 citations
A reusable engineering pattern for turning exploratory prototypes into auditable applications with versioned source, control, and validation artifacts is presented, which reconstructs this pattern into a traceable, auditable LLM-agent architecture.
User experience (UX) evaluation is central to software quality, yet it remains difficult to integrate into software engineering workflows in a systematic, explainable, and early-stage manner. This paper presents TraceUX, a framework for operationalizing UX heuristics and design guidance into a rule-based static evaluation pipeline that combines machine-interpretable formalization, executability-aware assessment, context-sensitive scoring, and actionable reporting. The framework is instantiated using Apple Human Interface Guidelines, Swift abstract syntax trees, and mobile games, and implemented in a proof-of-concept tool named TraceHIG. Evaluation was conducted in four layers: analysis of the full rule repository, controlled synthetic validation with injected violations, baseline assessment of 12 public Swift game projects, and a case study on one project. The full repository contained 206 rules; after excluding non-iOS yet platform-specific rules, 193 rules were retained for the downstream experiments. In controlled validation, 216 injected violations yielded 99.2% precision, 61.6% recall, and an F1-score of 0.760. In baseline analysis, overall project scores ranged from 41.6 to 88.0, reflecting rule-conformance spread under the instantiated rule base rather than direct measures of UX quality. The case study demonstrated that profile-aware scoring can yield materially different UX assessments for the same codebase under different game configurations, highlighting the importance of app profiling in static UX evaluation. These findings show that a meaningful subset of UX knowledge can be operationalized into explainable, context-aware static analysis that provides structured and actionable decision support while complementing, rather than replacing, manual and empirical UX evaluation.