Formal Verification Moves Into AI Coding

Builders now ship hundreds of PRs weekly from coding agents, and AI Engineer shows why formal verification is the only way to guarantee correctness for all inputs.

Varun Pant, who leads AI products and formal verification at Amazon (NASDAQ:AMZN), laid out the method at the AI Engineer session.

Why human review no longer scales

Coding agents outpace review because tests only sample inputs and LLM judges stay probabilistic.

Formal verification replaces sampling with proof, defining correctness as a specification and proving code matches it for every input.

How Lean turns proofs into code

Lean is both language and proof assistant with no translation layer between definition and proof.

Tactics act like chess moves that explore a proof tree until checkmate, then a small trusted kernel in C++, Rust or Lean independently checks the result.

That kernel model lets anyone write or verify a checker, since Lean is open source and proof artifacts export cleanly.

Where AWS already runs this in production

Pant showed an AI conversion of zlib from C to Lean that produced 32,000 lines of proof for the spec that decompress(compress(data)) equals the original data.

Cedar, the open source authorization language behind AWS Verified Permissions, keeps its Lean specification and Rust production code in sync with 100 million differential random tests nightly and ships nothing until they pass.

The forbid trumps permit property demonstrates the payoff, because denial must hold for every request that satisfies a forbid policy.

What solvers and Strata add

Verus annotates Rust inline with requires and ensures pre and post conditions and discharges them with the Z3 solver, a calculator that returns satisfiable or unsatisfiable.

Aeneas takes Rust mid level intermediate representation and translates it functionally to Lean for theorem proving on the same chessboard.

Strata, AWS work in progress open source framework, lets any language define a dialect that lowers to Strata core in Lean and then dispatches to Lean proofs, SMT solvers or model checkers.

Why this matters for AI generated software

As Copilot, Cursor and Claude Code flood repos, the spec becomes the only human owned artifact that stays upstream of disposable code.

StartupHub.ai data shows Lean at 54/100 trails You at 71/100 and Perplexity AI at 72/100 and Google at 74/100, while Lucidworks at 52/100, matey at 50/100 and Dante at 47/100 cluster nearby, signaling verification tooling is still undervalued relative to generation tooling.

Winners will own specification quality, because autoformalization from natural language only works if humans validate the spec before agents implement and provers certify.

What the talk leaves open

Pant demoed spec first flow with Kiro where you write a spec formally in Lean or in natural language for AI autoformalization, then test the spec itself.

Gaps remain around proof automation cost, debugging failed proofs, and integrating Lean checks into CI without slowing agent throughput.

Competing stacks like Coq, Isabelle and Dafny offer similar guarantees, but Lean4 extensibility and Rust friendly tooling give AWS a pragmatic path to adoption.

Pant pitch is simple, pick your most critical code, define correct and let agents write proofs that a kernel can check.