Sonar and the Star Hour of Verifiers (Category AI4SDLC)

Sonar as a product has been around for almost twenty years and has been popular in its niche all along: static analysis, quality gates, bug search, vulnerabilities and code smells. But now the company has begun a real dust. Agents generate code as if it were not in themselves - for everyone at once. Manual control of quality is becoming increasingly difficult. And here comes Sonar with its deterministic rules. And not just them. And so I looked. speech Tariq Shaukata, CEO of Sonar, at "AI Engineer World's Fair", in which Tariq talked about it.

Models are able to solve longer and longer tasks, but reliability lags. In Shaukat's METR data 16–20 hours of human work is the horizon of 50Percentage of success of the agent. Prix 80% it's down to 3-4 hours. One of Sonar's CTO customers noticed: an employee with precision 80The percentage would have been in the performance review. Even more frustrating, functionally correct code can remain complex, vulnerable, and expensive to maintain. A short-term increase in speed begins to be eaten up by the review and tech debt.

Sonar - Agent Centric Development Cycle, or AC/DC (This is the abbreviation for Sonar I already have. toldI was talking about another report about the same topic.): - Guide Give the agent context, architectural limitations, and quality profile. - Generate - The agent writes the code. - Verify Deterministic analysis checks data flows, secrets, and known patterns, and agent verification checks intent and business logic. - Solve The found problems are returned to the agent, he corrects the code and starts the cycle again.

In this case, verification should not only live in CI before merge. Shaukat talks about three related circuits: the internal agent cycle, CI verification, and constant codebase maintenance. And here's an important twist: clean code isn't just for people anymore. The agent is easier to navigate in it, he spends fewer tokens and is less likely to make mistakes. However, Sonar’s figures on reducing defects and token consumption remain the data of the vendor itself.

For me, the big takeaway is that good old-fashioned static analysis suddenly becomes not a legacy of the past, but an infrastructure of the future.

#AI #AI4SDLC #Agents #Engineering #DevSecOps #Software