Ask HN: How would you harden AI changes to a 1M-line legacy SaaS before review?
4 pointsby thegreatkahuna12 hours ago7 comments
  • harikshore3 hours ago
    Answering your questions from my knowledge level on AI:

    Managing AI agents is like running a knowledge business. If you are not an expert enough to understand what agents are doing, there is still large room for errors. Its important to set design decisions early in the development process.

    Your questions:

    3. I think this is absurd. Agent can generate the test cases, but you still have to verify the tests are actually valid.

    4. The architecture document should be the source of truth. SO when a engineer reviews they know what to look for & flag/fix. The comprehensive the document is the better. Version it based on what the prototype carries. — Data models, API design, Services, Roles, etc. You can ask this to AI — What all should a high/low level SDD carry?

    5. Just make sure the architecture doc is solid, development is as per the document, ask AI to generate/perform regression test cases and document them as well (pass/fail).

    So the engineer knows where things exactly stand.

    Thats the best can do

    Appreciate thoughts on this.

    • thegreatkahunaan hour ago
      I agree that in perfect world I could have done this exercise with competent engineers and a UX desginer. I know about software development processes and applied that to e.g. testing and hardening, but it is not a substitute for deep technical knowledge. THe idea behind having a separate agent create the tests is to that then the coding agent couldn't get functionality to work or fix bugs by weakening the test. I believe Bob Martin has talked about this. Noted about the architecture document - will have to ensure it is as solid as possible. I already run the full CI pipeline that we run for our app + the new ones that the agents developed - would it be good to have additional regression tests?
  • taleodor4 hours ago
    If you're planning to put it into production anything you do outside of bringing somebody qualified at this point is likely a waste of time. Highly recommend this recent talk by Kelsey Hightower on the subject - https://www.youtube.com/watch?v=A7WFt2JQ5sg
    • thegreatkahuna2 hours ago
      Thanks for the link! You could very well be right that there is not much more that could be done before the review. My reading of what Kelsey said is that agents can produce useful outcomes, it is just that humans need to validate and own them. In other words, I couldn't conclude that this somehow disproves that at least some of the functionalities that were generated in my project, couldn't be (close to) production-grade.
      • taleodoran hour ago
        This is more about understanding the big picture and architecture of what's going on (the part about the diagrams / blueprints). One practical thing actually that may be useful to you - try thinking and testing in terms of "what can go wrong" rather than "is this prod-ready".
  • 4 hours ago
    undefined
  • dnemmers7 hours ago
    In the past, problems like these were solved with software engineers. Those trained through schooling and experience to be able to read through and understand obscure code conventions and programming quirks.

    Their kind has almost gone extinct in this universe...

    • thegreatkahuna7 hours ago
      I hear you. This must have been a long time ago, like last year or something. Those were the times.
  • krembo8 hours ago
    At this point what stops you from asking AI this question? But honestly, extensive QA. There are probably more quirks than you could imagine
    • thegreatkahuna7 hours ago
      I have asked the AI, but was hoping for a second opinion, ideally by someone who has experience from doing something a bit similar. Your point about QA is interesting. Bob Martin, doesn't review AI code any more, just does extensive QA (https://x.com/unclebobmartin/status/2080257779395154409). Perhaps the key move would be for me to now focus on QA and try to nudge the engineering review to also emphasize testing over reading code?
      • scaredreally6 hours ago
        Once you no longer "own" the code, does it matter? If you provide a very detail set of specifications and success criteria then you can turn it into a black box. The code is no longer the asset, just the business that uses it. You can use AI to extract the requirements from the existing code and then modify as needed however, I would recommend doing this in two phases: first the conversion, then the enhancements.
        • thegreatkahuna6 hours ago
          I suppose you are right at least what comes to the functionality. Security is the one thing where I am sure that my company will require some peaking under the hood.
  • gysakai6 hours ago
    [flagged]
  • babyblueviper111 hours ago
    [flagged]