Catch AI-generated code that looks correct but breaks its contract
LLMLL wraps an SMT solver around agent-written functions, rejecting implementations that are type-correct yet violate formal contracts before they merge.
- LinkLoot access
- Free
- Provider costs
- Unknown
What you get from it
What it does
LLMLL (Large Language Model Logical Language) is a programming language and verification pipeline designed for experiments where AI agents write code under formal contracts. Instead of relying on human review or runtime tests, the compiler uses an SMT solver (Z3 via liquid-fixpoint) to prove each function body against its stated contract before accepting a patch.
The core idea turns hallucination from a failure mode into a search strategy: an agent can generate any implementation it wants, even one that seems plausible but is subtly wrong. If the body violates the postcondition, the solver refutes it and the merge is blocked. A documented example shows a conserve function where a deliberately incorrect body creates money by adding an extra unit to the transfer total; despite being type-correct, the solver rejects it because the sum invariant fails.
Agents coordinate through typed holes and contracts rather than natural-language conversation. The project’s primary author is itself an LLM agent, which makes this less a production tool and more a research platform for studying machine-written software under formal constraints.
Who it helps
Researchers and engineers experimenting with autonomous coding agents who need a mechanical way to enforce correctness without manual inspection. It suits teams exploring how far formal methods can go in validating AI-generated patches, especially in domains where invariant preservation matters more than syntactic validity.
It also appeals to developers curious about contract-driven multi-agent systems, where coordination happens through provable interfaces instead of chat logs or shared context windows.
Getting started
Clone the repository from GitHub and build with Make. The README references demo runbooks (payments-core/DEMO-RUNBOOK.md, withdraw-demo/DEMO-RUNBOOK.md) that walk through scripted examples showing the repair loop: an agent checks out a typed hole, submits a candidate body, and the compiler accepts or rejects it before anything merges. Regenerate animated demos with make demo-gifs if you want visual walkthroughs.
Documentation lives in docs/README.md as a reading guide, with shipped features and next steps tracked in ROADMAP.md. Experiment results are indexed in experiments/README.md.
Limits and costs
GPL-3.0 licensed, so derivative works must comply with copyleft terms. Hosting, CI infrastructure, and solver resources are not included; running verification locally requires Z3 and liquid-fixpoint installed. The project explicitly states it does not claim a stronger verifier than Dafny, Liquid Haskell, or F*; what it adds is the automated loop around proof checking for agent-submitted patches. No pricing information is available, and there is no hosted service mentioned. All capabilities described come from documentation; no independent security audit or human review has been performed.
Source links
Discussion
Share practical experience, questions, or warnings with the community.
Sign in to join the discussion and vote on comments.
Sign in