AI now writes most of the stateful code your systems depend on — workflows, control logic, anything with a "mode." That's exactly the code humans are worst at reviewing by eye: the dangerous bugs live in combinations that are hard to predict and easy to leave untested. Cognitive Fab brings deterministic, exhaustive verification to that code, so your team gates it on every change instead of trusting it on faith.
Review catches what a reviewer thought to imagine. It doesn't reliably catch the interleaving that's hardest to picture in advance — the DNS race condition no test enumerates and no reviewer sees, until it's already in production. That's not a hypothetical: it's the exact class of bug that pushed Amazon and Microsoft to formally verify their most critical infrastructure.
Amazon built specialist, PhD-level teams to write TLA+ models of S3 and DynamoDB to catch design defects in reachable states that testing and code review couldn't reach — the kind of defect that only shows up once you check every reachable state, not the ones a person happens to think of.
Microsoft did the same for Azure Cosmos DB. In both cases, the fix wasn't more review — it was exhaustive, deterministic checking of the state machine underneath the service.
That precedent used to require a specialist team and months of formal-methods training. It doesn't anymore — that's the point of Polygraph.
And it's not just Amazon and Microsoft. MongoDB, Elastic, Datadog, PingCAP, Yandex, and dozens of others reach for the same class of tool once review by eye stops being enough.
Ref: Newcombe et al., "How Amazon Web Services Uses Formal Methods," CACM 2015; Microsoft Azure Cosmos DB TLA+ verification; a crowdsourced list of companies using formal methods.
A career spent on stateful systems you can trust: a 1987 Ph.D.; the software engineer and material scientist behind the IMSC closed-loop control project at Hughes Research Labs; chief architect of the NEC Boston Technology Center, leading the design of one of the first business-process engines; and a contributor to the B2B and web-services standards that formalized how systems coordinate — ebXML BPSS, WS-TX, and XML DSig.
What's different now: the spec is ordinary code — no specialist team required to write the math.
A verification-gated lifecycle for the code AI agents now write. Code generation is solved — trust is the bottleneck. Agents already write large amounts of stateful code, the kind hardest to get right, and no human can enumerate every reachable state by eye. The dangerous bugs hide in combinations that are hard to predict and easy to leave untested.
Trust blindly
Trust by construction
Plugins to a coding agent. Every step the agent takes, a deterministic gate checks — no model needed at check time.
Where each tool fires across the development lifecycle, the artifact family they all speak, and — layer by layer — what is mechanically gated, what is partially measured, and what remains human judgment.
Code generation is solved. Trust is the bottleneck. Advisory and training from the author of the SAM pattern — so your team can gate AI-written code deterministically, on every change, instead of reviewing and hoping you catch every defect.
A 30-minute conversation about where AI-written code is quietly accumulating risk in your systems — and whether verification is the answer.
Anything that occupies a situation and moves between them on events is a state machine — whether or not anyone drew it as one. It is the hardest software to get right, and it is everywhere.
orders, billing, subscriptions, approvals NServiceBus, Particular Software
replication, consensus, consistency Amazon S3/DynamoDB, Azure Cosmos DB, MongoDB, Datadog, PingCAP, Elastic, Yandex ClickHouse
pre-silicon & chip verification Intel
SCADA, PLCs, factory automation
motion planning, task sequencing
perception → decision → actuation
flight control, avionics modese.g. OpenComRTOS — formally-designed RTOS
a pump that free-flows, a scanner stuck between modes
settlement, ledgers, trade lifecycle
call state, session & consensus protocols Informal Systems — Quint/TLA+, IBC
grid control, battery & plant management
fulfillment, routing, inventory
…and everything with a “mode”
Most systems bury their state machine in code, where it can't be inspected, verified, or safely evolved. We make it a first-class artifact across its whole lifecycle.
Model states, actions, and transitions explicitly — with contracts and invariants that capture what the system must and must never do.
Check machines against their contracts before they ship: reachable-state analysis, invariant checking, and replay of real traces against the model.
Run fleets of machines with visibility into every instance's state, safe version migrations, and compatibility gates for every change.
Change a live system without breaking it — versioned machine definitions, validated migrations, and gates that catch incompatibilities before deployment.
A 30-minute conversation about where AI-written code is quietly accumulating risk in your systems — and whether verification is the answer.