The compiler is a strong witness with a narrow brief
Niko Matsakis argues that Rust fits agentic development because its type system and guardrails keep generated code inside useful bounds. He also makes the boundary explicit. A type system can rule out named classes of mistakes. It cannot tell you that the code implements the intended behavior.[1]
That distinction matters when an agent can produce a large patch faster than a person can read it. A compiler result is cheap, repeatable evidence. It answers a precise question about the program accepted by that compiler. It does not answer whether the product requirement was right, the test oracle was complete, or the deployment resembles the test machine.
cargo check can support "this revision type-checks under this toolchain." It cannot support "this change is correct."Rust lets the interface carry more of the review
The useful move is not to worship a green build. Put more intent into types, ownership, error values, and contracts so a wrong edit has fewer legal shapes. The Rust Book's guidance on Result makes this concrete. Returning an error gives the caller a recovery choice, while a panic takes that choice away.[2]
For agent work, that is review leverage. A function that returns a typed error records part of the failure contract where the compiler can inspect it. A comment saying "this never fails" does not. The compiler still cannot decide whether the chosen recovery policy fits production. A reviewer must own that decision.
Add stronger checks only where the claim needs them
Kani uses model checking to analyze Rust programs. Its documentation separates safety checks, panic checks, contracts, loop bounds, and tool limitations.[3] This is a better model for agent verification than one giant "tests passed" badge. Each check has a target and a boundary.
A small pure function may justify a bounded proof. A network service still needs failure injection and workload replay. Unsafe code may need a dedicated property check. A command-line formatter may need golden files across real inputs. Pick the witness that matches the risk.
Build a ladder, not a halo
Use four separate receipts. Record the exact revision and toolchain for compilation. Name the behavior and input set for tests. State the property and bounds for formal checks. Record the environment, traffic shape, and recovery result for replay.
If only the first rung passes, ship that fact without inflating it. A precise narrow result is useful. A green halo around an untested system is decoration.