Tag: software testing

  • Stop Guessing: How to Build a Practical Evaluation Loop for AI Coding Agents

    Stop Guessing: How to Build a Practical Evaluation Loop for AI Coding Agents

    The New Problem: Coding Agents Are Systems, Not Autocomplete

    AI coding agents are not just smarter autocomplete. They can read files, search repositories, call tools, run tests, edit multiple files, retry after errors, and make decisions across several steps. That makes them useful, but it also makes them harder to trust than a single code suggestion in an editor.

    For AI-first software teams, the key question is no longer, “Can the model write code?” A better question is, “Can this agent complete the kinds of tasks we actually assign, inside our constraints, without creating hidden risk?” Evaluation-driven development answers that question with a lightweight, repeatable loop: choose representative tasks, run the agent, score the result, compare settings, and use the evidence to improve the workflow.

    This is different from a CI quality gate, observability dashboard, or human review process. Those still matter. Agent evaluations sit earlier in the loop: before a team grants larger tasks, new tool permissions, broader repository access, or customer-impacting work.

    What an Evaluation Loop Measures

    A useful agent evaluation does not measure only whether the code compiles. It measures how the agent behaves as a software teammate inside a defined task boundary. For a coding agent, that can include correctness, changed-file count, test results, cost, latency, instruction-following, rollback behavior, and how clearly the agent explains its work.

    • Correctness: Did the final change solve the requested problem without breaking expected behavior?
    • Test behavior: Did existing tests pass, did the agent add useful tests, and did it avoid weakening the suite?
    • Scope control: Did it touch only the files necessary for the task?
    • Instruction-following: Did it respect coding standards, framework conventions, security rules, and “do not change” areas?
    • Cost and latency: How many tool calls, model tokens, and minutes did the task require?
    • Maintainability: Would a human developer be comfortable owning the resulting code six months later?
    • Recovery behavior: When a command failed, did the agent diagnose the issue or spiral into unrelated edits?

    Single-turn LLM evals often compare one prompt with one answer. Agent evals are messier because the path matters. Two agents may produce similar final diffs while one used five safe steps and the other made twenty risky edits before landing on a working result. For real teams, that difference matters.

    A Starter Eval Suite for Small Teams

    You do not need a research lab to start. A small team can begin with 10 representative coding tasks pulled from real work, sanitized if needed. The goal is not to predict every possible future task. The goal is to create a stable measuring stick that reflects your codebase, conventions, and risk tolerance.

    • Pick 10 tasks that resemble normal work: one bug fix, one small feature, one refactor, one documentation update, one test improvement, one dependency-related change, one accessibility fix, one performance improvement, one data-validation task, and one edge-case handling task.
    • Create a clean starting state for each task, such as a branch, fixture repository, or archived issue with enough context for the agent to act.
    • Write the expected outcome in plain language before running the agent. Include what should change and what should not change.
    • Define allowed tools and permissions: file reads, file writes, terminal commands, test execution, package installation, web access, or issue tracker access.
    • Run the same tasks across two or three agent configurations, such as different system instructions, model choices, tool permissions, or planning requirements.
    • Capture the final diff, test output, execution time, approximate cost, number of files changed, and whether the agent followed instructions.
    • Have at least one human reviewer score the result using a simple rubric, then compare scores across runs.

    For example, a WordPress-focused team might include tasks such as fixing a shortcode rendering bug, adding a unit test around a REST API permission callback, improving admin-page copy without changing behavior, or validating metadata before saving a custom post type. The same pattern applies whether the product is a plugin, SaaS dashboard, mobile app, or internal tool.

    Choosing Metrics That Match Business Risk

    The best metrics depend on what can go wrong. A coding agent that updates marketing copy can be evaluated differently from one that edits authentication, billing, data deletion, or lead-generation logic. Evaluation-driven development is not about chasing a universal score. It is about matching measurement to risk.

    • Low-risk tasks may emphasize speed, readability, and instruction-following.
    • Medium-risk tasks may require passing tests, limited file changes, and human approval before merge.
    • High-risk tasks should include stricter rubrics, security review, regression tests, and a strong bias toward smaller diffs.
    • Customer-facing automation should track not only correctness but also tone, escalation behavior, privacy boundaries, and failure handling.
    • Data-enrichment workflows should measure precision, source quality, duplicate rates, and whether the agent leaves an audit trail.

    This is where product-specific evals matter. A generic public benchmark may be useful for comparing broad capabilities, but it will not tell a team whether its own AI workflow is safe. CoatiPress Content Studio, for instance, would benefit from internal evaluations around article structure, factuality checks, scheduling behavior, and editorial instruction-following. CoatiChat would need evals for escalation to a human, tone boundaries, token limits, and issue-resolution behavior. CoatiCRM would need evals for lead-record quality, public-source attribution, duplicate handling, and mapping accuracy. These are team-specific questions, not leaderboard questions.

    Synthetic Tasks, Real Tasks, and the Overfitting Trap

    Every eval suite involves tradeoffs. Synthetic tasks are clean, repeatable, and safe to share, but they may miss the messy details that make real repositories hard. Real tasks are more realistic, but they can be harder to reset, score, and keep confidential.

    Exact-match tests are attractive because they are objective: the agent either passes or fails. But exact matches can miss good alternative implementations, especially in UI, refactoring, documentation, and architectural work. Rubric scoring adds human judgment, but it can be slower and less consistent. A balanced suite usually uses both: automated checks for things that must be true, plus rubric scoring for quality, maintainability, and judgment.

    Public benchmarks are useful for understanding the field, but private evals are what make the results operational. If your team only optimizes for public benchmarks, you may select an agent that is impressive in general but weak on your framework, repository layout, test style, or product rules.

    There is also a real overfitting risk. If you repeatedly tune prompts and agent settings against the same 10 tasks, the workflow may get very good at those examples while failing on new work. Refresh the suite over time, keep a few holdout tasks, and regularly ask whether the eval set still represents the work your team actually does.

    Using Eval Results to Improve the Workflow

    The point of evaluations is not to crown a permanent winner. It is to create a feedback loop. When an agent fails, the result should help the team decide what to change next.

    • Improve prompts when the agent misunderstands goals, skips planning, or ignores formatting expectations.
    • Improve repository instructions when failures come from missing project conventions, setup steps, naming rules, or testing commands.
    • Adjust tool permissions when the agent needs more context, or when broad access causes unnecessary edits.
    • Add workflow checkpoints when tasks require a plan, human approval, test run, or diff summary before completion.
    • Change task routing when an agent is reliable for tests and documentation but not yet safe for security-sensitive code.
    • Update the eval suite when new product areas, frameworks, or recurring failure modes appear.

    This loop is especially powerful when it stays lightweight. A team that runs 10 tasks every week and tracks a few consistent metrics will learn faster than a team that debates agent quality anecdotally after every surprising pull request.

    Common Mistakes to Avoid

    • Using only demo tasks. Agents often look excellent on clean, tiny examples and struggle in mature repositories with old conventions.
    • Scoring only the final answer. For agents, the process matters: tool usage, retries, unnecessary edits, and failed commands can reveal risk.
    • Ignoring cost and latency. A correct result that takes too long or costs too much may not fit the workflow.
    • Treating human review as optional too early. Evals reduce uncertainty; they do not eliminate accountability.
    • Letting the agent modify tests to make itself pass. Test changes should be reviewed carefully and scored separately.
    • Comparing tools without holding tasks constant. If each agent gets a different task, the comparison is mostly noise.
    • Never refreshing the suite. Software changes, products change, and yesterday’s eval set can become stale.

    A Practical Checklist

    • Create 10 representative coding tasks from your actual work.
    • For each task, write the expected outcome and the unacceptable outcomes.
    • Reset each task to a known starting state before every run.
    • Run the same tasks across agent settings, tools, or instructions.
    • Record pass/fail results, rubric scores, changed files, test output, cost, and time.
    • Review failures and decide whether to improve prompts, instructions, permissions, tests, or task routing.
    • Keep a few holdout tasks that are not used for day-to-day tuning.
    • Repeat the evaluation after major model updates, tool changes, repository changes, or workflow changes.
    • Use public benchmarks for context, but make private evals the source of truth for your team.
    • Keep humans in the loop for high-risk changes, ambiguous requirements, and product judgment.

    Evaluation-driven development turns AI coding agents from a leap of faith into an engineering practice. The goal is not to remove uncertainty completely. The goal is to make uncertainty visible, measurable, and improvable before it reaches production.

    Sources and Fact Check References

    • Promptfoo – Promptfoo describes coding-agent evaluations as different from standard LLM evaluations because agents decide what to do, act, observe results, and iterate; it also documents assertions for cost, latency, tool trajectories, and rubric-based scoring.
    • OpenAI Evals – OpenAI Evals is an evaluation framework for language models and model-based systems that teams can use to build custom evaluations for their own tasks.
    • OpenAI – OpenAI argues that coding evaluations require careful design because benchmark scores can include noise and may not reliably represent real-world software-engineering performance without appropriate interpretation.
    • Visual Studio Code Documentation – Visual Studio Code documentation describes custom instructions for AI coding agents, including repository-specific guidance that can influence generated code, test behavior, and project conventions.
    • GitHub Changelog – GitHub’s June 12, 2026 changelog describes new Copilot code review configurations and controls, supporting the article’s point that AI coding workflows increasingly rely on explicit controls and project-specific configuration.
  • From Copilot to Coding Agents: How AI-First Development Is Changing the Pull Request

    From Copilot to Coding Agents: How AI-First Development Is Changing the Pull Request

    Why coding agents suddenly feel more real

    For years, AI in software development mostly meant autocomplete: a helpful suggestion inside the editor, a generated function, or a chat answer explaining an error message. That kind of assistance is still useful, but the bigger shift is toward agentic development workflows. These tools can read more of a repository, form a plan, edit multiple files, run tests when permitted, respond to failures, and prepare changes for a human to review.

    That does not mean teams should hand production systems to an AI and hope for the best. It means the unit of work is changing. Instead of asking, “Can AI write this line?” teams are asking, “Can AI take this scoped issue, work in a branch, follow our project rules, pass checks, and produce something reviewable?” That is the heart of AI-first development: turning intent, context, and verification into a repeatable workflow.

    Completion, chat, and agents are not the same thing

    The phrase “AI coding tool” now covers several different workflows. Separating them helps teams set realistic expectations and choose the right level of autonomy for each task.

    • Code completion suggests snippets as a developer types. It is fast, local to the current file, and best for boilerplate, common patterns, and small transformations.
    • Chat-assisted coding lets a developer ask questions, paste errors, request explanations, or generate code through back-and-forth guidance. It is useful for learning, debugging, and exploring options, but the human usually drives each step.
    • Agentic coding workflows assign a bounded task to an AI system that can inspect broader project context, make changes across files, run approved commands or tests, and return a proposed diff or pull request. The human shifts from typing every edit to specifying intent, reviewing results, and enforcing quality.

    The difference is more than interface design. A completion tool lives in the moment of writing. A coding agent can operate around an issue, branch, test run, or pull request. That makes it powerful, but it also makes guardrails more important.

    How today’s coding-agent workflows compare

    The leading tools are converging on a similar idea: give the model enough repository context and a bounded task, then let it produce reviewable work. They differ in where they live, how asynchronous they are, and how much control they give teams over environment, permissions, and review.

    • GitHub Copilot agent mode is designed around GitHub and editor-based workflows. GitHub describes agent mode as enabling Copilot to iterate on its own output, fix errors, suggest terminal commands, and analyze run-time errors in pursuit of a user’s request.
    • OpenAI Codex is positioned as a software engineering coding agent for real engineering work, including routine pull requests, features, refactors, migrations, testing, code review, and background tasks.
    • Google Jules emphasizes asynchronous agent work: developers can connect a repository, choose a branch, submit a task, review a generated plan, and come back when the work completes or needs input.
    • Claude Code focuses on terminal and repository workflows, with best practices around giving the agent clear context, asking it to plan, iterating through tests, and applying project-specific instructions.

    There is no universal winner for every team. A startup building quickly, an enterprise with strict compliance needs, a WordPress plugin shop, and an open-source maintainer may all value different capabilities. The practical question is not “Which agent replaces developers?” It is “Which workflow fits our repo structure, testing culture, review process, and risk tolerance?”

    What coding agents are good at today

    Coding agents are most useful when the task is concrete, the expected outcome is easy to verify, and the repository contains enough patterns for the agent to follow. They are less reliable when requirements are vague, domain context is missing, or success depends on product judgment rather than technical execution.

    • Drafting or updating documentation based on existing code and configuration.
    • Writing first-pass unit tests for functions, classes, API endpoints, and known edge cases.
    • Fixing small bugs with clear reproduction steps and failing tests.
    • Applying dependency updates, lint fixes, formatting changes, and repetitive migrations.
    • Refactoring narrow areas of code while preserving existing behavior.
    • Explaining unfamiliar modules to new team members or technical leaders.
    • Preparing pull request summaries that describe changed files, risks, and test coverage.

    These strengths map well to work that many teams postpone because it is necessary but time-consuming. A coding agent that drafts tests, updates docs, or handles a small bug can create leverage without asking the organization to trust it with major architectural decisions.

    What still needs human review

    Human judgment remains central. AI can produce code that looks plausible while missing an edge case, misunderstanding a requirement, or introducing a security issue. Review is not a formality; it is where engineering responsibility stays with the team.

    • Product intent: Does the change solve the right problem for real users?
    • Architecture: Does it fit the system’s long-term design, or does it add hidden complexity?
    • Security: Does it validate input, escape output, protect secrets, and respect permission boundaries?
    • Performance: Does it introduce slow queries, unnecessary network calls, or expensive loops?
    • Maintainability: Will the next developer understand the change six months from now?
    • Release risk: Can the team roll back safely if the change behaves unexpectedly?

    A useful mental model is to treat an AI agent like a very fast junior contributor with unusual memory and no lived accountability. It can be extremely helpful, but it should not approve its own work, merge directly to production, or define business-critical requirements without human oversight.

    A practical adoption path for teams

    The safest way to introduce AI-first development is to start where the cost of being wrong is low and the value of learning is high. Teams do not need to redesign their entire engineering organization on day one.

    • Start with documentation tasks: README updates, setup instructions, changelog drafts, inline comments, and developer onboarding guides.
    • Move to tests: ask agents to generate tests for existing behavior, then have humans review whether the tests reflect reality and cover meaningful cases.
    • Try small bug fixes: choose issues with clear reproduction steps, limited scope, and existing test coverage.
    • Use agents for dependency and compatibility chores: minor version updates, deprecation warnings, formatting changes, and static-analysis cleanup.
    • Experiment with contained refactors: rename internal APIs, simplify duplicate code, or reorganize files where CI can catch regressions.
    • Delay business-critical features: save payments, authentication, permissions, data migrations, and customer-impacting workflows until the team has mature guardrails.

    The first goal is not maximum automation. The first goal is calibration. Teams need to learn which tasks the agent handles well, which prompts produce reliable results, where it fails, and what review checklist catches the most important mistakes.

    Guardrails that make agentic development safer

    Agentic workflows become much more useful when they are surrounded by clear boundaries. The best teams will treat coding agents as part of the software delivery system, not as a side experiment running outside normal controls.

    • Repository instructions: maintain a short, current guide that explains coding style, test commands, architecture rules, naming conventions, and files the agent should not edit without permission.
    • Scoped permissions: limit what the agent can access, execute, or modify. Avoid broad credentials when a read-only or test-only token would work.
    • Branch isolation: require agents to work in separate branches or sandboxed environments instead of editing protected branches directly.
    • Continuous integration checks: run unit tests, linters, type checks, security scans, and build steps before review.
    • Human code review: require a human reviewer for every agent-authored pull request, especially when changes touch security, data, billing, or permissions.
    • Secrets hygiene: prevent agents from reading or printing sensitive keys, customer data, private tokens, or environment files unless there is a specific approved workflow.
    • Evaluation logs: keep records of task prompts, generated diffs, test results, and reviewer feedback so the team can improve prompts and policies over time.
    • Rollback plans: make sure changes can be reverted quickly through version control, feature flags, backups, or deployment controls.

    These controls are not meant to slow everything down. They make it possible to move faster without confusing speed with safety. The more autonomy a tool has, the more important it is to make boundaries explicit.

    A WordPress and plugin-development sidebar

    For CoatiPress readers working in WordPress, coding agents can be especially useful because plugin development often involves repeated patterns: hooks, filters, settings pages, shortcodes, REST routes, admin notices, scripts, styles, sanitization, escaping, and compatibility checks. Those patterns give agents useful context, but they also create security and quality responsibilities that cannot be delegated blindly.

    • Draft tests for plugin functions, REST endpoints, role checks, and settings validation.
    • Review whether hooks and filters are named consistently and documented clearly.
    • Generate documentation for plugin settings, admin screens, and integration steps.
    • Inspect edge cases around logged-in versus logged-out users, API limits, caching, and error handling.
    • Suggest compatibility checks for current WordPress and PHP versions.
    • Flag places where input should be sanitized, output escaped, nonces verified, and capabilities checked.

    For example, an agent might help draft tests for a chat plugin’s logged-in and logged-out request limits, document a content pipeline’s configuration options, or inspect lead-record mapping logic for obvious integration edge cases. But a human developer still owns the release decision, security review, and customer impact.

    The pull request becomes the control point

    AI-first development does not eliminate the pull request. It makes the pull request more important. The PR becomes the place where intent, generated changes, automated checks, risk notes, reviewer comments, and final accountability come together.

    In a mature workflow, the agent should not just dump code. It should explain what it changed, why it changed it, what tests it ran, what it could not verify, and what risks reviewers should inspect. That turns AI output from a mystery patch into a structured engineering artifact.

    What comes next

    Coding agents will keep improving. They will get better at repository context, long-running tasks, test repair, migration planning, and integration with issue trackers and deployment systems. But the winning teams will not be the ones that simply allow the most automation. They will be the ones that design the clearest workflows around it.

    The question for engineering leaders, plugin developers, and technical founders is not whether AI will write code. It already does. The better question is how to turn AI-written code into trustworthy software: scoped tasks, clear context, automated verification, human review, and a culture that treats speed as valuable only when paired with accountability.

    Sources and Fact Check References

    • GitHub Docs – GitHub describes Copilot agent mode as iterating on code, fixing errors, suggesting terminal commands, and analyzing run-time errors.
    • OpenAI – OpenAI positions Codex as a software engineering agent for tasks such as features, bug fixes, refactors, migrations, tests, and code review.
    • Google Jules Docs – Google Jules supports asynchronous coding tasks using connected repositories, branches, generated plans, and reviewable changes.
    • Anthropic – Anthropic provides Claude Code best practices focused on clear context, planning, testing loops, and project-specific instructions.