---
name: AI for Code & Code Intelligence
description: Use LLMs and coding agents where they genuinely help — refactoring, debugging, test generation, code understanding — with the prompt patterns and the guardrails that make the output trustworthy: every diff reviewed, tests as the acceptance gate, and a human owning the merge, so AI accelerates engineering without eroding correctness.
audience: engineer · tech lead · founding engineer
---

# AI for Code & Code Intelligence

## What this is
A method for applying AI to the software lifecycle effectively: understanding how LLMs and coding agents actually work on code (context, grounding, iteration), and using them for refactoring, debugging, test generation, and comprehension — inside a discipline that keeps a human accountable for what ships.

## What this is NOT
- **Not autonomous coding.** The AI produces; the engineer reviews every diff and owns the merge. Nothing is committed because "the agent said so."
- **Not a correctness oracle.** LLM output can be confidently wrong (hallucinated APIs, subtle logic bugs, insecure patterns); the skill treats generated code as a draft to verify, with tests as the gate, not proof.
- **Not a licence to leak.** Proprietary code and secrets aren't pasted into tools without checking data-handling; on sensitive code, local/permitted models only.

## When to use
Refactoring or modernizing code at speed; debugging with an AI pair; generating unit/property tests; understanding an unfamiliar codebase; scaffolding boilerplate — and deciding where AI helps vs where it adds risk.

## Operating principle
The model produces, the engineer governs. AI is a fast, fallible pair-programmer: give it the right context, constrain the task, and verify the output with tests and review — the acceleration is real, but the accountability stays human, especially on the irreversible.

## Capabilities
- **Prompting & grounding for code** — Goal: useful, in-context output. Method: give the model the real code context and constraints, specify the task and the invariants to preserve, ask for a plan before a large edit, iterate in small verifiable steps; ground against the actual codebase/docs rather than the model's memory. Output: an effective prompting pattern per task + guardrails. Quality bar: edits are small and reviewable; the model is grounded in the real code, not hallucinating APIs.
- **Refactor / debug / test-gen** — Goal: leverage AI on the right jobs. Method: refactors behind a green test suite (behaviour preserved, verified by tests); debugging by hypothesis with the AI proposing and the engineer confirming against reproduction; test generation for edge cases with the human judging relevance. Output: reviewed diffs + generated tests, each verified. Quality bar: a refactor is proven by passing tests, not by the model's assurance; generated tests are read, not trusted blindly.
- **Agent workflows & governance** — Goal: safe use of coding agents. Method: bounded tasks, plan-then-act approval, least-privilege on a branch (never prod creds), tests as the acceptance gate, and a human sign-off on merge; log what the agent did. Output: an agent workflow with review gates. Quality bar: irreversible or high-blast-radius actions are human-gated; every agent change lands as a reviewed PR, not a direct push.

## A worked example
"The agent can just refactor this module and merge it." → Reframed into a governed loop: the module already has (or first gets) a green test suite; the agent proposes the refactor as a small PR with a plan; the engineer reads the diff and runs the tests (behaviour preserved = the gate); generated edge-case tests are reviewed for relevance; the human merges. Speed from the agent, correctness from the tests, accountability from the review — and no direct-to-main push.

## Guardrails & escalation
Merging to production, irreversible actions → human sign-off. Security-sensitive code (auth, crypto, payments) → security review of AI-generated changes. Proprietary/sensitive code → check data-handling; use local/permitted models. Complements the Cline / OpenCode / legacy-codebase-audit skills with the underlying principles.

## References
Effective LLM-for-code practice (context grounding, plan-then-act, small verifiable steps); test-driven refactoring; secure-code review of generated output (OWASP); the "model produces, harness governs" discipline. Verify every AI change with tests and human review.