When Green Tests Lie: Coding Agents and Real Runtime Verification
How should AI coding-agent output be evaluated and accepted when unit tests, static analysis, and generated reports all report 100% pass rates, yet a mission-critical user flow fails at the cross-runtime integration boundary under real execution?
The targeted engineering repair and verification architecture: serialization via URLSearchParams (application/x-www-form-urlencoded), exact Turnstile CSP allowlist, dual-tier rate limiting, strict allowlist for source_path, removal of dead TypeScript validation mirrors, and mock-free Playwright E2E testing against an actual spawned PHP runtime.