4 Integrity Levels
Track change impact with function, static context, module/class, and file-level hashes.
AI Code Governance for Mission Critical SW
Gen AI codemust be reviewed by humans
In Automotive and functional-safety software, the provenance, integrity, review status, and change-control evidence of AI-generated code must be managed rigorously.
Synetics defines this process and applies solutions that identify AI-generated code and support reviewers so it can run inside the actual development workflow.
ISO 26262 supporting controlA‑SPICE SWE.3 / SWE.4VS Code + JenkinsHash-based Integrity
Flow with separated consulting, human, AI, and tool roles
Flow01
ConsultingDefine the AI coding method
02
HumanRequest AI code generation
03
AIGenerate code according to the defined method
04
ToolIdentify AI-generated code and secure integrity
05
ToolPresent review targets and suggest review items
06
HumanPerform review
07
ToolStore review results for AI-generated code
08
ToolShow AI-generated code status dashboard
Consulting defines the coding method, humans request generation and perform the final review, and tools manage AI-code identification, integrity, and review evidence.
3 Tool Components
Connect IDE and CI with AICodeGenSaver, AICodeGenReviewer, and AICodeGenDashboard.
CI Review Gate
Verify annotations, hashes, review status, and policy violations in Jenkins.
Why It Matters
AI-generated code needs control before speed
Merging AI-generated code without controls can create missing requirements, unintended behavior, weak review evidence, and tool-confidence issues.
Weak traceability
Without model, prompt, requester, and base commit information, teams cannot explain why code was generated.
Insufficient review evidence
Safety activities need objective evidence of who reviewed the code and when approval happened.
Undetected integrity regression
If reviewed code changes without status regression, change control and re-review discipline break down.
Operating Flow
Turn AI candidate code into approval-ready evidence
The flow connects developer prompts, IDE automation, human review, and Jenkins evidence output.
01
Requirement-based generation request
Include requirement ID, change ID, safety class, and allowed change scope in the Gen AI request.
02
Automatic annotation and hash injection
On save, the IDE plugin calculates provenance and function/context/module/file hashes.
03
Human review and status transition
AI cannot set Reviewed. Only human reviewers can record Reviewed or ReworkRequired.
04
CI gate and audit evidence
Jenkins verifies placeholders, hash mismatches, incomplete reviews, and independence violations.
Integrity Model
Manage AI provenance by logical unit, not whole files
Even when human-written and AI-generated code coexist in one file, change impact and re-review scope remain traceable.
L1
Function-Level
Normalize function signatures and bodies by AST and manage them with @funcId.
L2
Static Context Block
Track compile-time context such as includes, defines, typedefs, and constexpr values with @staticContextId.
L3
Module / Class-Level
Track class, struct, and namespace-level changes using a Merkle Tree style @moduleId.
L4
File-Level
Combine valid node hashes into @fileHash for Jenkins quick integrity checks.
Tool Architecture
The process must run inside development tools, not remain a document
Two VS Code plugins and one Jenkins plugin operationalize the defined process in daily engineering.
VS Code on-save hook
AICodeGenSaver
- Update annotation placeholders
- Calculate function/context/module/file hashes
- Regress review status after reviewed-code changes
Human review support
AICodeGenReviewer
- Identify review targets
- Show review-only Gen AI guidance
- Record human reviewer status history
Jenkins verification gate
AICodeGenDashboard
- Re-verify annotations and hashes
- Apply Advisory / Blocking policies
- Generate dashboard and audit artifacts
Consulting Scope
Design tool development and process adoption together
This is not just plugin development. It connects Safety Plan, A‑SPICE activities, coding rules, and CI/CT operations.
Process policy design
Define AI code policy, state model, annotation rules, review regression policy, and gate criteria.
Project adoption consulting
Align the process with requirement/change/safety classification systems and Git/Jenkins operations.
Tool confidence support
For safety projects, structure IDE/Jenkins plugins as software tool confidence assessment targets.
Review and verification operations
Connect human review, AI review guidance, static analysis, unit testing, and CI quality gates without conflict.
Evidence Dashboard
Leave metrics and artifacts for audits and process assessment
Jenkins results should be stored as JSON, HTML, or CSV artifacts, not just displayed on a screen.
Gen AI code LOC and ratio
Review target functions/files and completion rate
AI code ratio by model and module
Hash mismatches and review regressions
Average review lead time and reviewer progress
FAQ
Questions this process must answer
Does this process automatically guarantee ISO 26262 or A‑SPICE compliance?
No. It is a supporting control and must operate with the Safety Plan, coding rules, verification strategy, and quality assurance activities.
Can AI set the review state to Reviewed?
No. AI-generated output remains candidate code, and final state transition must be explicit human reviewer action.
Why manage function and context units instead of whole files?
Human-written and AI-generated code can coexist in one file. Logical-unit hashes make re-review scope practical and traceable.
Next Step
AI code generation needs governance, not just speed
For mission-critical software, teams must explain how AI code was generated, changed, reviewed, and approved. We can review the adoption scope for your current process.