Code Generation Output Checklist

Use this after an AI generates or modifies code, before you trust or merge it. Go through each item — don't rely on the code "looking right." - Does it actually run? Compile/build errors and typos are the most common failure and the easiest to miss by just reading. - Does it handle the actual inputs your system receives, not just the happy-path example you gave it — empty input, null/undefined, wrong type, huge input? - Does it match the existing codebase's patterns and conventions, or does it introduce a new, inconsistent way of doing something the codebase already does elsewhere? - Did it change more than you asked it to — unrelated files, unrelated refactors, deleted code that wasn't part of the task? - Are there new dependencies added, and are they actually necessary, actively maintained, and reasonably trustworthy? - Does it introduce an obvious security issue — unsanitized input passed to a query or shell command, secrets hardcoded, overly permissive access? - Are there tests, and do they actually exercise the new behavior — not just re-assert what the code does, but check it against what it should do? - Does error handling fail loudly and specifically, or does it silently swallow errors in a way that will be hard to debug later? - If you didn't fully understand a piece of the generated code, can you get an explanation you actually understand — or is it still a black box you're trusting blindly? If you can't check an item (e.g. no way to run it right now), treat that as an open risk you're knowingly accepting, not a box to skip past.