Microsoft Research's PDD Kit formally verifies agent-written Rust login code

Microsoft Research describes PDD Kit, a research prototype that turns a developer's intent into a Verus formal specification and then proves that agent-written Rust code meets it for every input.

The method is demonstrated on the login logic of Pet Store, a full-stack Rust web app, where Verus uncovered existing bugs.

The proof does not reach every component. The bcrypt password check and database lookups are covered by tests and an explicitly accepted trust boundary instead. Microsoft says the same process could verify the functional correctness of the entire app, and PDD Kit currently supports only Rust because Verus works only on Rust.