Protocol-Driven Development: Governing Generated Software Through Invariants and Evidence
For developers using automated program synthesis, PDD provides a principled governance layer to ensure generated code meets formal invariants, addressing the problem of admissibility in automated software construction.
Protocol-Driven Development (PDD) introduces a governance model where machine-enforceable protocols, defined by structural, behavioral, and operational invariants, replace natural-language specs and tests to control which generated code is admissible. This ensures compliance through verifiable evidence chains rather than trust in the generator.
Automated program synthesis has reduced the cost of producing candidate implementations, but it introduces a harder governance problem: determining which generated artifacts are admissible in a software system. Natural-language specifications remain semantically ambiguous, and example-based tests sample only part of the behavioral space. Used alone, neither provides a sufficient control boundary for automated software construction. We introduce Protocol-Driven Development (PDD), a development model in which the primary software artifact is a machine-enforceable protocol rather than implementation code. We define a protocol as the triplet P = (S, B, O), where S specifies structural invariants, B specifies behavioral invariants, and O specifies operational invariants. Their conjunction defines the admissible implementation space of a software component. Under PDD, implementations are treated as replaceable realizations discovered through constrained search. An implementation is admitted if and only if it satisfies the governing protocol and produces a verifiable Evidence Chain of compliance. Admission is therefore grounded not in trust in the generator, but in protocol satisfaction and recorded evidence. By combining ideas from formal methods, property-based testing, policy-as-code, and software provenance, PDD defines a governance layer for automated software engineering. Its organizing principle is simple: code is transient; protocol is sovereign.