ai-assisted-development

How we migrated a live routing system using AI-assisted refactoring (opens in new tab)

Stream Router evolved from a small configuration file into a critical control-plane service routing Datadog’s massive metrics workload. Its original FoundationDB key-value model eventually hit transaction-size and performance limits because relational relationships were reconstructed in application code. Datadog redesigned the system around PostgreSQL and DuckDB, using AI-assisted, test-driven refactoring to accelerate the migration without disrupting production traffic. ## Stream Router’s Role in Datadog’s Metrics Pipeline - Datadog processes more than a hundred trillion events per day. - Stream Router determines which Kafka cluster, topic, partitions, and sharding strategy should handle each datapoint. - It serves both producers and queriers but does not process Kafka messages itself. - Routing decisions change frequently as infrastructure evolves, making correctness and historical tracking essential. ## From Configuration File to Control Plane - In 2016, routing was managed through a small configuration file distributed to services. - As the platform grew, the file expanded to thousands of lines and required manual edits and rollouts. - Stream Router replaced this workflow with: - A centralized gRPC service - API-managed routes - Automated, gradual rollouts - The write path used FoundationDB, while the read path served static RocksDB snapshots restored into memory. - This eventually became a bottleneck as routing tables and operational changes grew larger. ## Why the Key-Value Model Stopped Scaling - Routes reference streams and sharding strategies, while rules reference routes. - These relationships are inherently relational and require cross-entity validation. - The KV implementation loaded tens of thousands of records into application processes and reconstructed database-like relationships in code. - Some operations exceeded FoundationDB transaction-size limits. - Moving to PostgreSQL without changing the access patterns would not solve the issue; certain operations were estimated to require 45 minutes because of thousands of sequential database round trips. - The fundamental problem was the data model and application logic, not simply the choice of database. ## Designing the New Storage Architecture - The team redesigned the schema manually before using AI tools. - The relational model introduced explicit foreign keys between: - Streams - Sharding strategies - Routes - Rules - PostgreSQL was selected for the write path because it provided the required relational semantics and transaction model. - DuckDB was selected for the read path because: - It is embeddable and suitable for snapshot-based serving - It supports array columns - Its SQL dialect is closely compatible with PostgreSQL - Shared query logic could therefore work across both storage engines. ## AI-Assisted Refactoring - Claude and Cursor were used to accelerate a systematic, test-driven migration. - For each method, developers supplied: - The old implementation - The new schema - A failing test - AI generated an initial implementation, while tests determined whether it was correct. - The models assisted with method-level refactoring rather than autonomously designing the architecture. - Human expertise remained central to schema design, migration strategy, and evaluating system-level risks. ## Foundations for a Safe Migration - The migration benefited from infrastructure already present at Datadog. - Stream Router’s storage layer was isolated behind an internal `Controller` interface. - This modularity helped contain storage changes and enabled incremental refactoring. - Existing tests and clear boundaries provided confidence in generated implementations while production traffic continued. The central lesson is that AI was most effective as an accelerator inside a disciplined engineering process. A well-designed relational schema, modular storage abstraction, and failing tests provided the safety mechanisms; AI helped implement the resulting changes faster, but did not replace human architectural judgment.

What are git worktrees, and why should I use them? (opens in new tab)

Git worktrees let developers check out multiple branches simultaneously in separate directories, avoiding the stash-and-switch cycle. They preserve editor state, reduce context-switching friction, and make parallel work—especially AI-assisted development—much easier. Their main drawbacks are dependency duplication, folder cleanup, and restrictions on checking out the same branch twice. ## Switching Contexts with Branches and Stashing - Traditional urgent-work flow often requires: - Stashing unfinished changes. - Checking out and updating `main`. - Creating a hotfix branch. - Committing, pushing, and merging the fix. - Returning to the original branch and restoring the stash. - This process creates mental overhead and may involve reloading files, reinstalling dependencies, or resolving stash conflicts. - Some developers compensate with multiple repository clones or increasingly complex stash commands. ## Working in Parallel with Worktrees - A worktree creates another working directory connected to the same Git repository: ```bash git worktree add ../hotfix-workspace -b hotfix-bug main ``` - The original feature branch and editor remain untouched while the hotfix is developed in a separate folder. - After merging, the temporary worktree can be removed: ```bash git worktree remove ../hotfix-workspace ``` - Worktrees eliminate stash conflicts and support truly parallel development. - Tools such as VS Code provide built-in worktree support. ## Why Worktrees Are More Popular Now - Worktrees have existed since 2015 but were historically overlooked because Git GUIs offered limited support. - Developers increasingly run multiple tasks, coding sessions, reviews, and AI agents simultaneously. - Modern tools, including the GitHub Copilot app, use worktrees as a default way to isolate parallel sessions. ## Limitations to Consider - **Dependency bloat:** Each worktree may contain its own `node_modules`, Python packages, or other dependencies. - **Folder management:** Temporary worktrees must be deleted to prevent clutter. - **`.gitignore` concerns:** Worktrees created inside the repository may need to be ignored; placing them outside the repository avoids this issue. - **One-branch restriction:** Git prevents the same branch from being checked out in multiple worktrees simultaneously. ## Worktrees in the GitHub Copilot App - New Copilot sessions can be created in a new worktree by default. - The app displays the generated worktree name, location, associated project, and changes. - Worktree management is integrated into the session workflow. Worktrees are especially useful for parallel development and AI-assisted workflows, but they are not mandatory. Developers can use worktrees, traditional branching and stashing, or a combination depending on their workflow and resource constraints.

Harden your pipeline perimeter for the era of AI-assisted coding (opens in new tab)

AI-assisted coding brings humans, agents, and third-party code together in the software pipeline, increasing the speed at which vulnerabilities can be introduced. The post argues that security tools must become part of the development workflow rather than separate portals. GitLab Ultimate presents this as a three-part control plane: see every risk, automatically enforce policy, and help developers fix vulnerabilities in context. ## See Every Project, Risk, and Action - The Group Security Dashboard consolidates SAST, SCA, secret detection, container, IaC, DAST, and fuzz-testing results across projects. - Security Inventory identifies projects that have never been scanned, exposing governance gaps hidden by project-level dashboards. - Credentials Inventory tracks tokens, owners, scopes, expiration, and revocation status, enabling rapid response to compromised credentials. - Token Lifetime Enforcement applies mandatory maximum lifetimes to tokens. - Audit Event Streaming sends events such as token creation, permission changes, MR approvals, and role updates to SIEM systems in real time. - Group-wide SBOM search helps identify open-source dependency exposure across the project portfolio. ## Enforce Policies Automatically - Scan Execution Policies inject mandatory SAST, SCA, and secret-detection jobs into production pipelines and prevent removal or bypass through configuration such as `[skip ci]`. - Pipeline Execution Policies enforce platform-owned CI templates, closing gaps created by ungoverned or “shadow” pipelines. - MR Approval Policies automate requirements for protected branches, approvers, and code owners. - The Compliance Center maps controls to SOC 2, ISO 27001, NIST, and PCI DSS while providing live dashboards and audit trails. - Secret Push Protection rejects credentials before they enter Git history and records bypass attempts. ## Fix Vulnerabilities in the Development Workflow - The MR security widget displays SAST, SCA, container, IaC, and secret findings directly alongside code changes before they reach the default branch. - Advanced SAST uses cross-file taint analysis to trace untrusted input from source to sink. - GitLab Duo helps identify likely false positives and explain the reasoning behind its assessment. - The Duo Security Analyst Agent prioritizes issues using exploitability, exposure, and business context in addition to CVSS. - Agentic Vulnerability Resolution can create fix merge requests for high-impact SAST findings, allowing developers to review and merge changes through the normal approval process. The practical recommendation is to make security controls native to the pipeline. For organizations adopting AI-assisted development, GitLab Ultimate’s integrated visibility, automated enforcement, and AI-supported remediation are presented as a way to maintain security without sacrificing delivery speed.

Double Click: When Coding Becomes Conversation | Figma Blog (opens in new tab)

Vibe coding replaces much of traditional programming with an ongoing conversation with AI: users describe an idea, review the result, and iterate through prompts. It lowers the barrier to creating software and makes experimentation faster, especially for prototypes and side projects. However, the approach can become unreliable as projects grow, producing tangled code and weak internal architecture. ## From Code to Conversation - Andrej Karpathy coined “vibe coding” to describe building software by talking to AI tools such as Cursor Composer and using voice input. - The process emphasizes seeing results, describing changes, running the project, and copying or pasting outputs rather than understanding every line of code. - The idea reflects a broader history of abstraction, from punch cards to assembly, C, Python, and now AI-assisted development. ## Faster, More Accessible Prototyping - Vibe coding lets people express interactive ideas without mastering syntax or a programming language. - Charmaine Lee of Val Town compares it to casually writing in a document or creating a spreadsheet. - Figma designer Nikolas Klein argues that the main benefit is shortening the gap between imagining an interaction and seeing it work. - Replit CEO Amjad Masad reported that 75% of Replit customers never write a line of code. - Figma engineer Vincent van der Meulen used AI to create projects, including a running coach and a loading animation, despite lacking SwiftUI expertise. ## The Complexity Ceiling - Vibe coding is most effective at the beginning of a project, when requirements are simple and experimentation matters more than structure. - As complexity increases, AI-generated solutions may stop fitting together coherently. - Developers can reach a “valley of despair”: an initial burst of progress gives way to difficult debugging and maintenance. - Vincent described ending up with “spaghetti code” and no consistent internal data model after reaching roughly 80% of his goal. Vibe coding is best treated as a powerful prototyping and exploration technique, not a replacement for engineering judgment. Teams should still inspect, test, refactor, and architect AI-generated code when projects become complex or production-critical.