Terms behind healthier AI-written code

AGENTS.md is a repository instruction file that tells coding agents how to work inside a codebase without breaking local conventions, safety rules, or validation workflows.

AI code review uses automated analysis to inspect code changes for security, quality, dependency, and test risks before humans approve or ship them.

Autofix is a bounded improvement that changes code to address a verified risk, then leaves the result for human review before it becomes part of the project.

Codebase hygiene is the day-to-day maintainability of a repository: clear structure, low duplication, working checks, current dependencies, and patterns that future changes can follow.

Cognitive debt is the hidden cost of code whose intent, constraints, and behavior are hard to recover when a human or coding agent needs to change it later.

DAST tests a running application from the outside to find security issues that only appear when routes, forms, authentication, and runtime behavior are exercised.

Dependency hygiene is the practice of keeping third-party packages known, current, necessary, and safe enough for the project that depends on them.

The green zone is the maintained state where a project's current audit areas are healthy enough for coding agents to keep building on it without compounding known risks.

A hallucinated package is a dependency name suggested by an AI tool even though the package does not exist, is not the intended package, or cannot be trusted.

Human approval is the control point where a person reviews a proposed automated change before it is applied, merged, or allowed to affect the project.

A recurring audit is a scheduled or repeated check that measures project health again as the repository and linked product change over time.

SAST analyzes source code or compiled code without running the application to find security flaws before they reach a live environment.

Slopsquatting is a supply-chain attack where someone registers package names that AI tools are likely to hallucinate, hoping developers or agents will install them.

Software Composition Analysis, or SCA, identifies third-party components and checks them for known vulnerabilities, license risk, and supply-chain exposure.

Test quality is the degree to which a test suite proves important behavior instead of merely producing a green status that can hide missing assertions or weak coverage.