TLA+

Block specified the Git storage protocol behind Buzz in TLA+ and model-checked it for durability, reconstruction, and concurrent pushes. Tyler Longwell's engineering post of 21 July 2026 describes what is being checked: repositories held as immutable content-addressed packfiles plus a mutable manifest pointer, advanced by a conditional compare-and-swap that serves as the commit point. The result is conditional. It holds only under three explicit guarantees from the object store, which is why Block pairs it with a conformance suite per backend.

TLA+ shows up a second time in the same codebase: multi-tenant isolation is mechanized in TLA+, authorization properties in Tamarin. The research report of 12 August 2026 treats that amount of formal work as rare for a v0.4.x/0.5.x release.

Julien Lépine, CTO of AWS France, frames it differently in If This Then Dev #351. When code can be generated at 100,000 lines a day, the problem becomes keeping control without reading all of it. He describes formal modeling in TLA+ as a way to hold invariants, with automated reasoning to bound agents and AI checking divergence between code and model. DynamoDB, at more than 5,000 billion requests per hour, is the scale he cites.

Block, Boris Cherny, and DynamoDB are the users on record, which puts a formal specification language at the center of the agent-generated-code question. Longwell's post carries no figures and no benchmarks: it is a design exposition, and what it costs to keep the model aligned with the code goes unstated.