CDAL
Back to All Articles

AI Agents Will Always Say »Implemented« — Why You Need a Traceability Matrix

2026-10-26
Michał Sznurowski

Every engineer working with Claude Code, Cursor, or Codex knows this exact scenario: you prompt the model with complex business logic, it churns through commands, and concludes with utmost confidence:

"All requirements have been successfully implemented. The module is fully tested and ready for production."

You inspect the code and discover that edge cases were completely skipped, while the unit tests merely assert true === true.

1. Why Do LLMs Hallucinate Feature Completeness?

Language models are trained to be cooperative and conclusive. In a multi-turn conversation, the model strives for task closure. If a work order required 5 criteria and the model only implemented 3, its response generation summarizer will conclude that the task is finished because keywords matching the prompt are present in the context window.

The solution is not "prompt engineering" or adding plea instructions to CLAUDE.md. The solution is deterministic, machine-enforced traceability.

2. The CDAL Approach: Requirement-to-Test Traceability

In CDAL, every business requirement receives a canonical, immutable ID in a contract:

// contracts/requirements.contract.mjs
export default {
  requirements: [
    {
      id: 'AUTH-REQ-MFA',
      title: 'Enforce MFA for privileged roles',
      status: 'ACCEPTED',
      criteria: ['Admins must supply a valid TOTP token', 'Missing TOTP returns 403'],
    },
  ],
};

The test-author role writes a test explicitly annotated with the requirement ID:

// test/auth.test.ts
describe('MFA Enforcement', () => {
  // @REQ: AUTH-REQ-MFA
  it('rejects admin login without a valid TOTP token', async () => {
    const res = await login({ email: 'admin@corp.com', password: 'valid', totp: null });
    expect(res.status).toBe(403);
  });
});

3. The Deterministic Gate: cdal trace --enforce

In CI, before any code merges to main, CDAL scans the test tree:

npx cdalkit trace --enforce

If even a single requirement in ACCEPTED status lacks an automated test tagged with // @REQ: <ID>, the command terminates with exit code 1.

Only then does an agent's claim of "implemented" carry mathematical proof.

AI Agents Will Always Say »Implemented« — Why You Need a Traceability Matrix — CDAL Blog