Code Completion Pipeline:

1: Context Gathering
   ├── Current file (cursor position)
   ├── Open tabs / related files
   ├── Import statements (dependency hints)
   ├── Recent edits (intent signals)
   └── Project structure (file tree)

2: Prompt Construction
   ├── Prefix (code before cursor)
   ├── Suffix (code after cursor)
   └── Metadata (language, framework, file path)

3: Model Inference
   └── Generate completion tokens

4: Post-Processing
   ├── Filter low-confidence suggestions
   ├── Deduplicate
   ├── Format to match style
   └── Present to user (inline ghost text)

# Validate that the email has a valid format, domain exists (MX record),
# and is not from a disposable email provider. Return a ValidationResult
# with is_valid, reason, and suggestions fields.
def validate_email(email: str) -> ValidationResult:
    # AI generates implementation based on the detailed comment
    ...

Pattern: Describe → Constrain → Example

"Write a TypeScript function that [DESCRIPTION].
It should [CONSTRAINTS].
Example: [INPUT] → [OUTPUT]"

Pattern: Context → Problem → Ask

"I have a React component that renders a list of users.
Currently it re-renders the entire list when any user updates.
How should I optimize this to only re-render changed items?"

Pattern: Role → Task → Format

"As a senior Python developer reviewing this code,
identify potential issues with error handling, type safety, and performance.
Format as a numbered list with severity (high/medium/low)."

Review this code for:
1. Correctness: Does it handle edge cases (empty input, null, overflow)?
2. Security: Any injection, auth bypass, or data exposure risks?
3. Performance: Any O(n²) where O(n) is possible? Unnecessary allocations?
4. Maintainability: Clear naming? Single responsibility? Testable?

For each issue found, provide:
- Severity (critical/high/medium/low)
- Line reference
- What's wrong
- Suggested fix

# Prompt: "Generate comprehensive tests for this function"

def calculate_shipping(weight: float, distance: int, express: bool = False) -> float:
    """Calculate shipping cost based on weight, distance, and speed."""
    base_rate = 5.0
    weight_rate = 0.5 * weight
    distance_rate = 0.01 * distance
    total = base_rate + weight_rate + distance_rate
    if express:
        total *= 1.5
    return round(total, 2)

# AI-generated tests:
import pytest

class TestCalculateShipping:
    def test_base_rate_only(self):
        assert calculate_shipping(0, 0) == 5.0
    
    def test_weight_contribution(self):
        assert calculate_shipping(10, 0) == 10.0  # 5 + 0.5*10
    
    def test_distance_contribution(self):
        assert calculate_shipping(0, 1000) == 15.0  # 5 + 0.01*1000
    
    def test_combined(self):
        assert calculate_shipping(4, 500) == 12.0  # 5 + 2 + 5
    
    def test_express_multiplier(self):
        assert calculate_shipping(0, 0, express=True) == 7.5  # 5 * 1.5
    
    def test_express_with_weight_and_distance(self):
        result = calculate_shipping(4, 500, express=True)
        assert result == 18.0  # (5 + 2 + 5) * 1.5
    
    def test_negative_weight_raises(self):
        # AI might suggest this — reveals missing validation
        with pytest.raises(ValueError):
            calculate_shipping(-1, 100)
    
    def test_rounding(self):
        result = calculate_shipping(3.33, 777)
        assert result == round(5 + 0.5*3.33 + 0.01*777, 2)

# Give AI a function and ask for documentation:

def merge_intervals(intervals: list[tuple[int, int]]) -> list[tuple[int, int]]:
    if not intervals:
        return []
    sorted_intervals = sorted(intervals, key=lambda x: x[0])
    merged = [sorted_intervals[0]]
    for start, end in sorted_intervals[1:]:
        if start <= merged[-1][1]:
            merged[-1] = (merged[-1][0], max(merged[-1][1], end))
        else:
            merged.append((start, end))
    return merged

# AI-generated documentation:
"""Merge overlapping intervals into non-overlapping intervals.

Given a list of intervals represented as (start, end) tuples,
merge all overlapping intervals and return the result sorted
by start time.

Args:
    intervals: List of (start, end) tuples where start <= end.

Returns:
    List of merged non-overlapping intervals, sorted by start.

Examples:
    >>> merge_intervals([(1, 3), (2, 6), (8, 10)])
    [(1, 6), (8, 10)]
    >>> merge_intervals([(1, 4), (4, 5)])
    [(1, 5)]
    >>> merge_intervals([])
    []

Time Complexity: O(n log n) due to sorting.
Space Complexity: O(n) for the output list.
"""

Pattern: Error → Context → Question

"I'm getting this error:
[paste full error with stack trace]

This happens when:
[describe the conditions]

The relevant code is:
[paste the function/module]

What's causing this and how do I fix it?"

Security Concerns with AI-Generated Code:

1: Injection vulnerabilities
   AI may generate string concatenation instead of parameterized queries

2: Hardcoded credentials
   Training data includes examples with real-looking secrets

3: Insecure defaults
   May use HTTP instead of HTTPS, weak crypto algorithms

4: Missing input validation
   Generated code often skips boundary checks

5: Dependency confusion
   May suggest packages that don't exist (typosquatting risk)

6: Information leakage
   Generated error handlers may expose internal details

Mitigation:
- Run SAST/DAST on all generated code
- Never trust AI-suggested package names without verification
- Review security-sensitive code manually regardless of source
- Use AI-aware security scanning tools

Problem: Models have training data cutoffs

Symptoms:
- Suggests deprecated APIs (e.g., old React lifecycle methods)
- Doesn't know about new language features
- References old library versions
- Misses breaking changes in frameworks

Mitigation:
- Always specify versions: "Using React 19, Next.js 15"
- Provide relevant documentation snippets in context
- Use tools with documentation retrieval (Cursor @docs, RAG)
- Verify suggestions against current official docs

CI Pipeline with AI Review:

┌─────────────┐     ┌──────────┐     ┌───────────┐     ┌──────────┐
│ Push / MR   │ ──→ │  Build   │ ──→ │   Test    │ ──→ │  Deploy  │
└─────────────┘     └──────────┘     └───────────┘     └──────────┘
       │                                    │
       ↓                                    ↓
┌─────────────┐                    ┌───────────────┐
│ AI Review   │                    │ AI Test Gen   │
│ (non-block) │                    │ (suggestions) │
└─────────────┘                    └───────────────┘

Findings from studies (GitHub, Microsoft, academic):

- 30-55% faster task completion for well-defined tasks
- Minimal improvement for complex architectural work
- Junior developers benefit more than seniors
- Quality impact is mixed (faster but sometimes buggier)
- Biggest gains: boilerplate, tests, documentation
- Smallest gains: novel algorithms, system design, debugging complex issues

Should I use AI for this task?

Is the task well-defined with clear inputs/outputs?
  YES → AI likely helps
  NO  → AI may produce plausible but wrong results

Is correctness critical (security, financial, safety)?
  YES → Use AI for drafting, human verifies everything
  NO  → AI can do more autonomously

Does the task require full system context?
  YES → Provide extensive context or do it manually
  NO  → AI works well with local context

Is this a common pattern or novel problem?
  COMMON → AI excels (it's seen thousands of examples)
  NOVEL  → AI may hallucinate; use for brainstorming only

Am I faster doing this manually?
  YES → Skip AI (context switching has a cost)
  NO  → Use AI and review the output

Effective design prompt structure:

"I'm designing [system/component] that needs to:
- [Requirement 1 with specific numbers]
- [Requirement 2]

Constraints:
- [Budget, team size, timeline]
- [Existing systems it must integrate with]
- [Non-negotiable technology choices]

I'm considering [Option A] vs [Option B].
What are the trade-offs I might be missing?"

"Generate a Mermaid diagram for an e-commerce backend with:
- API gateway routing to auth, orders, and search services
- Orders use PostgreSQL and publish to SQS for notifications
- Search uses Elasticsearch
- Orders service has a Redis cache layer"

What AI doesn't know about your system:

- Actual traffic patterns and growth projections
- Team expertise and hiring plans
- Budget constraints and cost sensitivity
- Existing technical debt and migration timelines
- Organizational politics and decision-making culture
- Compliance requirements specific to your industry
- Performance characteristics of your current infrastructure
- Undocumented dependencies between services

Rule: AI proposes options and trade-offs.
      Humans make decisions based on constraints AI can't see.

# Step 1: Describe the problem with constraints
prompt_1 = """
We need a real-time notification system for 50K concurrent users.
Constraints: AWS only, budget < $2K/month, team of 3 backend devs,
must integrate with existing PostgreSQL database.
Current stack: Python/FastAPI, deployed on ECS Fargate.
What architecture options should we consider?
"""

# Step 2: Drill into the recommended option
prompt_2 = """
You suggested WebSockets via API Gateway + Lambda.
How does this handle:
- Connection drops and reconnection?
- Message ordering guarantees?
- Scaling beyond 50K connections?
Show me the failure modes.
"""

# Step 3: Ask for the diagram
prompt_3 = """
Generate a Mermaid sequence diagram showing the happy path
and one failure/reconnection scenario for this WebSocket approach.
"""

# Prompt: "Explain what this legacy function does, what its side effects are,
# and what would break if I changed the sort order"

def process_batch(records, config):
    # 200 lines of undocumented legacy code
    # AI can trace the logic and explain:
    # - Data transformations applied
    # - External calls made (DB, APIs)
    # - Implicit assumptions (sort order, null handling)
    # - Side effects (file writes, state mutations)
    ...

// Prompt: "Generate a migration script that converts our Express.js
// middleware to Fastify plugins. Here's an example middleware:"

// Before (Express):
function authMiddleware(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) return res.status(401).json({ error: 'No token' });
  try {
    req.user = jwt.verify(token, process.env.JWT_SECRET);
    next();
  } catch {
    res.status(401).json({ error: 'Invalid token' });
  }
}

// AI-generated (Fastify):
import { FastifyPluginAsync } from 'fastify';
import fp from 'fastify-plugin';
import jwt from 'jsonwebtoken';

const authPlugin: FastifyPluginAsync = async (fastify) => {
  fastify.decorateRequest('user', null);

  fastify.addHook('onRequest', async (request, reply) => {
    const token = request.headers.authorization?.split(' ')[1];
    if (!token) {
      reply.code(401).send({ error: 'No token' });
      return;
    }
    try {
      request.user = jwt.verify(token, process.env.JWT_SECRET!);
    } catch {
      reply.code(401).send({ error: 'Invalid token' });
    }
  });
};

export default fp(authPlugin, { name: 'auth' });

Migration checklist prompt:

"I'm upgrading from [library v2] to [library v4].
Here are my imports and usages: [paste grep results]

For each usage, tell me:
1. Is this API still available in v4?
2. If changed, what's the new equivalent?
3. Are there behavioral changes (same API, different behavior)?
4. Priority: breaking (won't compile) vs subtle (compiles but behaves differently)"

Problem: Legacy codebases exceed AI context windows

A typical enterprise monolith:
- 500K+ lines of code
- 2000+ files
- Context window: 100K-200K tokens ≈ 50-100 files max

Strategies:
┌─────────────────────────────────────────────────┐
│ 1. Work module by module                        │
│    - Migrate one bounded context at a time      │
│    - Provide AI with just that module + its     │
│      interfaces to the rest of the system       │
│                                                 │
│ 2. Use dependency graphs as context             │
│    - Feed AI the import/call graph, not all code│
│    - Ask it to identify migration order         │
│                                                 │
│ 3. Summarize then detail                        │
│    - First pass: AI summarizes each module      │
│    - Second pass: detailed migration per module │
│                                                 │
│ 4. Focus on interfaces                          │
│    - Migrate public APIs first                  │
│    - Internal implementation can follow         │
└─────────────────────────────────────────────────┘

Onboarding prompt sequence:

1. "Here's the project structure [paste tree output].
    What kind of application is this? What framework and patterns does it use?"

2. "Here's the main entry point [paste file].
    Trace the request lifecycle from incoming HTTP to response."

3. "Here are the model files [paste].
    What's the domain model? Draw a Mermaid ER diagram."

4. "Here's the test suite structure [paste].
    What's well-tested vs undertested?"

# Feed AI a complex function and ask targeted questions:

# "What does this function do? What are the edge cases?
#  Why might the original author have used a generator here
#  instead of returning a list?"

def resolve_dependencies(graph: dict[str, set[str]]) -> Iterator[set[str]]:
    """Kahn's algorithm for topological sort, yielding parallel batches."""
    in_degree = {n: 0 for n in graph}
    for node in graph:
        for dep in graph[node]:
            in_degree[dep] = in_degree.get(dep, 0) + 1

    queue = {n for n, d in in_degree.items() if d == 0}
    while queue:
        yield queue
        next_queue = set()
        for node in queue:
            for dep in graph.get(node, []):
                in_degree[dep] -= 1
                if in_degree[dep] == 0:
                    next_queue.add(dep)
        queue = next_queue

Prompt: "Based on these files, generate a developer onboarding doc covering:
1. How to run the project locally
2. Architecture overview (with Mermaid diagram)
3. Key abstractions and where to find them
4. Common development tasks (add endpoint, add migration, run tests)
5. Gotchas and non-obvious conventions"

Input: package.json, docker-compose.yml, src/ tree, 2-3 key files
Output: A README that would save a new developer 2 days of exploration

# Round 1: Initial generation
# Prompt: "Write a rate limiter using sliding window"
# AI produces a basic implementation

# Round 2: Add constraints
# "This needs to work in a distributed system with Redis.
#  Multiple instances share the same rate limit per user."

# Round 3: Handle edge cases
# "What happens during Redis failover? I need a fallback
#  that's permissive (allow traffic) rather than blocking."

# Round 4: Production hardening
# "Add structured logging, metrics emission, and make the
#  window size and limit configurable per endpoint."

# Each round builds on the previous — don't start over.
# Keep the conversation context so AI remembers decisions.

Warning signs you're over-relying on AI:

- You accept code you don't fully understand
- You can't explain WHY the code works, only THAT it works
- You've stopped reading documentation directly
- You paste errors into AI without trying to understand them first
- Your debugging process is "ask AI" before "read the error message"
- You feel less confident coding without AI assistance

Healthy habits:
- Understand every line before committing
- Periodically code without AI to maintain skills
- Use AI to learn, not just to produce
- Read the docs AI references — don't just trust the summary
- If AI gives you a pattern you don't recognize, learn it properly

# DANGEROUS — AI often generates this:
query = f"SELECT * FROM users WHERE email = '{email}'"
cursor.execute(query)

# SAFE — what you should always use:
cursor.execute("SELECT * FROM users WHERE email = %s", (email,))

// DANGEROUS — AI often generates this:
const token = "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
const response = await fetch(url, {
  headers: { Authorization: `Bearer ${token}` }
});

// SAFE — environment variables:
const token = process.env.GITHUB_TOKEN;
if (!token) throw new Error('GITHUB_TOKEN not configured');
const response = await fetch(url, {
  headers: { Authorization: `Bearer ${token}` }
});

Before committing AI-generated code, verify:

□ Authentication & Authorization
  - Are all endpoints protected appropriately?
  - Is there role-based access where needed?

□ Input Validation
  - Are all user inputs validated and sanitized?
  - Are file uploads restricted by type and size?
  - Are path parameters checked for traversal?

□ Secrets Management
  - No hardcoded credentials, API keys, or tokens?
  - Secrets loaded from environment or vault?

□ Query Safety
  - All database queries parameterized?
  - No string interpolation in queries?

□ Error Handling
  - No stack traces or internal details in responses?
  - Errors logged server-side, generic message to client?

□ Dependencies
  - All suggested packages verified to exist?
  - Package names checked for typosquatting?
  - Versions pinned?

□ Cryptography
  - Using current algorithms (bcrypt/argon2, AES-256, SHA-256+)?
  - No MD5 or SHA-1 for security purposes?
  - No custom crypto implementations?

Real attack vector:

1. Researchers find AI frequently suggests "python-jwt" (doesn't exist)
2. Attacker publishes malicious "python-jwt" on PyPI
3. Developer asks AI for JWT code, gets: pip install python-jwt
4. Developer installs it without checking → compromised

Defense:
- ALWAYS verify package exists on the official registry
- Check download counts, maintainer, and publish date
- Compare against known legitimate packages:
  PyJWT (not python-jwt), requests (not python-requests)
- Use lockfiles and dependency scanning in CI