Agentic Separation Logic Specification Synthesis

Abstract: Specification synthesis, the task of automatically inferring formal specifications from program implementations and natural language, is important for refactoring, transpilation, optimization, and verification, yet remains an open challenge for large C++ repositories. Existing LLM-based approaches fail to simultaneously scale to such repositories, produce specifications expressive enough to capture systems-code features such as dynamic memory and heap-allocated data structures, and systematically validate those specifications to rule out incorrect candidates. We present Spec-Agent, an agentic system for synthesizing expressive, well-validated specifications across large C++ codebases. Spec-Agent targets a ladder of specification languages: propositional logic, first-order logic, propositional separation logic, and first-order separation logic. For each function, Spec-Agent uses static analysis and runtime heap tracing to select the appropriate target specification language, generalizes existing functional tests into fuzz harnesses, and iteratively refines LLM-generated candidates via counterexample-guided feedback. We evaluate Spec-Agent on open source C++ codebases comprising millions of lines of code. Spec-Agent synthesizes valid specifications for 85% of target functions, with no false positives observed under fuzzing and expert validation, outperforming Claude Code Opus 4.6 at 10x lower token cost.

• The paper demonstrates Spec-Agent's ability to synthesize validated C++ contracts with up to 85.87% success on evaluated repositories.
• It employs an adaptive logic ladder and coverage-guided fuzzing to generate rich, expressive specifications for memory-intensive codebases.
• The methodology ensures cost efficiency with 10× lower token costs and zero unsound contracts through rigorous counterexample-guided refinement.

Agentic Separation Logic Specification Synthesis: An Expert Review

Motivation and Context

Specification synthesis remains an unsolved problem for large-scale, memory-intensive C++ codebases, despite progress in LLM-based code generation. Prior approaches fail to simultaneously scale, express rich heap semantics, and systematically validate synthesized contracts. This paper introduces Spec-Agent, an agentic system for automatic inference of expressive, validated specifications targeting a hierarchy of logics: propositional, first-order, propositional separation logic, and first-order separation logic. Spec-Agent is evaluated on multi-million line C++ repositories and demonstrates superior specification validity and cost efficiency compared with leading agentic coding baselines.

Spec-Agent Architecture

Spec-Agent orchestrates a multi-stage pipeline:

• Code Mining: Static and dynamic features (e.g., syntactic structure, induction variables, heap access patterns) are extracted per function.
• Fuzz Harness Generation: Existing unit tests are generalized to fuzz harnesses via LLM agents, enabling execution coverage far beyond fixed hand-written inputs.
• Specification Language Selection: A logic ladder (Prop, FOL, Prop SL, FOSL) is adaptively selected per function, leveraging heap traces and loop detection.
• Specification Generation: LLMs synthesize candidate contracts given code context, documentation, prompt grammar, and manually written language exemplars.
• Specification Fuzz Testing: Contracts are compiled to runtime assertions, stress-tested under coverage-guided fuzzing; rejection and refinement are counterexample-guided.
• Specification Refinement: Contracts progress within an order-theoretic lattice, with acceptance conditioned on both validation and expressivity. The refinement loop ensures structural feedback and deterministic progression.

  Figure 1: The Spec-Agent refinement loop, showing automated fuzz-driven validation and iterative candidate improvement.

  

  Figure 2: Spec-Agent tracks specification progress in an order-theoretic lattice, enforcing expressive contract synthesis.

Formal Specification Languages

Spec-Agent targets four specification languages (Prop, FOL, Prop SL, FOSL), each with distinct grammatical operators designed for capturing conditional logic, loops, and heap-manipulation:

• Propositional logic: conjunction, disjunction, negation.
• First-order logic: quantification required for loop invariants.
• Separation logic: points-to ( $x \mapsto n$ ), separating conjunction ( $p \star q$ ), essential for heap correctness.
• First-order separation logic: combines quantification and heap relations, enabling specification of iterated memory properties.

Figure 3: The propositional logic specification grammar as a foundational element for code contracts.

Quantitative Results

Spec-Agent achieves strong performance across two evaluated repositories (BDE, BMQ):

• Specification validity: Up to 85.87% of BDE functions and 77.73% of BMQ functions have valid synthesized contracts, outperforming Claude Code Opus 4.6 and Sonnet 4.6 by 4–15%.
• Expressivity: Spec-Agent generates contracts with mean atom counts of 3.35 (BDE) and 4.15 (BMQ), versus 2.34 and 2.46 for Claude Code, indicating richer logical descriptions.
• No false positives: Fuzzing and expert review found zero unsound contracts in Spec-Agent outputs.
• Cost efficiency: Spec-Agent operates at 10× lower token cost than Claude Code for comparable validity.

  Figure 4: Spec-Agent vs Claude Code on specification validity and dollar cost.

Practical Validation via Fuzzing

Spec-Agent uses coverage-guided fuzzing as a strong pseudo-oracle for contract validation, generalizing unit tests to maximize input diversity:

• On BDE, 0.4% of candidates passing unit tests are rejected by fuzzing; on BMQ, this figure is 8.0%, demonstrating fuzzing's critical role in eliminating unsound specifications beyond traditional testing regimes.
• Testing dominates inference time, with per-function means at 400s for fuzzing versus 170s for LLM inference.

Figure 5: Distribution of cumulative inference time per validated specification.

Qualitative Analysis

Contracts synthesized by Spec-Agent not only match observed code behaviors but frequently capture the strongest post- and loop invariants due to adaptive specification language selection. The system achieves high coverage and expressive contracts for a majority of functions, particularly those with memory manipulations and nontrivial control flow. However, inference of the strongest possible specification remains challenging—especially for functions requiring full FOSL—suggesting that stronger LLM modeling or formal algorithmic advances are needed.

Related Work and Comparative Capability

Spec-Agent is the first system to unify the following dimensions:

• Scalability to multi-million line C++ repositories
• Synthesis of both pre- and postconditions
• Full separation logic support
• Adaptive logic selection per function
• Systematic fuzz harness generation and validation
• Counterexample-guided deterministic refinement

Prior work—such as Daikon [ErnstPGMPTX07], SLING [LeZN19], and Fun2Spec [ugare2025fun2spec]—falls short on at least one major dimension (scalability, logic expressivity, or validation methodology). Spec-Agent sets a new standard for real-world contract synthesis.

Implications and Future Directions

The practical impact of Spec-Agent is multifold:

• Formal specifications generated at scale support code translation, refactoring, optimization, and verification for safety-critical software.
• Automated contract synthesis enables systematic security auditing, formal documentation generation, and paves the way for agentic vulnerability discovery pipelines.
• Fuzz-guided validation offers a scalable alternative to full formal verification, especially for languages such as C++ with immature program provers.

Theoretically, Spec-Agent demonstrates that counterexample-driven agentic refinement, combined with adaptive logic selection and coverage-guided fuzzing, is both tractable and superior to stochastic agentic exploration. Future developments may involve further integration of symbolic reasoning, higher-order logics, or automated strongest specification inference.

Figure 6: Distribution of evaluated function code length, demonstrating Spec-Agent's coverage of both short and long functions.

Conclusion

Spec-Agent represents a significant advance in large-scale, expressive, validated code contract inference for C++ repositories. Through adaptive logic selection, fuzz-guided validation, and agentic refinement, it achieves both superior specification validity and expressive power at a fraction of baseline costs. Practical deployment will make such specification synthesis integral to verification, translation, and security pipelines. Further work should focus on strongest specification synthesis and more advanced validation methodologies.