Founder's note · ISL
The bet behind ISL
May 14, 2026 · The Wholestack team · 6 min read
A year building a specification language for AI code. Natural language is the drift, not the interface — here's the thesis, what already ships, and what comes next.
The fantasy and the real ending
Every AI coding tool in 2026 sells the same fantasy: describe what you want, get production code. Anyone who has actually shipped AI-written code knows how that story really ends — it drifts. Three prompts in, the output has wandered off. Six prompts in, the model is patching hallucinations it buried two rounds back. Senior engineers spend their week catching behavior shifts nobody asked for.
That review tax is the reason AI doesn’t cut engineering cost the way the decks promise. I’ve watched my own team pour hours into that tax and call it progress. So here’s what I think the real problem actually is.
Natural language is the drift.
The bet
If the contract between a human and a model is English, then every round trip is a translation, and translation always adds noise. Give them instead a small, exact language — one the human writes and the model has to compile against — and the loop starts to converge. The spec becomes the test. The gate is the same artifact. SHIP or NO_SHIP, no debate at 11pm.
I call it ISL — Intent Specification Language. Not a clever name. An honest one.
What is real today
This isn’t a thesis with a prototype stapled to the back. The infrastructure is shipped. The grammar is small enough to hand-write and big enough to encode API contracts, behaviors, postconditions, and scenarios. A verifier grades generated code against the spec and returns per-category trust scores.
The heal loop has guardrails I had to add after watching it burn tokens: budget caps, retry caps, and a fingerprint tracker that bails the moment the model keeps regenerating the same broken patch. The merge gate — shipgate next . — runs in CI today with real exit codes and JSON-Schema-pinned evidence. One spec source compiles out to TypeScript and OpenAPI 3.1.
And I’ve written publicly about where it’s still weak, because pretending otherwise is how this whole category dies — see that audit. The CLI is on npm, the schemas are pinned to a CDN, and other teams are running it against their own repos right now.
Why this turns into a category
The math isn’t subtle. Teams shipping AI-written code pay a hidden review tax — low six figures a year for a mid-size team, north of a million for one enterprise org, before you even count the seniors who quietly stop reviewing carefully because they’re exhausted. That last cost is the biggest, and nobody puts it on a slide.
A working ISL gives those hours back — not by making the model smarter (nobody knows how to do that on demand) but by handing it a contract it can’t wriggle out of. It’s the missing seam between the LLM and the codebase, and right now nothing owns it.
It becomes a category, not a product, because adoption is the whole game: a spec language is worth whatever the ecosystem standardizes on. The earlier serious teams sit on it, the harder it is to dislodge — which is also exactly why it could fail.
What is next
Three tracks, ordered by how much they unlock.
Track 01
Richer spec primitives
Security and infrastructure expressiveness — cookies, redirect allowlists, rate limits, timing-safe comparisons, secrets-from-vault, token rotation. The spec has to encode the properties the industry already knows are correct, instead of leaving them to vibes.
Opinionated, and learnable in an afternoon, or it loses.
Track 02
Real verification
SMT-backed pre/postcondition proof, taint tracking, type-state machines, property-based fuzzing inside the heal loop, static analyzers wired in as blocking gate signals. The verifier graduates from “test runner with a strong opinion” into an actual verifier.
This is the deepest work on the roadmap — the difference between a strong heuristic and a real proof.
Track 03
Library-pinned codegen
LLMs are great at glue and bad at primitives. The Pro pipeline pins to vetted libraries for the dangerous domains — auth, payments, sessions — and lets the model write the seam, never the cryptography.
Best security-per-dev-month payoff on the roadmap, and probably the one that wins enterprise.
Why we kept going
The biggest unlock on the roadmap isn’t a feature — it’s the verification core itself: real pre/postcondition proof, taint tracking, type-state machines. That’s the part formal methods has been ready to give the industry for twenty years, waiting for someone to actually demand it. Building it is the difference between a test runner with an opinion and a verifier you can trust.
The work continues either way. The architecture is built, the daily-driver product ships today, and the spec language is the lever that turns a useful tool into the layer every AI engineering team eventually depends on. The market gets a vote — and we’re building like the answer is yes.
Natural language was always the drift. The spec is how the loop finally converges.