Δ Delta
Constraint craft for AI-assisted code in regulated systems

Delta: Closing the
Specification Gap

Generation got cheap. Verification did not. This is the book on what you actually write to make AI-generated code survive a regulated production system.
Sandeep Dhuri Author and Independent Researcher · Two decades in financial services, healthcare & insurance
Abstract
AI coding assistants produce the statistically most likely code, not the code your domain requires. The distance between the two is the Specification Gap. REPORTEDVeracode’s 2026 GenAI Code Security Report (150+ models): roughly 44–45% of code-generation tasks introduced a risky vulnerability — a security pass rate essentially flat across report cycles (56% vs 55%) while syntactic correctness ran ~95%. A vendor figure, directional — bracketed by independent academic estimates: ~40% of Copilot-generated programs vulnerable (Pearce et al., IEEE S&P) and >62% exhibiting exploitable weaknesses (Tihanyi et al., 2024). Larger models were no safer. That is the shape of a specification problem, not a model problem. This book presents the Specification Frame: the constraint sentences that close the gap in enterprise, regulated-domain codebases — the content that goes inside a specification, rather than the tooling built around one.
Read the book — free See the argument
Measured, September 2026
A pre-registered test of the Specification Frame across five frontier models and 50 regulated-domain tasks: 148 defects without the Frame, 23 with it. Every model improved. None got worse. An independent security scanner agreed (53 issues to 11). Every output, checker, and the pre-registration are public. Paper: arXiv:2609.23270. The data and the paper →
Free · no royalties · compilable code in .NET 9, Java 21, Python 3.12 & TypeScript
Foundational implementations (Money, Result, SecurePromptBuilder, idempotent webhook handler) are complete and compilable in the companion repository (MIT); the book carries the excerpts and the reasoning.
Not another prompt-engineering primer, and not a spec-driven-development tool guide. Those give you a container; this is about the constraint content that goes in it.
Figure 1

The same task, one missing constraint apart.

Unspecified prompt → likely output
// "sum the transaction amounts"
public double Total(List<Tx> t) =>
  t.Sum(x => (double)x.Amount);

Outcome: a reconciliation shortfall compounding silently below monitoring thresholds — figures illustrative, sized to a realistic mid-market payment volume. Passes review. Passes tests.
ILLUSTRATIVE SCENARIOConstructed teaching example — demonstrates a failure mechanism documented in published post-mortems; not a transcription of an actual incident. Why the book marks these →

Specified prompt → correct output
// money is never a binary float
public Money<USD> Total(List<Tx> t) =>
  t.Aggregate(Money<USD>.Zero,
    (s,x) => s.Add(x.Amount));

Difference: one constraint sentence — "use Money<TCurrency> for all amounts; never double." Ten words.

The model was not wrong. It produced what was statistically most likely. The prompt asked for what was statistically most likely. That is the entire problem, stated precisely.

What the book contributes

Five named ideas, with their prior art stated.

I

The Specification Frame

A four-element prompt structure — role, context, task, constraints — that closes the domain, context, and constraint gaps simultaneously. Read the overview →

II

The Specification Gap

A three-component diagnosis — domain, context, and constraint gaps — of why capable models still produce domain-incorrect code.

III

The Evidence Brief

A six-section debugging protocol that turns "help, it's broken" into a systematic diagnosis, often before the prompt is sent.

IV

The Ten Laws

A unified, numbered set of structural truths for enterprise AI prompting that hold regardless of which model is used.

V

Regulated-domain practice, in existing codebases

HIPAA, PCI-DSS, GDPR, idempotency, money-types, and the AI security attack surface — applied where agents measurably struggle most: brownfield systems with undocumented conventions, not greenfield demos.

The book's intellectual-property note says what builds on earlier work: the four-element structure follows published conventions such as CO-STAR and RISEN, and Laws 5, 6 and 8 apply the Money pattern, the OWASP LLM Top 10, and the prompts-are-code principle. What the book claims as its own is the enterprise specialization of the Frame, the gap diagnosis, the Evidence Brief, and the Ten Laws as one numbered set.

The book also includes 100+ worked examples across 19 chapters and 11 appendices (foundational implementations compilable in the companion repository) spanning code generation, review, debugging, testing, MCP, security, and DevOps.

How to cite this work
Reference
Dhuri, Sandeep. (2026). Delta: Closing the Specification Gap: A Prompt Engineering Framework for Enterprise Software Teams. Acuity Press.
DOI
10.5281/zenodo.21584309
When citing a technique
"…using the Specification Frame technique described by Dhuri (2026)."

BibTeX: delta-book.bib. The CITATION.cff file is in the companion repository. The research paper and dataset have their own citations on the data page.

Start with the artifacts

The evidence
500 model outputs, nine checkers, the pre-registration, and the paper. Re-scorable in ten minutes.The Gap Index
Every sourced statistic on AI-code failure. Tiered, dated, CC BY — cite freely.SPEC.md template
The Specification Frame as a drop-in file for your repo. Free to copy.The Score tool
Twelve checks against your own prompt. Client-side; nothing transmitted.

The Reverse Review (Appendix H): every prompt in this book was passed back through the AI and asked what’s missing — the critiques are published alongside the author’s responses, inside the book.

Read it

The most expensive line of code you'll ever ship

is the one an AI generated from a vague prompt on a quiet afternoon.

Download PDF (free) Download EPUB (free) Sample: Chapter 1

The EPUB is the recommended accessible edition (reflowable text, screen-reader friendly). Media: fact sheet.

Free · no account · no payment · ~44,500 words · 228 pages (PDF) · 145 (EPUB) · 19 chapters, 11 appendices · 3–4 hours

Prefer a store? Kobo · Barnes & Noble · Booktopia · IBS.it — free everywhere.

If Delta helps you, a rating on Kobo or Goodreads helps other engineers find it.

From the writing

Articles and notes from the book

All writing → · Read the book online, chapter by chapter → · Press & media kit → · The data and the paper →