Δ Delta
Constraint craft for AI-assisted code in regulated systems

Delta: Closing the
Specification Gap

Generation got cheap. Verification did not. This is the book on what you actually write to make AI-generated code survive a regulated production system.
Sandeep Dhuri Tech Lead · Two decades in financial services, healthcare & insurance
Abstract
AI coding assistants produce the statistically most likely code, not the code your domain requires. The distance between the two is the Specification Gap. REPORTEDVeracode’s 2026 GenAI Code Security Report (150+ models): roughly 44–45% of code-generation tasks introduced a risky vulnerability — a security pass rate essentially flat across report cycles (56% vs 55%) while syntactic correctness ran ~95%. A vendor figure, directional — bracketed by independent academic estimates: ~40% of Copilot-generated programs vulnerable (Pearce et al., IEEE S&P) and >62% exhibiting exploitable weaknesses (Tihanyi et al., 2024). Larger models were no safer. That is the shape of a specification problem, not a model problem. This book presents the Specification Frame: the constraint sentences that close the gap in enterprise, regulated-domain codebases — the content that goes inside a specification, rather than the tooling built around one.
Read the book — free See the argument
Free · no royalties · compilable code in .NET 9, Java 21, Python 3.12 & TypeScript
Foundational implementations (Money, Result, SecurePromptBuilder, idempotent webhook handler) are complete and compilable in the companion repository (MIT); the book carries the excerpts and the reasoning.
Not another prompt-engineering primer, and not a spec-driven-development tool guide. Those give you a container; this is about the constraint content that goes in it.
Figure 1

The same task, one missing constraint apart.

Unspecified prompt → likely output
// "sum the transaction amounts"
public double Total(List<Tx> t) =>
  t.Sum(x => (double)x.Amount);

Outcome: a reconciliation shortfall compounding silently below monitoring thresholds — figures illustrative, sized to a realistic mid-market payment volume. Passes review. Passes tests.
ILLUSTRATIVE SCENARIOConstructed teaching example — demonstrates a failure mechanism documented in published post-mortems; not a transcription of an actual incident. Why the book marks these →

Specified prompt → correct output
// money is never a binary float
public Money<USD> Total(List<Tx> t) =>
  t.Aggregate(Money<USD>.Zero,
    (s,x) => s.Add(x.Amount));

Difference: one constraint sentence — "use Money<TCurrency> for all amounts; never double." Ten words.

The model was not wrong. It produced what was statistically most likely. The prompt asked for what was statistically most likely. That is the entire problem, stated precisely.

What the book contributes

Five named, original contributions.

I

The Specification Frame

A four-element prompt structure — role, context, task, constraints — that closes the domain, context, and constraint gaps simultaneously. Read the overview →

II

The Specification Gap

A three-component diagnosis — domain, context, and constraint gaps — of why capable models still produce domain-incorrect code.

III

The Evidence Brief

A six-section debugging protocol that turns "help, it's broken" into a systematic diagnosis, often before the prompt is sent.

IV

The Ten Laws

A unified, numbered set of structural truths for enterprise AI prompting that hold regardless of which model is used.

V

Regulated-domain practice, in existing codebases

HIPAA, PCI-DSS, GDPR, idempotency, money-types, and the AI security attack surface — applied where agents measurably struggle most: brownfield systems with undocumented conventions, not greenfield demos.

The book also includes 100+ worked examples across 19 chapters and 11 appendices (foundational implementations compilable in the companion repository) spanning code generation, review, debugging, testing, MCP, security, and DevOps.

How to cite this work
Reference
Dhuri, Sandeep. (2026). Delta: Closing the Specification Gap: A Prompt Engineering Framework for Enterprise Software Teams. Acuity Press.
DOI
10.5281/zenodo.21584309
When citing a technique
"…using the Specification Frame technique described by Dhuri (2026)."

A BibTeX entry and the CITATION.cff file are available in the companion repository.

Start with the artifacts

The Gap Index
Every sourced statistic on AI-code failure. Tiered, dated, CC BY — cite freely.SPEC.md template
The Specification Frame as a drop-in file for your repo. Free to copy.The Score tool
Twelve checks against your own prompt. Client-side; nothing transmitted.

The Reverse Review (Appendix H): every prompt in this book was passed back through the AI and asked what’s missing — the critiques are published alongside the author’s responses, inside the book.

Read it

The most expensive line of code you'll ever ship

is the one an AI generated from a vague prompt on a quiet afternoon.

Download PDF (free) Download EPUB (free) Sample: Chapter 1

The EPUB is the recommended accessible edition (reflowable text, screen-reader friendly). Media: fact sheet.

Free · no account · no payment · ~45,000 words · 227 pp (PDF) · ~145 pp (EPUB) · 3–4 hours · ~44,500 words · 228 pages (PDF) · 145 (EPUB) · 19 chapters, 11 appendices · 3–4 hours

Prefer a store? Kobo · Barnes & Noble · Booktopia · IBS.it — free everywhere.

If Delta helps you, a rating on Kobo or Goodreads helps other engineers find it.