CTO at @informalinc+@quint_lang. Building @quint_lang. In the past building Tendermint, Cosmos and Malachite.

Joined April 2009
We're getting closer to releasing Quint Studio 🚀 AI makes generating code easy. Understanding how it actually behaves is still hard. If you want to be among the first to try it, join the waitlist 👇 tally.so/r/81PQyO
We considered many shapes for the Quint product. We experimented a lot. It's time to put something out into the world! Waitlist link below
1
2
11
907
Replying to @derekcheng
I’ve played a bunch with formal verification. I find Quint to be the most useful tech, and what seems to work well is to write the program in quint first and then generate the real code from it. You can then write a testing harness that basically lets you use the quint scenarios to write test cases for the prod code. I’ve formalized this for rust in this library: archastro.github.io/quint-re… I’ve also messed around with using Z3 to do formal verification. I’ve had less success with this because it assumes you write pure code with no side effects (IE, no db calls). It also forces you to basically re-express your business logic as assertions in the Z3 bindings. I messed around with this by writing a macro system for elixir that would let me generate proofs in Z3 for biz logic, but it wasn’t super useful for the above reasons.
1
1
4
336
Replying to @tritlo
You should look into @quint_lang, it’s TLA+ with types and syntax resembling programming languages rather than math
1
1
2
153
Replying to @tianyin_xu
What we are building at @quint_lang aims to bring formal executable specifications into the day to day workflows of all engineers to help them understand better how their requirements translate into properties and behaviors and how they impact the existing ones and if we find a bug during this process we will tell you!
1
1
4
66
For TLA+ with types, check out @quint_lang They are not harmful
> be Leslie Lamport > literally wrote THE book on Paxos > specifications shouldn't be math > specifications should be text > "Claude, make no mistakes" Preempted LLMs by 30 decades. That's why he's the GOAT.
4
8
76
2,504
zarinjo retweeted
While we are fully focused on making the human-centered benefits of formal specifications part of every team, it's great to see these kinds of advancements in hardcore formal verification. By advancing both sides, the world can have more trust in more software.
New on our Frontier Red Team blog: using Claude to formally verify software at large scale. Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time). With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks. Read our research in full here: anthropic.com/research/forma…
1
2
1
20
740
I was on the Stack Overflow Podcast talking about TLA+ and Quint! Check it out 👇
🎙️ We're joined by Gabriela Moreira @bugarela, CEO at @quint_lang, about why formal specification languages like TLA+ are essential for catching system design flaws before writing code, how Quint brings developer-friendly syntax and executability to formal methods, and the ways trace validation and model-based testing can verify AI-generated code against real-world production data. stackoverflow.blog/2026/10/1…
1
6
25
839
zarinjo retweeted
Quint made it onto the @StackOverflow Podcast!
🎙️ We're joined by Gabriela Moreira @bugarela, CEO at @quint_lang, about why formal specification languages like TLA+ are essential for catching system design flaws before writing code, how Quint brings developer-friendly syntax and executability to formal methods, and the ways trace validation and model-based testing can verify AI-generated code against real-world production data. stackoverflow.blog/2026/10/1…
1
7
328
zarinjo retweeted
quint help this code base 🙏
god help this codebase
2
9
373
So I've been meaning to learn about Quint. Enjoying this interview with CEO @bugarela so far.
1
1
8
171
zarinjo retweeted
I’m personally a fan of @quint_lang
2
4
375
zarinjo retweeted
Leslie Lamport asks, “Who builds a house without drawing blueprints?” We ask, “Who chews a tree without listening for cracks?”
3
23
471
New post on Eth Research! SEACAST: fast, lean broadcast for Ethereum, with an executable spec and a formal model By: - cskiraly 🔗 ethresear.ch/t/26167 Highlights: - Ethereum’s broadcast problem is getting harder as objects grow (bigger execution payloads, DA data, possible future proofs and post-quantum signatures), and today’s gossip can be seconds late for home builders and wastes bandwidth with duplicates. - SEACAST combines segmented forwarding (send/forward chunks immediately), erasure coding (Reed–Solomon so no specific chunk is ‘the last one’), and availability sampling (nodes can request only required columns/rows/cells rather than full objects). - The protocol explicitly separates what a node wants (interest: full object vs custody columns vs samples) from what it must relay (duty) and from who it pushes vs merely announces to, avoiding ‘one topic per piece’ designs like many-column topics. - In simulations on identical network setups, SEACAST delivers faster and with fewer bytes than both today’s gossipsub and ECBroadcast’s RS mode; e.g., in an all-home 500-node network with 16 peers each, 99% reach for a 1 MiB payload is ~0.64s vs 0.97s (ECBroadcast) vs 4.5s (gossipsub), with much lower received bytes per node. - SEACAST is designed to be ‘elastic’ under thinner uplinks (delay tracks bandwidth without runaway duplication) and is unusually well-specified: it has an executable pseudocode spec plus a formal model (Quint/TLA+) that already found and helped fix multiple liveness gaps. ELI5: Ethereum nodes need to quickly share big “packages” of data with lots of other nodes. Today’s sharing is wasteful: nodes often wait until they have the whole package before forwarding it, and many nodes get multiple duplicate copies. SEACAST is a smarter way to share: it breaks data into small pieces, adds error-correcting coding so any enough pieces work, forwards pieces immediately, and lets nodes request only the pieces they actually need (sometimes just a sample). It also comes with a spec you can actually run like a program, plus a formal math model to find bugs in the rules.
1
1
11
628
zarinjo retweeted
More speed, more check marks, more formal verification. None of it matters without understanding. Catch the whole conversation with @bugarela on @ttforall.
1
3
11
544
zarinjo retweeted
Replying to @ttforall @bugarela
The more code AI writes, the more the spec becomes the one artifact a human still has to read and own, which is why tools like Quint matter now.
1
1
3
57
Replying to @poteto
I've been super happy recently with @quint_lang instead of TLA+, it uses the same TLA logic but is much easier to review the generated specs being a programmer and not a mathematician. It also has quint-connect crate for Rust so you can do model-based testing.
1
4
361
New TTFA episode is out! 🎙️ This time I sat down with Gabriella Mora, CEO of Quint, to talk about formal specifications, TLA+, temporal logic, and the increasingly important role of formal methods in the age of AI. With AI generating more and more code, how can we make sure that the software we're building actually behaves as intended? We also discuss the story behind Quint, how it compares to Alloy, and the challenges of teaching formal methods. I think this is a particularly timely conversation given everything happening at the intersection of AI and formal verification. 0:00 Intro 2:10 Gabriela's path: from Tumblr themes to a TLA+ thesis 11:56 Quint and TLA+ vs. Alloy 15:05 Why write a spec? Understanding over checkmarks 22:04 How AI changes the economics of formal methods 27:19 Executable specs as the middle ground for AI-written code 36:13 Keeping spec and code in sync: codegen, model-based testing, trace validation 39:04 Inside Quint Studio 47:53 Quint vs. TLA+: syntax, types, effects and the simulator 54:08 Model checking: a new Rust checker, TLC and Apalache 1:02:31 Temporal logic: modal operators, LTL vs. CTL 1:07:41 In practice: invariants, witnesses and cheap liveness checks 1:12:33 Bugs found in audits just by writing the spec 1:16:13 From Informal Systems and blockchain to Quint 1:23:38 Spinning Quint out and becoming CEO 1:36:19 Teaching formal methods as AI learned to write Quint 1:41:12 Teaching with games, and what students found hardest 1:50:56 What's next for Quint and Quint Studio 1:57:44 Wrap-up and outro
New TTFA episode! 🎙️ I sat down with @bugarela, CEO of Quint, to discuss formal specifications, TLA+, temporal logic, and how formal methods can help us trust AI-generated software. We also explore the story behind Quint, its comparison with Alloy, and the challenges of teaching formal methods in the age of AI. A timely conversation about where software engineering is heading! youtu.be/SdwjRJgp6gs
6
19
635
New TTFA episode! 🎙️ I sat down with @bugarela, CEO of Quint, to discuss formal specifications, TLA+, temporal logic, and how formal methods can help us trust AI-generated software. We also explore the story behind Quint, its comparison with Alloy, and the challenges of teaching formal methods in the age of AI. A timely conversation about where software engineering is heading! youtu.be/SdwjRJgp6gs
3
7
2
21
2,478
Replying to @bugarela
@Bugarela joins @Robbyrussel to ask a deceptively simple question: how do you know you can actually trust your tests? Catch up here: buff.ly/h4gbg2V
3
5
140
zarinjo retweeted
We’re delighted to be sponsoring and attending @gambiconf this November. Come say hi to the Quint team!
🏴‍☠️ Novo patrocinador a bordo: @quint_lang! A Quint é uma linguagem open source de especificação executável. Com ela você descreve o comportamento do sistema e verifica se ele está certo antes que o bug chegue em produção.
4
12
301