Formal specifications for AI coding agents turn review into a gate agents cannot rewrite. See which code deserves TLA+ or Quint specs and how to wire CI.