Microservice-based systems evolve continuously through API changes, service splits and merges, dependency churn, and deployment-topology drift driven by DevOps practices. This rapid evolution erodes the assumptions encoded in formal models, test suites, and architectural descriptions, leaving practitioners with limited guidance on how to keep verification artifacts aligned with evolving implementations. Prior surveys cover microservices design, deployment, performance, and isolated verification techniques, but, to our knowledge, none consolidate the intersection of evolution and formal/rigorous verification, nor map how repository-derived signals and CI/CD pipelines support continuous verification of microservice-based systems. This paper addresses that gap through a systematic literature review (SLR). Following the Kitchenham et al. guidelines and PRISMA-style reporting, we defined a review protocol with four research questions covering (i) formal modeling and verification approaches, (ii) the impact of architectural and API evolution on verifiability, (iii) repository-derived signals for updating formal artifacts, and (iv) continuous and incremental verification in CI/CD pipelines. Structured searches in IEEE Xplore, ACM Digital Library, SpringerLink, and Scopus returned 1187 records, which were screened in seven stages and reduced to 18 included studies (13 primary studies that supply evidence and five background studies retained for transparency and framing) through inclusion/exclusion criteria and a weighted 15-item quality-assessment instrument. We synthesized the included studies thematically and compared them along five dimensions: verification technique, evolution dimension, automation level, empirical evidence, and tool/artifact availability. The synthesis shows that actor-based model checking, TLA+ control-plane verification, static code analysis, continuous certification, and runtime/self-adaptive testing form five complementary clusters, but empirical evaluation is dominated by small academic case studies, only a minority of approaches automate model updates from repository signals, and few are integrated end-to-end into CI/CD. We discuss methodological limitations of the body of work, including a lack of industrial-scale validation and shared datasets, contrast intrinsic (build-time, model-driven) and extrinsic (recovery-based) verification strategies, and outline a research agenda toward repository-aware, pipeline-integrated verification for evolving microservices. The present synthesis distils a set of immediate, evidence-based actions for practitioners together with a focused agenda of open research challenges.
Decomposing monolithic systems into microservices is a key activity in software modernization. Although Large Language Models (LLMs) can generate semantically plausible decompositions from textual requirements, it remains unclear whether these proposals preserve the structural dependencies implemented in the source code. This paper evaluates the structural adherence of microservice decompositions generated by OpenAI o3 for the PetClinic and Bookstore systems. We propose an automated validation pipeline based on static dependency analysis and compare zero-shot and few-shot prompting using dependency preservation (TPD) and dependency violation (TVD) metrics. A robustness analysis was conducted to control for differences in class-to-service mapping coverage. After normalization, both prompting strategies produced equivalent structural adherence, achieving TPD values of 68.0% (PetClinic) and 83.3% (Bookstore). The findings demonstrate that structural evaluations of LLM-generated decompositions should explicitly control for mapping coverage, as apparent differences between prompting strategies may otherwise reflect methodological bias rather than genuine architectural quality.
D. Silva, Renan Alves, E. Filho et al.· 0 citations
Overall, this survey provides a structured characterization of the current state of AIware testing research and identifies key structural challenges that must be addressed to support lifecycle-aware, reliable AIware systems.
K. Gonzalez, Mariam El Mezouar· AIware· 0 citations
We propose an extension to Zynerator, a Model-Driven Architecture framework for automated microservice generation, that embeds DevSecOps principles directly at the modeling stage through semantic decorators. These decorators enable the automated synthesis of secure back-end and front-end components together with operational artifacts, including authentication and authorization modules, audit trails, monitoring dashboards, and DevSecOps pipelines covering SAST, DAST, testing, and deployment. The approach addresses a key limitation of the original Zynerator framework, namely the absence of explicit DevSecOps integration, and supports a security-by-design methodology that reduces reliance on specialized DevSecOps expertise. Through a detailed e-commerce case study and empirical evaluation against manual development and existing Model-Driven Architecture tools, we show that the enhanced framework reduces development effort, strengthens security posture, and accelerates DevSecOps adoption. These findings indicate that DevSecOps-aware model-driven engineering offers a viable pathway toward secure, auto-mated software delivery.
Younes Zouani, Mohamed Lachgar, Youssef Harrati et al.· International Journal of Adv...· 0 citations
At present, the contradiction between the speed of delivering changes and the operational stability of software systems acts as a fundamental constraint for DevOps practices. In this study, the subject of analysis is the decisive significance of a high level of test coverage in continuous integration and delivery (CI/CD) pipelines, with a particular emphasis on how microservice architectural patterns determine the scalability of verification processes. The study relies on a mixed methodology that combines quantitative processing of metrics from the State of DevOps 2024–2025 (DORA) reports and the SonarQube State of Code with qualitative analysis of industrial cases from Netflix, Uber, and Meituan. It is demonstrated that although high test coverage (above 80%) is a necessary but not sufficient condition for reducing defect density, in the context of hyperscalable distributed systems it turns into a critical bottleneck in the absence of shift-right strategies, including automated canary analysis (ACA). A separate section is devoted to the 2024 Paradox of Engineering Productivity, where the introduction of AI assistants accelerated the generation of software code but simultaneously led to a 7,2% decrease in delivery stability. In conclusion, the concept of productive coverage is formulated, shifting the center of gravity from gross quantitative test indicators to their semantic significance for business-critical scenarios, and practical recommendations are proposed for reconfiguring CI pipelines in order to minimize economic losses caused by brittle tests.
Evgenii Lvov· International Journal of Mod...· 0 citations
Large Language Models (LLMs) are increasingly used to generate executable software environments from repository artifacts. However, functional executability does not necessarily imply conformity with architectural, security, workflow, and production intent. This study investigates whether a frontier LLM can generate Dockerfiles and Docker Compose configurations for multi-service applications using repository contents without access to developer-authored deployment artifacts. Three heterogeneous repositories combining Python, Node.js, .NET, React, Rust, Java, Redis, PostgreSQL, and MySQL-compatible infrastructure were evaluated using deterministic end-to-end HTTP oracles and manual structural comparison. All three generated environments became functionally operational, although one required a Rust base-image update from version 1.85 to 1.88. The model correctly reconstructed service topology, application ports, infrastructure dependencies, service hostnames, a background worker, hidden proxy configurations, and a file-based Docker secrets mechanism. However, it consistently omitted network segmentation, multi-stage builds, dependency-layer caching, live-reload volumes, production frontend serving, restrictive backend-port policies, and cross-platform build logic. Based on these observations, the study formalizes the distinction between functional correctness and deployment-intent fidelity and analytically derives a minimal explicit deployment specification for information that cannot be reliably inferred from repository artifacts.
Oleg Grynets, Kyrylo Fursov, V. Lyashkevych et al.· 0 citations