Skip to main content

Agentic SDLC: Spec-to-PR Delivery

An open-source Claude Code and Codex plugin that runs a six-stage, spec-to-PR delivery loop with a human gate at every handoff, and the same plugin in daily use by a ten-engineer team at One Mount.

View on GitHub
  • Framework Author
  • Open-source Maintainer
  • Team Rollout

Part A: in production at One Mount

My team at One Mount runs this plugin for day-to-day delivery. I rolled it out to ten engineers, and these are the results of that team rollout.

  • 10

    engineers on the rollout

  • 95%

    of pull requests delivered through the AI SDLC

  • 60%

    more delivered per sprint

  • 40%

    less review time

On top of the open-source plugin, the team extended it with internal integrations: automated Jira transitions and design-doc generation.

Humans hold the spec and the architectural call. The loop carries the work between those decisions, up to an open pull request that a person reviews.

Part B: the open-source plugin

ai-sdlc is an MIT-licensed plugin for Claude Code and Codex. It is my independent implementation of Anthropic's AI-Native SDLC playbook. Install it in a repository and the loop turns each change into six stages, one committed Markdown artifact per stage, with a human approval gate at every handoff.

AI-native SDLC: six stages, one artifact each, a human gate after every stage1 · Planintent.mdinterview to set the intentHuman gate2 · Designspec.mdflagged concernsHuman gate3 · Buildplan.md, plan review, then codeengineer approves the planHuman gate4 · Testreal test outputevals on config changesHuman gate5 · Deployreviewer, then fresh verifierPR for human reviewHuman gate6 · Maintainbands.yaml, diagnosticiandrafts the next intent.mdHuman gateFast pathdeclared low-riskEnforced at thetool boundaryArtifact gateno write withouta committed planProd-guardblocks destructiveprod commands
Six stages, one artifact each, a human gate after every stage. Maintain feeds the next intent back into Plan. Hooks enforce policy at the tool boundary.

A declaration buys fewer stages, never fewer boundaries

A person can declare a change low-risk and enter at Build, skipping Plan and Design while every other stage and gate still applies. The change still gets a plan review, real tests, reviewer passes and a human PR approval, and it cannot touch sensitive paths. If the real diff touches one, the change moves back to the full path.

Guard rails that do not rely on prose

  • Hooks enforce policyAn artifact gate refuses file writes until a committed plan lists the file. It reads the plan and the sensitive-path list from git HEAD, so an agent cannot loosen its own rules by editing them in the working tree, and REVIEW.md protects itself.
  • Plan reviewed before codeA defect caught in Markdown costs a paragraph, not a commit and a re-review. The engineer sees the plan only after it has been reviewed.
  • Reviewer and fresh verifierA reviewer subagent finds issues, then a second pass in fresh context judges whether each one really happens. Rounds are capped at three, re-reviews cover only the diff, and nits are capped.
  • Untrusted input is dataDiffs, commit text and logs are treated as data. A prompt-injection attempt inside them is reported as a finding, not followed.
  • Pinned modelsThe reviewer runs on Sonnet and the diagnostician on Haiku, so review quality stops depending on whichever model the user picked.

Closing the loop with production

A bands.yaml file defines statistical control bands for the metrics a service owner cares about. A breach hands off to a read-only diagnostician subagent, which drafts the next intent for a person to accept. A person approves every deployment.

When a production defect traces back to a merged change, it becomes a proposed eval case for the reviewer. A person confirms it, so incidents turn into test cases for the reviewer instead of post-mortem slides.

Shipped in public

Fifteen pull requests merged in about eight weeks, with test suites for the hooks run in CI and a security audit that closed eight findings, including path traversal and a production guard rebuilt around destructive verbs. It runs on two runtimes from one source and needs only bash, git and Python 3.

Tech stack

  • Claude Code
  • Codex
  • Markdown skills
  • Subagents
  • Git hooks (bash)
  • Python
  • YAML policy
  • GitHub Actions
  • Jira