portfolio-press · applied-AI lab
Method 02 · SDLC on agents

A spec goes in; a reviewed pull request comes out.

One person runs a software factory: agents plan, implement, review and open the PR. The human sits on approvals and steering, not in the loop. The same discipline as everywhere on this shelf: nothing merges on an agent's word alone, and every number below is counted, not claimed.

The loop

Real stage names from the running system, with no invented screenshots. Press play to walk one spec through it.

specs repo
01
Spec
Its own pull request in the specs repo: acceptance criteria before code.
agent
02
Plan
The runner reads the spec and the project manifest, stakes out the change.
agent
03
Implement
A branch, a focused diff, tests run behind a gate before anything is pushed.
rival vendor
04
Review
A different model family reviews the diff and posts inline PR comments.
agent
05
Converge
Findings are banked; fixes land; the loop debounces to the branch head.
CI
06
Verify
CI-aware merge flow: failures feed back into the continue loop, not a human chat.
human
07
Approve
The one seat that never automates: merge is a human click, every time.

Why a rival vendor in seat 04: measured on this factory's own production data, one model family reviewing its own code raised a blocking concern in 0% of rounds; a rival vendor on the same code: 43%. Review that cannot disagree is not review. (462 completed reviewer rounds, production D1, pulled 2026-08-19.)

Receipts

Counted from records on 2026-10-02, over 2026-04-22 to 2026-10-02. Each card names its own source and its own date, and the page source keeps the method behind each, so these rot loudly, not quietly. The whole sheet, on one page →

794 spec documents. A spec is its own pull request; the implementation is a separate one — acceptance criteria are never an afterthought.

✓spec files first added, both spec homes · counted 2026-10-02

440 pull requests opened by the factory, 420 merged, and 418 of those merged by a human clicking the button.

✓GitHub, factory/* branches across 53 repositories · 2026-10-02

80% of factory branches were green on the first CI run, 90% in the main repository.

✓190 of 237 branches with Actions runs · 2026-10-02

3,037 findings from the rival-vendor reviewer in 705 reviews, and 410 fix rounds that followed them.

✓review records, all completed reviewer rounds · 2026-10-02

Median 60 hours from a merged spec to the merged code that implements it. 58 specs shipped inside a day.

✓the 177 specs matched to the merged pull request that implements them · 2026-10-02

Same model family reviewing its own code: 0% blocking verdicts. A rival vendor on the same code: 43%. So the reviewer seat is always a rival.

✓462 review rounds · production data, 2026-08-19

127 of 882 developer rounds failed. Half of them were infrastructure. None failed on an ambiguous spec.

✓failure records classified by cause · 2026-10-02

~140,000 lines of TypeScript, one person. Planned, implemented, reviewed and merged through the loop above.

✓git ls-files '*.ts' '*.tsx' · counted 2026-08-23, not recounted since

What the human actually does

The point of the factory is not to remove the human but to move them to the two seats where a human is irreplaceable.

Approvals

Nothing merges without a click, and the click is informed: the PR arrives with the spec it implements, the reviewer's verdicts, and CI state attached. The same shape as this lab's publishing gate: verified first, approved second, shipped third.

Steering

Review findings are banked, not re-litigated: a concern raised once binds the follow-up work until it is fixed or explicitly waived. The review loop debounces to the branch head so agents converge instead of circling. The human writes specs and priorities; the loop turns them into merged code.

The factory itself is not exposed publicly: it holds write access to real repositories, and autonomy is earned, even here. What you can touch is this shelf: the same verify-then-approve discipline, live, in the cockpit. The factory's fuller story lives at codecot.com.

← prev: queries on rails you are here · sdlc on agents next: the command post →