AI-Native SDLC skill

# AI-Native SDLC

Turn a stated goal into a planned, built, tested, deployed, and monitored project by running the loop from Anthropic's AI-Native SDLC playbook: **Plan → Design → Build → Test → Deploy → Maintain**.

Every phase ends by committing a versioned artifact to git; the next phase starts by reading it. The commit chain is the audit trail: who asked, what the agent produced, and who approved. The agent does the generating, verifying, and mechanical work. Humans keep the judgment calls and the final approvals.

## Frameworks

The workflow is framework-agnostic. Claude Code calls the repository-memory file `CLAUDE.md` and keeps skills in `.claude/skills/`; Codex calls the repository-memory file `AGENTS.md` and installs skills into `~/.codex/skills/`. Wherever this skill says CLAUDE.md, use the repository-memory file your framework recognizes. The same skill folder installs in either environment, and the artifacts (`intent.md`, `spec.md`, `plan.md`, `REVIEW.md`, `bands.yaml`) are framework-neutral.

## Hard rules

1. **Human gates are real gates.** Do not advance without approval: intent accepted → Design; spec approved → Build; plan approved → code; PR merged → Deploy; release authorized → production.
2. **Never cross the production gate.** Agent-generated changes stop at the merge/release boundary. High-risk actions (production config, migrations, releases) require explicit human authorization, enforced by a hook where possible.
3. **Verify before asking for review.** Run build, tests, lint, and screenshots yourself first; fix what fails; only then hand work to a human.
4. **Encode repeated lessons.** The same mistake twice → write the correction into the project's CLAUDE.md, a skill, or a hook.
5. **Evidence in reviews.** Every finding cites file/line and concrete evidence, ordered by severity, with at most 5 nit comments per review.
6. **Plan mode first.** Nothing is implemented without an accepted plan; when implementation departs from the plan, update plan.md in the same commit.
7. **Reviews feed back.** When a review flags a mistake for the second time, the correction goes into CLAUDE.md as part of that review.
8. **Subagents are named, visible, and accountable.** Scaffold subagents only with a functional name, a committed definition, an explained dispatch, and a bounded report with evidence — never a silent background worker that can idle or act on stale context.

## Rule → enforcement matrix

Each hard rule is backed by an advisory layer (makes compliance likely), a
deterministic layer (makes violation nearly impossible), or a review pass
(checked at a gate). Use this when compliance asks "how is this enforced?"

| Hard rule | Advisory (skill/CLAUDE.md) | Deterministic (hook/file) | Checked at |
|---|---|---|---|
| 1. Gates are real | CLAUDE.md conventions | committed artifact chain in git; hooks | gate acceptance commits |
| 2. Never cross the production gate | this skill | `production-gate.sh` + approval/expiry; release approvals recorded in the hash-chained gate ledger (`gate_ledger.py`) | Deploy gate |
| 3. Verify before review | CLAUDE.md "Verifying your work" | single `make`-style verify commands | PR template evidence |
| 4. Encode repeated lessons | CLAUDE.md "Things the agent gets wrong" | protected-path hooks | second-time-mistake rule in reviews |
| 5. Evidence in reviews | REVIEW.md | — | review passes, 5-nit cap |
| 6. Plan mode first | plan.md template | `check_plan_sync.py` (optional pre-commit hook / PR gate) | plan-vs-diff check in PR review |
| 7. Reviews feed back | CLAUDE.md | — | review comments → CLAUDE.md |
| 8. Subagents named/visible | this hard rule | subagent definitions committed in git | subagent reports in session |

Anything in the deterministic column must always hold — enforce it with code,
not prose.

## Starting from an idea

When the user gives a goal or idea and there is no workflow in place yet: