Context Engineering for AI-Augmented Development
Quick Reference
| Task |
Primary Skill |
Reference |
| Write AGENTS.md / CLAUDE.md |
agents-project-memory |
memory-patterns.md |
| Create implementation plan |
dev-workflow-planning |
— |
| Write PRD / spec |
docs-ai-prd |
agentic-coding-best-practices.md |
| Create subagents |
agents-subagents |
— |
| Set up hooks |
agents-hooks |
— |
| Configure MCP servers |
agents-mcp |
— |
| Git workflow + worktrees |
dev-git-workflow |
ai-agent-worktrees.md |
| Orchestrate parallel agents |
agents-swarm-orchestration |
— |
| Application security |
software-security-appsec |
— |
| Assess repo maturity |
this skill |
maturity-model.md |
| Full idea-to-ship lifecycle |
this skill |
— |
| Multi-repo coordination |
this skill |
multi-repo-strategy.md |
| Regulated environment setup |
this skill |
regulated-environment-patterns.md |
| Fast-track onboarding |
this skill |
fast-track-guide.md |
| Context lifecycle (CDLC) |
this skill |
context-development-lifecycle.md |
| Convert existing repos |
this skill |
repo-conversion-playbook.md |
| Team transformation |
this skill |
team-transformation-patterns.md |
| Measure AI coding impact |
dev-ai-coding-metrics |
— |
The Paradigm Shift
Software development is shifting from tool-centric workflows to context-driven development:
| Dimension |
Traditional |
Context-Driven |
| Source of truth |
Jira + Confluence |
Repository (AGENTS.md + docs/) |
| Standards |
Wiki page |
.claude/rules/ (loaded every session) |
| Execution |
Human writes code |
Agent writes code with structured context |
| Knowledge transfer |
Onboarding meetings |
AGENTS.md = instant context |
| Planning |
Sprint board |
docs/plans/ with dependency graphs |
| Review |
Humans only |
Humans + AI disclosure checklist |
Why it matters: Unstructured AI coding ("vibe coding") is 19% slower with 1.7x more issues (METR). Structured context engineering inverts this — agents become faster and more reliable than solo coding. But context quality matters more than quantity: ETH Zurich research (March 2026) shows LLM-generated context files degrade performance by 3% while human-written files help only when limited to non-inferable details.
Cross-platform convention: AGENTS.md is the primary file. CLAUDE.md is always a symlink (ln -s AGENTS.md CLAUDE.md). Codex reads AGENTS.md directly; Claude Code reads the symlink. One file, two agents, zero drift.
See: references/paradigm-comparison.md for full mapping + migration playbook.
Complete Lifecycle: Idea to Ship
flowchart LR
P1["1 CAPTURE\n─────────\nIdea → Spec\n(docs-ai-prd)"]
P2["2 PLAN\n─────────\nSpec → Plan\n(dev-workflow-planning)"]
P3["3 CONTEXT\n─────────\nPlan → Repo Context\n(agents-project-memory)"]
P4["4 EXECUTE\n─────────\nContext → Code\n(agents-swarm-orchestration)"]
P5["5 VERIFY\n─────────\nCode → Quality Gate\n(agents-hooks)"]
P6["6 SHIP\n─────────\nVerified → Merged\n(dev-git-workflow)"]
P7["7 LEARN\n─────────\nShipped → Better Context\n(CDLC)"]
P1 --> P2 --> P3 --> P4 --> P5 --> P6 --> P7
P7 -.->|"feedback\nloop"| P1
style P1 fill:#e8daef,color:#4a235a
style P2 fill:#d6eaf8,color:#1b4f72
style P3 fill:#d5f5e3,color:#1e8449
style P4 fill:#fdebd0,color:#7e5109
style P5 fill:#fadbd8,color:#922b21
style P6 fill:#d4efdf,color:#1e8449
style P7 fill:#fef9e7,color:#7d6608
Seven phases from idea capture to learning. Each phase references the primary skill and key actions.
Phase 1: CAPTURE — Idea to Spec
Skill: docs-ai-prd
- Capture the idea in
docs/specs/feature-name.md
- Use docs-ai-prd to generate a structured PRD
- Include: problem statement, success criteria, constraints, non-goals
- Architecture extraction: docs-ai-prd/references/architecture-extraction.md
- Convention mining: docs-ai-prd/references/convention-mining.md
Phase 2: PLAN — Spec to Implementation Plan
Skill: dev-workflow-planning
- Create
docs/plans/feature-name.md from the spec
- Break into tasks with dependencies and verification steps
- Identify parallelizable tasks for multi-agent execution
- Estimate token budget for the implementation
Phase 3: CONTEXT SETUP — Plan to Repository Context
Skills: agents-project-memory, agents-subagents
- Update AGENTS.md if the feature introduces new patterns
- Add/update
.claude/rules/ for any new conventions
- Create specialized subagents if needed (e.g., test-writer, migration-helper)
- For multi-repo: ensure coordination repo is updated if shared context changes
Phase 4: EXECUTE — Context to Working Code
Skills: agents-swarm-orchestration, dev-git-workflow
- Create feature branch and worktree for isolation
- Execute plan tasks — use subagents for parallel work
- Follow plan verification steps after each task
- Use
--add-dir for cross-repo context if needed
Phase 5: VERIFY — Code to Quality + Compliance Gate
Skills: agents-hooks, dev-git-workflow
- Run automated verification: tests, lint, type-check
- Run compliance gates (if regulated): signed commits, secrets scan, SAST, PII check
- AI disclosure: complete PR template with AI involvement
- Human review: code reviewer verifies AI-generated code
Phase 6: SHIP — Verified to Merged + Deployed
Skill: dev-git-workflow
- PR approved by reviewer (different person from author)
- Security review for critical paths (auth/, payments/, crypto/)
- Merge to main via merge commit (not squash — audit trail)
- Deployment approved by DevOps (separate from code approval)
Phase 7: LEARN — Shipped to Better Context
Framework: CDLC (context-development-lifecycle.md)
- Session retrospective: what context was missing or misleading?
- Update AGENTS.md and rules based on learnings
- Extract patterns: if you repeated the same instruction 3+ times, make it a rule
- Track metrics: agent success rate, rework rate, token cost
SDLC Compression
Traditional regulated SDLC: Requirements (14d) → Dev (3w) → QA (6-8w) → Deploy (1-2w) = 12-16 weeks.
The 2-month QA is a late discovery problem, not a QA problem. CDLC shifts verification left into every phase:
| Phase |
Traditional |
With CDLC |
Key Enabler |
| Requirements |
14 days |
3-5 days |
AI-assisted specs, architecture extraction |
| Development |
3 weeks |
2-3 weeks |
Structured context = fewer mistakes |
| QA |
6-8 weeks |
1-2 weeks |
Automated gates + verification per task |
| Deployment |
1-2 weeks |
1-3 days |
Pre-verified compliance, audit trail |
| Total |
12-16 weeks |
4-6 weeks |
60-65% compression |
QA compresses the most because convention violations, integration bugs, compliance gaps, and missing tests are caught during development — not discovered weeks later. Automated compliance gates mean QA focuses on what humans are good at: exploratory testing and edge cases.
See: references/context-development-lifecycle.md § SDLC Compression for full analysis with caveats.
Repository Maturity Quick Assessment
| Level |
Per-Repo |
Org-Wide (100 repos) |
Key Action |
| L0 No Context |
No AGENTS.md |
No shared standards |
Create AGENTS.md (30 min) |
| L1 Basic |
AGENTS.md <50 lines |
Template repo exists, 10% adoption |
Add rules + docs (2-4 hrs) |
| L2 Structured |
+ rules + docs/specs |
Shared rules, 50% adoption |
Add agents + hooks (1-2 days) |
| L3 Automated |
+ agents + hooks + CI gates |
Compliance gates, 80% adoption |
Start CDLC (2-4 weeks) |
| L4 Full CE |
+ CDLC active + metrics |
InnerSource governance, 95%+ |
Sustain + optimize |
Quick self-assessment: 14 yes/no questions in references/maturity-model.md.
Multi-Repo at Scale
For organizations with many repositories, use a coordination layer pattern:
Coordination Repo (recommended for polyrepo)
flowchart TD
CR["Coordination Repo\n━━━━━━━━━━━━━━\nOrg AGENTS.md\nShared rules\nSync scripts"]
R1["Service A\n─────────\nLocal AGENTS.md\nLocal rules"]
R2["Service B\n─────────\nLocal AGENTS.md\nLocal rules"]
R3["Service C\n─────────\nLocal AGENTS.md\nLocal rules"]
RN["... 97 more"]
CR -->|"mandatory rules\n(CI/CD sync)"| R1
CR -->|"mandatory rules\n(CI/CD sync)"| R2
CR -->|"mandatory rules\n(CI/CD sync)"| R3
CR -.->|sync| RN
DEV["Developer Session\nclaude --add-dir coordination-repo"]
DEV -->|"reads shared"| CR
DEV -->|"reads local"| R2
style CR fill:#d6eaf8,color:#1b4f72
style DEV fill:#d5f5e3,color:#1e8449
style R1 fill:#fef9e7,color:#7d6608
style R2 fill:#fef9e7,color:#7d6608
style R3 fill:#fef9e7,color:#7d6608
style RN fill:#f5f5f5,color:#666666
One meta-repo holds shared context: org-wide AGENTS.md, mandatory rules, shared skills, sync scripts. Individual repos maintain focused local context.
# Load shared context into any repo session
claude --add-dir ../coordination-repo
Shared vs Local Context
| Category |
Scope |
Distribution |
| Mandatory (compliance, security, data handling) |
All repos |
CI/CD sync (automated) |
| Recommended (coding standards, commit conventions) |
Most repos |
Template sync or --add-dir |
| Local (architecture, domain patterns, subagents) |
Per-repo |
Maintained by repo team |
Symlink Convention (enforced everywhere)
# Every repo, every time
ln -s AGENTS.md CLAUDE.md
# CI validates: [ -L CLAUDE.md ] or fail
See: references/multi-repo-strategy.md for full patterns, sync scripts, token budgets, and InnerSource governance.
Regulated Environments
For FCA-regulated EMIs and similar organizations:
Mandatory Compliance Rules
Install these in every repo (copy from assets/ directory):
| Asset File |
Install To |
Purpose |
compliance-fca-emi.md |
.claude/rules/compliance-fca-emi.md |
Audit trail, separation of duties, SM&CR |
data-handling-gdpr-pci.md |
.claude/rules/data-handling-gdpr-pci.md |
Safe/prohibited data categories |
ai-agent-governance.md |
.claude/rules/ai-agent-governance.md |
Approved tools, disclosure, training |
pr-template-ai-disclosure.md |
.github/pull_request_template.md |
AI involvement checklist per PR |
fca-compliance-gate.yml |
.github/workflows/fca-compliance-gate.yml |
Signed commits, secrets, SAST, PII, AI disclosure |
Core Regulatory Principles
- Audit trail: Signed commits, merge commits, immutable history (PS21/3)
- Separation of duties: AI cannot approve/merge/deploy; different reviewer required
- No sensitive data in context: PII, card data, credentials never in agent prompts or files
- AI disclosure: Every PR declares AI involvement and human verification
- Accountability: Named Senior Manager accountable for AI governance (SM&CR)
- Portability: Dual-agent strategy (Claude Code + Codex) avoids vendor lock-in (PS24/16)
- Agent isolation: Sandbox execution for automated agent runs (microVM/gVisor for CI/CD)
- Platform audit: GitHub Agent HQ audit logs with
actor_is_agent identifiers (Feb 2026)
Also track: NIST AI Agent Standards Initiative (Feb 2026) — US framework for agent identity, security, governance. FINRA 2026 — first financial regulator to require AI agent action logging and human-in-the-loop oversight.
See: references/regulated-environment-patterns.md for full regulatory mapping and incident response.
Agent and Tool Selection
Primary Agents (use both)
Both Claude Code and Codex are available as first-class agents on GitHub Agent HQ (Feb 2026), with enterprise audit logging (actor_is_agent identifiers), MCP allowlists, and organization-wide policy management.
| Capability |
Claude Code |
Codex |
| Best for |
Interactive planning, complex refactoring |
Async batch tasks, issue triage |
| Context file |
Reads CLAUDE.md (symlink) |
Reads AGENTS.md (direct) |
| Execution |
Local, interactive |
Cloud, sandboxed |
| GitHub Agent HQ |
Yes (cloud sessions) |
Yes (cloud sessions) |
| Subagents |
Yes (.claude/agents/) |
No |
| Hooks |
Yes (.claude/hooks/) |
No |
| MCP servers |
Yes |
No |
| Worktrees |
Yes |
Branches |
| Multi-repo |
--add-dir |
Single repo per task |
Decision Tree
flowchart TD
Q1{"Interactive task?\n(needs back-and-forth)"}
Q2{"Batch of independent\ntasks?"}
Q3{"Complex refactor\nneeding subagents?"}
CC1["Claude Code"]
CX1["Codex\n(parallel async)"]
CC2["Claude Code"]
EITHER["Either works\n(prefer Claude Code\nfor regulated envs)"]
Q1 -->|Yes| CC1
Q1 -->|No| Q2
Q2 -->|Yes| CX1
Q2 -->|No| Q3
Q3 -->|Yes| CC2
Q3 -->|No| EITHER
style CC1 fill:#d5f5e3,color:#1e8449
style CC2 fill:#d5f5e3,color:#1e8449
style CX1 fill:#d6eaf8,color:#1b4f72
style EITHER fill:#fef9e7,color:#7d6608
Supplementary Tools
| Tool |
Use When |
Context File |
| Cursor |
IDE-embedded editing, quick fixes |
.cursor/rules |
| GitHub Copilot |
Inline suggestions during manual coding |
— |
Context as Infrastructure
Six principles for treating context like production infrastructure:
- Version it — AGENTS.md and rules live in git, reviewed in PRs
- Review it — Context changes get the same review rigor as code changes
- Test it — Run a task with new context to verify it works before committing
- Scope it — One concern per rule file; clear sections in AGENTS.md
- Budget it — Monitor token cost; compress or split when context grows
- Retire it — Remove stale rules quarterly; outdated context is worse than no context
Anti-Patterns
| Anti-Pattern |
Problem |
Fix |
| Vibe coding |
No spec, no plan, just "build it" |
Start with Phase 1 (CAPTURE) |
| Context bloat |
2000-line AGENTS.md nobody reads |
Split into rules/ and references; keep AGENTS.md <200 lines |
| Over-specification |
Rules for every edge case |
Write rules for patterns, not exceptions |
| Tool accumulation |
5 AI tools, no coordination |
Pick 2 primary (Claude Code + Codex), standardize context |
| Parallel Jira+context |
Maintaining specs in both Jira and repo |
Jira for portfolio; repo for execution context |
| Static context |
Write AGENTS.md once, never update |
CDLC: monthly review, retire stale rules |
| God agent |
One agent does everything |
Specialized subagents for distinct tasks |
| Skipping verification |
Trust AI output without review |
Phase 5 (VERIFY) is mandatory, not optional |
| Compliance bypass |
"We'll add gates later" |
Install mandatory rules from day 1 (assets/) |
| Separate CLAUDE.md |
CLAUDE.md and AGENTS.md with different content |
Always symlink: ln -s AGENTS.md CLAUDE.md |
| LLM-generated context |
Auto-generated AGENTS.md duplicates discoverable info (-3% perf) |
Write only non-inferable details (ETH Zurich 2026) |
| Single-file at scale |
One massive file can't scale beyond modest codebases |
Three-tier architecture: hot memory → agents → cold knowledge |
Do / Avoid
Do:
- Start with maturity assessment before investing in automation
- Use the lifecycle (7 phases) — skipping CAPTURE and PLAN is the #1 cause of rework
- Install compliance rules before development starts (not after)
- Run context retrospectives — context without feedback loops decays
- Use both Claude Code and Codex for their respective strengths
Avoid:
- Don't migrate from Jira overnight — use the incremental playbook
- Don't create 500-line AGENTS.md files — use progressive disclosure
- Don't skip the symlink convention — drift between AGENTS.md and CLAUDE.md causes bugs
- Don't let context go stale — if it hasn't been updated in 90 days, it's suspect
- Don't treat AI-generated code differently from human code in review rigor
Navigation
References
| File |
Content |
Lines |
| paradigm-comparison.md |
Old vs new paradigm mapping, 2026 industry validation |
~200 |
| maturity-model.md |
5-level maturity, adoption data, research caveats |
~280 |
| fast-track-guide.md |
30-min, 2-hour, batch tracks + quality research insight |
~250 |
| context-development-lifecycle.md |
CDLC + three-tier architecture, Manus patterns, ETH research |
~615 |
| multi-repo-strategy.md |
Coordination patterns, GitHub Agent HQ, VS Code CE |
~420 |
| regulated-environment-patterns.md |
FCA/EMI, NIST, FINRA 2026, sandbox isolation, GH audit |
~400 |
| repo-conversion-playbook.md |
Step-by-step conversion with real scripts and templates |
~790 |
| team-transformation-patterns.md |
AI-native vs traditional teams, shadow experiments, risk assessment |
~230 |
Assets (Copy-Ready Templates)
| File |
Install To |
Purpose |
| compliance-fca-emi.md |
.claude/rules/ |
FCA/EMI audit trail and separation of duties |
| data-handling-gdpr-pci.md |
.claude/rules/ |
GDPR/PCI safe and prohibited data categories |
| ai-agent-governance.md |
.claude/rules/ |
AI tool restrictions and disclosure |
| pr-template-ai-disclosure.md |
.github/ |
PR template with AI involvement checklist |
| fca-compliance-gate.yml |
.github/workflows/ |
CI/CD compliance gates |
Related Skills
| Skill |
Relationship |
| agents-project-memory |
How to write AGENTS.md (L1 foundation) |
| dev-workflow-planning |
Creating implementation plans (Phase 2) |
| docs-ai-prd |
Writing specs for AI agents (Phase 1) |
| agents-subagents |
Creating specialized subagents (Phase 3) |
| agents-hooks |
Event-driven automation (Phase 5) |
| agents-mcp |
MCP server configuration |
| dev-git-workflow |
Git patterns, worktrees (Phase 4-6) |
| agents-swarm-orchestration |
Parallel agent execution (Phase 4) |
Web Verification
83 curated sources in data/sources.json across 10 categories:
| Category |
Sources |
Key Items |
| Context Engineering |
10 |
Anthropic CE, Fowler, CDLC, Codified Context (arxiv), Manus lessons |
| AGENTS.md Standard |
6 |
agents.md spec, Linux Foundation, ETH Zurich evaluation (arxiv) |
| Paradigm Shift |
8 |
OpenAI Harness, METR study, Anthropic 2026 Trends Report |
| Tool Documentation |
10 |
Claude Code, Codex, GitHub Agent HQ, VS Code CE guide |
| Multi-Repo Patterns |
6 |
Spine Pattern, InnerSource, Git submodules, GH Actions |
| Security Tooling |
10 |
Gitleaks, Semgrep, NIST Agent Standards, sandbox patterns |
| FCA/EMI Compliance |
9 |
PS21/3, SS1/23, SM&CR, PS24/16, FINRA 2026 AI agents |
| Data Protection |
4 |
IAPP GDPR, PCI SSC, Anthropic DPA, OpenAI DPA |
| SDLC and DevOps |
6 |
DORA metrics, GitHub Enterprise AI Controls, branch protection |
| Practitioner Insights |
14 |
Stripe Minions, Block/Dorsey, HBR AI layoffs, Harvard/P&G, OpenAI guide |
Verify current facts before final answers. Priority areas:
- AGENTS.md specification changes (agents.md — 60,000+ repos, evolving rapidly)
- Claude Code and Codex feature updates (now on GitHub Agent HQ)
- GitHub Enterprise AI Controls evolution (MCP allowlists, agent governance)
- FCA regulatory updates (PS21/3, SS1/23, PS24/16 — watch for consultations)
- NIST AI Agent Standards Initiative (comments due April 2026)
- FINRA AI agent guidance evolution (annual oversight reports)
- CDLC framework evolution (community-driven, externally validated March 2026)
- Context file effectiveness research (ETH Zurich, Codified Context — ongoing)
Fact-Checking
- Use web search/web fetch to verify current external facts, versions, pricing, deadlines, regulations, or platform behavior before final answers.
- Prefer primary sources; report source links and dates for volatile information.
- If web access is unavailable, state the limitation and mark guidance as unverified.
Source: echohaoran/AI-AGENT-Skills — distributed by TomeVault.
1---2name: dev-context-engineering3description: Context-driven AI development with Claude Code and Codex. Use when transitioning teams to AGENTS.md workflows or multi-repo AI setups. Use when this capability is needed.4---56# Context Engineering for AI-Augmented Development78## Quick Reference910| Task | Primary Skill | Reference |11|------|--------------|-----------|12| Write AGENTS.md / CLAUDE.md | agents-project-memory | memory-patterns.md |13| Create implementation plan | dev-workflow-planning | — |14| Write PRD / spec | docs-ai-prd | agentic-coding-best-practices.md |15| Create subagents | agents-subagents | — |16| Set up hooks | agents-hooks | — |17| Configure MCP servers | agents-mcp | — |18| Git workflow + worktrees | dev-git-workflow | ai-agent-worktrees.md |19| Orchestrate parallel agents | agents-swarm-orchestration | — |20| Application security | software-security-appsec | — |21| **Assess repo maturity** | **this skill** | maturity-model.md |22| **Full idea-to-ship lifecycle** | **this skill** | — |23| **Multi-repo coordination** | **this skill** | multi-repo-strategy.md |24| **Regulated environment setup** | **this skill** | regulated-environment-patterns.md |25| **Fast-track onboarding** | **this skill** | fast-track-guide.md |26| **Context lifecycle (CDLC)** | **this skill** | context-development-lifecycle.md |27| **Convert existing repos** | **this skill** | repo-conversion-playbook.md |28| **Team transformation** | **this skill** | team-transformation-patterns.md |29| **Measure AI coding impact** | dev-ai-coding-metrics | — |3031## The Paradigm Shift3233Software development is shifting from tool-centric workflows to context-driven development:3435| Dimension | Traditional | Context-Driven |36|-----------|------------|----------------|37| Source of truth | Jira + Confluence | Repository (AGENTS.md + docs/) |38| Standards | Wiki page | `.claude/rules/` (loaded every session) |39| Execution | Human writes code | Agent writes code with structured context |40| Knowledge transfer | Onboarding meetings | AGENTS.md = instant context |41| Planning | Sprint board | `docs/plans/` with dependency graphs |42| Review | Humans only | Humans + AI disclosure checklist |4344**Why it matters**: Unstructured AI coding ("vibe coding") is 19% slower with 1.7x more issues (METR). Structured context engineering inverts this — agents become faster and more reliable than solo coding. But context quality matters more than quantity: ETH Zurich research (March 2026) shows LLM-generated context files *degrade* performance by 3% while human-written files help only when limited to non-inferable details.4546**Cross-platform convention**: `AGENTS.md` is the primary file. `CLAUDE.md` is always a symlink (`ln -s AGENTS.md CLAUDE.md`). Codex reads AGENTS.md directly; Claude Code reads the symlink. One file, two agents, zero drift.4748See: references/paradigm-comparison.md for full mapping + migration playbook.4950## Complete Lifecycle: Idea to Ship5152```mermaid53flowchart LR54 P1["1 CAPTURE\n─────────\nIdea → Spec\n(docs-ai-prd)"]55 P2["2 PLAN\n─────────\nSpec → Plan\n(dev-workflow-planning)"]56 P3["3 CONTEXT\n─────────\nPlan → Repo Context\n(agents-project-memory)"]57 P4["4 EXECUTE\n─────────\nContext → Code\n(agents-swarm-orchestration)"]58 P5["5 VERIFY\n─────────\nCode → Quality Gate\n(agents-hooks)"]59 P6["6 SHIP\n─────────\nVerified → Merged\n(dev-git-workflow)"]60 P7["7 LEARN\n─────────\nShipped → Better Context\n(CDLC)"]6162 P1 --> P2 --> P3 --> P4 --> P5 --> P6 --> P763 P7 -.->|"feedback\nloop"| P16465 style P1 fill:#e8daef,color:#4a235a66 style P2 fill:#d6eaf8,color:#1b4f7267 style P3 fill:#d5f5e3,color:#1e844968 style P4 fill:#fdebd0,color:#7e510969 style P5 fill:#fadbd8,color:#922b2170 style P6 fill:#d4efdf,color:#1e844971 style P7 fill:#fef9e7,color:#7d660872```7374Seven phases from idea capture to learning. Each phase references the primary skill and key actions.7576### Phase 1: CAPTURE — Idea to Spec7778**Skill**: docs-ai-prd79801. Capture the idea in `docs/specs/feature-name.md`812. Use docs-ai-prd to generate a structured PRD823. Include: problem statement, success criteria, constraints, non-goals834. Architecture extraction: docs-ai-prd/references/architecture-extraction.md845. Convention mining: docs-ai-prd/references/convention-mining.md8586### Phase 2: PLAN — Spec to Implementation Plan8788**Skill**: dev-workflow-planning89901. Create `docs/plans/feature-name.md` from the spec912. Break into tasks with dependencies and verification steps923. Identify parallelizable tasks for multi-agent execution934. Estimate token budget for the implementation9495### Phase 3: CONTEXT SETUP — Plan to Repository Context9697**Skills**: agents-project-memory, agents-subagents98991. Update AGENTS.md if the feature introduces new patterns1002. Add/update `.claude/rules/` for any new conventions1013. Create specialized subagents if needed (e.g., test-writer, migration-helper)1024. For multi-repo: ensure coordination repo is updated if shared context changes103104### Phase 4: EXECUTE — Context to Working Code105106**Skills**: agents-swarm-orchestration, dev-git-workflow1071081. Create feature branch and worktree for isolation1092. Execute plan tasks — use subagents for parallel work1103. Follow plan verification steps after each task1114. Use `--add-dir` for cross-repo context if needed112113### Phase 5: VERIFY — Code to Quality + Compliance Gate114115**Skills**: agents-hooks, dev-git-workflow1161171. Run automated verification: tests, lint, type-check1182. Run compliance gates (if regulated): signed commits, secrets scan, SAST, PII check1193. AI disclosure: complete PR template with AI involvement1204. Human review: code reviewer verifies AI-generated code121122### Phase 6: SHIP — Verified to Merged + Deployed123124**Skill**: dev-git-workflow1251261. PR approved by reviewer (different person from author)1272. Security review for critical paths (auth/, payments/, crypto/)1283. Merge to main via merge commit (not squash — audit trail)1294. Deployment approved by DevOps (separate from code approval)130131### Phase 7: LEARN — Shipped to Better Context132133**Framework**: CDLC (context-development-lifecycle.md)1341351. Session retrospective: what context was missing or misleading?1362. Update AGENTS.md and rules based on learnings1373. Extract patterns: if you repeated the same instruction 3+ times, make it a rule1384. Track metrics: agent success rate, rework rate, token cost139140### SDLC Compression141142Traditional regulated SDLC: Requirements (14d) → Dev (3w) → QA (6-8w) → Deploy (1-2w) = **12-16 weeks**.143144The 2-month QA is a **late discovery** problem, not a QA problem. CDLC shifts verification left into every phase:145146| Phase | Traditional | With CDLC | Key Enabler |147|-------|-----------|-----------|-------------|148| Requirements | 14 days | 3-5 days | AI-assisted specs, architecture extraction |149| Development | 3 weeks | 2-3 weeks | Structured context = fewer mistakes |150| QA | 6-8 weeks | 1-2 weeks | Automated gates + verification per task |151| Deployment | 1-2 weeks | 1-3 days | Pre-verified compliance, audit trail |152| **Total** | **12-16 weeks** | **4-6 weeks** | **60-65% compression** |153154QA compresses the most because convention violations, integration bugs, compliance gaps, and missing tests are caught during development — not discovered weeks later. Automated compliance gates mean QA focuses on what humans are good at: exploratory testing and edge cases.155156See: references/context-development-lifecycle.md § SDLC Compression for full analysis with caveats.157158## Repository Maturity Quick Assessment159160| Level | Per-Repo | Org-Wide (100 repos) | Key Action |161|-------|----------|---------------------|------------|162| **L0** No Context | No AGENTS.md | No shared standards | Create AGENTS.md (30 min) |163| **L1** Basic | AGENTS.md <50 lines | Template repo exists, 10% adoption | Add rules + docs (2-4 hrs) |164| **L2** Structured | + rules + docs/specs | Shared rules, 50% adoption | Add agents + hooks (1-2 days) |165| **L3** Automated | + agents + hooks + CI gates | Compliance gates, 80% adoption | Start CDLC (2-4 weeks) |166| **L4** Full CE | + CDLC active + metrics | InnerSource governance, 95%+ | Sustain + optimize |167168Quick self-assessment: 14 yes/no questions in references/maturity-model.md.169170## Multi-Repo at Scale171172For organizations with many repositories, use a coordination layer pattern:173174### Coordination Repo (recommended for polyrepo)175176```mermaid177flowchart TD178 CR["Coordination Repo\n━━━━━━━━━━━━━━\nOrg AGENTS.md\nShared rules\nSync scripts"]179180 R1["Service A\n─────────\nLocal AGENTS.md\nLocal rules"]181 R2["Service B\n─────────\nLocal AGENTS.md\nLocal rules"]182 R3["Service C\n─────────\nLocal AGENTS.md\nLocal rules"]183 RN["... 97 more"]184185 CR -->|"mandatory rules\n(CI/CD sync)"| R1186 CR -->|"mandatory rules\n(CI/CD sync)"| R2187 CR -->|"mandatory rules\n(CI/CD sync)"| R3188 CR -.->|sync| RN189190 DEV["Developer Session\nclaude --add-dir coordination-repo"]191 DEV -->|"reads shared"| CR192 DEV -->|"reads local"| R2193194 style CR fill:#d6eaf8,color:#1b4f72195 style DEV fill:#d5f5e3,color:#1e8449196 style R1 fill:#fef9e7,color:#7d6608197 style R2 fill:#fef9e7,color:#7d6608198 style R3 fill:#fef9e7,color:#7d6608199 style RN fill:#f5f5f5,color:#666666200```201202One meta-repo holds shared context: org-wide AGENTS.md, mandatory rules, shared skills, sync scripts. Individual repos maintain focused local context.203204```bash205# Load shared context into any repo session206claude --add-dir ../coordination-repo207```208209### Shared vs Local Context210211| Category | Scope | Distribution |212|----------|-------|-------------|213| **Mandatory** (compliance, security, data handling) | All repos | CI/CD sync (automated) |214| **Recommended** (coding standards, commit conventions) | Most repos | Template sync or --add-dir |215| **Local** (architecture, domain patterns, subagents) | Per-repo | Maintained by repo team |216217### Symlink Convention (enforced everywhere)218219```bash220# Every repo, every time221ln -s AGENTS.md CLAUDE.md222# CI validates: [ -L CLAUDE.md ] or fail223```224225See: references/multi-repo-strategy.md for full patterns, sync scripts, token budgets, and InnerSource governance.226227## Regulated Environments228229For FCA-regulated EMIs and similar organizations:230231### Mandatory Compliance Rules232233Install these in every repo (copy from `assets/` directory):234235| Asset File | Install To | Purpose |236|-----------|-----------|---------|237| `compliance-fca-emi.md` | `.claude/rules/compliance-fca-emi.md` | Audit trail, separation of duties, SM&CR |238| `data-handling-gdpr-pci.md` | `.claude/rules/data-handling-gdpr-pci.md` | Safe/prohibited data categories |239| `ai-agent-governance.md` | `.claude/rules/ai-agent-governance.md` | Approved tools, disclosure, training |240| `pr-template-ai-disclosure.md` | `.github/pull_request_template.md` | AI involvement checklist per PR |241| `fca-compliance-gate.yml` | `.github/workflows/fca-compliance-gate.yml` | Signed commits, secrets, SAST, PII, AI disclosure |242243### Core Regulatory Principles2442451. **Audit trail**: Signed commits, merge commits, immutable history (PS21/3)2462. **Separation of duties**: AI cannot approve/merge/deploy; different reviewer required2473. **No sensitive data in context**: PII, card data, credentials never in agent prompts or files2484. **AI disclosure**: Every PR declares AI involvement and human verification2495. **Accountability**: Named Senior Manager accountable for AI governance (SM&CR)2506. **Portability**: Dual-agent strategy (Claude Code + Codex) avoids vendor lock-in (PS24/16)2517. **Agent isolation**: Sandbox execution for automated agent runs (microVM/gVisor for CI/CD)2528. **Platform audit**: GitHub Agent HQ audit logs with `actor_is_agent` identifiers (Feb 2026)253254Also track: **NIST AI Agent Standards Initiative** (Feb 2026) — US framework for agent identity, security, governance. **FINRA 2026** — first financial regulator to require AI agent action logging and human-in-the-loop oversight.255256See: references/regulated-environment-patterns.md for full regulatory mapping and incident response.257258## Agent and Tool Selection259260### Primary Agents (use both)261262Both Claude Code and Codex are available as first-class agents on **GitHub Agent HQ** (Feb 2026), with enterprise audit logging (`actor_is_agent` identifiers), MCP allowlists, and organization-wide policy management.263264| Capability | Claude Code | Codex |265|-----------|------------|-------|266| **Best for** | Interactive planning, complex refactoring | Async batch tasks, issue triage |267| **Context file** | Reads CLAUDE.md (symlink) | Reads AGENTS.md (direct) |268| **Execution** | Local, interactive | Cloud, sandboxed |269| **GitHub Agent HQ** | Yes (cloud sessions) | Yes (cloud sessions) |270| **Subagents** | Yes (`.claude/agents/`) | No |271| **Hooks** | Yes (`.claude/hooks/`) | No |272| **MCP servers** | Yes | No |273| **Worktrees** | Yes | Branches |274| **Multi-repo** | `--add-dir` | Single repo per task |275276### Decision Tree277278```mermaid279flowchart TD280 Q1{"Interactive task?\n(needs back-and-forth)"}281 Q2{"Batch of independent\ntasks?"}282 Q3{"Complex refactor\nneeding subagents?"}283 CC1["Claude Code"]284 CX1["Codex\n(parallel async)"]285 CC2["Claude Code"]286 EITHER["Either works\n(prefer Claude Code\nfor regulated envs)"]287288 Q1 -->|Yes| CC1289 Q1 -->|No| Q2290 Q2 -->|Yes| CX1291 Q2 -->|No| Q3292 Q3 -->|Yes| CC2293 Q3 -->|No| EITHER294295 style CC1 fill:#d5f5e3,color:#1e8449296 style CC2 fill:#d5f5e3,color:#1e8449297 style CX1 fill:#d6eaf8,color:#1b4f72298 style EITHER fill:#fef9e7,color:#7d6608299```300301### Supplementary Tools302303| Tool | Use When | Context File |304|------|----------|-------------|305| Cursor | IDE-embedded editing, quick fixes | `.cursor/rules` |306| GitHub Copilot | Inline suggestions during manual coding | — |307308## Context as Infrastructure309310Six principles for treating context like production infrastructure:3113121. **Version it** — AGENTS.md and rules live in git, reviewed in PRs3132. **Review it** — Context changes get the same review rigor as code changes3143. **Test it** — Run a task with new context to verify it works before committing3154. **Scope it** — One concern per rule file; clear sections in AGENTS.md3165. **Budget it** — Monitor token cost; compress or split when context grows3176. **Retire it** — Remove stale rules quarterly; outdated context is worse than no context318319## Anti-Patterns320321| Anti-Pattern | Problem | Fix |322|-------------|---------|-----|323| **Vibe coding** | No spec, no plan, just "build it" | Start with Phase 1 (CAPTURE) |324| **Context bloat** | 2000-line AGENTS.md nobody reads | Split into rules/ and references; keep AGENTS.md <200 lines |325| **Over-specification** | Rules for every edge case | Write rules for patterns, not exceptions |326| **Tool accumulation** | 5 AI tools, no coordination | Pick 2 primary (Claude Code + Codex), standardize context |327| **Parallel Jira+context** | Maintaining specs in both Jira and repo | Jira for portfolio; repo for execution context |328| **Static context** | Write AGENTS.md once, never update | CDLC: monthly review, retire stale rules |329| **God agent** | One agent does everything | Specialized subagents for distinct tasks |330| **Skipping verification** | Trust AI output without review | Phase 5 (VERIFY) is mandatory, not optional |331| **Compliance bypass** | "We'll add gates later" | Install mandatory rules from day 1 (assets/) |332| **Separate CLAUDE.md** | CLAUDE.md and AGENTS.md with different content | Always symlink: `ln -s AGENTS.md CLAUDE.md` |333| **LLM-generated context** | Auto-generated AGENTS.md duplicates discoverable info (-3% perf) | Write only non-inferable details (ETH Zurich 2026) |334| **Single-file at scale** | One massive file can't scale beyond modest codebases | Three-tier architecture: hot memory → agents → cold knowledge |335336## Do / Avoid337338**Do**:339- Start with maturity assessment before investing in automation340- Use the lifecycle (7 phases) — skipping CAPTURE and PLAN is the #1 cause of rework341- Install compliance rules before development starts (not after)342- Run context retrospectives — context without feedback loops decays343- Use both Claude Code and Codex for their respective strengths344345**Avoid**:346- Don't migrate from Jira overnight — use the incremental playbook347- Don't create 500-line AGENTS.md files — use progressive disclosure348- Don't skip the symlink convention — drift between AGENTS.md and CLAUDE.md causes bugs349- Don't let context go stale — if it hasn't been updated in 90 days, it's suspect350- Don't treat AI-generated code differently from human code in review rigor351352## Navigation353354### References355356| File | Content | Lines |357|------|---------|-------|358| paradigm-comparison.md | Old vs new paradigm mapping, 2026 industry validation | ~200 |359| maturity-model.md | 5-level maturity, adoption data, research caveats | ~280 |360| fast-track-guide.md | 30-min, 2-hour, batch tracks + quality research insight | ~250 |361| context-development-lifecycle.md | CDLC + three-tier architecture, Manus patterns, ETH research | ~615 |362| multi-repo-strategy.md | Coordination patterns, GitHub Agent HQ, VS Code CE | ~420 |363| regulated-environment-patterns.md | FCA/EMI, NIST, FINRA 2026, sandbox isolation, GH audit | ~400 |364| repo-conversion-playbook.md | Step-by-step conversion with real scripts and templates | ~790 |365| team-transformation-patterns.md | AI-native vs traditional teams, shadow experiments, risk assessment | ~230 |366367### Assets (Copy-Ready Templates)368369| File | Install To | Purpose |370|------|-----------|---------|371| compliance-fca-emi.md | `.claude/rules/` | FCA/EMI audit trail and separation of duties |372| data-handling-gdpr-pci.md | `.claude/rules/` | GDPR/PCI safe and prohibited data categories |373| ai-agent-governance.md | `.claude/rules/` | AI tool restrictions and disclosure |374| pr-template-ai-disclosure.md | `.github/` | PR template with AI involvement checklist |375| fca-compliance-gate.yml | `.github/workflows/` | CI/CD compliance gates |376377### Related Skills378379| Skill | Relationship |380|-------|-------------|381| agents-project-memory | How to write AGENTS.md (L1 foundation) |382| dev-workflow-planning | Creating implementation plans (Phase 2) |383| docs-ai-prd | Writing specs for AI agents (Phase 1) |384| agents-subagents | Creating specialized subagents (Phase 3) |385| agents-hooks | Event-driven automation (Phase 5) |386| agents-mcp | MCP server configuration |387| dev-git-workflow | Git patterns, worktrees (Phase 4-6) |388| agents-swarm-orchestration | Parallel agent execution (Phase 4) |389390## Web Verification39139283 curated sources in `data/sources.json` across 10 categories:393394| Category | Sources | Key Items |395|----------|---------|-----------|396| Context Engineering | 10 | Anthropic CE, Fowler, CDLC, Codified Context (arxiv), Manus lessons |397| AGENTS.md Standard | 6 | agents.md spec, Linux Foundation, ETH Zurich evaluation (arxiv) |398| Paradigm Shift | 8 | OpenAI Harness, METR study, Anthropic 2026 Trends Report |399| Tool Documentation | 10 | Claude Code, Codex, GitHub Agent HQ, VS Code CE guide |400| Multi-Repo Patterns | 6 | Spine Pattern, InnerSource, Git submodules, GH Actions |401| Security Tooling | 10 | Gitleaks, Semgrep, NIST Agent Standards, sandbox patterns |402| FCA/EMI Compliance | 9 | PS21/3, SS1/23, SM&CR, PS24/16, FINRA 2026 AI agents |403| Data Protection | 4 | IAPP GDPR, PCI SSC, Anthropic DPA, OpenAI DPA |404| SDLC and DevOps | 6 | DORA metrics, GitHub Enterprise AI Controls, branch protection |405| Practitioner Insights | 14 | Stripe Minions, Block/Dorsey, HBR AI layoffs, Harvard/P&G, OpenAI guide |406407Verify current facts before final answers. Priority areas:408- AGENTS.md specification changes (agents.md — 60,000+ repos, evolving rapidly)409- Claude Code and Codex feature updates (now on GitHub Agent HQ)410- GitHub Enterprise AI Controls evolution (MCP allowlists, agent governance)411- FCA regulatory updates (PS21/3, SS1/23, PS24/16 — watch for consultations)412- NIST AI Agent Standards Initiative (comments due April 2026)413- FINRA AI agent guidance evolution (annual oversight reports)414- CDLC framework evolution (community-driven, externally validated March 2026)415- Context file effectiveness research (ETH Zurich, Codified Context — ongoing)416417## Fact-Checking418419- Use web search/web fetch to verify current external facts, versions, pricing, deadlines, regulations, or platform behavior before final answers.420- Prefer primary sources; report source links and dates for volatile information.421- If web access is unavailable, state the limitation and mark guidance as unverified.422423---424> Source: [echohaoran/AI-AGENT-Skills](https://github.com/echohaoran/AI-AGENT-Skills) — distributed by [TomeVault](https://tomevault.io).425<!-- tomevault:4.0:skill_md:2026-05-23 -->