Anthropic's engineering team has published their practice for an AI-native software development lifecycle: six stages, each producing a committed artifact. A stage's commit is the trigger for the next stage. Humans stay at the gates, and the commit chain itself is the audit trail.
PactKit operationalizes this model — not as a Claude-only practice, but as deployable tooling across Claude Code, OpenCode, and Codex CLI.
The Three Principles
The published practice rests on three principles. Each one is a PactKit design decision:
| Principle | Meaning | PactKit implementation |
|---|---|---|
| Commit chain is the audit trail | What was asked, what the agent produced, who approved — one history | Specs, Stories, Board, snapshots, and enforcement records are all committed artifacts |
| Humans at the gates | Judgment calls stay with humans; attention shifts from every line to every artifact | Authorization gates (pactkit gate) require explicit human confirmation for push, PR, release, publish |
| End triggers the next stage | One stage's accepted artifact is the next stage's green light | The PDCA chain: /project-plan output gates /project-act, Done gates release |
Stage-by-Stage Mapping
| AI-Native SDLC stage | Published practice | PactKit mechanism |
|---|---|---|
Plan — intent.md | A raw idea becomes a committed artifact with author and timestamp | /project-clarify surfaces ambiguities, /project-plan writes the Spec and Board entry — provenance lives in git history |
Design — spec.md | Requirements and design merge into one session; org policies are applied at generation time | Spec generation reads rule modules (brand/security/UX constraints as versioned rules); spec_guard keeps the Spec law during Act |
Build — plan.md | No code before an accepted plan; guardrails are code, not prompts | Spec lint + consistency checks gate /project-act; enforcement hooks enforce what prompt text can only state |
Test — diff + tests | Sessions self-verify; the steering config itself is regression-tested | TDD loop (RED -> GREEN) + regression gates; commit-gate blocks RED suites with skip != pass transparency |
Deploy — PR + findings | Multi-pass review (bugs / security / compliance); hooks act as allow/ask/block gates | auth_gate authorization pairs, push_gate on protected branches, tamper_guard on enforcement artifacts — all audited |
| Maintain | Incidents feed the next cycle | Gate telemetry + friction stats (pactkit stats) decide what to tune next |
Beyond the Published Practice
The article describes a single-host (Claude Code) workflow. PactKit goes further:
- Same governance, three hosts — Claude Code, OpenCode, and Codex CLI run the same PDCA lifecycle, the same gates, the same audit trail. Governance doesn't fragment when your team uses more than one assistant.
- Interruption fences — a session that dies between attempt and outcome leaves a
machine-observable
outcome_unknownfence. Resume is blocked until the gate re-runs; an interrupted verification can never silently masquerade as a pass. - Audited authorization pairs — every gate decision (asked, granted, bypassed)
lands in
.pactkit/enforcement/as paired records. Not just a log — an audit chain that survives a conflicting instruction. - Tamper protection — modifying enforcement artifacts (hooks, gate registrations, audit records) is itself a gated, audited operation.
Deliberate Differences
Two places where PactKit intentionally diverges:
- Spec merges spec + plan. The published lifecycle keeps
spec.md(requirements + design) andplan.md(implementation plan) as separate artifacts. PactKit's Spec carries both — requirement and test evidence live in one file, which is what makes the Done-phase honesty gate (pactkit done-verify) possible: requirement -> test evidence chains are checked per story. - PDCA slicing. Six stages and Plan-Act-Check-Done are isomorphic — two ways to slice the same loop. PactKit stays on PDCA because its phases map one-to-one onto deployable commands and agents with constrained tools.
Summary
If you're adopting the AI-native SDLC and want it enforced rather than remembered — across whichever coding assistant your team actually uses — PactKit is that enforcement layer.