Build

Outcome: Code and IaC on a branch — aligned to approved spec, with no secrets in Git and pre-commit quality enforced.

Goals

• Implement only against Approved spec
• Enterprise AI tools with MCP context (ADRs, OpenAPI)
• Pre-commit: format, lint, types, secret scan
• Task roles and secrets via IaC — not hardcoded

Key roles

Role	Accountable for
DEV	Implementation, PRs, unit tests
ARCH	Contract adherence, ADR proposals
SEC	Scan policy, IAM review on new permissions

→ Developer perspective · Security perspective

Decision guides

• AI toolkit catalog
• AI coding tools
• Spec-driven development
• Linters & static analysis
• Identity, access & secrets

Topic deep dives

• Developer workflow · Identity & access

Reference SOPs

SOP	Procedure
SOP-004	Implementation
SOP-010	AI tool usage
SOP-011	Engineer onboarding

Gates before Verify

• Spec traceability in PR description
• No secrets in diff (gitleaks)
• No prod data in fixtures or prompts

---

← Plan · Lifecycle overview · Verify →