Skip to content
MODULE 16 · SPEC-DRIVEN DEVELOPMENT · REV 1.0

SPEC-DRIVEN DEVELOPMENT

The spec isthe prompt.

For fifty years the spec was scaffolding — read once, then discarded. Code was the artifact of record.

Agents changed the arithmetic. An agent produces a plausible implementation of whatever it infers, fast and confident, with no way to check that inference against what you meant. The scarce output is no longer code — it’s a specification precise enough that a model can’t misread it.

NAVIGATE ⌘K search · R flow ↔ deck · G construction grid

THE THREAD05

  1. constitution.mdthe always-on rules
  2. spec.mdwhat and why — signed
  3. plan.mdhow — approved
  4. tasks.mdordered, atomic
  5. the diffcited, verified

Every line of the last one cites a line of the second. That citation is the whole discipline.

Chapters12plus a copy-ready appendix
Reading time~6 minscan, don’t read start to finish
Interactive figures15every claim, demonstrated

A design document is read. A specification under this discipline is executed — the build fails when it drifts from the code.

Source of truth

Before: The code in the default branch
After: The signed specification

What a reviewer reads

Before: The diff, alone
After: The diff, checked against a spec already approved

What survives a rewrite

Before: Nothing — intent is re-read out of old code
After: The spec; the code regenerates against it

What a new session reads first

Before: Whatever fits in the prompt
After: The committed spec, plan, and constitution

What a stale doc costs

Before: A wiki page nobody trusts
After: A failed build (Ch.07)
FIG.00 · THE INVERSION · STATIC▸ Five questions, answered twice — once for code-as-authority, once for spec-as-authority. Every later chapter follows from the right-hand column.

A five-row table contrasts what was authoritative before this inversion against what is authoritative after it. Source of truth: the code in the default branch, versus the signed specification. What a reviewer reads: the diff alone, versus the diff checked against an already-approved spec. What survives a rewrite: nothing, versus the spec, with code regenerated against it. What a new agent session reads first: whatever fits in the prompt, versus the committed spec, plan and constitution. What a stale document costs: an untrusted wiki page, versus a failed build.

DESIGN DOC

READ BY

Humans

ENFORCEMENT

Advisory — anyone may diverge

LIFECYCLE

Becomes outdated, rarely revisited

LIVES IN

A wiki rarely accessed

SDD SPEC

READ BY

Humans and agents

ENFORCEMENT

Executable — tests fail on drift

LIFECYCLE

Living, continuously validated

LIVES IN

The repo, next to the code, in CI

FIG.00B · DOC VS SPEC · STATIC▸ A design doc is advisory and goes stale silently. This kind of spec is enforced — tests fail the moment it and the code disagree.

Two columns compare a traditional design document against a spec under this discipline, across four rows. Read by: humans, versus humans and agents. Enforcement: advisory, versus executable — tests fail on drift. Lifecycle: goes stale, rarely reopened, versus living and continuously validated. Lives in: a wiki nobody visits, versus the repo, beside the code, in CI.

Rigor LadderCh. 01 / 12

The Rigor Ladder

Three rigor levels — pick one, not a ladder to climb.

Not a maturity ladder — each rung fits different work.

Three rigor levels, not a ladder to climb. Each fits different work — the top rung stays aspirational for most teams.

The three rigor levels compared across definition, drift, what each is best for, and cost.
AttributeSpec-firstSpec-anchored★ TargetSpec-as-source
DefinitionThe spec seeds generation. Afterwards code is allowed to drift.Spec and code evolve together; tests enforce alignment. Code stays the source of truth.Humans edit only the spec. Code is fully generated and never hand-edited.
DriftAcceptedDetected and correctedEliminated by construction
Best forPrototypes, spikes, one-off featuresMost production systemsNarrow, well-bounded, heavily-tooled domains
CostVery lowModerateHigh, and demands trusted generation
RuleSpec-anchored is the target for most production work: code stays the source of truth, and the spec is the anchor tests verify against.

SPEC-ANCHORED · ★ TARGET

YOU EDIT
The spec and the code, together, in the same PRs.
GENERATED
The first implementation, and every change after, proposed by the agent.
ENFORCES ALIGNMENT
Automated tests, each cited to an acceptance criterion in the spec.
IF INCORRECT
CI — a cited test fails, or a criterion turns up with no test at all.

▸ specs/ + src/ + tests/ (spec cited in tests)

FIG.03 · THE RIGOR LADDER · INTERACTIVE▸ Spec-anchored is the recommended target: code stays the source of truth, and drift detection becomes a CI check instead of a matter of memory.

KEYS← → move between rungs · Enter / Space selects the focused rung · Tab reaches each rung directly

Three ascending rungs of increasing rigor. Spec-first: edit only the initial spec, code is generated once and then drifts unchecked. Spec-anchored, the recommended target: spec and code are edited together, tests enforce alignment, drift is detected and corrected. Spec-as-source: edit only the spec forever, code is regenerated wholesale, drift is eliminated by construction — though this rung demands tooling maturity most teams lack. Selecting a rung expands what you edit, what enforces alignment, and what breaks if you are wrong.

WHICH RUNG FITS THIS CODE?

Will this code outlive the quarter?

Will more than one person maintain it?

Answer both questions above for a recommendation.

The LoopCh. 02 / 12

The Loop

Seven phases, six human gates, one path to a diff.

The seven-phase pipeline every serious toolkit already implements.

Every toolkit runs this same pipeline under different names. The phase boundaries are the value — not what you call them.

Constitutionhuman gate
The agent does: Drafts project-wide rules based on observable repository conventions
The human owns: Ratifies the rules; once ratified, they are binding rather than advisory.
Artifact: constitution.md / AGENTS.md
Specifyhuman gate
The agent does: Drafts what and why: user stories, acceptance criteria, out-of-scope
The human owns: Signs the acceptance criteria
Artifact: spec.md
Clarifyagent-led
The agent does: Identifies ambiguities and raises questions prior to planning
The human owns: Answers, or declares the unknown out of scope
Artifact: Resolved question log inside the spec
Planhuman gate ★
The agent does: Proposes how: architecture, data model, technical decisions
The human owns: Approves the approach
Artifact: plan.md
Taskshuman gate
The agent does: Decomposes into atomic, independently shippable items
The human owns: Checks scope and ordering
Artifact: tasks.md
Implementhuman gate
The agent does: Executes tasks, verifying each against its criteria
The human owns: Reviews the diff against the approved plan
Artifact: The diff
Analyzehuman gate
The agent does: Cross-checks spec ↔ plan ↔ tasks ↔ code for consistency
The human owns: Determines the significance of any inconsistencies found
Artifact: Convergence report

SEVEN PHASES, IN ORDER

CONSTITUTIONSPECIFYCLARIFYPLAN ★TASKSIMPLEMENTANALYZE

A plan is cheap to read and cheap to reject. A diff is neither.

DIFF SIZE AT REVIEW

4 files / 180 lines

▸ SELECT A PHASE

Select or focus a node and press Enter to view its inputs, outputs, the consequence of skipping the gate, and the corresponding command in three tools.

PR-DESCRIPTION CHECKLIST
FIG.04 · THE LOOP · INTERACTIVE▸ Seven phases, six human sign-off gates — and a plan-approval step markedly cheaper to reject than the diff it forecloses.

KEYSArrow keys move focus between phases · Enter or click opens that phase's inspector · S toggles the skip-the-plan-gate simulation · hovering or focusing Plan dims every other phase

The loop runs Constitution, Specify, Clarify, Plan, Tasks, Implement and Analyze in sequence, with two feedback edges: Clarify returns open questions to Specify, and Analyze returns detected inconsistencies to Specify. Six of seven phases end in a human sign-off gate; only Clarify is a dialogue rather than a gate. Simulating a skip of the Plan gate rewires Specify directly to Implement and the reviewable diff swells from four files and 180 lines to thirty-one files and 2,400 lines for the same ticket.

Paste this into the PR description before requesting review.

ConstitutionCh. 03 / 12

The Constitution

The always-on rules an agent reads before anything else.

The one file every agent session must read first.

A constitution is a repo’s always-on constraints: stack, testing, dependencies, security, untouchable paths. Commit it before the first spec — skip it, and every session re-infers conventions from scratch.

AGENTS.md / CLAUDE.md

The operating manual

Stack, commands, conventions, restricted paths, known failure modes.

constitution.md

The governing principles

Rules a team would defend in a design review, independent of tooling.

constitution.mdmarkdown
# Constitution — <project-name>Version: 1.0 · Ratified: <date> · Owner: <name> > Governing principles for this repository. Every spec, plan and task is> subordinate to this document. Where a client agreement is stricter, the> client agreement wins. ## 1 · Stack (non-negotiable without an ADR)- Language: <e.g. TypeScript 5.x, strict mode>- Runtime: <e.g. Node 22>- Framework: <e.g. Next.js 15 App Router>- Data: <e.g. PostgreSQL 16 via Drizzle>- Package manager: <e.g. pnpm — never mix with npm/yarn> ## 2 · Commands (run these; do not invent variants)- Lint:  `<make lint>`- Test:  `<make test>`     single: `<make test T=path::name>`- Build: `<make build>`- All three must pass before any commit is proposed. ## 3 · Principles (ubiquitous EARS form)- THE system SHALL have unit tests for all domain logic.- THE system SHALL NOT log personally identifying data at any level.- THE system SHALL NOT gain a new runtime dependency without a human  decision recorded in the plan.- THE system SHALL keep HTTP handlers free of business logic.- THE system SHALL return structured errors from `<errors module>`;  never bare exceptions, never silent fallback values. ## 4 · Specification standard- One feature = one directory: `specs/NNN-slug/{spec.md,plan.md,tasks.md}`.- Acceptance criteria SHALL use EARS syntax and carry `AC-NN` identifiers.- Every task SHALL cite the criteria it satisfies.- Every spec SHALL contain an explicit "Out of scope" section.- A spec SHALL be updated in the same pull request as the behaviour it describes. ## 5 · Autonomy tiers| Tier | Work | Agent may | Gate ||------|------|-----------|------|| 1 | Tests, docs, lint, dependency bumps | Work autonomously | PR review || 2 | Feature work, refactors, bug fixes | Propose a plan, then implement | Approved plan || 3 | Auth, crypto, data models, migrations, IaC, public contracts | Analyse and propose only | Line-by-line acceptance + architect sign-off | **Escalation rule:** when the tier is unclear, treat it as the higher one. ## 6 · No-go paths (propose only, never modify)- `migrations/` · `infra/` · `src/generated/` · `vendor/`- `.env*` except `.env.example`, and anything matching `*secret*` ## 7 · Security posture- Production data SHALL NOT appear in any prompt. Use synthetic fixtures.- Every agent-suggested dependency SHALL pass composition and licence scanning.- Secret scanning SHALL run in pre-commit hooks. ## 8 · Definition of done- Lint, tests and build pass via the commands in §2.- New behaviour has tests a human has read and approved.- The diff touches only files named in the approved plan.- The spec reflects the behaviour that shipped. ## 9 · Sharp edges (append every hard-won surprise here)- <e.g. the ORM session is request-scoped; holding it across awaits deadlocks>- <e.g. `make test` requires Docker for the Postgres fixture>
FIG.05 · CONSTITUTION ANATOMY · INTERACTIVE▸ Nine sections, ordered by the cost of skipping each: stack ambiguity compromises every spec downstream, and a hallucinated dependency is a live security risk.

KEYSTab through gutter pins, or hover

An annotated constitution.md template with nine gutter markers, each explaining that section's significance on hover or tab. The most consequential are the stack declaration and the dependency policy.

→

Appendix A, one click

The complete template above, ready to paste into a repository.

Writing The SpecCh. 04 / 12

Writing the Spec

One feature, one directory, three pages, max.

Structure, scope boundaries, and the over-specification trap to avoid.

A spec over three pages is two specs. One that reads like pseudo-code is a program written twice.

EXAMPLE 1 OF 4

✕ VAGUE

“Users should be able to log in easily.”

✓ PRECISE

WHEN a user submits a valid email THE system SHALL send a one-time login link valid for 15 minutes.

AMBIGUITY: HIGH → LOW · TESTABLE: NO → YES · TESTS IMPLIED: 0 → 2

FIG.06 · VAGUE → PRECISE · INTERACTIVE▸ Four rewrites, one principle: name the trigger, name the quantity, name the response.

KEYSLeft / Right arrow keys, or the REWRITE button, step through four examples; the current example is announced for screen readers

Four rewrites of vague requirements into EARS-precise criteria, each with an ambiguity/testability readout. 'Users should log in easily' becomes a WHEN/THE-system-SHALL sentence naming a 15-minute link expiry; three more examples cover error handling, performance, and security in the same shape. In every case ambiguity drops from high to low and testability flips from no to yes.

THE DISCIPLINES

RuleDomain language, not implementation detail — once a spec names an ORM, design has started in the wrong document.
RuleOne directory per feature: specs/004-magic-link/{spec,plan,tasks}.md
RuleDraft collaboratively, decide independently — describe it, let the model structure it, strip anything not an explicit decision.
RuleSpecify failure behaviour explicitly. It’s what an agent invents on its own if you don’t.

THE STRUCTURE

  1. 01

    Context

    One paragraph: why the feature exists, for whom, and the current state of the system.

  2. 02

    Goals

    Three to five outcomes, stated in domain language.

  3. 03

    Non-goals / out of scope

    The scope boundary. Constrains agent behaviour more than any other section.

  4. 04

    User stories

    One narrative per capability, from the user's perspective.

  5. 05

    Acceptance criteria

    EARS notation, numbered, testable, one clause each (Ch.05).

  6. 06

    Data & interfaces

    Limited to what the behaviour requires. The schema belongs in the plan, not here.

  7. 07

    Open questions

    Each needs an owner and a resolution date — otherwise it's an aspiration, not a tracked question.

  8. 08

    Constitution deviations

    Any departure from a standing rule, with justification.

→

Appendix B, one click

The complete spec.md template, ready to drop into a feature directory.

EARSCh. 05 / 12

EARS

Five sentence patterns a model cannot misread.

Five sentence shapes that leave no room for misreading.

EARS — the Easy Approach to Requirements Syntax — is the standard for acceptance criteria unambiguous to humans and models. Five patterns, learnable in minutes: a keyword that says what kind of condition you are writing, then the same THE system SHALL spine underneath it every time.

— none —Ubiquitous

An invariant, true at all times

Template

THE system SHALL response

Example

THE system SHALL log every authentication attempt.

WHENEvent-driven

A trigger — something that happens

Template

WHEN trigger THE system SHALL response

Example

WHEN a user submits the login form THE system SHALL validate credentials.

WHILEState-driven

A state — something that persists

Template

WHILE state THE system SHALL response

Example

WHILE a sync is running THE system SHALL show a progress indicator.

IF … THENUnwanted behaviour

An unwanted condition to fence off

Template

IF condition THEN THE system SHALL response

Example

IF validation fails three times THEN THE system SHALL lock the account for 15 minutes.

WHEREOptional feature

An optional, not-always-present feature

Template

WHERE feature THE system SHALL response

Example

WHERE MFA is enabled THE system SHALL require a TOTP code.

RuleOne clause per criterion. A sentence joining two behaviours with “and” is two criteria — and becomes two tests.
RuleEvery criterion gets an ID (AC-03). Tasks cite it, tests name it, commits reference it — the thread that makes a spec executable.

STAGE 1 — CHOOSE A SHAPE

STAGE 2 — FILL THE SLOTS

THE system SHALL observable response

▸ An invariant — always true, no trigger and no condition. Reserve this for rules, not behaviour.

STAGE 3 — LIVE ANALYSIS

AC-07THE system SHALL ‹observable response›▸ implies test: spec/behaviour.spec.ts › observable response

✕ TESTABLE — FAIL

What would you assert in a test?

✓ ATOMIC — PASS

✓ MEASURABLE — PASS

✓ BOUNDED — PASS

FIG.07 · EARS PATTERN BUILDER · INTERACTIVE▸ Pick a pattern, fill its fields, and four meters score the result — the checks a reviewer would otherwise run by hand.

KEYSTab through pattern tiles and slot fields · type to see the assembled criterion and meters update (debounced ~400ms) · Wall of Shame switch shows 4 failing examples with zero typing required

An interactive EARS composer: choose one of five sentence shapes, fill its slots, and the tool assembles the criterion live while scoring it against four meters — testable, atomic, measurable, bounded — with fuzzwords struck through automatically. A Wall of Shame mode shows four pre-written bad criteria failing all four meters with no typing required.

Plan & TasksCh. 06 / 12

Plan & Tasks

How intent becomes a reviewable, ordered diff.

The plan is the review; the diff isn’t.

CONTAINS

A plan contains

  • The stack and versions
  • The data model
  • The interfaces and contracts
  • The sequence of the change
  • Decisions, with alternatives and trade-offs
  • The risks
  • What will not be touched
DOES NOT

A plan does not contain

Implementation code — that would mean reviewing the same work twice.

The spec omits the stack on purpose. plan.md lifts that constraint — the cheapest, highest-leverage review in this methodology.

RuleTasks follow the plan. A well-formed task is atomic, ordered, independently verifiable, and cites the acceptance criterion it satisfies.
tasks.mdtext
- [ ] T1  migration: magic_tokens table                      refs AC-01, AC-04- [ ] T2  POST /auth/magic-link — issue + send                refs AC-01, AC-03- [ ] T3  GET  /auth/verify — consume + establish session     refs AC-02- [ ] T4  contract tests for the 202 and 410 paths            refs AC-02, AC-03- [ ] T5  rate limit the issue endpoint (5/min/IP)            refs AC-05

The refs column is the thread: intent → task → commit → test. When something breaks, one search names which intent failed.

CRITERIA

AC-01

issues a single-use magic link

AC-02

a reused link is rejected with 410

AC-03

a link expires after 15 minutes

AC-04

token is persisted hashed

AC-05

issue endpoint rate-limited 5/min/IP

TASKS

T1

migration: magic_tokens table

T2

POST /auth/magic-link — issue + send

T3

GET /auth/verify — consume + session

T4

contract tests: 202 + 410 paths

T5

rate limit the issue endpoint

COMMITS

C1

feat(auth): magic_tokens migration

C2

feat(auth): issue magic link on login

C3

feat(auth): verify endpoint + session

C4

test(auth): 202/410 contract tests

C5

feat(auth): rate limit issue endpoint

TESTS

X1

magic-link.spec.ts › migration applies

X2

magic-link.spec.ts › issues link, 15m TTL

X3

auth/verify.spec.ts

X4

verify.spec.ts › 410 on reused link

X5

rate-limit.spec.ts › 429 at 5/min

Hover or focus any node to trace its thread across all four columns.

FIG.08 · TRACEABILITY THREAD · INTERACTIVE▸ Not documentation — an immediate answer to what a given failure actually broke.

KEYSTab or hover any node to trace its thread · BREAK A TEST button demonstrates the failure trace · RESET returns to the neutral state

Four columns — criteria, tasks, commits, tests — share one magic-link example, five items each, linked one-to-one. Hovering any node highlights its connected thread; a 'break a test' button turns a test node red and traces the failure backward to its task and acceptance criterion, printing which specified intent failed.

→

plan.md and tasks.md templates

Both templates are in the appendix, ready to use.

Traceability & DriftCh. 07 / 12

Traceability & Drift

Make drift a failed build, not a hunch.

Specs go stale. Enforce drift in CI, not memory.

Every abandoned wiki proves the objection: docs drift because nothing fails when they do. Make drift break the build.

A COMMIT TRAILER, MECHANISM 1

commit-message.txttext
feat(auth): magic link issue + verify refs specs/004-magic-link/spec.md AC-01, AC-02

FOUR MECHANISMS, RISING COST

  1. 01

    1 · Citation

    Tests reference their criterion; commits reference the spec path. Costs nothing, and answers which intent failed.

  2. 02

    2 · Coverage check in CI

    A script fails the build if any spec.md criterion has no matching test. ~40 lines, the highest-return automation here (Appendix D).

  3. 03

    3 · Contract enforcement

    Generate or verify declared interfaces — OpenAPI validation, Pact/Specmatic, Protobuf. The spec becomes the interface, not prose describing it.

  4. 04

    4 · Convergence review

    Periodically diff the codebase against spec/plan/tasks and list divergences. Cheap to run; catches behaviour nobody specified.

RuleWhen a requirement changes, update the spec first, in the same PR — not after, not in a follow-up ticket.

Week 0 of 12.

TRACK A — NO ENFORCEMENT

WEEK 0 · 96% · ALIGNED

TRACK B — CI COVERAGE CHECK ENABLED

WEEK 0 · 96% · ALIGNED

END STATE · WEEK 12 — ALIGNMENT 34% vs 96% · UNKNOWN BEHAVIOUR 11 vs 0

Illustrative, not measured — a demonstration of the mechanism, not a study result.

FIG.09 · THE DRIFT SIMULATOR · INTERACTIVE▸ An illustrative simulation, not a measured study: it demonstrates the mechanism a coverage check provides.

KEYSDrag the range slider, or focus it and press Left / Right, to scrub week by week · the current week and both tracks' status are announced for screen readers

A twelve-week simulated timeline comparing two tracks. Track A, no enforcement: alignment starts at 96 percent and decays through three unfixed events to 34 percent. Track B, CI coverage check enabled: the same three events each fail a build immediately and get corrected the same week, so alignment saw-tooths back near 96-98 percent every time. This is a demonstration of the mechanism, not a measured statistic.

→

Appendix D, the CI script

The coverage-check script, ready to drop into CI.

ToolingCh. 08 / 12

The Tooling Landscape

Eight tools, one loop underneath, and how to pick.

Eight implementations of the same loop, and when to reach for one.

Every tool below runs the Ch.02 loop. They differ on three axes: living vs. static specs, workspace vs. organizational orchestration, and how much ceremony they demand.

ToolShapeStrengthBest for
GitHub Spec KitOpen-source CLI + slash commands, works with 30+ agentsThe reference implementation most commonly used as a benchmark; supports extensions, presets, and role bundlesTeams avoiding vendor lock-in
AWS KiroAgentic IDE with native specs, steering files and event hooksrequirements.md / design.md / tasks.md as first-class objects; dependency-graphed task wavesAWS-native organizations that want the IDE to enforce it
Claude Code + cc-sddTerminal-first slash commands / skillsThe lowest-ceremony path to the complete loop; plan mode already functions as a review gateSolo developers and CLI-based workflows
CursorIDE plan mode + AGENTS.mdInline diff review; Spec Kit reachable over MCPTeams optimizing for review UX
OpenSpecMarkdown + YAML, proposal-firstMinimal, framework-agnostic, delta-orientedIndependent developers, exploratory brownfield adoption
BMAD-METHODCommunity methodology, multi-agent rolesConstitution plus role-based agent personas; a flexible framework rather than a packaged productTeams wanting method over tool
TesslSpec-as-source, compliance-orientedAudit trails, regulated templatesFintech, healthtech, regulated delivery
Google AntigravityAgent-first, specification-constrained autonomyDeep autonomy under spec constraintsTeams exploring high agent autonomy

THE 30-SECOND RUBRIC

Already in Claude Code? ......... Spec Kit + cc-sdd skills
In Cursor? ...................... Plan mode + AGENTS.md + Spec Kit via MCP
AWS-native shop? ................ Kiro
Regulated industry? ............. Tessl
Want minimal ceremony? .......... OpenSpec — or just the templates on this page
Not sure? ....................... Start with the templates. Add a tool when the
                                  templates start feeling like manual labour.

GITHUB SPEC KIT

# GitHub Spec Kit — install, init, then drive it from your agent
uv tool install specify-cli
specify init my-project --integration copilot
cd my-project

# then, inside the agent:
/speckit.constitution   Principles: code quality, testing standards, UX
                        consistency, performance budgets.
/speckit.specify        Build ... (what and why, no tech choices)
/speckit.clarify        (recommended before planning)
/speckit.plan           Stack, architecture, data model
/speckit.tasks          Actionable, ordered, criterion-citing
/speckit.analyze        Cross-artifact consistency before implementing
/speckit.implement      Execute the approved plan

AWS KIRO

# Kiro — spec as a first-class IDE object
.kiro/
├── steering/          # always-on project context (product, tech, structure)
├── specs/<feature>/
│   ├── requirements.md   # user stories + WHEN/THEN acceptance criteria
│   ├── design.md         # architecture, sequence diagrams, considerations
│   └── tasks.md          # discrete, trackable, dependency-graphed
└── hooks/             # event-driven agent actions (on save, on commit)

NO TOOL AT ALL

# No tool at all — this is a complete SDD setup
repo/
├── AGENTS.md                    # or CLAUDE.md — the operating manual
├── docs/constitution.md         # governing principles
└── specs/
    └── 004-magic-link/
        ├── spec.md              # what + why + EARS criteria
        ├── plan.md              # how
        └── tasks.md             # ordered, each citing AC-NN

MY AGENT

MY CONTEXT

MY TOLERANCE

SPEC KITKIROCC + CC-SDDCURSOROPENSPECBMADTESSLANTIGRAVITY

▸ Spec Kit is the conservative default: an open ecosystem, compatibility with over thirty agents, and no vendor lock-in.

LAST VERIFIED: 2026-08 — Tooling in this space changes every quarter. Verify before you standardize.

FIG.10 · TOOL MATRIX · INTERACTIVE▸ The recommended zone — spec-anchored, low-ceremony — is a region, not a single product. Filter to see what falls in it for your team.

KEYSTab through the pills to filter · hover or focus a mark for its detail

A scatter plot with ceremony on the horizontal axis and enforcement on the vertical. Claude Code, cc-sdd, OpenSpec and no-tool sit low-ceremony; GitHub Spec Kit sits centrally; Cursor and BMAD-METHOD cluster near it; Kiro and Antigravity sit higher on both axes; Tessl sits at high-ceremony, high-enforcement. A dashed region marks the low-ceremony, high-enforcement sweet spot. Filtering by agent, context, or risk tolerance dims non-matching tools and prints a one-line verdict.

BrownfieldCh. 09 / 12

Brownfield

Adopting the discipline inside code that already exists.

Adopt one feature at a time. Never rewrite everything.

Adoption starts with an existing codebase — no tests on the path you’re touching, deadlines looming. Adopt one feature at a time — never as a rewrite.

TWO WAYS TO GET THIS WRONG

Do
Spec the next change, never the system that already exists.
Don’t
Retro-spec paralysis — months documenting a system that changes weekly. Markdown monster — ceremony, no real decision change.

THE FIVE-STEP ON-RAMP

  1. 01

    1 — Write the constitution from the code that exists

    Direct an agent to infer conventions and module boundaries from the repo. ~1 hour; improves every session.

  2. 02

    2 — Spec the next change, not the system

    Spec the next ticket, one page — not the whole app. Over time, the most-touched code becomes the most-specified.

  3. 03

    3 — Characterize before you change

    Pin current behaviour with characterization tests first. Spec the change as a delta: what stays, what changes, what must not.

  4. 04

    4 — Add the CI coverage check on new specs only

    Scope the drift check to specs created after adoption began — never over pre-existing documents.

  5. 05

    5 — Let the map assemble itself

    Every spec documents part of the system. After ~20 features, the map exists as a by-product, not a project.

REPO TREE

package.json
src/
(400,000 lines you did not write)
AGENTS.md ← new

EFFORT vs BENEFIT

STEP 1 — CONSTITUTION FROM WHAT EXISTS · effort: 1 hr

Every future agent session, immediately.

FIG.11 · THE ON-RAMP · INTERACTIVE▸ Each step leaves the repo working — never mid-migration — and produces one real, verifiable artifact.

KEYS← → or click STEP buttons · MONTH 3 toggles the fast-forwarded state

A five-step on-ramp shown as a repo tree gaining one file per step: AGENTS.md, a spec directory, a characterization-tests directory, then a CI workflow file. A month-three toggle fast-forwards to twelve accumulated feature spec directories, with no separate documentation project ever scheduled.

Honest Case AgainstCh. 10 / 12

The Honest Case Against

The strongest objections, read before you adopt this.

Where this discipline is unwarranted, stated without hedging.

Weigh these before an organization standardizes on this methodology.

“This is waterfall under a new name.”

Fair, conditionally: where a spec is agent-generated and approved without scrutiny, the ceremony is real cost with no analytical benefit.

“Drift and hallucination aren't eliminated.”

Correct — code still needs maintenance. “The spec alone is enough” describes the top rung while addressing teams on the first. Thoughtworks: “Assess,” not “Adopt.”

“Over-specification defeats the purpose.”

When a spec becomes pseudo-code, you've written the program twice — once in prose, once in a language with a compiler.

“Precision produces false confidence.”

An implementation that perfectly satisfies a wrong spec satisfies nothing real. Precision makes intent auditable — it doesn't make intent correct.

“Vendor figures are marketing.”

Reported gains are directional, not rigorous. The defensible finding: time shifts from authoring to review — whether that's a net win depends on your review capacity.

VERDICT BAR — 0/5

JUST BUILD IT

Throwaway prototype, solo, short-lived, exploratory. Ceremony here is pure cost.

FIG.12 · WORTH IT / SKIP IT · INTERACTIVE▸ A methodology that can't say when not to apply itself is marketing, not guidance. Zero yes-answers is a deliberate verdict below, not a hedge.

KEYSTab through the five toggles · Enter/Space to flip one

A decision widget with five yes/no questions: will agents write a meaningful share of this code, will more than one person maintain it, are requirements complex or contested, is it integration-heavy, regulated, or safety-relevant, and will it outlive this quarter. A verdict bar fills as yes answers accumulate: four or five recommend full spec-anchored SDD; three recommend a light spec-first approach; one or two recommend skipping specs and keeping only a plan-approval gate; zero recommends skipping the methodology and just building it.

Monday MorningCh. 11 / 12

Monday Morning

Ninety minutes, one feature, zero tools bought.

One feature, five steps, ninety minutes, no purchase required.

Ninety minutes, one feature, no tooling purchase. Next week: add the CI drift check (Appendix D) and an AI-involvement line to the PR template. That’s the whole procedure.

0:000:200:501:001:201:30

0:00–0:20 — Constitution

0:00–0:20 · 20 MIN

Constitution

Copy Appendix A into docs/constitution.md. Specify the stack, the three required commands, and the restricted paths, then commit it. This alone improves every future agent session in this repository.

▸ produces: docs/constitution.md

Total: 90 minutes. No subsequent phase is required.

FIG.13 · THE 90-MINUTE CLOCK · INTERACTIVE▸ Five segments, one feature — each produces a concrete artifact and a literal prompt ready to paste.

KEYS← → moves between segments · each segment has its own COPY THE PROMPT button

A timeline in five weighted segments spanning ninety minutes: twenty minutes to write a constitution, thirty to write one spec, ten to clarify ambiguities, twenty to review a plan, ten to decompose tasks and implement the first one. Each segment names its artifact and offers a prompt to paste into an agent.

The spec is where the thinking happens now. Everything after it is execution.

Operating ModelCh. 12 / 12

The Operating Model

Jira, Git and Claude Code, running as one loop.

The board, the agent, the tiers — one mechanism, end to end.

Three systems, one loop: Jira the card, the repo the spec, Claude Code the work. A risk tier, not a title, decides how far it goes before it must stop and ask.

Agent-signed gates0at every tier, by design

PHASE A · PRE-CONSTITUTION

Day −1 · human-led, document-first — No agent should draft a constitution before this phase concludes, because until these decisions are recorded there is no valid source material to draft one from.

EXIT CRITERIA — PRD, NFR document, System Design Document and the core ADRs are written and committed as reference material. No ticket enters Specify before this phase is complete.

PHASE B · CONSTITUTION AND ENVIRONMENT

Day 0 · agent-drafted, human-ratified — This phase converts Phase A's decisions into an operating environment: one governing document, one configured board, and the deterministic controls that make both enforceable.

EXIT CRITERIA — constitution.md ratified and committed; deny rules and hooks committed; the Atlassian MCP server connected under a least-privileged service account; the board's gates and automations active; branch protection enabled; the resource envelope defined.

B01 · DRAFT THE CONSTITUTION

OWNER — Agent drafts · a human ratifies

Direct Claude Code to read the Phase A artifacts and draft docs/constitution.md: the stack derived from the ADRs rather than independently decided, the exact lint, test and build invocations, the autonomy tiers, the no-go paths, and the security posture. This is the highest-leverage artifact in the ticket-level system — every spec, plan and task is subordinate to it, and its no-go paths are the mechanism by which a system-design boundary becomes enforceable against an agent.

LEAVES BEHIND docs/constitution.md — ratified

FIG.OP-A · BEFORE ANY TICKET EXISTS · INTERACTIVE▸ Twelve steps in two phases — everything a team commits before the first ticket ever enters Specify.

KEYS← → walks all twelve steps across both phases · Enter or click selects one

A two-phase, twelve-step sequence: Phase A is human-led and document-first — repository and constitution setup; Phase B turns those decisions into a running environment — Jira, CI, and permission wiring. Selecting a step shows what it produces and why it precedes ticket work.

4.1 · JIRA → CLAUDE CODE

Atlassian's remote MCP server lets the agent read tickets, create issues, post comments and transition statuses without leaving the development environment. OAuth 2.1 suits an interactive session; an API token suits headless CI, because a token does not disconnect mid-session. The server enforces the authenticated account's existing Jira permissions — so the service account gets read access to the board and write access limited to comments and non-gate transitions, and nothing more.

claude mcp add --transport sse atlassian https://mcp.atlassian.com/v1/sse

FIG.OP-B · JIRA, GIT AND CLAUDE CODE · INTERACTIVE▸ Six integrations, one shared identifier — the Jira key. Nothing here synchronizes by a person retyping a status.

KEYSTab through the six edge buttons · hover or focus for detail

A triangle of three systems — Jira, Git, Claude Code — connected by six directional integrations, each keyed on the ticket's Jira identifier. Selecting an edge shows what configuration wires it and what it keeps in sync.

1 · ◉ HUMAN

PERSON

DOES
Writes what and why in one paragraph on a new or existing Jira card. Adds a tier label if the blast radius is already known; leaves it blank if it isn't — Clarify will surface the question either way.
PRODUCES
A card in Backlog, or a comment on one already in flight.

THREE PATHS THAT LEAVE THE MAIN SEQUENCE

A review at Station 5 changes acceptance criteria → reopens Station 3's spec.md before anything else moves.
Station 6, Tier 2 or Tier 3 → holds at Station 2, the board, until a human moves the card.
Station 6, Tier 1 only → loops back to Station 3 on the next queued card, with no human trigger.
FIG.OP-C · THE OPERATING LOOP · INTERACTIVE▸ Six stations a ticket crosses — Person and Human Reviews are the two human stations, three others carry a ✎ SPEC mark where the specification, not just the code, changes.

KEYS← → moves between stations, wrapping · Enter or click opens the detail panel

Six stations — Person, The Board, Claude Reads and Drafts, Commit and Update, Human Reviews, Claude Initiates — with three marked SPEC where the specification is written or amended. Selecting a station opens its detail: what it does, what it produces, and which of three backward paths reopen the spec, hold at the board, or loop automatically for Tier 1 work.

TIER 2 · TO-PLAN · SHARED

WHO DECIDES
Shared — Claude Code proposes, a named human approves, at two separate points.
MAY DO
Draft the spec and the plan; implement only once the plan is approved; open the PR. It does not merge it, and it does not start the next card unasked.
ESCALATES TO
The ticket's spec owner — whoever signed its acceptance criteria — by a comment on the card, not a guess at their intent.
FORCING MECHANISM
The Plan Review and In Review columns' WIP limits (Ch.01): a card physically cannot clear either without an approval recorded on it.
OVERRIDE TRIGGER
A plan rejected twice in a row escalates to the tech lead rather than drawing a third autonomous attempt at the same plan.
FIG.OP-D · THE ESCALATION LADDER · INTERACTIVE▸ The same three risk tiers as the board's swimlanes, read as decision rights: who decides, what the agent may do alone, and who it escalates to.

KEYS← → moves between tiers · Enter / Space selects the focused tier

Three ascending tiers — agent-autonomous, to-plan, proposal-only — each stating who decides, what Claude Code may do unasked, who it escalates to, and what forces the ticket up a tier regardless of its label. Selecting a tier shows all four fields.

WHAT OVERRIDES THE TIER LABEL

RuleA diff touching a no-go path (Ch.03) reclassifies to Tier 3 — regardless of label.
RuleA failed drift check (Ch.07) halts the ticket at In Review, at every tier.
RuleA plan rejected twice escalates to the tech lead. No third autonomous attempt.
RuleAnyone commenting “stop” halts the ticket immediately. No tier overrides this.

WHAT WIRES A TIER-1 HANDBACK

jira-automation-tier1.txttext
# Jira Automation rule — "Tier 1: hand back to Claude Code"Trigger:    card moved to Done AND tier = T1Condition:  no comment containing "stop" in the last 10 minutesAction:     webhook POST to the agent runner   { "event": "card.done", "key": "{{issue.key}}",    "tier": "{{issue.tier}}", "next": "pull-next-in-queue" } Tier 2, Tier 3, and any card with no tier label fire nothing. Therunner never polls the board — the board tells it when to move.

SEE ALSO

AppendicesCh. AX / 12

Appendices

Constitution, spec, plan, tasks and CI — ready to paste.

Copy-ready templates for every artifact this book describes.

Four artifacts, byte-for-byte identical to what COPY and DOWNLOAD produce — nothing here is retyped for display.

APPENDIX A

docs/constitution.mdmarkdown
# Constitution — <project-name>Version: 1.0 · Ratified: <date> · Owner: <name> > Governing principles for this repository. Every spec, plan and task is> subordinate to this document. Where a client agreement is stricter, the> client agreement wins. ## 1 · Stack (non-negotiable without an ADR)- Language: <e.g. TypeScript 5.x, strict mode>- Runtime: <e.g. Node 22>- Framework: <e.g. Next.js 15 App Router>- Data: <e.g. PostgreSQL 16 via Drizzle>- Package manager: <e.g. pnpm — never mix with npm/yarn> ## 2 · Commands (run these; do not invent variants)- Lint:  `<make lint>`- Test:  `<make test>`     single: `<make test T=path::name>`- Build: `<make build>`- All three must pass before any commit is proposed. ## 3 · Principles (ubiquitous EARS form)- THE system SHALL have unit tests for all domain logic.- THE system SHALL NOT log personally identifying data at any level.- THE system SHALL NOT gain a new runtime dependency without a human  decision recorded in the plan.- THE system SHALL keep HTTP handlers free of business logic.- THE system SHALL return structured errors from `<errors module>`;  never bare exceptions, never silent fallback values. ## 4 · Specification standard- One feature = one directory: `specs/NNN-slug/{spec.md,plan.md,tasks.md}`.- Acceptance criteria SHALL use EARS syntax and carry `AC-NN` identifiers.- Every task SHALL cite the criteria it satisfies.- Every spec SHALL contain an explicit "Out of scope" section.- A spec SHALL be updated in the same pull request as the behaviour it describes. ## 5 · Autonomy tiers| Tier | Work | Agent may | Gate ||------|------|-----------|------|| 1 | Tests, docs, lint, dependency bumps | Work autonomously | PR review || 2 | Feature work, refactors, bug fixes | Propose a plan, then implement | Approved plan || 3 | Auth, crypto, data models, migrations, IaC, public contracts | Analyse and propose only | Line-by-line acceptance + architect sign-off | **Escalation rule:** when the tier is unclear, treat it as the higher one. ## 6 · No-go paths (propose only, never modify)- `migrations/` · `infra/` · `src/generated/` · `vendor/`- `.env*` except `.env.example`, and anything matching `*secret*` ## 7 · Security posture- Production data SHALL NOT appear in any prompt. Use synthetic fixtures.- Every agent-suggested dependency SHALL pass composition and licence scanning.- Secret scanning SHALL run in pre-commit hooks. ## 8 · Definition of done- Lint, tests and build pass via the commands in §2.- New behaviour has tests a human has read and approved.- The diff touches only files named in the approved plan.- The spec reflects the behaviour that shipped. ## 9 · Sharp edges (append every hard-won surprise here)- <e.g. the ORM session is request-scoped; holding it across awaits deadlocks>- <e.g. `make test` requires Docker for the Postgres fixture>
vedantsen.com/spec-driven · v1.0 · content last verified 2026-08 · tooling in this space changes quarterly — verify before you standardize
SPECPLANTASKSCODE

MODULE 16 · REV 1.0

Chapter 00 of 12 — The Inversion