TL;DR — Solo + AI-assisted building has a specific failure mode: nothing stops a capable agent from drifting off-spec, and nothing forces you to notice until it ships. ADLC (Agentic Development Lifecycle) is a ten-phase apparatus — Discovery through Wrapup — with a hard rule: a phase only advances on its own gate criterion, and between gates the agent runs autonomously and stops for exactly two reasons: a routine human sign-off (HG) at every phase transition, or one of ten named standing halts (H1-H10). A Constitution of artifact-checkable principles gets walked at each gate; a separate Operating-Norms doc governs session conduct that a gate can’t tick against an artifact. First real run: BookTS, a real App Store app. This post is what the apparatus is, why a team-of-one needs one at all, and where it still leaves gaps.
JTBD: why a solo builder needs a lifecycle at all
When I’m building alone with an AI coding agent that can write in any direction I point it, I want a structure that catches a dropped requirement or a scope-creeping design before it’s shipped, so that I don’t have to be the one re-reading every diff line-by-line looking for what I forgot to ask for.
On a team, that structure exists for free. A PM reviews the spec before eng starts. A second engineer reviews the PR. QA runs the smoke test nobody remembers to run themselves. None of that is process for its own sake — it’s checkpoints supplied by having other people in the loop. Solo, they don’t exist unless you build them.
An AI agent makes this worse, not better, in one specific way: it will happily produce a confident, well-formatted, wrong answer, and it will do it at the same fluency as a correct one. I wrote about this in Harness Engineering — the model doesn’t stop hallucinating just because it’s writing code instead of prose; you have to build the harness that catches it. ADLC is that harness applied to the whole build, not just one agent loop. It’s the scaffolding around “build an app,” the same way the eval numbers in the Eval-Framework post are the scaffolding around “which model is actually good at this task.” Same instinct, different altitude: don’t trust the fluent answer, build the apparatus that checks it.
What ADLC actually is
Ten phases, numbered 0 through 9, each with a named tool or artifact and an explicit gate that decides whether it’s allowed to advance:
| # | Phase | What it produces | Gate to advance |
|---|---|---|---|
| 0 | Discovery | a validated idea + V0 scope | idea-validation pass (or an explicit logged waiver) |
| 1 | Spec | spec.md (WHAT, not how) | entry only — validated idea in hand |
| 2 | Validate Spec | spec status LOCKED | completeness checklist + Constitution walk + human sign-off |
| 3 | Architect | design.md (HOW) | entry only — spec LOCKED |
| 4 | Validate Architecture | design status APPROVED | generator-critic planning loop clean + spikes pass + human sign-off |
| 5 | Implement | code | all design-derived tasks done, build/tests green |
| 6 | Reflect | reflection + fixes | self-review clean or justified |
| 7 | Review | reviewed code | P0/P1 findings resolved, P2 triaged or waived |
| 8 | Ship | merged / deployed artifact | a real-device (or post-deploy) smoke actually passes |
| 9 | Wrapup | updated docs/lessons | closeout done |
A few things about that table matter more than the row count.
Spec is WHAT-only; Architect is HOW. This split isn’t decoration — it changes what the gate at each phase is even allowed to check. Early on I ran the Validate-Spec gate through a plan-shaped critic and it kept penalizing a WHAT-only spec for missing build-order and cost tradeoffs, which is exactly what design.md is for. A spec gate is a completeness-and-discipline checklist; the plan/design critic runs one phase later, at Validate-Architecture, where there’s finally something plan-shaped to critique. Getting the gate to match the artifact it’s grading sounds obvious in hindsight and cost a rewrite to learn.
Two of the nine “phases after Discovery” are gates, not authoring. Validate-Spec and Validate-Architecture don’t produce new content — they decide whether what got authored is allowed to lock. That’s deliberate: authoring and judging are different modes, and collapsing them is how a spec quietly ships with three [NEEDS CLARIFICATION] markers still in it.
Ship’s gate is a real smoke, not a green build. The gate at phase 8 isn’t “the code compiled” — it’s “a real device (or a real post-deploy check) actually exercised the shipped thing and it worked.” On BookTS, the first project through ADLC, that’s a literal TestFlight install onto a physical iPhone, driven through mobile automation, tapping the actual controls, not screenshotting them. That distinction caught bugs a simulator never would have: a path-containment check that broke because iOS only strips a filesystem prefix from paths that already exist, and a GPU job silently killed when the app backgrounds unless you explicitly request background compute. Neither shows up until real hardware runs the real flow.
Gate discipline: only two reasons to stop
The single rule that makes the rest of ADLC work: a phase advances only on its own gate criterion, and a gate failure is never autonomous-proceed — it loops back to the authoring phase and re-runs, it does not get waved through. Between gates, the agent runs autonomously. It doesn’t ask permission for every step, doesn’t pause to confirm things already decided, doesn’t drip small questions across ten turns. It stops for exactly two categories of reason:
HG — the phase-gate halt. Every phase transition that locks or approves an artifact (spec → LOCKED, design → APPROVED, the ship decision) requires my explicit sign-off. This is the backbone: an agent must never cross a phase boundary on its own say-so, no matter how confident it is that the spec is done.
H1 through H10 — ten standing halts, each a named, specific trigger rather than a vague “use judgment”: a mid-work product decision the spec never settled; three failed retries on a build/test/eval loop; a failed ship-gate smoke; an unresolvable merge or requirement conflict; a hook blocking for the first time; a destructive or outward-facing action; an ambiguous target that doesn’t clearly match; spending money or minting a new credential; crossing into another workspace’s territory; a login step.
That’s the whole halt surface. Anything not on that list is autonomous by default — a log entry, not a pause. The contract says so explicitly: a pause that isn’t HG or H1-H10 is a bug in the contract, fix the contract, don’t invent an ad-hoc pause. Most process documents enumerate what an agent may do and leave “when to stop” implicit. ADLC enumerates the stops and leaves everything else as permission by default — the only version of “autonomous” that’s usable for a solo builder who doesn’t want to babysit every step but does want to be pulled in for the ten things that matter.
Two documents, two jobs: Constitution vs. Operating Norms
Early drafts had one flat list of “how to build well,” and it didn’t work as a gate — you can’t tick “communicate concisely” against a spec document. So the rules split into two:
The Constitution is artifact-checkable: a table of principles, each scoped to the phases it applies to (a deploy principle is N/A at the Spec gate — it doesn’t get checked there, and it doesn’t halt anything), each with a severity. A P0 violation in scope halts immediately. A P1 must be fixed or justified in writing before the phase can advance. A P2 is advisory — logged, never blocking. Categories cover product/scope discipline (ship over polish, bounded scope, no silent widening), engineering rigor (verify infrastructure empirically rather than from memory, no claiming “done” before it’s verified, a real functional smoke after every deploy), truth and citation (abstain below a confidence threshold, every factual claim carries a source), and security boundaries (no credential reuse, no secrets in tracked files, strict isolation). Each row is a presence-check — a gate ticks the in-scope rows and surfaces only violations, never a 30-item checklist for every pass.
The Operating Norms are the opposite: always-on conduct, never ticked against a document. Self-execute feasible steps instead of asking permission for each one. Pause only at a login step or a genuine decision, then continue. An already-approved multi-step plan runs straight through without re-asking mid-flow. Deliver findings once, with a recommendation, instead of dripping options across five turns.
Splitting them mattered: the Constitution stopped trying to police tone, and the Operating Norms stopped pretending “no scope creep” was a communication-style rule instead of a P1 principle with a source and a severity.
Where this connects to the harness-engineering thesis
ADLC is the same argument as Harness Engineering applied one layer up. That post’s claim was that the intelligence in a long agent session lives in the plumbing, not the model — the durable log, the wake-up trigger, the verification loop that forces a tool call instead of a fluent guess. ADLC is that plumbing wrapped around an entire build: the gate is the verification loop (nothing advances on a claim, only on a checked artifact), the Autonomy Contract is the trigger design (it decides exactly when a human needs to wake up), and the phase pipeline is the durable log (spec and design are externalized state that outlive any one session’s context window).
The Validate-Architecture gate runs on a generator-critic planning loop — the same shape as the idea-to-ship pipeline: one side proposes, the other grades against a rubric, and nothing advances until the loop comes back clean. Review at Phase 7 works the same way at a different scope: a reviewer on a different model than the one that wrote the code, scoping the diff mechanically rather than letting the author pick what to show, verifying each finding adversarially before a separate triage step ranks what survives. The pattern repeats at every altitude: never let the thing that produced the artifact be the only thing that judges it.
What it still can’t fix
The gates only catch what they’re scoped to check. A Constitution row marked N/A for the current phase means exactly that — nothing enforces a deploy-discipline row at the Spec gate, on purpose, and that’s a real gap if a spec quietly implies a deployment decision the row would have caught two phases later.
The Autonomy Contract only stops for what’s named. H1-H10 is a fixed enumeration precisely so “everything else is autonomous” stays unambiguous — but a genuinely novel failure mode that doesn’t map onto any of the ten will either get force-fit into the nearest one or slip through as a log entry when it probably deserved a pause. The fix so far has been amending the contract when that happens, not adding a catch-all halt — a catch-all is exactly the vague “use judgment” escape hatch this design exists to avoid.
And a gate only ever grades what got written down. If the spec itself is wrong about what the user actually needs, a clean Constitution walk and a passing gate will happily lock in the wrong thing with full process compliance. ADLC catches drift from the spec. It does not catch a spec that was wrong from Discovery — that’s still a human job, before any of this apparatus starts checking anything.
The honest summary
A team gives you checkpoints for free by being made of other people who each notice different things. Solo, you have to build those checkpoints on purpose or they don’t exist. ADLC is ten phases, a gate that only opens on its own criterion, two documents that split “is the artifact right” from “is the session behaving,” and an autonomy contract that enumerates exactly ten reasons to stop and treats everything else as permission. It’s not a guarantee the build is right. It’s a guarantee that when it’s wrong, there’s a specific gate that should have caught it — which turns “how did this ship broken” from a mystery into a bug report against the process itself.