AgentFlow SDLC2.0
How it works
AgentFlow 2.0 replaces uniform multi-step ceremony with risk-calibrated control loops. Routine slices collapse into a single oracle-pinned builder pass; consequential work escalates to separate seats, clean-context councils, cross-family Four-Eyes review, and out-of-band supervisory steering.
Product and analysis define the outcome, acceptance criteria, and slice boundaries (`pm.*` writes only `.agentflow/**` and `goals/**`). The slice is classified from `P0`/`P1` (routine) to `P2–P4` (cross-cutting or high-assurance), and checked against the consequence floor (`auth`, `crypto`, `storage`, `locking`, `migration`, `tests/oracles/**`).
Goal spec + AcceptanceContract + complexity class (P0–P4)Before any implementation begins, `orch.arch` (and a clean-context Council at `effort: high` when `P2+`) locks the design and pins the cryptographic SHA-256 digest of `tests/oracles/**`. Builder seats (`dev.build`) are barred by path-ownership rules from modifying oracle files.
Phase 3 Oracle Digest Pin + RoleHandoffFor routine `P0`/`P1` slices with a pinned oracle digest, `dev.build` executes a single-turn Composite Phase 3–5 Builder Pass inside an isolated git worktree (`.worktrees/<branch>`) at `effort: medium`, spawning ephemeral L2 subagents for code search and test runs. If the slice is `P2–P4` or touches a consequence-floor path, AgentFlow enforces full Phase 3 → 4 → 5 → 6 seat separation.
DeliveryReceipt + candidate SHA + L2 subagent evidenceCode gates verify the oracle digest, path ownership, candidate SHA, and test exit codes first. Next, Dynamic Reviewer Dispatch assigns `rev.review` to an orthogonal model family (`Claude` ↔ `GPT` ↔ `Gemini`) so no model family grades its own homework. If rework is requested, Sticky Builder Return Affinity routes the slice back to the exact builder seat and worktree.
Deterministic gate report + Cross-family Four-Eyes verdictIf `reworkRounds > 2`, the Epoch Circuit Breaker freezes the slice. The Grounded Decider Port (`d3-flash`) classifies the failure (`transient`, `architectural_conflict`, `oracle_gap`, `spec_ambiguity`) so out-of-band `steer.lead` can execute `unfreeze` or `accept_and_register`. Meanwhile, out-of-band `eval.tester` and trace extractors feed the Closed-Loop RSI engine.
Decider classification + Steer resolution + RSI refinement proposalAdaptive execution substrates
You do not need a multi-agent daemon to adopt AgentFlow 2.0. `doctor-env` inspects your environment and maps the workflow onto `S0`, `S1`, or `S2`.
Uses a single installed CLI (`claude`, `codex`, `agy`, `pi`, or `grok`). One parent session steps through role phases sequentially and spawns native ephemeral L2 subagents for read-only codebase exploration and test verification.
Uses two or more CLIs from different model families on the same workstation. The primary CLI executes the Composite Phase 3–5 Builder Pass while an orthogonal CLI performs independent Phase 6 Four-Eyes review and Council checks.
Projects four persistent L1 execution seats (`orch.arch`, `dev.build`, `dev.qa`, `rev.review`) working in isolated `.worktrees/<branch>` checkouts, paired with out-of-band `steer.lead` (Plane 1) and `eval.tester` (Plane 3 RSI).
Deterministic gates + Grounded Decider Port
AgentFlow never spends a frontier model call to check whether an artifact exists, whether an oracle was tampered with, or whether a seat wrote outside its allowed paths.
Deterministic validators check candidate SHA, Phase 3 oracle digest integrity, path-ownership rules (`pm.*`, `steer.*`, `dev.build*`, `dev.test-eng`), and compiler/test exit codes. Failed invariants block immediately.
Only after deterministic checks pass does the fast, low-cost decider port (`d3-flash`, fallback `gemini-3.8-flash` / `gpt-6-mini`) classify rework loops, defect severity, and circuit-breaker escalations for `steer.lead`.
Out-of-rig `steer.lead` governs `unfreeze`, `accept_and_register`, and `merge` verbs with zero code write access (`allow: []`). High-assurance `P4` slices require explicit human security and acceptance sign-off.
Zero self-waiver invariant: Neither an execution seat nor the Grounded Decider Port can waive a failing deterministic check, alter a pinned oracle digest, or bypass a required human gate.
Proportional ceremony & consequence floors
AgentFlow scales coordination depth automatically based on complexity class (`P0`–`P4`) and the `CONSEQUENCE_FLOOR_RE` path guard.
When the Phase 3 oracle digest is pinned and no high-consequence path is touched, `dev.build` executes Phases 3, 4, and 5 in a single worktree turn (`effort: medium`) using internal L2 subagents. Deterministic gates and `dev.qa` / `rev.review` verify the result before acceptance.
Separates planning (`orch.arch`), implementation (`dev.build`), and QA verification (`dev.qa`), followed by cross-family Phase 6 review (`rev.review`) with Sticky Builder Return Affinity if rework is needed.
Triggered automatically for `P3` work or any diff touching `auth`, `crypto`, `storage`, `locking`, `migration`, or `tests/oracles/**`. Convening a Council spawns clean-context (<40k token) advisers at `effort: high` so deep reasoning never degrades inside a polluted builder transcript.
Combines full seat separation, clean-context Council advice, cross-family Four-Eyes review, and a delivery-bound human approval on the open PR before merge.
Nine canonical roles → Lean 4-Seat Squad
AgentFlow retains nine canonical lifecycle responsibilities for auditability, while projecting them onto four persistent L1 execution seats plus two out-of-band supervisory/RSI seats.
In `S0` (Single-CLI), one executor wears the execution hats sequentially while enforcing the same phase contracts and path rules. In `S2` (OpenRig), the Lean 4-Seat Squad is the default topology (`--topology 6-seat` remains available when dedicated `dev.test-eng` and `ops.pr` seats are desired).
Inspect the role catalog and seat projection ↗See the technical design