Spec-driven development
The spec is the contract
Work starts as a versioned spec whose acceptance criteria are executable checks. Agents implement against the spec file, and CI rejects any PR that does not reference a spec ID.
AI Coding & Build
Agents write the code. Gates decide what ships.
We run agentic coding the way regulated teams run change control: a written spec, a human gate, an eval gate, and a provenance trailer on every generated line — so speed never costs you the audit trail.
Approach
Six controls between a prompt and production
Each control is a mechanism in the repository or CI, not a policy document. Remove one and the pipeline fails closed.
Agentic coding, human gates
Agents propose; people dispose
Agents run on scoped branches with least-privilege tokens and no production credentials. Branch protection lets them open PRs but never merge; CODEOWNERS routes every AI-authored change to a named reviewer.
Cursor Rules governance
Conventions enforced in the editor
Rule files live in the repository, are reviewed like code, and pin architecture boundaries, banned APIs and secret handling. A CI check diffs them against the platform baseline so local edits cannot quietly weaken them.
Eval-gated merges
No regression beyond the band
CI runs the golden-set eval suite on every PR and refuses merges whose score regresses beyond the tolerance band declared for that service; the score, the band and the failing cases are posted to the PR.
Provenance on every line
Every hunk knows where it came from
Every AI-authored hunk carries a commit trailer with model, prompt hash and reviewer. A post-merge job writes those trailers to the decision ledger, so any production line can be traced to the prompt that produced it.
Sandboxed agent runtime
Blast radius set before the first prompt
Agents execute in ephemeral containers with egress allow-lists and read-only mounts outside the working tree; model calls leave through private endpoints and are logged, so a misbehaving agent is contained, not trusted.
Pipeline
From spec to provenance ledger
Seven stages, two gates, two loops. Amber marks the gates: nothing passes them on an agent's say-so.
01 · Human
Spec
A versioned spec with acceptance criteria written as executable checks. Its ID is required in the branch name and the PR, or CI rejects the PR.
02 · Agent
Plan
The agent proposes a task graph, the files it will touch and the risks it sees; an engineer approves the plan before any code is generated.
03 · Agent
Agent implementation
Agents work on a scoped branch with least-privilege tokens, no production credentials, and the repository's Cursor Rules loaded into every session.
04 · Reviewer
Human gate
CODEOWNERS routes the PR to a named reviewer who approves the diff, not the summary. Branch protection lets agents open PRs but never merge them.
05 · CI
Eval gate
CI runs unit tests, the spec's acceptance checks and the golden-set eval suite. A score that regresses beyond the service's tolerance band fails the build.
06 · CI
Merge
Squash-merge produces a signed commit whose trailers record model, prompt hash, spec ID and reviewer for every AI-authored hunk.
07 · System
Provenance ledger
A post-merge job writes the trailers to the hash-chained decision ledger, so any line in production traces back to its prompt, reviewer and eval score.
Loops
Rejections return to the agent
Changes requested at the human gate, or an eval score below tolerance, send the work back to implementation with the reviewer's notes or the failing cases attached as context.
Tools constellation
Every tool orbits one control plane
Models, agents, media generators and builders all reach work through the Earp Orchestration Layer, which applies identity, guardrails and ledger logging the same way whichever vendor sits behind it.
CoreEarp Orchestration Layer
Claude
ProductionFoundation Models · Coding · Agents · Data
Our primary model for agentic coding, spec drafting, long-context document review and structured extraction, called through private endpoints with every prompt hashed to the ledger.
Full entry in the tools index- Inner orbitModels & clouds6
- Middle orbitMedia & design5
- Outer orbitCoding & agents11
- Hover or focus a node to pause the orbit; it stays still under reduced motion.
Core
Earp Orchestration Layer
Inner orbit · Models & clouds
- GrokEvaluatingA model we score on our eval harness for reasoning and retrieval-heavy tasks before we would route any client workload to it.
- Microsoft AI FoundryProductionModel deployments and evaluations inside client Azure tenants, fronted by private endpoints and Entra ID so access follows the tenant's existing identity controls.
- ClaudeProductionOur primary model for agentic coding, spec drafting, long-context document review and structured extraction, called through private endpoints with every prompt hashed to the ledger.
- Amazon BedrockProductionManaged model access inside client AWS accounts, reached over VPC interface endpoints so prompts and grounding data stay inside the account boundary.
- ChatGPTProductionA second model for drafting and cross-model review: we run it against the same golden sets as Claude and route work to whichever scores higher for the task.
- Hermes 2.0R&DAn open-weight model line we benchmark in our eval harness for scenarios where inference has to run self-hosted, inside a boundary no external API can reach.
Middle orbit · Media & design
- KlingProductionVideo model we used alongside Seedance, via Higgsfield, to generate this site's hero backdrop and ambient motion loops.
- Higgsfield AIProductionThe generation API we use to orchestrate video models — this site's hero backdrop was produced through it with Kling and Seedance.
- SeedanceProductionVideo model we used, via Higgsfield, to generate this site's hero backdrop; we use it for motion studies and explainer footage.
- Nano BananaEvaluatingImage model wired into our media pipeline as the keyframe generator; it is not yet enabled on our API account, so keyframes route through other models today.
- AI FigmaProductionFigma's built-in AI features, which we use to explore layout variants and draft prototype flows before a design review — the reviewed file, not the suggestion, is the source of truth.
Outer orbit · Coding & agents
- JevEvaluatingAgent tooling we are running through our coding-agent harness on internal repositories to decide whether it earns a place in the build pipeline.
- Claude PluginsProductionWe package our review commands, hooks and connectors as versioned plugins so every engineer's coding agent runs the same governed toolchain.
- BoltEvaluatingA browser-based app generator we use for disposable prototypes, so stakeholders can react to a working flow before we write the spec.
- Claude SkillsProductionWe encode house procedures — eval runs, landing-zone reviews, ledger export — as skills the agent loads only when the task calls for them, keeping context budgets tight.
- CursorProductionThe editor our engineers use for agentic implementation against a written spec, with every generated diff reviewed hunk by hunk before commit.
- Cursor RulesProductionRepository-scoped rule files, reviewed like code, that pin architecture boundaries, banned APIs and secret-handling patterns into every Cursor session.
- ReplitEvaluatingA hosted workspace with an AI agent that we use for throwaway proofs of concept — never for client production code or client data.
- Auri.buildR&DAn AI build tool we are assessing against our spec-driven workflow; it has no production role yet.
- GrokbotR&DConversational agent tooling we explore in a sandbox to compare agent behaviour and guardrail responses across model providers.
- OpenClawR&DAn open-source agent runtime we study in an isolated sandbox to understand tool-permission and prompt-injection behaviour before anything similar touches client systems.
- Base 44EvaluatingAn app builder we are evaluating for internal tools that a client's business team could own and maintain after hand-off.
Bring agentic coding under change control
We install the spec template, Cursor Rules baseline, eval gate and provenance trailers in your repositories, then run the first features through them with your engineers.