--- title: "The Board, the Rules and the Handoff to QA" author: "Harry" published: 2026-10-31T04:14:13.820Z updated: 2026-10-31T05:05:45.124Z category: "AI Agents: SDLC & STLC" tags: ["sdlc"] canonical: "https://fxblog.dev/posts/ai-coding-standards-board-qa-handoff" --- # The Board, the Rules and the Handoff to QA ## Key takeaways - The Agents tab reads Claude Code transcripts read-only and gives every subagent a stable first name, its task and its last step. - Agents that ran together sit at one round table, and a task id two of them name is listed as shared, so a collision is visible before the merge. - Every list endpoint is paginated, cursor first, with a default limit of 20, a maximum of 100 and a unique tiebreaker. - Security findings live in a SEC ledger for life, and only a named person can accept one, with an owner and a date. - G10 will not deploy without a passing QA report dated after the shipped commit's G8 run, a GO sign-off, or a person's written waiver. > **TL;DR** Left to taste, AI agents write two list endpoints in two styles, collide on the same file, and deploy on the developer's word. In sdlc, AI coding standards each have one owner and one gate that can fail it, and development ends at one file, `qa-handoff.md`. G10 refuses to deploy until QA's report passes and is dated after the shipped commit's G8 run, a sign-off says GO, or a named person waives QA in writing. > > **Do this:** Check one of your list endpoints against `DEV-CONTRACTS.md §13`: cursor pagination, `limit` 20 by default, and RFC 9457 errors. [Part 3](03-vs-code-board.md) left case-search with several agents building its tasks, and two questions: is any of them stuck or about to collide, and what stops the code shipping before QA has tested it? **This series, in four parts:** 1. **Your AI Coding Agent Grades Its Own Homework. Add Gates.**: the problem, and the route sdlc takes. 2. **Your First sdlc Run: case-search From Problem to Design**: install, then the first three gates and their logs. 3. **When Something Changes: STALE, Reaffirm and Who May Override**: an edit lands after approval. 4. **The Board, the Rules and the Handoff to QA** (you are here). ## Who is working on case-search right now Scrolling transcripts will not tell you which agent is stuck. The **Agents** tab reads Claude Code's own transcripts, read-only, and draws every chat and the subagents it spawned. Each agent keeps a stable first name, so "Anh is on TASK-003" works in a stand-up. ![The Agents tab for case-search: one /sdlc-implement chat with three agents at one round table, Anh working on TASK-003, Hung idle on TASK-004, Minh done, and a finished G6 review chat](https://fxblog.dev/media/01a18fc9-3c1a-7699-853a-9c2bfeecc19e/1600) _Agents that worked together sit at one table_ On one of my projects an implementer ran for two hours before it stopped on a file another lane owned. Parallel tasks save time until that happens. > **Tip** > > Each agent shows its task id and its last steps, and a table lists any task id two agents both name, so a collision shows up here before the merge. ## One rule per list endpoint Ask two agents for two list endpoints and you get two pagination styles and two error shapes. sdlc decides once, in `DEV-CONTRACTS.md §13`, and each rule names the skill that owns it and the gate that checks it. The list endpoint answers to these when its contract is reviewed (G4) and again when its code is (G7): | Topic | The rule | | ---------- | -------------------------------------------------------------- | | Lists | Always paginated, "no exceptions". Default `limit` 20, max 100 | | Pagination | Cursor by default; every sort ends with a unique tiebreaker | | Errors | RFC 9457 `application/problem+json`, one shape | | Writes | `Idempotency-Key` on creates; `ETag` and `If-Match` on updates | So case-search's acceptance criterion reads "20 cases and a next cursor, sorted by title then id". Security findings work the same way: one ledger, one `SEC-NNN` row each for life, and only a named person can mark one `accepted`. By default an open critical or high finding fails G8 and G9. ## One file, and a deploy that waits `/sdlc-release case-search` writes `release/case-search/qa-handoff.md`: the REQ table, acceptance criteria, contract and data-model paths, the shipped commit, and the criteria only a running product can prove. For case-search that is `AC-101`, p95 under 300 ms at 50 requests a second, against staging. ![case-search leaves development as one file: G9 writes qa-handoff.md, stlc tests and reports, and G10 deploys only on a pass dated after the G8 run, a GO or a named waiver; escapes return at G11](https://fxblog.dev/media/01a18fc9-43af-73c8-a042-85c540f097bb/1600) _Nothing else crosses in either direction_ G10 will not deploy on the developer's word. It waits for one of these: 1. the latest QA report is dated after the shipped commit's G8 run and every gate line passes; 2. a release sign-off covering it says GO; 3. a named person has waived QA in writing. > **Note** > > Limits: sdlc runs only in Claude Code, and people still own overrides and release sign-off. So the deploy waits for a QA verdict newer than the last G8 run, and the series stops at the handoff. What QA does with `qa-handoff.md`, from requirement ids to a verdict on that commit, is the stlc series. ## Try it ```sh cd your-project npx agentic-fx@latest install ``` Pick `dev`; the installer adds the VS Code board. Then run **SDLC: Open Board**, or **SDLC: Open Agents** while a `/sdlc-implement` is running. The standards are rows in `DEV-CONTRACTS.md §13`, in your repo. ## Read this with your AI ```text Read the post "The Board, the Rules and the Handoff to QA". 1. Pick 3 rows of the API standards table that my API breaks (below), and say which gate would fail each. 2. Ask me 3 questions to check I understood; wait, then correct me. 3. List what my next release should put in its QA handoff. ``` > **Success** > > case-search is in QA's hands now. Back to the start: **Your AI Coding Agent Grades Its Own Homework. Add Gates.** ## FAQ ### Where does the Agents tab get its data? From Claude Code's own transcripts for the project, including each subagent's file, read without changing them. ### Can I change sdlc's standards? The registry says which skill owns each rule and which gate enforces it. A check is added to a gate's reviewing skill with /sdlc-improve, which refuses to run without evidence of what reached production. ### What goes into qa-handoff.md? The REQ table, the acceptance criteria, the contract and data model paths, the shipped commit, and the criteria only a running product can prove.