sdlc and stlc: No Passing QA Report, No Deploy

TL;DR In an AI coding agent workflow, the developer's agent says "done" while QA's proof sits in another tool, so a deploy goes out on the developer's word. sdlc (development) and stlc (testing), two free Claude Code bundles, meet at two files: a handoff packet out and a QA report back. Only here: sdlc's G10 deploy gate refuses to run until stlc's report passes every gate line and is dated after the shipped commit's G8 run, and stlc computes that report's overall verdict from those lines, so neither side takes the other's word.

Do this: Run npx agentic-fx@latest install, pick dev and qa, and start one small feature with /sdlc-intake.

On Friday the developer's agent says case-search is done. QA's tests sit somewhere else, written against requirements someone retyped. On Monday it deploys, and nobody can say which test proved which requirement.

Two bundles, two files between them

sdlc is the development bundle and stlc the testing bundle. Each takes its own input and writes a named file at every step. They touch at exactly two files: a packet going out, a report coming back.

Four questions to ask of any dev and QA flow

1. Does QA start from the developer's requirement ids, or from a copy someone retyped?
2. Is the handoff one file, or a chat message?
3. Is the QA verdict computed from evidence rows, or typed by a person?
4. What stops a deploy when there is no verdict?

The handoff, step by step

1. G9 (/sdlc-release) writes release/case-search/qa-handoff.md: the REQ table (REQ-001, REQ-002, REQ-101), the acceptance criteria, the contract path and the shipped commit. Stops: retyped requirements.
2. stlc runs /qa-analyze case-search release/case-search/qa-handoff.md. It keeps every REQ id verbatim and takes the criteria only a running product can prove, here AC-101 (p95 under 300 ms at 50 requests a second), as its scope.
3. /qa-report writes reports/case-search/YYYY-MM-DD-report.md with shipped_sha, one pass or fail line per quality gate, each with its evidence, and overall, derived from those lines. qa:lint errors if they disagree. Stops: a typed "pass".
4. G10 (/sdlc-deploy) reads the latest report: dated after the shipped commit's G8 run, every gate line passing. Or a sign-off says GO, or a named human waives QA in writing. Stops: a deploy on the developer's word.

I carried the commit from stlc's test plan into the report as shipped_sha, so the report says what QA judged. G10 itself checks a date: the report has to be newer than the shipped commit's G8 run.

One run, and where it stops

Say case-search reaches G10 and nobody has run /qa-report. /sdlc-deploy case-search stops with BLOCKED: "QA has not passed this release; run /qa-analyze case-search release/case-search/qa-handoff.md through /qa-report".

A report that exists but fails blocks the same way. In stlc's own fixture, one failing P1 case makes the Functional row fail, so the report says overall: fail.

The two series use different sample apps, so each board below is its own.

Try it

npx agentic-fx@latest install

Pick dev and qa, fill DEV-PROFILE.md and PROJECT-PROFILE.md, and start one small feature with /sdlc-intake. Know the limits:

• Both bundles run in Claude Code only.
• G10 is skipped by class for a change or fix, unless it carries a migration or a flag, so the deploy gate is built for larger work.
• A person still waives QA or signs off; the bundles never do.

Read this with your AI

Take my last release. Who wrote the QA verdict, from which
requirement ids, and what would have stopped the deploy
without it? If nothing, say so.