--- title: "sdlc and stlc: No Passing QA Report, No Deploy" author: "Harry" published: 2026-10-31T04:13:42.030Z updated: 2026-10-31T05:05:13.416Z category: "AI Agents: SDLC & STLC" tags: ["sdlc", "stlc"] canonical: "https://fxblog.dev/posts/sdlc-and-stlc-ai-speed-with-proof" --- # sdlc and stlc: No Passing QA Report, No Deploy ## Key takeaways - A release that ships on the developer's word has no proof of what QA checked, against which requirement ids. - Ask any dev and QA flow four questions: does QA start from the developer's ids, is the handoff one file, is the verdict computed, and what stops a deploy without one. - G9 writes qa-handoff.md with the REQ table, acceptance criteria and shipped commit; stlc keeps the REQ ids verbatim and writes a report with shipped\_sha and overall. - stlc computes overall from the report's gate lines; G10 refuses to deploy without a passing QA report dated after the shipped commit's G8 run, a GO sign-off, or a named human's written waiver. - Install with npx agentic-fx@latest install, pick dev and qa, and start one small feature with /sdlc-intake. > **TL;DR** In an AI coding agent workflow, the developer's agent says "done" while QA's proof sits in another tool, so a deploy goes out on the developer's word. sdlc (development) and stlc (testing), two free Claude Code bundles, meet at two files: a handoff packet out and a QA report back. Only here: sdlc's G10 deploy gate refuses to run until stlc's report passes every gate line and is dated after the shipped commit's G8 run, and stlc computes that report's `overall` verdict from those lines, so neither side takes the other's word. > > **Do this:** Run `npx agentic-fx@latest install`, pick dev and qa, and start one small feature with `/sdlc-intake`. On Friday the developer's agent says case-search is done. QA's tests sit somewhere else, written against requirements someone retyped. On Monday it deploys, and nobody can say which test proved which requirement. ## Two bundles, two files between them sdlc is the development bundle and stlc the testing bundle. Each takes its own input and writes a named file at every step. They touch at exactly two files: a packet going out, a report coming back. ## Four questions to ask of any dev and QA flow 1. Does QA start from the developer's requirement ids, or from a copy someone retyped? 2. Is the handoff one file, or a chat message? 3. Is the QA verdict computed from evidence rows, or typed by a person? 4. What stops a deploy when there is no verdict? ## The handoff, step by step 1. **G9** (`/sdlc-release`) writes `release/case-search/qa-handoff.md`: the REQ table (REQ-001, REQ-002, REQ-101), the acceptance criteria, the contract path and the shipped commit. Stops: retyped requirements. 2. **stlc** runs `/qa-analyze case-search release/case-search/qa-handoff.md`. It keeps every REQ id verbatim and takes the criteria only a running product can prove, here AC-101 (p95 under 300 ms at 50 requests a second), as its scope. 3. **`/qa-report`** writes `reports/case-search/YYYY-MM-DD-report.md` with `shipped_sha`, one pass or fail line per quality gate, each with its evidence, and `overall`, derived from those lines. `qa:lint` errors if they disagree. Stops: a typed "pass". 4. **G10** (`/sdlc-deploy`) reads the latest report: dated after the shipped commit's G8 run, every gate line passing. Or a sign-off says GO, or a named human waives QA in writing. Stops: a deploy on the developer's word. I carried the commit from stlc's test plan into the report as `shipped_sha`, so the report says what QA judged. G10 itself checks a date: the report has to be newer than the shipped commit's G8 run. ![The handoff on case-search: G9 writes qa-handoff.md, stlc analyzes it and writes a QA report, and G10 deploys only on a passing report; otherwise it stops at BLOCKED and the way out is to run QA](https://fxblog.dev/media/01a18fc6-fc29-73a1-8829-c4c50517e094/1600) _One packet out, one report back_ ## One run, and where it stops Say case-search reaches G10 and nobody has run `/qa-report`. `/sdlc-deploy case-search` stops with `BLOCKED`: "QA has not passed this release; run `/qa-analyze case-search release/case-search/qa-handoff.md` through `/qa-report`". A report that exists but fails blocks the same way. In stlc's own fixture, one failing P1 case makes the Functional row `fail`, so the report says `overall: fail`. > **Note** > > G10 has blocked wrongly before. After stlc moved its files from `qa/` to `.stlc/`, sdlc looked only in `qa/` until 1.6.1, so no `.stlc/` project could pass G10. It failed closed. The two series use different sample apps, so each board below is its own. ![The sdlc board for case-search in Sample Test Hub: G0 and G1 passed, G2, G5 and G6 stale, G7 authoring, and G9 to G11 not started](https://fxblog.dev/media/01a18fc7-171b-7613-99c6-135498a0e2fb/1600) _sdlc: G10 has not started_ ![The stlc board for orders checkout in Sample Orders App: 6 of 12 cases passed, 2 failing, and the Run step failing](https://fxblog.dev/media/01a18fc7-3849-7789-9ba6-618c723749b2/1600) _stlc: the Run step is red, so no passing report_ ## Try it ```sh npx agentic-fx@latest install ``` Pick dev and qa, fill `DEV-PROFILE.md` and `PROJECT-PROFILE.md`, and start one small feature with `/sdlc-intake`. Know the limits: - Both bundles run in Claude Code only. - G10 is skipped by class for a `change` or `fix`, unless it carries a migration or a flag, so the deploy gate is built for larger work. - A person still waives QA or signs off; the bundles never do. ## Read this with your AI ```text Take my last release. Who wrote the QA verdict, from which requirement ids, and what would have stopped the deploy without it? If nothing, say so. ``` > **Success** > > No passing QA report dated after the shipped commit's G8 run, no deploy. stlc computes the verdict from its gate lines, and sdlc reads it. Next: **Your AI Coding Agent Grades Its Own Homework. Add Gates.** asks why a feature that passed its own review shipped without pagination, and **A QA Pipeline Your AI Agent Can't Fake** asks how forty green tests let a rounding bug reach production. ## FAQ ### What is the difference between sdlc and stlc? sdlc is the development bundle: it takes a change from a problem statement to production through 12 gates. stlc is the testing bundle: it takes a feature from docs to a QA report and sign-off. They meet at one handoff file and one report verdict. ### What does G10 need from stlc before it deploys? The latest QA report for the slug, dated after the shipped commit's G8 run, with every gate line passing. A release sign-off that says GO, or a named human's written waiver, also unblocks it. ### Do sdlc and stlc work with tools other than Claude Code? No. Both bundles run inside Claude Code only. The files they write are plain Markdown and JSON, so you keep them if you leave, but the commands and reviewers need Claude Code.