Skip to content
Press / to search

Software Delivery Squad

Human-supervised software agents that plan, implement, test, review, and open pull requests with traceable decision records.

Use Case PlaybookLast reviewed:
At a glance

Purpose

Turn a well-scoped engineering task into a governed delivery run. ContextOS specifies boundaries a conforming software-agent runtime can enforce: understand the ticket, inspect the repository, propose a plan, edit only owned files, run validation, request review, and preserve a replayable trail.

For this delegated/durable design, admit exact contextos.enterprise@1 and contextos.durable-delegated@1 requirements plus actual arbitrary-code, network, sensitive-data and memory features. Roles can share a runtime. The implementing system supplies real sandbox/egress, credential brokers and atomic stores; the repository’s reference tests do not demonstrate a secure coding worker or production release pipeline.

Why this is agentic-first

Software delivery is an ideal agentic workflow because it is multi-step, tool-heavy, and full of feedback loops. The agent has to read requirements, search the codebase, form a plan, edit files, run tests, interpret failures, revise, and hand work to humans at the right checkpoint.

Atlassian’s HULA research describes a human-in-the-loop coding agent that reads a Jira work item, creates a plan, writes code, and raises a pull request. IBM also frames enterprise IT delivery as an agentic workflow spanning code generation, testing, and deployment.

Context Pack

LayerRequired entries
decision_layer.decision_specs[]delivery.plan.approve, delivery.patch.prepare, delivery.pr.open, delivery.deploy.request
policy_layer.policy_bundles[]Repository ownership, change-risk tiers, secure coding policy, release policy
policy_layer.approval_gates[]GATE_PLAN_REVIEW, GATE_PR_REVIEW, GATE_DEPLOY_APPROVAL
tooling_layer.adapter_registry[]adp_repo.search, adp_repo.patch, adp_ci.run, adp_pr.open, adp_issue.update, adp_release.request
memory_layer.memory_policy.write_classes_allowedevidence_link, correction, decision_outcome; codebase/review-pattern labels are candidate content, not new canonical write classes
evaluation_layer.eval_targets[]P/U/L/S/E targets; test/lint pass, review rework and release recovery are linked domain-suite metrics

Agent roles

AgentResponsibilityBoundary
Requirements AgentResolves ticket scope, acceptance criteria, and non-goals.Read-only issue and docs access.
Codebase AgentFinds relevant files, owners, APIs, and local conventions.Read-only repo access.
Implementation AgentWrites the patch inside declared ownership.Cannot change protected files without gate.
Validation AgentRuns tests, type checks, lint, and static checks.Cannot merge or deploy.
Review AgentChecks risk, security, docs, and acceptance criteria.Can block PR creation.

Execution flow

  1. invokeAgent arrives with intent=delivery.implement, issue ID, repository, branch policy, and target owners.
  2. Trusted admission resolves repository/base/diff, issue, standards, ownership and tool/release pins; the compiler consumes these inputs rather than enforcing filesystem permissions.
  3. Requirements Agent extracts acceptance criteria and detects ambiguity.
  4. Codebase Agent builds a focused file map and dependency map.
  5. Implementation Agent proposes a plan; GATE_PLAN_REVIEW triggers for broad or risky changes.
  6. Implementation Agent edits only the approved write set.
  7. Validation Agent runs local and remote checks, summarizes failures, and loops back to implementation when safe.
  8. Review Agent verifies acceptance criteria, security posture, and touched ownership.
  9. Before adp_pr.open, the Gateway binds exact repository/base/diff/target and policy/profile/release pins, current scope/ancestor revocation, any required stored approval/quorum/redemption, actual boundary/data route and original aggregate reservation, then claims the stable operation under current revision/generation.
  10. The implementing runtime emits a DecisionRecord with decision_key="delivery.pr.open", diff summary, tests, applicable approvals, and trace.

Repository contents, dependency install scripts, tests, build hooks and tool output are untrusted execution/data surfaces. Observe actual filesystem/process/resource/egress controls, isolate personal/work/tenant data, and broker narrowly scoped credentials outside model-visible state. A worktree, container label, passing test or reviewer consensus does not by itself prove containment or authorize merge/deployment. Govern actual model, CI, telemetry and artifact-export recipients/processors and retention.

Reserve parent/child/retry/repair/reviewer capacity from original aggregate limits/deadline; no lane or resumed worker gets fresh budget. Lost PR/CI/release acknowledgements retain stable operation identity and uncertainty until verified provider reconciliation. Stop/cancel propagates to children and enforces ownership/target fencing where required; checkpoint migration cannot silently change repository/release interpretation. A file rewind does not unpublish a package or undo an external deployment. Verify remote PR identity and required postconditions before reporting completion. See Execution Contract and Conformance.

Decision gates

GateTriggerRequired evidence
GATE_PLAN_REVIEWCross-module work, schema migrations, auth changes, payment logic, or security-sensitive code.issue scope, file map, owners, rollback plan
GATE_PR_REVIEWPR creation against protected repository.required checks, exact diff/base, reviewer list and any explicitly authorized exception; mandatory controls cannot be waived by an ordinary approval
GATE_DEPLOY_APPROVALAny production deploy request.release notes, CI evidence, rollback command, owner approval

Failure modes

  • Ambiguous ticket - ask only when missing information changes scope/authority or required acceptance; continue useful independent authorized work without fabricating the answer.
  • Ownership drift - the actual filesystem/tool enforcer blocks writes outside current scope; the compiler’s manifest cannot enforce OS permissions. Changed diff/base or protected files require renewed impact/authorization checks.
  • Validation loop without progress - Orchestrator caps retries and emits a diagnosis artifact.
  • Unsafe generated code - Review Agent blocks PR creation when security or data-handling rules fail.
  • Stale branch - Tool Gateway refuses PR creation until the branch is rebased or revalidated.

Metrics

  • Plan approval rate.
  • First-pass test and typecheck pass rate.
  • Review rework rate and reviewer override rate.
  • Time from issue intake to PR.
  • Production rollback and hotfix rate for agent-authored changes.
  • Number of learned codebase patterns promoted to memory.

Research signals