What we learned running agentic SDLC patterns

That last row is the practical limit. A report can start a conversation with the team that owns the system. It cannot sign a checkpoint. The worst findings in this kind of scan sit on applications nobody has claimed. If nobody will accept a merge, the pipeline has nothing to attach to.

BC Parks attendance and revenue admin

Repository: bcgov/bcparks-ar-admin-agentic-b. An earlier fork, bcgov/bcparks-ar-admin-agentic, was the first enrolment and was left as a partial pilot. The numbers below are from the second fork.

The two misses and most of the partials have a cause, and it is useful. One implementation pull request merged an evidence file and no code: the narrative said the logging levels had changed, and keycloak.service.ts had not. Several other findings were signed at a narrower scope than the assessment asked for, then verified against that narrower contract. The pipeline was faithful to the contract and incomplete against the original defect. Reviewer effort on this fork was a simulated checkpoint, so the 97% figure is a gate result, not a count of hours a person spent reading diffs.

CSCP restitution

Repository: bcgov/pssg-cscp-restitution-agentic, on branch development. Copilot’s coding agent implemented most slices. An operator had to nudge Actions, and finished the tail of the backlog by hand when credits ran out.

Reviewer effort here was real and narrow. The operator’s repeated job was an empty commit so GitHub Actions would leave the action_required state and actually run the checkpoint gate. A CodeQL default-setup error failed the aggregate gate on slice after slice even when Trivy and the tests were green. The team recorded that residual and kept moving, which kept the backlog moving and also trained everyone to ignore a red check. Both facts belong in the lesson.

LEAR

Repository: bcgov/lear-agentic. This run shows the pipeline stopping, which is part of the result. Forty-one pull requests were closed without merge, including a merge-train, and main was reset to upstream plus a fresh enrolment. One pull request has been merged, and it is the enrolment itself. The first real slice (CONFIG-003) reached a green build and waited for a person. Agents do not merge their own work. The rest of the assessment backlog is still open. Treat LEAR as the control: a harness that can generate a backlog still needs a named person who will accept the first change before a second one is worth starting.

The method is the part worth copying. Agents read the original and wrote acceptance criteria. Tests were derived from those criteria without seeing an implementation, then run against the original application so the tests had to describe what the system really does. The plan cut the criteria into 21 slices. A builder implemented each slice. Verify ran that slice’s tests and the earlier slices’ tests before a reviewer could approve. Routine rulings, such as a re-derived test, could be approved by automated checks. A person could take any seat.

The returns are the result, not a blemish. Slice 21 was sent back because criteria could not be exercised, then because they failed, then because an earlier slice’s criterion regressed, and only then verified clean. Slice 14 was refused when the builder was asked to change a design file the build stage is not allowed to write. The gate’s job is to send that condition to the stage that can carry it out.

AI Garage

The Garage points a harness at the existing estate. In the Academy walkthrough the sequence was: a Git Insights brief is a lead, not a verdict; a second scan (dependency and application checks, plus a red-team and blue-team pass) re-verifies before anyone edits; repositories that already have tests and a clean dependency bump are patched; repositories that are vendor-locked or tangled are routed to a rebuild instead. The presenter described one orchestrator driving 30 virtual machines and about 300 coding-agent instances, fixing on the order of 55,000 of about 79,000 known dependency findings in about 40 hours, at a stated compute cost of $125,000 (about $34 a repository) after a scan he put at about $10 a repository. He also said about 2,600 pull requests were staged and not merged, because the next missing piece was a smoke test good enough to hand to the team that owns the repository. About 73% of the repositories had no continuous integration, so the harness was adding tests in the same pass that claimed a fix.

The lesson we kept is the one our own re-checks confirmed at a much smaller scale. A scan starts the work. A second check, against the original wording of the finding, is what you are allowed to call a fix. And a pull request that the owning team has not accepted is still a proposal.

AI Factory

The Factory builds new. Alberta’s published case study, From Five Months to Four Days, gives two numbers from their own staff. The Remote Area Heating Allowance application, hand-written in Java over five months in the early 2000s, was rebuilt in four days with a public portal the original did not have. The Alberta Classroom Information Portal was delivered in eleven weeks for about $108,000, against a traditional estimate of $1.3 million to $1.9 million and up to eighteen months. The paper summarises the pair as a 25-fold speed change and a 95% drop in delivery cost. Those are Alberta’s delivery accounts, with their own baselines.

The Academy also showed a smaller version of the same idea: several agents building the same specification in parallel, so a mistake that appears in every build is blamed on the template rather than on one model. That exercise produced a working application in a teaching session. It was not a production launch. Our factory-shaped run is the Digital Marketplace rebuild above: one specification, tests locked to the original behaviour, slices, and a gate that returns work. We have not reproduced a four-day or an eleven-week production cutover, and this page does not claim one.

Alberta’s papers, if you want the pattern in their words: the four approaches and the factory case study.

A reasonable first week is one repository, one owner, and one finding that already has a test. If that pull request cannot be reviewed by someone who would be on the hook in production, the rest of the backlog will reproduce LEAR: a queue of proposals and a single merged enrolment.