目录

• 一、为什么现在必须转型
• 二、什么是 AI 原生 SDLC：从直线到闭环
• 三、六阶段实战 Plays（含真实文件案例）
• 四、治理如何贯穿全程
• 五、关键要点与行动清单

代码不再是瓶颈

• AI 写代码的速度，一年前还难以想象
• 但审批门、评审、交接、政策——几乎没变
• 传统 SDLC 是为「写代码最贵」的时代设计的
• 而这个前提，今天已经失效

Metrics · 关键数字

瓶颈搬家后的三个真相

Before vs After · 对比

一个真实的瓶颈：安全评审

旧的控制目标 + 新的执行方式

• 把「旧控制目标」与「新执行方式」重新组合
• 从线性流程 → 闭环循环，AI 嵌入每个节点
• 阶段之间自动交接、自动触发
• 别名：智能体 SDLC / AI SDLC，本质相同

Roadmap · 时间线

核心主线：版本化产物驱动闭环

Stage 1 规划 · 把想法变成 intent.md

# Intent: claims status self-service
Author: J. Ortiz (claims operations). Status: draft.

## Problem
Customers phone the contact centre to ask where their claim is.
Handlers spend roughly a third of call time on status-only queries.

## Proposed outcome
Customers see claim status, next step and expected date in the portal.

## Affected users and systems
Claims handlers, portal team, claims-core API.

## Constraints
No new PII in the portal session. Existing authentication only.

## Open questions
Do third-party loss adjusters need access too?

Stage 2 设计 · 从 intent 到 spec

Stage 3 构建 · Plan Mode 是默认起点

# Payments service

## Commands
- Build: make build
- Test: make test (unit), make itest (integration, needs docker)
- Lint: make lint (runs in CI; fix before pushing)

## Conventions
- Java 21, Spring Boot 3. No new Lombok.
- Money is always BigDecimal, never double.
- Every endpoint needs an integration test in src/itest.

## Architecture
- api/ holds REST controllers, core/ holds domain logic,
  adapters/ talks to external systems.

## Things Claude gets wrong
- Do not bump dependency versions; the platform team owns them.
- The legacy v1/ package is frozen; changes go in v2/.

构建阶段的三种控制机制

---
name: secure-api-review
description: Apply the API security standard. Use whenever creating or
  modifying an external-facing endpoint, reviewing API code, or
  generating an OpenAPI spec.
---
# Secure API review

When you create or change an API endpoint:
1. Authentication: every endpoint requires the gateway JWT;
   no anonymous routes outside /health.
2. Input validation: validate request bodies against the OpenAPI
   schema and reject unknown fields.
3. Audit: every state-changing endpoint emits an audit event.
4. Data classification: fields tagged pii must never appear in logs.

Run scripts/check-endpoints.sh and include its output in your summary.

Stage 4 测试 · 给 AI 一个反馈回路

• 始终给 Claude 自我验证的方式：测试 / 构建 / 截图 diff
• 目标要可量化：全绿、截图与原型一致、返回 200
• 修 bug 先写失败测试，且不许 AI 改测试
• 反馈回路 ≠ verifier 子代理（前者贯穿全程）
• 持续评估：CI 里跑 20–50 个真实任务，配置一改就回归

---
name: verifier
description: Runs the app and checks the change works before the session
  reports done
tools: Bash, Read
---
Start the app with make run. Exercise the changed behavior and the two
nearest neighboring flows. Report what you ran, what you saw, and any
behavior that does not match plan.md. Do not fix anything; report only.

Stage 5 部署 · PR 审查回路

# Review instructions

## Passes
Run three passes and tag each finding with its pass:
- Bugs: logic errors, broken edge cases, subtle regressions
- Security: injection risks, authentication gaps, PII in logs
- Compliance: the change matches spec.md, plan.md and design principles

## What Important means here
Reserve Important for findings that would break behavior, leak data
or breach a policy. Style and naming are nits.

## Cap the nits
Report at most five nits per review; summarize the rest as a count.

## Do not report
Generated files under src/gen/ and anything CI already enforces.

# .claude/hooks/production-gate.sh  (PreToolUse -> Bash)
#!/bin/bash
# Production deploys require a named release authorization
cmd=$(jq -r '.tool_input.command' < /dev/stdin)
if [[ "$cmd" == *"deploy"* && "$cmd" == *"production"* ]]; then
   if [ -z "$RELEASE_APPROVAL" ]; then
     echo "Production deploys need a release authorization." >&2
     exit 2   # exit 2 blocks the action; the message goes to Claude
   fi
fi
exit 0

Stage 6 维护 · 让闭环自主运行

metric: ci_test_failure_rate
baseline: rolling_30d
rules: western_electric
tiers:
  1sigma: { action: log }
  2sigma: { action: diagnose,
            tools: "Read,Grep,Bash(gh run view *)" }
  3sigma: { action: propose,
            routes: [pull_request, runbook:rollback-deploy] }

Chart · 数据图

人工注意力的重新分配（示意）

治理不是补丁，而是内建

关键要点与行动清单

• 代码不再是瓶颈 → SDLC 必须同等量级转型
• 从直线到闭环，版本化产物驱动自动交接
• 六阶段各有明确 play 与真实文件模板
• 治理内建：人类判断 + 产物审计 + 双层控制 + 职责分离
• 从今天起：先给一个仓库写 CLAUDE.md，再挑一条策略写成 Skill