How to Build a Working SDLC for Autonomous AI Coding Agents

Running autonomous AI coding agents at scale without governance quickly leads to chaos. When multiple agents independently manage a single repository, they often claim duplicate work, edit the same files, merge conflicting changes, and close tasks without actually delivering code.

To solve this, Hapax Research introduced a mechanical enforcement layer—a set of automated hard gates and git hooks that block improper operations rather than relying on guidelines or best practices.

The Core Problem: Autonomous Chaos

Running multiple AI tools concurrently—such as interactive and headless Claude Code sessions, OpenAI Codex, and Gemini CLI—can push velocity to extreme levels (e.g., merging over 200 PRs in a single day).

However, without hard constraints, scaling multi-agent operations causes severe friction:

• Task Contention: Agents steal tasks outside their scope or work on overlapping features.
• Conflicting Code: Multiple agents modify the same files simultaneously.
• Phantom Closures: Agents mark tasks as "done" without creating or merging a Pull Request (PR).
• Branch Bloat: Dozens of abandoned feature branches clutter the remote repository.

Rather than slowing down production, the solution is to implement strict automated rules.

The 5 Pillars of the Agent SDLC Architecture

Instead of relying on documentation (e.g., CLAUDE.md), the system enforces compliance using executable scripts and automated hooks.

1. Mandatory Paper Trails for Task Completion

• Agents must run a claim script (cc-claim) to reserve a task before work begins.
• Closing a task (cc-close --pr <number>) requires supplying a PR number.
• The system verifies via the GitHub API that the PR exists and is successfully merged. Tasks cannot be closed without verified, merged code.

2. Guarded Task Dispatch & Authority Verification

Before an agent launches a new lane, a dedicated dispatch script checks:

• Authorization: The task must link back to an authorized specification (authority_case) and parent request (parent_spec).
• Environment Hygiene: The working tree must be completely clean with no uncommitted artifacts.
• Tool Sync: Local agent scripts must be running the latest software versions.

If any condition fails, the launch is aborted.

3. Continuous Automated Governance Sweeps

A watchdog timer triggers a governance check every 4.5 minutes (270s) to monitor:

• Duplicate or orphaned task claims.
• Tasks marked as complete without verified merged PRs.
• Stale agent claims with no recent commit activity.
• System health of the background governance services.

The "Nuclear Option": If a governance check fails, a gate hook immediately halts all PR merges repository-wide until the violation is manually or automatically resolved.

4. Strict Branch & Worktree Controls

• Branch Cap: Active worktrees are limited to a maximum of 20. Creating new branches is blocked if unmerged branches remain open.
• PR Association: Edits on feature branches without an open PR are automatically blocked.
• Deployment Integrity: Branch-switching is explicitly forbidden on the canonical deployment worktree.

5. Granular Hook Architecture

A suite of 41 automated hooks intercepts specific tool operations (git actions, command execution, file edits). These scripts enforce secondary checks, including:

• PII scanning.
• Audio/media routing safeguards.
• Visual interface inspection requirements.

Evolution of the Multi-Agent System

1. Phase 1 (No Rules): Relied on documentation and developer conventions. Failed as parallel agent counts scaled beyond 3.
2. Phase 2 (Task Lifecycle): Introduced basic claim/close scripts and centralized task state tracking in Obsidian.
3. Phase 3 (Branch Discipline): Capped active branches and worktrees to prevent repository bloat.
4. Phase 4 (Enforced Governance): Implemented mechanical gates, dispatch authorization, and blocking hooks to eliminate ungoverned agent executions.

Key Takeaway

AI agents operate best under strict, non-negotiable mechanical boundaries. Replacing flexible developer guidelines with automated enforcement gates guarantees code quality, preserves repository hygiene, and allows high-volume parallel development to scale smoothly.