Day 5 · Synthesis Checkpoint

Reassemble Spec-Driven Production from Memory

No new ideas, just a retrieval workout for the production capstone.

Day 5's spine: vibe coding is not vibe-in-production. The spec becomes the asset, instructions get a home, review scales, and an external safety net contains the risk. Rebuild it from memory before revealing. The struggle is the learning.

1 · Rebuild the Day-5 line

Four lessons, one arc: author intent, house it, review it, contain it. Recall each, then check.

The four-lesson line — reconstruct it, then reveal 
SPEC-DRIVEN (L1)   code is disposable, the SPEC is the asset; BDD Given/
                   When/Then; format tax → Markdown + conditional YAML
INSTRUCTIONS (L2)  hierarchy: chat / specs-folder / skills / system-prompts;
                   5 modes (Architect / Builder / Forensic / Author / Librarian)
CODE REVIEW (L3)   PR deluge → bundled summaries, Conditional LGTM, review the
                   blueprint; 3-tier reviewers (Managed / Hybrid / Custom)
ZERO-TRUST (L4)    guardrails aren't optional: sandbox + HITL + Policy Server
                   (structural + semantic gating) + context hygiene

The arc moves from authoring intent (spec) to enforcing it (policy server): the humans become architects; the AI does the heavy lifting; a safety net separates governance from execution.

2 · The whole series, in one line each

Day 5 closes the course. Recall the five days as one system.

The five-day arc — from memory first 
DAY 1  the conceptual frame: the dial, harness, factory, context, roles, economics
DAY 2  the hands: tools + MCP — how agents act, and the governance wrapper they need
DAY 3  the state: sessions (the now) + memory (the user) — context engineering deep
DAY 4  the trust spine: 7-pillar security + evaluation — the two axes of trust
DAY 5  the capstone: spec-driven production, review at scale, zero-trust guardrails

And the second axis threaded through all five: your governance layer (VERDICT + the maturity ladder): build discipline on one axis, runtime governance on the other, production-ready only when both are high. Day 5's Policy Server is that governance made into running code.

3 · Recall under fire

Shuffled across Day 5, with links to the whole series. Pick before you're sure.

In spec-driven development, the disposable thing is —

L1. Code is regenerable from a solid spec; the spec is the durable asset and source of truth.

BDD/Gherkin makes the model reason in —

L1. Given/When/Then = State → Action → Outcome, a strict track that eliminates guessing.

Reusable, trigger-based engineering habits live in —

L2. Skills (in .agent/); the spec folder holds design, chat is ephemeral orchestration.

The Conditional LGTM merges a PR when —

L3. Approve contingent on green tests → auto-merge, killing cross-timezone delay.

The Policy Server's two gating layers are —

L4. Deterministic role/env rules (YAML) + an LLM judging intent (e.g. no unmasked PII).

Rules baked into a system prompt are a weak guardrail because —

L4. Brittle: real guardrails are external and tamper-proof, separate from execution logic.

"Tests catch deterministic regressions; evaluation catches —"

L4. The line that ties Days 1, 4, and 5: tests are binary, evals are scored + tolerance-banded.

4 · Put it together

The Day-5 reflex on a fresh case. Answer before revealing.

Your team is taking a vibe-coded prototype to production. Name the spec-driven, review, and zero-trust moves you'd insist on. — answer, then reveal

Spec-driven: write a BDD spec (Given/When/Then) into a version-controlled specs/ folder, human-reviewed before generation; house rules in AGENTS.md; pin every version. Code is disposable, so the spec is what you protect.

Review at scale: bundled AI summaries + risk on each PR; Conditional LGTM (green tests → merge); a Tier-2 code-check.md continuous reviewer in CI; split ownership to cut conflicts.

Zero-trust: sandbox execution; HITL sign-off on high-stakes sinks; a Policy Server (structural + semantic gating) in front of tool calls; context hygiene (PII masking / placeholders); AI-generated failing-test coverage + evaluation gates.

That is a vibe prototype turned into production reality. Name it cold and Day 5 (and the series) has done its job.

What you can now do

Author production-grade specs (BDD, right format), file instructions where they belong, survive the PR deluge with tiered continuous review, and wrap agents in an external safety net (sandbox, HITL, policy server, context hygiene). Vibe prototype → production reality. Day 5, met.

Day 5 consolidated. ✓ Every day's lessons are now built. Spec is the asset; review scales; guardrails are external; humans are architects.

The finale → The Arc. A whole-series synthesis tying all five days into one system, with the governance layer as the spine.

Revisit: L1 · L2 · L3 · L4 · Glossary · Governance Layer · Course home