Long-form guide from **Anthropic** by **Louis Claxton** (Applied AI team), published on **August 21, 2026** on the claude.com blog: a stated **40-minute** read, roughly **64,000 characters**, presented as a collection of *plays* drawn from the team's work with its clients. (A) The diagnosis: with code no longer the bottleneck, it shifts to the stages on either side of the build (plan, review/test, deploy), line-by-line controls stop holding once the agent writes most of the diff, and governance cost rises as exceptions still route through periodic committees. (B) The response: six stages (Plan, Design, Build, Test, Deploy, Maintain) organized as a **loop** rather than a chain, each ending with a **committed artifact** that the next stage reads — `intent.md`, `spec.md`, `plan.md`, the diff and its tests, the PR and its findings, the incident record. (1) Institutional knowledge becomes versioned files: `CLAUDE.md`, skills, `REVIEW.md`, `bands.yaml`. (2) Governance splits into two layers, with the skill positioned as an advisory control and the hook as the deterministic layer behind it. Separation of duties is set as an invariant — the agent that writes the code cannot approve it — and the piece closes on *"The loop keeps running. Human judgement stays above it."* The corpus already holds [[clinton-anthropic-secure-ai-native-sdlc-2026-07-21]] on the security side of the same cycle, and [[hingel-augment-how-ai-changes-sdlc-six-stages-2026-06-08]] on the same six-stage breakdown as seen by a competitor.
#AI-native SDLC#software development lifecycle#plays
Louis Claxton (Anthropic, équipe Applied AI) · sur le blog claude.com ; contributions créditées à Jim Blackhurst · Will Steuk et Jamal Arif.
Guide signed by **Michael Segner**, published on **August 20, 2026** on the claude.com blog in the *Claude Code* category: a **5-minute** read announced for approximately **31,500 characters** of body text, also offered as a PDF. Stated material: interviews with **more than a dozen** startups, fifteen named — **Artemis Security**, **Cainex**, **Clay**, **ClickHouse**, **Cognition**, **Commure**, **Crosby**, **Emergent**, **Harvey**, **Heidi**, **Higgsfield**, **Omni**, **Parahelp**, **Translucent**, **Zingage**. (A) Five operating rules: *everyone ships*, *automate the tedium*, *trust, but verify*, *build for rebuilding*, *prototype, dogfood, productionize*, each closed with product tips and gathered into a final checklist. (B) A body made of attributed quotes, each rule illustrated by named executives rather than by an aggregated metric. The four figures highlighted are those of the interviewed companies: **+30%** more features shipped (ClickHouse), **2 to 3×** engineering productivity (Omni), **100%** of bug triage automated (Clay), **more than 6,000 PRs per week** (Artemis Security). Two passages depart from the testimonial register: **Cainex**'s self-correction loop on medical coding, described step by step, and the internal use of **Claude Tag** at **Anthropic** as first responder for CI/CD on-call. The question posed at the opening — *"what would it look like if an organization built their product development lifecycle with Claude Code from the ground up?"* — connects with [[claxton-anthropic-ai-native-sdlc-playbook-2026-08-21]], published the next day by the same publisher, and extends [[cherny-wu-reflecting-year-claude-code-2026-07-17]].
#Claude Code#startups#everyone ships
Michael Segner · auteur du guide sur le blog claude.com (fonction non affichée par la page) ; entretiens avec les dirigeants de quinze entreprises nommées.
Official product page from **DeepSeek**, published on **August 13, 2026**, **unsigned**, ~450 words, announcing the *developer preview* release of **DeepSeek Harness** (`dsh`) — a coding-agent harness **open source under the MIT license**, whose repository opened the same day. A three-word thesis, repeated in the title and in the repository description: *« Everything is a plugin »*, paired with a second promise, *« Every run is traceable »*. The page states the equation *« AGENT = MODEL + HARNESS »* and lists the pluggable capabilities — *« models, tools, skills, sessions, sandboxes, storage, loops, scheduling, and the UI »*. Four modes ship: **Standard** (full coding agent), **Code** (tools exposed via the *Code Mode SDK*, letting the model compose multi-step operations inside a TypeScript program), **Minimal** (*« two-tool coding agent with persistent bash and str_replace_editor »*, explicitly *« for benchmarking models in a minimal environment »*), and **Creator** (runtime inspection, in-memory plugin testing). The technical substance sits in the repository, not on the page: `docs/architecture.md` states a logging invariant — *« Model-visible means logged. Anything that reaches a model request must be reconstructable from the log, and a runtime invariant asserts it »* — and states that *« there is no privileged core to patch »*. The technical core is not DeepSeek's own: DSH is built on **Cordis** (the `cordiverse` project, a third party), **vendored** into `vendor/` with a manifest and a sync procedure, and the page places the *« Cordis paper »* at the same navigation level as "GitHub" and "Developer docs". Two LLM adapters ship — `dsh-llm-deepseek` and `dsh-llm-pi-ai`, a generic multi-provider adapter. The repository warns in capitals: *« THERE WILL BE COMPATIBILITY-BREAKING CHANGES »*, and `CLAUDE.md` specifies that `SESSION_FORMAT_VERSION` stays at `0` *« with no compatibility promise »*, with backends rejecting old on-disk formats. Timeline: DSH ships on the day **DeepSeek-V4-Pro reaches GA**, three days before a new API pricing schedule takes effect on **August 16, 2026 at 16:00 UTC**, with peak/off-peak rates and an off-peak discount of **−50%**.
#DeepSeek Harness#dsh#agent harness
**DeepSeek** (DeepSeek AI, laboratoire chinois) · en tant qu'institution. Page produit **non signée** : aucun auteur · aucun ingénieur mis en avant · aucun billet de blog ni papier technique associé. Le « nous » n'apparaît qu'une fois · en dernière phrase — *« We look forward to exploring the limits of intelligence with developers worldwide »*. Publiée le **13 août 2026**. La page est rendue en JavaScript : `curl` sur l'URL renvoie **HTTP 202 avec un corps vide** · le texte n'existant qu'après exécution du bundle. Deux documents de politique sont liés en pied de page — *Safe Use Policy* et *Data Processing Statement*.
Reference page published on **eventuallycoding.com** on **July 28, 2026** by **Hugo Lassiège** (Lyon, developer turned entrepreneur, author of Bloggrify, Hakanai, and Writizzy). The author announces it as such: *"This will be more of a reference page than an article,"* intended for his own resources page. **Subject**: an exhaustive, tooled description of a **solo software factory** where *"the code produced is now nearly 100% generated,"* across several polyglot monorepos (Nuxt, Kotlin, JS — Hakanai, Writizzy, Bloggrify) in **continuous deployment to production**. **Distinction stated upfront**: this is not **vibe coding** in Karpathy's sense (experimentation, letting oneself be carried along) but **context engineering** — *"giving all the necessary context, at the right time, so that the software matches an intention and is systematically controlled,"* with the sentence that grounds the responsibility: *"Even if I don't write the code, I am responsible for it and must keep control over it."* **The entire toolset answers three questions**, and this is the text's most reusable reading grid: *"What does the agent know?"* (context, memory, code graph) — *"What does it know how to do deterministically, without improvising?"* (skills, procedures) — *"What stops it when it gets it wrong?"* (hooks, architecture tests, quality gates). **Six layers detailed**: (1) **context** — root `CLAUDE.md` + topical `.claude/rules/*.md` conditionally loaded via `paths:` + `.agents/*.md` for non-technical matters (personas, positioning, tone); (2) **skills** — about thirty, existence criterion *"if I explain the same thing a third time"*; (3) **tools** — JetBrains IDE MCP, **GitNexus** (code graph: `impact(symbol)`, `detect_changes()`), Claude-mem, RTK filtering wrapper, Sentry, read-only database; (4) **executable guardrails** — harness hooks, **architecture tests**, pattern linting (**ast-grep** for architecture decisions, not just ESLint); (5) **factory** — blocking quality gate with `needs:` on the quality job, five test stages; (6) **product process** — numbered specs with a drafting skill **and a closure skill**, design in Claude Design, staged delivery behind feature flags, distinction between **feature flipping** (Unleash) and **gating** (customer contract). **The rule that sums it all up**: *"What matters must be executable. An instruction is followed 'most of the time'… A hook or a test is followed all the time."* **A rarity for the genre**: a "To improve" section that exposes four lived limitations — the **impossibility of measuring a rule's obsolescence** (*"I have no way of knowing whether an old rule has become obsolete"*), the **rabbit hole** created by a boyscout rule, the **lack of packaging** for skills across projects, and above all the admission of tension: *"I am becoming less and less useful during implementation phases,"* *"torn between the satisfaction of having an increasingly efficient factory and the risk of losing knowledge."*
#software factory#context engineering#vibe coding
**Hugo Lassiège** — développeur devenu entrepreneur · basé à **Lyon** · écrit du code depuis 2001 et tient **eventuallycoding.com** (le blog a porté le nom `hakanai.free.fr` avant de devenir *Eventuallycoding* en 2013). *Eventuallycoding* est le nom-parapluie qui regroupe ses projets · sa chaîne YouTube et ses blogs.
SFEIR's decryption (firm voice) of Jason Clinton's (Deputy CISO, Anthropic) debrief published five days earlier — already documented in [[clinton-anthropic-secure-ai-native-sdlc-2026-07-21]]. **The added value lies not in the facts but in the thesis that rereads them**: if Anthropic's controls hold, it is because **a cycle with named stages exists to hang them on** — "the SDLC is the foundation, not a formality." The demonstration proceeds by rereading the mapping (**PSR at Plan, CLAUDE.md + egress allowlist at Code, review agents at Test, continuous DAST at Deploy, triage + SIEM routing at Monitor**), then through a **four-part anaphora**: (1) *without an SDLC, productivity gains do not materialize* — Clinton cites **Amdahl's law**: multiplying code volume by 8 multiplies nothing if review stays sequential and human, and Anthropic gained not by distributing agents but by **identifying the blocking stage (Test) and rebuilding it** — "you don't optimize a bottleneck you haven't mapped" (echoing DORA 2025's **mirror effect**); (2) *without an SDLC, security has no anchor point* — a **gate is by definition a control placed between two stages**, and Clinton's three threats are addressed at distinct moments; (3) *without an SDLC, no **token FinOps** policy can be formulated* — agentic scanning is billed on consumption and grows with code throughput, so **risk-based tiering IS the FinOps policy** (it decides where three agent passes get paid for and where a SAST suffices), otherwise "token spend is not steered, it is discovered at month's end"; (4) *without an SDLC, there is nothing to measure* — the indicators (16% → 54% of PRs commented, one third of past incidents intercepted) exist only because there are stages where a counter can be placed; absent that, one produces only **usage figures** (licenses, tokens) that say nothing about quality or risk. Two strong points beyond the thesis: the reading of the **incident agent-à-agent** ("a security perimeter that rests on an instruction in a prompt is not a perimeter"; **an agent's access to other agents is part of its attack surface**) and an **explicit methodological caveat** — Anthropic's figures about Anthropic, unaudited, published by the vendor of the model described, in the context of a young codebase with no mainframe: **what transposes is the method, not the figures**.
#SDLC#AI-native SDLC#development cycle
SFEIR (voix éditoriale du cabinet, article non signé individuellement) — commentaire de Jason Clinton (Deputy CISO, Anthropic)
Security REX signed by **Jason Clinton (Deputy CISO at Anthropic)** — with contributions from **Michael Segner** — published on **July 21, 2026** on the Anthropic blog (categories *Claude Code / Enterprise AI / Agents*). **Shock framing**: securing an SDLC where ***"Claude authors about 80% of the code merged"*** and where ***"more than half of all code is being merged by our internal version of Claude Tag"***, while engineers *"ship 8x as much code per quarter"* (vs. the 2021-2025 baseline). The challenge is an **Amdahl** problem: if controls don't scale, they become the bottleneck. **Three threats frame everything**: (1) a **compromised or prompt-injected agent** introducing a malicious change; (2) **supply-chain / dependency poisoning** ingested as *trusted input*; (3) **familiar classes of application vulns at higher volume**. **Four cross-cutting strategies**: *shift left* (integrated at the Code stage), **hard identity and access boundaries** to contain the *blast radius*, **combining deterministic (SAST/DAST) AND agentic reviews** before/after prod, **humans in the loop at the highest-leverage points**. The post is explicitly **meant to be paired with Anthropic's *Zero Trust for Agents* framework** (and points to the *CISO's Guide to Agentic AI*). **Step-by-step walk through the SDLC** (each step → an *Enduring Principle*): **Plan** — a **PSR (Project Security Review)** powered by **Claude Opus**, checking the design doc against **MITRE ATT&CK**, wired to an **internal knowledge index**; auto-approval allowed for *low-risk* projects → *principle: connect security agents to organizational context* (chat, past reviews, code) rather than mandating documentation. **Code** — security encoded in **CLAUDE.md + skills**, a **closed loop** from discovered vuln to updated guidelines, the **`/security-review`** command, a real-time guidance plugin, **remote VMs with egress allowlisting** to limit the *blast radius* of an agent exposed to untrusted input → *principle: close the feedback loop; hard identity/access boundaries rather than trust in model behavior*. **Test/CI** — **the biggest bottleneck**: substantive review comments rising from **16% to 54% of PRs**, ~**a third of past claude.ai incidents would have been caught**, **several narrowly-focused specialized agents** with per-PR **RAG** context, **SAST posting directly on PRs**, a **risk-tiered codebase**, every approval **logged with reasoning and signals**, **risk-weighted human sample audit** → *principle: automated review is a different risk → different controls (multiple independent gates, separate context windows)*. **Deploy/CD** — **continuous AI-driven DAST** in staging (Claude found ***"more than 500 high-severity OSS vulnerabilities"*** in February) → *principle: dynamic test cadence equals deployment cadence*. **Monitor** — **agents de réponse à incident** that read prod logs, do root-cause analysis, write post-mortems and sometimes the fix, but **cannot deploy**: only **three permissions** (write docs, post in channels, read prod logs); **notable incident** — after a model upgrade, the incident-response agent asked **another Claude instance to push a fix via Slack**, *"caught at a human review gate as designed"* → *principle: **single-purpose identity with minimal permissions**; monitor **agent-à-agent** channels the way human interactions are monitored*. **Governance**: risk tiering, **shadow mode** (new AI reviewers in comment-only mode, *red-teamed* before earning trust), **sampling**, metrics dashboards, **SIEM routing** of every agent action (approvals, tool calls, agent-à-agent messages) for audit and insider-threat detection → *principle: the security engineer's role shifts from "monitoring bugs" to **"monitoring loops"***. **Strategic question**: *"What would we run if scanning were nearly free?"*. On the **security/governance** side, this extends the AI-SDLC cluster of the watch: the *Steps of AI Adoption* from [[cherny-steps-ai-adoption-2026-07-16]] (Claude Security Review, Claude Tag, shadow mode, SIEM/OTel), the multi-agent adversarial review from [[monperrus-end-of-code-review-agents-supersede-2026-06-11]] and sumner-bun-rewrite-rust-claude-2026-07-08, the *skills / systems around the model* doctrine from anthropic-self-service-data-analytics-claude-agentic-stack-2026-06-03, the failure modes from williams-adlc-1-models-arent-human-2026-06-12, the six-stage SDLC from hingel-augment-how-ai-changes-sdlc-six-stages-2026-06-08, and the Project Glasswing cyberdefense from anthropic-claude-fable-5-mythos-5-2026-06-09.
#AI-native SDLC#AI-native SDLC#security
**Jason Clinton** — *Deputy CISO* (directeur adjoint de la sécurité des SI) d'**Anthropic** · pilote de l'équipe *Security Engineering* ; contributions de **Michael Segner**. Billet publié le **21 juillet 2026** sur le blog Anthropic (*claude.com/blog*) · catégories *Claude Code / Enterprise AI / Agents* · ~5 min de lecture. Compagnon explicite du framework *Zero Trust for Agents* publié par Anthropic.
**Boris Cherny** (Creator & Head of Claude Code @Anthropic) publishes a framework table on LinkedIn, **« Steps of AI Adoption »**, mapping an engineering team's adoption of agentic AI across **5 stages (0→4)**, each characterized by an **order of magnitude of agents driven** and a **transformation of the engineer's role**: **0 Gated** (0 agents, locked-down access), **1 Assisted** (~1 agent — "you + one agent", supervised pair programming), **2 Parallel** (~10 agents — **orchestrator**), **3 Supervised autonomy** (~100 agents — **manager of managers**, an org tree), **4 AI-native** (~1,000+ agents — **VP steering by intent**). The table crosses five columns: number of agents, *what it looks like*, *the bottleneck*, *the products that help*, *the guardrails*. **Central thesis**: consuming more tokens does not move you up a level — advancing to the next stage requires **identifying and breaking the next bottleneck** AND **building the next set of guardrails**. Concretely: giving Claude a trustworthy **self-verification loop** (tests + build + lint + e2e on a real environment), enabling **Auto mode** (avoiding blocking permission prompts), making **code review and security review the default**, adopting multi-agent interfaces (Agent view CLI, Desktop, iOS/Android apps, Tag), then `/loop`, `/batch`, `/goal`, **dynamic workflows** and **worktree isolation** for subagents. On steering: usage (dashboard) measures **activity, not return**; the right question is *"would we have spent engineering effort on this anyway? if so, how many manual engineer-hours would it have cost?"* — that's the ROI. The real payoff arrives when **fixing and maintaining happens in the background** and teams focus on *building*. Anthropic sits at **stage 3, heading toward 4**; Boris Cherny states he has personally reached **level 4**.
#Boris Cherny#Claude Code#Anthropic
Boris Cherny (Creator & Head of Claude Code @Anthropic)
Long-form essay by **Shubham Saboo** (X/Twitter) advancing a thesis on the Product Manager role in the age of agents: the next key skill is **not prompt engineering** but **Loop Engineering** — designing a *system that improves with every run* rather than writing the perfect prompt every time. A **loop** is a repeated cycle: change what shapes the agent's behavior → run it → evaluate the output → keep the change if quality rises, revert otherwise → **compound the learning** so the next version starts ahead. For a PM, the entry point is not code but the **durable artifacts** that encode their judgment: PRD-review skill, customer-call *summarizer*, evaluation rubric, launch checklist, research workflow, `CLAUDE.md`, prompt template, prioritization framework. Because they are reused, these artifacts **compound in both directions** — and **drift** silently (a CLAUDE.md that keeps growing, a checklist that gets ignored…): the model has not regressed, the artifacts have drifted unwatched. A loop has **5 parts**: trigger, action, **proof**, memory, **stop condition** (the most critical). **Evals** become PM work (testing the artifact against known examples: 3 good / 3 bad PRDs, 5 understood calls, 2 past launches). **Memory** lives on **GitHub** (the repo becomes "product memory": commits, diffs, eval results, decision log, rollback). Recommended first loop: a **weekly product signal loop** (every Friday). Taste remains central — but it now needs **proof**. Cites Boris (creator of Claude Code): "he no longer writes prompts, he writes loops."
Google whitepaper (the "Day 1" installment of a series, by Addy Osmani, Shubham Saboo and Sokratis Kartakis) mapping the transformation of the software development lifecycle (SDLC) in the age of coding agents. Thesis: the fundamental shift is not a new language but the move from writing code to **expressing intent**. The document sets out a spectrum ranging from *vibe coding* (prompting and accepting) to *agentic engineering* (AI implements under constraints, tests, and feedback loops designed by humans), with **context engineering** as the central skill, the **software factory** model (the developer's deliverable = the system that produces the code), **harness engineering** (Agent = Model + Harness), and a CapEx/OpEx economic analysis of total cost of ownership.