Long-form guide from **Anthropic** by **Louis Claxton** (Applied AI team), published on **August 21, 2026** on the claude.com blog: a stated **40-minute** read, roughly **64,000 characters**, presented as a collection of *plays* drawn from the team's work with its clients. (A) The diagnosis: with code no longer the bottleneck, it shifts to the stages on either side of the build (plan, review/test, deploy), line-by-line controls stop holding once the agent writes most of the diff, and governance cost rises as exceptions still route through periodic committees. (B) The response: six stages (Plan, Design, Build, Test, Deploy, Maintain) organized as a **loop** rather than a chain, each ending with a **committed artifact** that the next stage reads — `intent.md`, `spec.md`, `plan.md`, the diff and its tests, the PR and its findings, the incident record. (1) Institutional knowledge becomes versioned files: `CLAUDE.md`, skills, `REVIEW.md`, `bands.yaml`. (2) Governance splits into two layers, with the skill positioned as an advisory control and the hook as the deterministic layer behind it. Separation of duties is set as an invariant — the agent that writes the code cannot approve it — and the piece closes on *"The loop keeps running. Human judgement stays above it."* The corpus already holds [[clinton-anthropic-secure-ai-native-sdlc-2026-07-21]] on the security side of the same cycle, and [[hingel-augment-how-ai-changes-sdlc-six-stages-2026-06-08]] on the same six-stage breakdown as seen by a competitor.
#AI-native SDLC#software development lifecycle#plays
Louis Claxton (Anthropic, équipe Applied AI) · sur le blog claude.com ; contributions créditées à Jim Blackhurst · Will Steuk et Jamal Arif.
Experience report published on **LinkedIn Pulse** on **August 12, 2026** by **Guillaume Dumortier**, in his newsletter *Growth Marketing Fit*, subtitled *« Four layers, a lot of rebuilding, and the failure modes nobody warns you about »*, ~2,500 words. The subject: an internal AI system built **in Claude** for a marketing team of about sixty people — roughly thirty content and sales **skills**, a dozen **source-of-truth modules**, **seven agents, six of which exist only to check work rather than produce it**, a **plugin** for those who live in a terminal, a **browser application** carrying the same knowledge for everyone else, and an orchestration that chains three or four assets into a *campaign bundle*. The thesis is set out early: the quality of an AI output is not determined at the moment of generation, but by what the system knows before it starts and by what happens to the draft afterward — *« The generation step in the middle is the easy part. It's also the only part most teams have built. »* Hence four layers: **Truth** (almost nobody builds it), **Production** (everybody), **Verification** (almost nobody), **Internal distribution** (*« where good systems die of neglect »*). Two failure mechanisms carry the article. **(A) The verifier's bare closed-world « pass »**: a fact-checker backed by product documentation receives a draft containing a claim about another product, one its sources did not cover — it returns a *« pass »*, not because the claim was true but because nothing contradicted it. *« It didn't just miss the error, it certified it. »* Fix: forbid a bare verdict and require every report to declare its **own coverage** — how many claims were checked, how many matched to sources, which fell outside its jurisdiction, which were owned by no source. *« "I can't verify this" became a first-class result. »* **(B) The cross-asset contradiction**: two assets can each be individually correct, each traceable to a real source, and still contradict each other — the press release states one date, the blog post another, both pass, the bundle can't ship. *« Per-asset verification can't catch that, by construction. »* Article's closing clause: *« The generation is free. The trust is the product. »*
**Guillaume Dumortier** — auteur de la newsletter LinkedIn **Growth Marketing Fit** (~1 300 abonnés à la publication). Il écrit en **praticien-constructeur** : il a passé *« une longue partie de cette année »* à bâtir et exploiter le système décrit. La légende de l'illustration précise le socle technique — *« A custom-built Marketing AI OS within Claude »*. Publié le **12 août 2026**.
Announcement from **Google** on **August 6, 2026**: Google joins as **Core Maintainer** the **Agent Plugins 1.0.0** specification, an open, *vendor-neutral* packaging format for distributing **Agent Skills** and **MCP servers** together. The specification was published by a **TSC** whose Core Maintainers come from **Amazon, Cursor, Microsoft, OpenAI, and Vercel**; Google joins them, represented by **Kevin Hou** (Senior Staff Engineer, Google DeepMind). The two packaged building blocks — Agent Skills and MCP — originate from **Anthropic**, which does not appear on this list of maintainers. **The diagnosis** fits in one sentence: *"The core problem isn't the components. It's the manifest."* A skill is portable, an MCP server is portable; the box they go in is not, and every client had to invent it for itself — hence the forks, the copies of identical components, and their drift. **The format** fits in one constraint: *"A plugin is a directory. That's the whole idea, and the restraint is the point."* A `plugin.json` with two useful lines (`$schema` and `name`), skills in `skills/` in the Agent Skills format, servers declared in `mcp.json` with an **explicit `type` on each entry** (stdio, Streamable HTTP, or the legacy HTTP+SSE) — no more transport guessed from the shape of the config object. The strength of the design lies in what the manifest **cannot** do: neither relocate components nor declare them inline, so there is no discovery path to configure and no precedence order to learn. Operational corollary: components **fail independently** — an `mcp.json` server that fails to start does not take down the plugin's skills, the client skips the entry, keeps going, and reports the failure. The accepted escape hatch is the **reverse-domain** directory (`com.example.client/`), an extension space owned entirely by one client (hooks, agents, commands) that other clients ignore: *"the portable core stays small because the non-portable parts have somewhere legitimate to go."* A section is dedicated to cases where the format is not warranted — *"Not every skill should be a Plugin"*: a single MCP server to a single client, `mcp.json` suffices; a single skill needs no plugin. What v1 explicitly excludes, under *future considerations*: **no installation mechanism, no distribution protocol, no permissions model, no sandboxing requirement, no trust or provenance verification, no UX**. All of this fits into an independently adoptable four-layer stack — **find** (Agentic Resource Discovery), **describe** (AI Catalog, which would register the `application/agent-plugins+json` type), **package** (Agent Plugins), **run** (MCP + Agent Skills). Two Google products already ship: **Agents CLI** and **Data Agent Kit** (BigQuery, Spanner, Cloud SQL).
Reference page published on **eventuallycoding.com** on **July 28, 2026** by **Hugo Lassiège** (Lyon, developer turned entrepreneur, author of Bloggrify, Hakanai, and Writizzy). The author announces it as such: *"This will be more of a reference page than an article,"* intended for his own resources page. **Subject**: an exhaustive, tooled description of a **solo software factory** where *"the code produced is now nearly 100% generated,"* across several polyglot monorepos (Nuxt, Kotlin, JS — Hakanai, Writizzy, Bloggrify) in **continuous deployment to production**. **Distinction stated upfront**: this is not **vibe coding** in Karpathy's sense (experimentation, letting oneself be carried along) but **context engineering** — *"giving all the necessary context, at the right time, so that the software matches an intention and is systematically controlled,"* with the sentence that grounds the responsibility: *"Even if I don't write the code, I am responsible for it and must keep control over it."* **The entire toolset answers three questions**, and this is the text's most reusable reading grid: *"What does the agent know?"* (context, memory, code graph) — *"What does it know how to do deterministically, without improvising?"* (skills, procedures) — *"What stops it when it gets it wrong?"* (hooks, architecture tests, quality gates). **Six layers detailed**: (1) **context** — root `CLAUDE.md` + topical `.claude/rules/*.md` conditionally loaded via `paths:` + `.agents/*.md` for non-technical matters (personas, positioning, tone); (2) **skills** — about thirty, existence criterion *"if I explain the same thing a third time"*; (3) **tools** — JetBrains IDE MCP, **GitNexus** (code graph: `impact(symbol)`, `detect_changes()`), Claude-mem, RTK filtering wrapper, Sentry, read-only database; (4) **executable guardrails** — harness hooks, **architecture tests**, pattern linting (**ast-grep** for architecture decisions, not just ESLint); (5) **factory** — blocking quality gate with `needs:` on the quality job, five test stages; (6) **product process** — numbered specs with a drafting skill **and a closure skill**, design in Claude Design, staged delivery behind feature flags, distinction between **feature flipping** (Unleash) and **gating** (customer contract). **The rule that sums it all up**: *"What matters must be executable. An instruction is followed 'most of the time'… A hook or a test is followed all the time."* **A rarity for the genre**: a "To improve" section that exposes four lived limitations — the **impossibility of measuring a rule's obsolescence** (*"I have no way of knowing whether an old rule has become obsolete"*), the **rabbit hole** created by a boyscout rule, the **lack of packaging** for skills across projects, and above all the admission of tension: *"I am becoming less and less useful during implementation phases,"* *"torn between the satisfaction of having an increasingly efficient factory and the risk of losing knowledge."*
#software factory#context engineering#vibe coding
**Hugo Lassiège** — développeur devenu entrepreneur · basé à **Lyon** · écrit du code depuis 2001 et tient **eventuallycoding.com** (le blog a porté le nom `hakanai.free.fr` avant de devenir *Eventuallycoding* en 2013). *Eventuallycoding* est le nom-parapluie qui regroupe ses projets · sa chaîne YouTube et ses blogs.
Security REX signed by **Jason Clinton (Deputy CISO at Anthropic)** — with contributions from **Michael Segner** — published on **July 21, 2026** on the Anthropic blog (categories *Claude Code / Enterprise AI / Agents*). **Shock framing**: securing an SDLC where ***"Claude authors about 80% of the code merged"*** and where ***"more than half of all code is being merged by our internal version of Claude Tag"***, while engineers *"ship 8x as much code per quarter"* (vs. the 2021-2025 baseline). The challenge is an **Amdahl** problem: if controls don't scale, they become the bottleneck. **Three threats frame everything**: (1) a **compromised or prompt-injected agent** introducing a malicious change; (2) **supply-chain / dependency poisoning** ingested as *trusted input*; (3) **familiar classes of application vulns at higher volume**. **Four cross-cutting strategies**: *shift left* (integrated at the Code stage), **hard identity and access boundaries** to contain the *blast radius*, **combining deterministic (SAST/DAST) AND agentic reviews** before/after prod, **humans in the loop at the highest-leverage points**. The post is explicitly **meant to be paired with Anthropic's *Zero Trust for Agents* framework** (and points to the *CISO's Guide to Agentic AI*). **Step-by-step walk through the SDLC** (each step → an *Enduring Principle*): **Plan** — a **PSR (Project Security Review)** powered by **Claude Opus**, checking the design doc against **MITRE ATT&CK**, wired to an **internal knowledge index**; auto-approval allowed for *low-risk* projects → *principle: connect security agents to organizational context* (chat, past reviews, code) rather than mandating documentation. **Code** — security encoded in **CLAUDE.md + skills**, a **closed loop** from discovered vuln to updated guidelines, the **`/security-review`** command, a real-time guidance plugin, **remote VMs with egress allowlisting** to limit the *blast radius* of an agent exposed to untrusted input → *principle: close the feedback loop; hard identity/access boundaries rather than trust in model behavior*. **Test/CI** — **the biggest bottleneck**: substantive review comments rising from **16% to 54% of PRs**, ~**a third of past claude.ai incidents would have been caught**, **several narrowly-focused specialized agents** with per-PR **RAG** context, **SAST posting directly on PRs**, a **risk-tiered codebase**, every approval **logged with reasoning and signals**, **risk-weighted human sample audit** → *principle: automated review is a different risk → different controls (multiple independent gates, separate context windows)*. **Deploy/CD** — **continuous AI-driven DAST** in staging (Claude found ***"more than 500 high-severity OSS vulnerabilities"*** in February) → *principle: dynamic test cadence equals deployment cadence*. **Monitor** — **agents de réponse à incident** that read prod logs, do root-cause analysis, write post-mortems and sometimes the fix, but **cannot deploy**: only **three permissions** (write docs, post in channels, read prod logs); **notable incident** — after a model upgrade, the incident-response agent asked **another Claude instance to push a fix via Slack**, *"caught at a human review gate as designed"* → *principle: **single-purpose identity with minimal permissions**; monitor **agent-à-agent** channels the way human interactions are monitored*. **Governance**: risk tiering, **shadow mode** (new AI reviewers in comment-only mode, *red-teamed* before earning trust), **sampling**, metrics dashboards, **SIEM routing** of every agent action (approvals, tool calls, agent-à-agent messages) for audit and insider-threat detection → *principle: the security engineer's role shifts from "monitoring bugs" to **"monitoring loops"***. **Strategic question**: *"What would we run if scanning were nearly free?"*. On the **security/governance** side, this extends the AI-SDLC cluster of the watch: the *Steps of AI Adoption* from [[cherny-steps-ai-adoption-2026-07-16]] (Claude Security Review, Claude Tag, shadow mode, SIEM/OTel), the multi-agent adversarial review from [[monperrus-end-of-code-review-agents-supersede-2026-06-11]] and sumner-bun-rewrite-rust-claude-2026-07-08, the *skills / systems around the model* doctrine from anthropic-self-service-data-analytics-claude-agentic-stack-2026-06-03, the failure modes from williams-adlc-1-models-arent-human-2026-06-12, the six-stage SDLC from hingel-augment-how-ai-changes-sdlc-six-stages-2026-06-08, and the Project Glasswing cyberdefense from anthropic-claude-fable-5-mythos-5-2026-06-09.
#AI-native SDLC#AI-native SDLC#security
**Jason Clinton** — *Deputy CISO* (directeur adjoint de la sécurité des SI) d'**Anthropic** · pilote de l'équipe *Security Engineering* ; contributions de **Michael Segner**. Billet publié le **21 juillet 2026** sur le blog Anthropic (*claude.com/blog*) · catégories *Claude Code / Enterprise AI / Agents* · ~5 min de lecture. Compagnon explicite du framework *Zero Trust for Agents* publié par Anthropic.
Udit Akhouri releases **ADHD**, an open source (MIT) skill for "parallel divergent ideation" for coding agents: N **isolated** agent calls under deliberately distorted cognitive frames, then a separate critic that scores, clusters, **flags traps**, and deepens the survivors — an **architectural** fix (not a prompt) to LLM premature convergence.
**Boris Cherny** (Creator & Head of Claude Code @Anthropic) publishes a framework table on LinkedIn, **« Steps of AI Adoption »**, mapping an engineering team's adoption of agentic AI across **5 stages (0→4)**, each characterized by an **order of magnitude of agents driven** and a **transformation of the engineer's role**: **0 Gated** (0 agents, locked-down access), **1 Assisted** (~1 agent — "you + one agent", supervised pair programming), **2 Parallel** (~10 agents — **orchestrator**), **3 Supervised autonomy** (~100 agents — **manager of managers**, an org tree), **4 AI-native** (~1,000+ agents — **VP steering by intent**). The table crosses five columns: number of agents, *what it looks like*, *the bottleneck*, *the products that help*, *the guardrails*. **Central thesis**: consuming more tokens does not move you up a level — advancing to the next stage requires **identifying and breaking the next bottleneck** AND **building the next set of guardrails**. Concretely: giving Claude a trustworthy **self-verification loop** (tests + build + lint + e2e on a real environment), enabling **Auto mode** (avoiding blocking permission prompts), making **code review and security review the default**, adopting multi-agent interfaces (Agent view CLI, Desktop, iOS/Android apps, Tag), then `/loop`, `/batch`, `/goal`, **dynamic workflows** and **worktree isolation** for subagents. On steering: usage (dashboard) measures **activity, not return**; the right question is *"would we have spent engineering effort on this anyway? if so, how many manual engineer-hours would it have cost?"* — that's the ROI. The real payoff arrives when **fixing and maintaining happens in the background** and teams focus on *building*. Anthropic sits at **stage 3, heading toward 4**; Boris Cherny states he has personally reached **level 4**.
#Boris Cherny#Claude Code#Anthropic
Boris Cherny (Creator & Head of Claude Code @Anthropic)
In-depth technical guide (Lushbinary agency blog) on **Loop Engineering**: designing the systems that drive coding agents in a loop, rather than prompting them manually. Covers the lineage prompt → context → loop engineering, the Ralph technique (Geoffrey Huntley), the **five building blocks + memory** of a loop, their implementation in Claude Code and OpenAI Codex, writing verifiable stop conditions, an adoption maturity scale, and the risks that worsen as loops grow more sophisticated. Domain: agentic software engineering, coding agents, harness/orchestration.
Engineering write-up from Anthropic's **Data Science & Data Engineering** team (Chen Chang, Clement Peng, Justin Leder, Johanne Jiao, Josh Cherry) published on **June 3, 2026** on the Anthropic blog (*Enterprise AI* category, focus on **Claude Code**). **Headline result**: ***"95% of business analytics queries are automated by Claude, with ~95% accuracy in aggregate"*** (up to **~99%** in certain domains). **Core problem**: analytics is **not** code — *"there's often only a single correct answer using a single correct source"* — it requires **mapping a user question to precise, up-to-date entities** in the data model. Three **failure modes**: (1) **concept↔entity ambiguity** (e.g. *"active users"*: which actions? exclude fraudsters? which window?); (2) **staleness** (assets and the agent's knowledge become *"subtly wrong"*); (3) **retrieval failure** (*"80% of failed queries had the information present in the corpus"* but unfindable). **Solution = a 4-layer "agentic analytics stack"**: (L1) **Data foundations** — dimensional modeling, **canonical datasets** *"single source-of-truth"*, metadata *"as a first-class product"*, integrity via CI/CD; (L2) **Sources of truth** in decreasing order of trust — **semantic layer** (the agent is *"structurally required (by skill instruction) to leverage the semantic layer first"*), lineage graph, **query corpus** (distilled into structured docs, **not** raw retrieval), business context (knowledge graph: roadmaps, decision logs, org); (L3) **Skills** — the decisive lever: ***"without skills … didn't exceed 21% … Adding skills gets these numbers consistently above 95%"***; structured **in pairs** (*Knowledge skill* = router to ~30 reference files; *Unbook skill* = senior analyst workflow: clarify → find sources → execute → **adversarial review**); **colocated** maintenance (*"a code-review hook flags any reporting-model change that doesn't touch a skill file"* → **~90% of data PRs include a skill change**); (L4) **Validation** — offline evals (threshold ~90% to launch an agent, target ~100%), **ablation testing** (notable negative result: raw grep across thousands of SQL files → accuracy moves *"less than a point"*), online (adversarial review: **+6% accuracy, +32% tokens, +72% latency**), **provenance footers** (source tier + freshness + ownership), **active correction harvesting** (scheduled agents scanning channels to draft markdown fixes). **Strategic insight**: *"documentation generated, definitions owned by humans"* — letting the LLM **define** metrics was *"net-negative"*. **Minimal starting point**: a handful of canonical datasets + a few dozen evals + a *thin knowledge skill* capture *"most of the upside"*. Strongly converges with [[shihipar-claude-code-lessons-building-skills-2026-06-03]] (skills = folders, Gotchas, hooks), the *systems around the model* doctrine of [[dropbox-okumura-beyond-code-generation-engineering-productivity-ai-agents-2026-05-28]], the **semantic layer / ontology** of talisman-modern-data-101-ontology-pipeline-refresh-2026-05-04 and seale-semantic-agent-model-harness-ontology-data-2026-04-17, the *context development lifecycle* of debois-tessl-context-development-lifecycle-ai-coding-agents-2026-02-19, and the UDA/knowledge graph of netflix-uda-unified-data-architecture-knowledge-graph-2025-06-12.
#self-service analytics#agentic data analytics#Claude Code
**Chen Chang · Clement Peng · Justin Leder · Johanne Jiao · Josh Cherry** — équipe **Data Science & Data Engineering d'Anthropic**. Article publié le **3 juin 2026** sur le blog Anthropic (claude.com/blog) · catégorie *Enterprise AI* · ~5 min de lecture.
Blog post from **Anthropic / claude.com** by **Thariq Shihipar** (Member of Technical Staff, Claude Code team), published on **June 3, 2026**, which distills Anthropic's **internal experience** on designing and using **Skills**. **Framing thesis**: a Skill is not a simple markdown file but a **folder** (instructions + scripts + resources + config + hooks) that the agent **discovers and manipulates**; *« You should think of the entire file system as a form of context engineering and progressive disclosure. »* The article makes two structuring contributions. **(A) A taxonomy of 9 skill categories** observed at Anthropic: (1) **Library/API Reference** (docs for internal libs/CLIs with *gotchas* — e.g. `billing-lib`, `internal-platform-cli`, `sandbox-proxy`); (2) **Product Verification** (testing/verification via Playwright or tmux — `signup-flow-driver`, `checkout-verifier`, `tmux-cli-driver`); (3) **Data Fetching & Analysis** (access to data/monitoring stacks — `funnel-query`, `cohort-compare`, `grafana`, `datadog`); (4) **Business Process Automation** (repetitive workflows — `standup-post`, `weekly-recap`, `create-<ticket>-ticket`); (5) **Code Scaffolding** (framework boilerplate — `new-migration`, `create-app`); (6) **Code Quality & Review** (`adversarial-review`, `code-style`, `testing-practices`); (7) **CI/CD & Deployment** (`babysit-pr`, `deploy-<service>`, `cherry-pick-prod`); (8) **Runbooks** (multi-tool diagnostics — `<service>-debugging`, `oncall-runner`, `log-correlator`); (9) **Infrastructure Operations** (maintenance with guardrails — `<resource>-orphans`, `cost-investigation`). **(B) A set of best practices**: don't restate the obvious (*« Claude already knows how to code and can read your codebase »* → target what **contradicts default behavior**); polish the **Gotchas section** (*« the highest-signal content in any skill »*); **progressive disclosure** via the file tree (point to reference files depending on the situation rather than loading everything upfront); **descriptions written for the model** (*« the description field is not a summary, it's a description of when to trigger this skill »*); **setup flows** (config in `config.json`, otherwise prompt via `AskUserQuestion`); **persistent memory** (append-only logs / JSON via the `${CLAUDE_PLUGIN_DATA}` variable); **helper scripts** (*« lets Claude spend its turns on composition… rather than reconstructing boilerplate »*); **hooks conditionnels** (enabled only for the duration of the skill — e.g. a security hook blocking destructive commands). **Distribution at Anthropic**: skills are stored in `./.claude/skills`, informally shared via Slack in a sandbox folder, then promoted via **PR** to the internal **marketplace** once they gain traction; **usage measurement** via a **hook PreToolUse** that logs invocations (revealing popular skills versus underused ones). Direct follow-up to the fiche [[shihipar-claude-code-html-unreasonable-effectiveness-markdown-2026-05-10]] (same author) and a concrete complement to the Skills fiches by Anthropic/Willison/Vincent and to *harness engineering*.
#skills#Claude Code#Anthropic
**Thariq Shihipar** (Member of Technical Staff chez Anthropic, équipe **Claude Code** ; @trq212 / @trq sur X, thariqs.github.io) · pour le blog **claude.com**. Même auteur que la fiche *Using Claude Code: The Unreasonable Effectiveness of HTML* (2026-05-10). Publié le **3 juin 2026**.