The Approach — Section 02

The Agent Fleet

Fourteen small agents, one job each. Not one big assistant that does everything badly.

Why a Fleet

A single broad assistant demos well. It is hard to trust.

One big assistant
  • No defined output
  • No gate it has to pass
  • No way to say “I do not have what I need”
  • Access to everything, all the time
  • When it is wrong, you cannot tell which part failed
→
A fleet of narrow agents
  • One job, one output artefact each
  • One named human approves each output
  • Stops and asks when an input is missing
  • Read-only, scoped access
  • When it is wrong, you know which agent to fix
●

One job each

Role, Task, Context, Steps, Output. If you cannot say its output in one line, it is two agents.

●

Stop, do not guess

Missing input or an unresolved question? The agent stops and asks. It does not write a confident draft with quiet caveats.

●

Shared memory

All agents read and write one .ai-memory/. Module docs, domain glossary, code patterns, past decisions.

●

No invention

Endpoints, components, columns and queries come from the live code. If it cannot find one, it says so.

The Pipeline

Requirement in at the top. UAT pack out at the bottom.

Fourteen agents, six gates

Client requirement Regulatory circular Bug report 1 Spec Agent requirement → acceptance criteria 2 Regulatory Watch circular → obligation → modules GATE — Product Owner approves the spec 3 Architecture & Impact design + change map + restricted-zone flag 4 API Contract contract-first, breaking-change check GATE — Tech Lead approves design and contract 5 Backend engines and services, reuse first 6 Web UI — React controllers, view models, views 7 Data & Migration scripts only, never executes 8 Code Review Agent standards + analyzers + security, before a human opens the PR GATE — Developer reads it, fixes it, commits it 9 Characterization Test pins existing behaviour 10 Test & QA one test per acceptance criterion 11 Critical-Logic Verify ⚠ golden datasets GATE — QA Lead, plus a named Domain Owner for anything in the restricted zone 12 Bug Triage locate, reproduce, draft the ticket 13 Release & UAT Pack change log, checklist, rollback GATE — Release Manager approves. UAT sign-off stays human 14 Knowledge Update — write back to memory No agent in this fleet deploys, merges to a protected branch, or runs DDL
Agent step
Human gate
Review agent — the production-ready gate
⚠ Restricted zone

The Fourteen Agents

Input, output, and who signs it off

1

Spec Agent

Requirement → structured spec

Takes a requirement however it arrives — email, call notes, a ticket — and writes a spec with testable acceptance criteria. It works from your own past specs, so the shape matches what your team already builds from. Anything it does not know becomes an open question rather than an assumption.

In: raw requirement, module docs, past specs
Out: spec + acceptance criteria + open questions
Gate: Product Owner
2

Regulatory Watch Agent

Circular → obligation → modules

Reads an exchange or SEBI circular and turns it into engineering work: what it requires, which n.tasc modules cover that area today, and what the compliance deadline means for the release date. Regulatory releases are a standing part of your work, so they get a repeatable path instead of a scramble.

In: circular text, module map, past regulatory changes
Out: obligation summary, impacted modules, draft spec, deadline
Gate: Product Owner + compliance contact
3

Architecture & Impact Agent

Spec → design + change map

Reads the approved spec against the real solution and says exactly what is in scope: which services, React components, database logic and config tables. It also raises the restricted-zone flag when a change touches business-critical calculations or rule engines, which routes it through the restricted gate.

In: approved spec, solution map, database logic inventory, module docs
Out: design note, change map, restricted-zone flag, test scope
Gate: Tech Lead
4

API Contract Agent

Contract first, before implementation

Your engines and UI are built on the API, so the contract gets designed and signed before anyone writes code behind it. The agent diffs the proposed shape against the existing surface, classifies it additive or breaking, and drafts the deprecation and notification plan when it breaks something.

In: spec, existing endpoint and DTO inventory
Out: contract diff, breaking-change verdict, deprecation plan
Gate: Tech Lead. Breaking changes need explicit approval
5

Backend Agent

Change map → backend implementation

Works on a feature branch, reuse first. It has to find the existing service, repository or helper before writing a new one, and follow the conventions already present in that project. It never touches a file the change map did not authorise, and never edits restricted-zone code without routing through agent 11.

In: change map, coding standards, existing patterns
Out: branch commits + a note on what it did and did not do
Gate: Developer commits under their own name
6

Web UI Agent — React

Spec + contract → controllers, view models, views

Works in the React idiom already in the codebase. Components, hooks, state management, routing and the existing component and state conventions. For dashboard work it follows the display conventions already in place: refresh behaviour, alert prominence, and the fact that an operations user reads that screen under time pressure.

In: spec, signed contract, existing view and layout conventions
Out: React components, state, routing, API wiring
Gate: Developer + UI reviewer
7

Data & Migration Agent

Scripts only. Never runs them.

Where real business logic sits in the database, code generation without database awareness is worse than useless. This agent writes forward and rollback migrations, query and database-logic changes, and an index and query-plan note. It reads the live schema, so it never guesses a column name. It never runs DDL anywhere.

In: change map, live schema, database logic inventory
Out: migration script, rollback script, query/logic diff, performance note
Gate: DBA / Tech Lead runs it. Agent has no write credentials
8

Code Review Agent

The production-ready gate

Reviews the branch before a human opens it: your coding standards, ESLint on the React side plus the backend's linters and static analysis, the change map, and a security pass covering injection, encoding, authorisation and secrets. This is the agent that makes “production-ready code generation” a measurable claim instead of a hope.

In: the branch, standards, analyzer output, the approved change map
Out: findings, applied fixes, and anything it could not fix flagged for the human
Gate: Developer. The agent narrows what they read, it does not replace them
9

Characterization Test Agent

Legacy code → a net that did not exist

This is what makes the rest safe. Point it at an untested part of n.tasc. It runs the existing code and writes tests that pin what it does today — no spec needed first. Anything it captures that looks wrong gets raised as a finding, not frozen into a test.

In: target module, seeded database via Testcontainers
Out: approval tests, coverage delta, list of suspicious behaviours
Gate: QA Lead + module steward review the suspicious list
10

Test & QA Agent

Acceptance criteria → runnable tests

Unit, integration and Playwright journey tests mapped one to one to acceptance criteria. Plus the cases n.tasc needs and people forget: empty data sets, a missing upstream feed, stale data, expired records, a value sitting exactly on a configured limit. It also generates the synthetic test data.

In: spec with acceptance criteria, change map
Out: test code, manual cases, synthetic test data
Gate: QA Lead checks what is missing
11

Critical-Logic Verification Agent ⚠

Business-critical calculations and rule engines

Any change touching business-critical calculations or rule engines gets re-run against golden datasets: known inputs, known correct outputs, agreed with your domain owners. It reports every difference from the reference, however small, and it cannot mark a change as passing. A rounding difference in a calculated figure is exactly the kind of defect that reaches a client.

In: changed critical-logic code, golden datasets, reference outputs
Out: divergence report. Pass or fail is a human call
Gate: Named Domain Owner. No exceptions
You can prohibit generation entirely in nominated modules
12

Bug Triage Agent

Bug report → located, reproduced, ticketed

Takes a defect however it arrives, finds the likely code, drafts a failing test that reproduces it, and writes the ticket in the shape your team already uses. Where the defect sits in a client-specific module rather than the core product, it says so, because the fix path differs.

In: bug report, logs, code, module docs
Out: suspect files, failing repro test, drafted ticket, severity suggestion
Gate: QA Engineer confirms severity and validity
13

Release & UAT Pack Agent

Merged work → a standard release unit

Your releases stay on request. What changes is that each one arrives in the same shape: what changed and why, the UAT checklist derived from the acceptance criteria, known limitations, the migration scripts to run, and the rollback plan. Assembling that by hand costs half a day per release.

In: merged commits, change map, test results, migration scripts
Out: UAT pack + release notes + rollback plan
Gate: Release Manager approves. UAT sign-off stays human
14

Knowledge Update Agent

Write-back

After each completed change it updates .ai-memory/: new patterns, decisions the PO or tech lead made, things reviewers pushed back on, dead ends worth not repeating. Skip this and the fleet is exactly as good in month twelve as it was in week one.

In: completed change, review comments, pushbacks, decisions
Out: updated memory and module docs, new precedent records
Gate: Tech Lead reviews memory diffs in the PR

How an Agent Is Packaged

Version-controlled next to the code it reasons about. Agents are software.

.claude/ ├── settings.json # workspace runtime: MCP servers, hooks, permission floor ├── agents/ │ ├── architecture-agent/ │ │ ├── CLAUDE.md # Role / Task / Context / Steps / Output + hard stops │ │ ├── settings.json # read-only scoping for this agent │ │ └── skills/ │ │ ├── solution-impact-trace/ SKILL.md │ │ ├── db-dependency-trace/ SKILL.md │ │ └── restricted-zone-detection/ SKILL.md │ ├── code-review-agent/ │ ├── backend-agent/ │ └── ... one folder per agent └── commands/ ├── spec.md # /spec <requirement> ├── impact.md # /impact <spec path> ├── review.md # /review <branch> └── triage.md # /triage <bug id> .ai-memory/ ├── modules/ # one doc per n.tasc module ├── domain-glossary.md # business term -> backend -> React component -> table ├── architecture/ # solution map, API inventory, schema, database logic inventory ├── patterns/ # the conventions this codebase actually follows ├── testing/ # strategy, golden datasets, test data └── decisions/ # precedent, pushbacks, dead ends

Autonomy Levels

Where each agent starts, where it can get to, and where it stops for good

The ladder
Every agent starts at L1. Promotion needs pilot data. L5 is off the table.
L1
Suggest — agent proposes, a human does the work
Where every agent starts in Stage 3. No exceptions.
L2
Draft — agent produces the artefact, a human edits and commits
Spec, Backend, UI, Data/Migration, Test & QA, Release Pack, once their pilot numbers hold.
L3
Draft + self-verify — agent presents evidence with the draft
Code Review, Characterization Test, Test & QA, Architecture & Impact, API Contract.
L4
Autonomous inside a fence — a whole class of low-risk work
Characterization backfill on non-restricted modules. Documentation and memory write-back.
L5
Autonomous to production — NOT IN SCOPE, EVER
No agent deploys, merges to protected branches, or runs DDL. On a platform clients depend on in production this is permanent, not a phase.

Promotion needs numbers

An agent moves L1 to L2 when its pilot data says so: how often its drafts are accepted, how much rework they cause in review, and escaped defects on work it touched. Promotions get decided in the Stage 4 review and written down, so nobody has to work out later why an agent was trusted with more.