What Stage 0 Is
Three weeks. No agents get built.
Stage 0 answers two questions: what does the codebase actually look like, and what are our numbers today? Skip the second and six months later everyone agrees it feels faster, and nobody can prove it to a sceptical board member.
0.1 — Baseline Measurement
From records you already have. No instrumentation needed.
| Metric | How we take it | Why it matters later |
|---|---|---|
| Cycle time: requirement accepted → UAT-ready | Last 20 changes, split by kind of release | The headline number |
| Where the time goes | Same 20 changes split across the seven bands: spec, impact, code, test, review, regression, deploy | Tells us which agents matter most for you, rather than in general |
| Escaped defects per release | Found after UAT sign-off, last 6 months | Stops us buying speed with quality |
| Rework rate | Review iterations per PR; changes reopened after UAT | Catches drafts that look fast and cost more in review |
| Test reality | Test count, what passes, real coverage, what gates on it | Sizes the Stage 2 job honestly |
| Build and deploy to UAT | Wall clock from merge to a usable UAT, manual steps included | The streamlining target from your brief |
| Bus factor per module | Commit history: distinct engineers per module in 12 months | The clearest sign the role change is real |
| Regulatory lead time | Past circulars: published date to UAT-ready | The class of work with the least schedule flexibility |
Both sides sign the baseline before Stage 1 starts
A number nobody agreed to gets disputed the moment it becomes inconvenient. This also settles which of the seven bands is actually your bottleneck, which shapes the order agents get built in Stage 2.
0.2 — Codebase Readiness Audit
Agents copy whatever quality level they find
Structure
- Repository, service and React app layout, naming actually in use
- Where logic sits between backend services, the database and React components
- Dead code, duplicated logic, abandoned modules
- Framework and library version spread across the codebase
Conventions
- Do similar things look similar? Agents copy what they find
- Error handling, logging, validation patterns
- Where the codebase contradicts itself, and which side should win
- Existing standards, written or implicit
Restricted zones
- Which services and database logic implement business-critical calculations
- Which implement rule engines, thresholds and alerting
- You nominate any module as generation-prohibited
- Recorded in memory so every agent respects it automatically
Data layer
- Database logic inventory and how much business logic lives there
- Schema documentation state, migration approach today
- Whether a containerised database is feasible for tests
- Hot paths where performance is a hard constraint
Findings split into two lists
Blocking — must be fixed before agents work reliably there. Becomes Stage 1 and 2 work. Worth knowing — real technical debt that is not on the critical path. Handed over as a backlog. We are careful not to let a transformation programme turn into a refactoring programme.
0.3 — Governance and Guardrails
Agreed before the first agent runs, not after the first incident
- Data policy — no live client data, client codes or UCC in agent context. Schema only, never production data
- Restricted-zone gate — named domain owners appointed; generation-prohibited modules listed
- Disclosure — does any client or exchange agreement require disclosing AI-assisted authorship? Settle it in writing
- Credentials — read-only everywhere. No deploy, no DDL, no protected-branch merge for any agent
- Audit — log every agent run. Agree retention. Tag AI-assisted commits
- Kill switch — a documented way to disable any agent instantly. Drilled in Stage 2
- Standards baseline — agree the coding standards and analyzer rule set that the gate will enforce
0.4 — Tooling and Pilot Scope
The pilot module has to satisfy four things at once
Picking the pilot
Stage 0 deliverables
Signed baseline metrics including the seven-band time split · codebase readiness report, split blocking and non-blocking · restricted-zone register and named Domain Owners · agreed coding standards and analyzer rule set · governance and access policy · tooling installed, access provisioned · agreed pilot module and steward.