Governed agent delivery against an un-upgradeable estate

This case study is not “AI wrote the infrastructure.” It is what happens when a governed AI SDLC makes the expensive parts of legacy work (reading four repos end to end, writing the map down, sequencing cutovers) cheap enough to run in the margins of a working week, while two AI engineers keep shipping product features with no freeze.

It is the second live proof for Apptension SDLC, next to nini.bot. Nini shows greenfield product velocity on the harness. Teamdeck shows the same class of gates on an estate that had been deferred for eight years because it never justified a staffed program on its own.

Around it: one shared AWS account for prod and stage, unreproducible Terraform variables that lived only on former operators’ laptops, and a four-hop deploy ending in a hand-forked Beanstalk tool. The binding product constraint made it worse: ordinary feature work had to continue. Modernization could not buy a feature freeze.

The first unlock was not a rewrite. It was an audit with severity-ranked findings and citations, produced in a day from reading four repositories end to end. Critical hygiene issues were found by reading, not by an incident. A human then re-sequenced the roadmap: migrate workers to Temporal on the current infrastructure first, so the later account cutover could be data and DNS only.

The repository became machine-readable: a hard-capped entry-point map, path-scoped conventions, and bindings for branch strategy, CI, and verification commands. Non-trivial work got a written spec first. Multi-week programs got phase plans. Choices that constrained the future became ADRs with rejected alternatives recorded. Across this program: 30 phase plans, 20 design specs, 7 ADRs, and 6 runbooks, roughly 37,000 lines of written thinking beside ~96,000 lines of shipped code.

Three explicit gates (worker platform, foundations live, cutover readiness) blocked phases whose entry criteria were unmet. Twelve GitHub Actions workflows and thirteen scripts enforce titles, release-line merges, promotion ancestry, drift detection, and first-pass review. Every gate script has its own test file. AI review jobs hold no write token; validators check out from the base SHA, never the PR head.

When the model was wrong, the fix was procedural. A Pulumi provider major that previewed clean and failed on apply produced a runbook rule and a drift workflow. A silent “merge to master without an image” failure mode produced a required check. Those traps are why gates exist, and why we install the same class of harness for client teams on /agentic-sdlc.

Measured in the same window: about nine weeks from audit to mid-September, 60 pull requests (56 merged), median open-to-merge 1.2 hours, and 57 ordinary product commits from other authors with no feature freeze. Over half of modernization commits landed at or after 18:00. The RabbitMQ decommission alone was a net deletion of roughly 2,300 lines.

What is still ahead, stated plainly: production still runs on the legacy Elastic Beanstalk path. Cutover is planned and rehearsed on paper, not executed. Cost parity against the prior monthly baseline is a target until post-cutover numbers exist. Publish the process. Hold the victory lap.

For engineering leaders: start with the harness (context, gates, verification), then read the companion deep dive on what an AI SDLC actually enforces. When you want the same operating system installed in your org, that is Agentic SDLC.