By David Speakman ·
Fourteen skills take a project from a business description to a pentested, production ready codebase. Architecture, requirements, code, infrastructure, and three environment gates in between. One command runs the sequence. Every human checkpoint still needs a human.
File: src/api/app.py:41. Found: allow_origins=["*"].
Fix: Read CORS_ORIGIN from an environment variable. Never a wildcard.
Architecture lives in one document, requirements in another, the codebase somewhere else, infrastructure defined by whoever touched Terraform last, and security testing scheduled on its own calendar. By the time a pentest finding comes back, the design decision that caused it is three meetings away.
These skills close that gap by making each phase read the previous phase's real output, not a summary of it. Requirements are seeded from the actual architecture document. Code is generated from the actual API schema and domain model. A promotion gate refuses to pass a codebase whose upstream gate never ran.
The pipeline is opinionated about order for one reason. Skipping a step is how the gap reopens.
Run every skill yourself in order, or hand the sequence to /sdlc-pipeline.
It carries the output path, tech stack, and promotion level between phases, and stops
at the three places a human needs to look anyway.
| Phase | Skill | Output |
|---|---|---|
| Architecture | /generate-sad | Solution Architecture Document, HTML and PDF |
| Requirements | /generate-requirements | Domain model, naming dictionary, use cases, API and DB schema, test strategy |
| Code Generation | /generate-speakmanai-code | Working codebase, JS, Go, or Python, seven commits |
| Infrastructure | /generate-infrastructure | Terraform for GCP, AWS, or Azure, plus pre-pentest hardening |
| Promote · Level 1 | /promote-environment 1 | Pass/block report, local to DEV |
| Promote · Level 2 | /promote-environment 2 | Pass/block report, DEV to STG |
| Pentest + UAT | /pentest + /generate-uat-tests | Findings report and executed test cases, against live STG |
| Promote · Level 3 | /promote-environment 3 | Pass/block report plus functionality score, STG to PROD |
generate-speakmanai-code reads the same six coding contracts regardless of
stack, then applies one set of rules on top. Pure domain layer. Injected repositories.
One commit per milestone gate.
Express and React 18, better-sqlite3, factory functions over classes.
npm install is the install gate for every milestone.
chi router, modernc.org/sqlite with no cgo, a DomainError struct, httputil.ReverseProxy for the BFF layer, go:build e2e tags to isolate journey tests.
One FastAPI process serving REST, MCP SSE, and a Jinja2 plus HTMX admin UI. Domain layer is frozen dataclasses. No async past the application layer.
Adding a fourth language is one file. Write
generate-speakmanai-code-{lang}/SKILL.md against the documented LANG_CONFIG
contract and add one row to the router's table. The router, and every variant already
registered, never changes.
promote-environment produces a pass/block report against a fixed
checklist. It never fixes anything itself. Pentest and UAT both run against the live
STG environment, not DEV, because
STG is the shape production will actually have.
Code quality. Test coverage, no hardcoded URLs, strict boolean validation, static 500 error messages. Fails on one unenforced max length field.
Security and reliability. Rate limiting on auth routes, a timeout on every outbound call, pagination on every list endpoint. Inherits every Level 1 check.
Against live STG. Pentest runs through a companion app with four of its own human sign off gates. UAT is human executed, traced to every use case.
Hardening plus a functionality score computed from the UAT results file. One use case with no passing test blocks production.
If a pentest or UAT finding needs a code change, Level 1 and Level 2 no longer describe the code that earned them. The pipeline restarts from Level 1, redeploys DEV and STG, and retests against a fresh STG build. There is no shortcut back to Level 3.
/pentest and /pentest-execute drive a real penetration test
through a companion app that owns scope approval, findings review, and report sign
off. The orchestrator polls those gates. It never approves them.
Closer to production, more stable. The environment the report should actually describe.
gate2/complete, gate3/complete, and
gate4/complete are routes the skill is forbidden to call itself.
Business outcome to requirement to use case to test to functionality score, computed by Level 3 straight from the results file.
Skills install to ~/.claude/skills. Global, so they are available
everywhere Claude Code runs, not only inside this repo.
# from a PowerShell prompt
git clone https://github.com/speakmancip/speakmanai-cc.git
cd speakmanai-cc
.\install.ps1
# from a terminal
git clone https://github.com/speakmancip/speakmanai-cc.git
cd speakmanai-cc
chmod +x install.sh && ./install.sh
New here? Read PIPELINE.md in the repo for the full phase by phase roadmap.
Or run /sdlc-pipeline and answer the questions in order.
Every skill is a markdown file you can read, fork, or delete. No SaaS dependency for the pipeline itself. Only the SPEAKMAN.AI MCP server, or its local self hosted build, for the phases that use one.
Pentest and UAT are gates inside the pipeline, not a separate engagement scheduled afterward. A code fix always sends you back through promotion, not just the one check that failed.
Same contracts, same milestone gates, same promotion checklist, whether the target is JS, Go, or Python. The router pattern means a fourth variant never touches the ones already registered.
Fourteen markdown files define the entire pipeline. No hidden service, no proprietary ruleset. Clone it, read it, run it against your own project.
Written by David Speakman. Speakman Consulting designs and builds this kind of system for growing organizations: agent workflows with the governance that keeps humans in the loop.