Phase 3 · Build

Start a story. Let the Harness prepare the engineering work.

The approved story enters the lab. AI drafts the code and tests from its controls. The developer stays accountable.

1 · Requirements → 2 · Development → 3 · QA → 4 · Release → The screen it builds → 5 · Observability → 6 · Documentation

Arrived from the Requirements Lab.

Story NP-AUTH-321 arrives under epic NP-FAMILY-042 with its control pack. Development inherits it, and does not re-decide it.

AUTH-PASS-016AUTH-PASS-017PRIV-CHILD-001A11Y-BASE-001

← See how it was written

NP Development LabDeveloper workspace · Approved story run · local demo

Verified engineering session

● Signed inRole: Developer / ownerEpic: NP-FAMILY-042Story: NP-AUTH-321

1 · Start storyDeveloper launches the approved work package.

2 · AI interpretPull skills, story context, and control packs.

3 · Generate & testDraft code, unit tests, and enforcement checks.

4 · Review & evidenceDeveloper owns approval and release inputs.

NP-AUTH-321

Approved story · epic NP-FAMILY-042

Parent registration with controlled credentials

As a parent, I want to create a secure account so that I can manage our family wishlist with appropriate verification and consent.

Acceptance criteria and story context pulled from the approved work package.
Skills: implementation, secure coding, unit testing, observability, release readiness.
Controls pulled: AUTH-PASS-016, AUTH-PASS-017, PRIV-CHILD-001, and A11Y-BASE-001.

Approved and ready. Starting it writes nothing to a repository.

AI engineering package

Implementation and tests

The AI works from the approved story, current skills, and central control packs.

Waiting to start

AUTH-PASS-016AUTH-PASS-017PRIV-CHILD-001A11Y-BASE-001

// Generated from NP-AUTH-321 — illustrative only
export async function registerParent(input) {
  assertPasswordPolicy(input.password, controls.AUTH_PASS_016);
  const credential = await hashWithArgon2id(input.password, policy.hashProfile);
  await consentGate.verify(input.guardianConsent);
  return accounts.create({ email: input.email, credential });
}

Unit test · policyRejects a credential below the approved length or composition rule.Waiting

Unit test · storageUses the approved one-way hash profile and never retains plaintext.Waiting

Unit test · consentBlocks account creation until the required consent gate completes.Waiting

Unit test · accessibilityReturns accessible validation errors for invalid registration input.Waiting

AI interpretationAwaiting story start

Control enforcementAwaiting generated checks

Unit-test evidenceAwaiting AI test run

Developer approvalAwaiting accountable review

Next: verification.

The story now carries code and tests. QA executes the criteria already attached — and finds a defect.

Continue to the QA Lab →

Operating model: AI does the drafting, the tests, and the control checking. The developer reviews it and stays accountable for the decision.

* The production workbench is internal — reachable over the corporate VPN only. This public page is a local demonstration.