Our Agentic SDLC

The Hall of Mastery stands silent. The six seals of the Codex glow on the walls — one for each domain, one for each truth the candidate has learned on the journey from initiate to master. The Codex Master who placed the seals speaks: "Show me that you did not only read the Codex. Show me that you understand why it was written."

🗺️ The Arc Complete

graph TD
    D1["Domain 1: Agentic SDLC"]
    D2["Domain 2: Tools & Permissions"]
    D3["Domain 3: Memory & Context"]
    D4["Domain 4: Evaluation"]
    D5["Domain 5: Multi-Agent"]
    D6["Domain 6: Governance"]
    CAP["🏆 CAPSTONE: Agentic Codex Master"]

    D1 --> D2 --> D3 --> D4 --> D5 --> D6 --> CAP

    style CAP fill:#FFD700,stroke:#B8860B,stroke-width:4px,color:#000
    style D1 fill:#4CAF50,stroke:#2E7D32,color:#fff
    style D2 fill:#4CAF50,stroke:#2E7D32,color:#fff
    style D3 fill:#4CAF50,stroke:#2E7D32,color:#fff
    style D4 fill:#4CAF50,stroke:#2E7D32,color:#fff
    style D5 fill:#4CAF50,stroke:#2E7D32,color:#fff
    style D6 fill:#4CAF50,stroke:#2E7D32,color:#fff

🎯 Quest Objectives

Workbench status (verified): Needs GitHub + Copilot for the full trial — especially the MCP seal and hosted agent runs. There is no honest local-only claim for the Grand Capstone; use the chapter mini-labs to rehearse patterns, then assemble in a real repository.

Six seals, six domains — break them all to claim the trial:

• Seal 1 (Domain 1 — Learn 15–20%): Implement agent-in-SDLC and define boundaries
• Seal 2 (Domain 2 — Learn 20–25%): Configure tools, permissions, MCP, environment integration
• Seal 3 (Domain 3 — Learn 10–15%): Implement memory strategy and context continuity
• Seal 4 (Domain 4 — Learn 15–20%): Evaluate agent performance and iterate on instructions
• Seal 5 (Domain 5 — Learn 15–20%): Build and manage a multi-agent system
• Seal 6 (Domain 6 — Learn 10–15%): Implement responsible autonomy, guardrails, and HITL

---

🏛️ The Grand Trial Scenario

The Scribe presents the scenario:

You are the lead AI engineer at a software team that has decided to adopt agentic AI development using GitHub. You have been given an empty repository, a GitHub account with Copilot, Actions, and Environments, and a mandate: build a working agentic SDLC in the next 6 hours and demonstrate competency in every domain.

The following 6 chapters map directly to the GH-600 exam domains.

🏰 A worked answer key exists. The IT-Journey repository itself implements every seal below — its AI fleet, kill switches, autonomy matrix, drift guard, and audit trails are mapped file-by-file in GH-600 in the Wild. Consult it when you are stuck, the way you would check a solved example — but the trial wants your build, in your repository.

---

⚔️ Seal 1: The Agentic SDLC (Domain 1 — Learn 15–20%)

Related quests: Q1 (SDLC Integration), Q2 (Plan vs Action), Q3 (Observability)

Challenge 1.1: Describe where agents live in your SDLC

Task: Document where in your software development lifecycle agents operate. Produce a diagram.

<!-- work/gh-600/capstone/sdlc-diagram.md -->
# Our Agentic SDLC

## Agent Integration Points

| Phase | Agent Role | Trigger | Human Touchpoint |
|---|---|---|---|
| Planning | Requirements analysis | Issue created | Human approves specification |
| Implementation | Code writing | `agent-implement` label | Human reviews PR |
| Review | Code review comments | PR opened | Human accepts/rejects suggestions |
| Testing | Test execution | PR opened | Human reviews failures |
| Deployment | Deploy staging | PR merged to main | Human approves production |

## Architecture Diagram
[Include Mermaid diagram here]

Challenge 1.2: Demonstrate planning vs. action separation

Task: Show a GitHub Actions workflow that separates the plan step from the execute step with a mandatory break between them. (The raw/endraw tags below are this site's Liquid escapes — drop them when you copy the YAML into your own .github/workflows/.)

{% raw %}

# .github/workflows/plan-then-execute.yml
name: Plan-Then-Execute (Sealed Capstone)

on:
  issues:
    types: [labeled]

jobs:
  plan:
    if: contains(github.event.label.name, 'agent-implement')
    runs-on: ubuntu-latest
    outputs:
      plan_approved: ${{ steps.plan.outputs.approved }}
    steps:
      - name: Generate plan
        id: plan
        run: |
          echo "Generating implementation plan..."
          # Agent generates plan here — does NOT execute
          echo "approved=pending" >> "$GITHUB_OUTPUT"

      - name: Post plan for approval
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.payload.issue.number,
              body: '**Agent Plan Generated** ✅\n\nReact with 👍 to approve execution, or 👎 to reject.\n\n_No changes have been made yet._'
            });

  execute:
    needs: plan
    runs-on: ubuntu-latest
    environment: agent-approval    # Human must approve in GitHub UI before this runs
    steps:
      - name: Execute approved plan
        run: echo "Executing plan after human approval..."

Challenge 1.3: Configure an observability workflow

Task: Ensure every agent run emits structured logs that can be queried.

Refer to Q3 (Observability & Control) for the full pattern.

---

⚔️ Seal 2: Tools, Permissions, and Environment (Domain 2 — Learn 20–25%)

Related quests: Q4 (Tool Selection), Q5 (MCP), Q6 (Dev Env), Q7 (Safe Execution)

Challenge 2.1: Configure a scoped GitHub token

Task: Set the minimum permissions needed for an implementation agent.

# In your workflow:
permissions:
  contents: write        # Write files to repository
  pull-requests: write   # Create and update PRs
  issues: write          # Comment on issues
  # Explicitly deny everything else:
  # actions: none (default)
  # security-events: none (default)

Challenge 2.2: Configure an MCP server

Task: Add a GitHub MCP server to Copilot and demonstrate its use.

// .vscode/mcp.json (workspace-level MCP configuration)
{
  "servers": {
    "github": {
      "command": "npx",
      "args": ["@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "${input:github-token}"
      }
    }
  }
}

Challenge 2.3: Document error handling and escalation

Task: Add a failure escalation workflow that creates an issue when an agent fails.

Refer to Q7 (Safe Execution & Error Handling) for the full pattern.

---

⚔️ Seal 3: Memory and Context (Domain 3 — Learn 10–15%)

Related quests: Q8 (Memory Strategies), Q9 (State Persistence), Q10 (Cross-tool Continuity)

Challenge 3.1: Implement all three memory tiers

Task: Create artifacts demonstrating ephemeral, session, and persistent memory.

## Memory Tier Implementation Checklist

- [ ] **Ephemeral**: Variables in workflow `env:` block used within a job
- [ ] **Session**: Artifact uploaded in step A, downloaded in step B
- [ ] **Persistent**: Repository file updated by agent, committed and pushed

Challenge 3.2: Implement drift detection

Task: Produce a drift check that compares current agent state to expected state.

Refer to Q9 (State Persistence & Drift) for detect_drift.py.

Challenge 3.3: Implement cross-surface context handoff

Task: Show a context-handoff.json passed between an issue → PR → branch context.

Refer to Q10 (State Continuity Cross-Tools) for the schema and inject_cross_surface_context.py.

---

⚔️ Seal 4: Evaluation and Performance (Domain 4 — Learn 15–20%)

Related quests: Q11 (Success Criteria), Q12 (Root Cause Analysis), Q13 (Behavior Tuning)

Challenge 4.1: Define machine-verifiable acceptance criteria

Task: Write 3 acceptance criteria for an agent task that can be verified programmatically.

// work/gh-600/capstone/acceptance-criteria.json
{
  "task": "Implement authentication feature",
  "criteria": [
    {
      "id": "AC-01",
      "description": "Unit tests pass",
      "signal": "ci-pass",
      "check_command": "gh run list --workflow=test.yml --branch=feature/auth --status=success --limit=1"
    },
    {
      "id": "AC-02",
      "description": "No new security vulnerabilities",
      "signal": "security-scan-pass",
      "check_command": "gh api /repos/{owner}/{repo}/code-scanning/alerts?state=open | jq 'length == 0'"
    },
    {
      "id": "AC-03",
      "description": "Code review approved",
      "signal": "pr-approved",
      "check_command": "gh pr view {pr_number} --json reviewDecision -q '.reviewDecision == \"APPROVED\"'"
    }
  ]
}

Challenge 4.2: Perform an RCA on a failed run

Task: Take a failed workflow run and produce a 5-Why RCA document.

Refer to Q12 (Failure Root Cause Analysis) for the full RCA template.

Challenge 4.3: Iterate on agent instructions

Task: Make one instruction change, measure the before/after difference.

Refer to Q13 (Behavior Tuning) for the instruction changelog template.

---

⚔️ Seal 5: Multi-Agent Systems (Domain 5 — Learn 15–20%)

Related quests: Q14 (Orchestration), Q15 (Observability), Q16 (Recovery), Q17 (Lifecycle)

Challenge 5.1: Design a 3-agent orchestration workflow

Task: Create a fan-out or chain orchestration with 3 sub-agents.

Refer to Q14 (Multi-Agent Orchestration Patterns) for the fan-out and chain patterns.

Challenge 5.2: Add tracing to the multi-agent run

Task: Each sub-agent emits a trace entry with a shared correlation ID.

Refer to Q15 (Multi-Agent Observability) for trace_writer.py.

Challenge 5.3: Add failure recovery to the orchestrator

Task: Orchestrator continues after one sub-agent fails and produces a recovery plan.

Refer to Q16 (Multi-Agent Failure Recovery) for recovery_coordinator.py.

Challenge 5.4: Register all agents in the agent registry

Task: Publish _data/agents.yml with all 3 agents registered.

Refer to Q17 (Multi-Agent Lifecycle Management) for the registry schema.

---

⚔️ Seal 6: Responsible Agentic AI (Domain 6 — Learn 10–15%)

Related quests: Q18 (Autonomy Levels), Q19 (Guardrails & HITL)

Challenge 6.1: Produce your autonomy matrix

Task: Complete _data/autonomy-matrix.yml with 5 task types at appropriate levels.

Refer to Q18 (Autonomy Levels Matrix) for the matrix schema.

Challenge 6.2: Implement 3 guardrails

Task: CODEOWNERS file-scope boundary, approval gate environment, forbidden actions list.

Refer to Q19 (Guardrails & Human-in-the-Loop) for each guardrail.

---

📋 Domain Coverage Rubric

Official exam weights are ranges from Microsoft Learn (GH-600 study guide — Skills at a glance). The campaign score columns are IT-Journey pedagogy only — not Microsoft point values. Official pass rule: a score of 700 or greater.

Domain	Learn weight (official)	Campaign seal (IT-Journey)	Notes
D1: Agentic SDLC	15–20%	Pass / Fail	Integrate agents; plan vs execute; observability
D2: Tools & Environment	20–25%	Pass / Fail	Tools, permissions, MCP, safe execution
D3: Memory & Context	10–15%	Pass / Fail	Memory strategy, persistence, drift
D4: Evaluation	15–20%	Pass / Fail	Signals, RCA, tune from evidence
D5: Multi-Agent	15–20%	Pass / Fail	Orchestration, observability, recovery
D6: Governance	10–15%	Pass / Fail	Autonomy levels, guardrails, HITL
Exam pass (official)	—	—	≥ 700 on the GH-600 (not a 70/100 campaign total)

---

🪞 The Grand Reflection

After completing all 6 seals, publish your reflection:

<!-- work/gh-600/capstone/grand-reflection.md -->
# Grand Reflection: Agentic Codex Trial

## What I Built
[Summary of the agentic system you designed and implemented]

## Most Challenging Domain
[Which domain was hardest and why?]

## Key Architectural Decision
[The most important decision you made and why]

## What I Would Do Differently
[Honest reflection on what could be improved]

## Exam Readiness Self-Assessment
[Domain-by-domain confidence rating 1-5]

## Resources I Would Review Again
[Links back to quests or docs that were most valuable]

---

✅ Capstone Validation

The trial ends the way every domain taught you to end: with a machine-verifiable verdict, not a feeling. Create this script in your capstone repository and make it pass — it checks that every seal left its artifact behind:

cat > validate-capstone.sh <<'EOF'
#!/usr/bin/env bash
# validate-capstone.sh — each seal must have left its artifact behind
set -uo pipefail
fails=0
seal() {  # description, test-command...
  local desc="$1"; shift
  if "$@" >/dev/null 2>&1; then echo "✅ $desc"
  else echo "❌ $desc"; fails=$((fails + 1)); fi
}

# Seal 1 — SDLC design + plan/act separation
seal "S1: SDLC diagram exists"            test -s work/gh-600/capstone/sdlc-diagram.md
seal "S1: plan-then-execute workflow"     grep -ql "environment:" .github/workflows/plan-then-execute.yml
# Seal 2 — tools, permissions, MCP
seal "S2: least-privilege permissions"    grep -ql "pull-requests: write" .github/workflows/plan-then-execute.yml
seal "S2: MCP server configured"          test -s .vscode/mcp.json
# Seal 3 — memory + drift
seal "S3: persistent memory committed"    sh -c 'git log --oneline -- .agent/memory/ | grep -q .'
seal "S3: drift guard present"            test -x scripts/drift-guard.sh
# Seal 4 — evaluation
seal "S4: acceptance criteria schema"     jq -e '.criteria | length >= 3' work/gh-600/capstone/acceptance-criteria.json
seal "S4: RCA document written"           grep -qil "5-why" forensics/*.md
# Seal 5 — multi-agent
seal "S5: agent registry (>= 3 agents)"   test "$(grep -c '^- name:' _data/agents.yml)" -ge 3
seal "S5: orchestration workflow"         grep -ql "needs:" .github/workflows/council-fanout.yml
# Seal 6 — governance
seal "S6: autonomy matrix"                test -s _data/autonomy-matrix.yml
seal "S6: CODEOWNERS boundary"            test -s .github/CODEOWNERS
seal "S6: forbidden actions in AGENTS.md" grep -qi "forbidden" AGENTS.md
# The reflection
seal "🪞 Grand reflection published"      test -s work/gh-600/capstone/grand-reflection.md

echo
[ "$fails" -eq 0 ] && echo "🏆 All seals hold — the trial is complete." \
                   || { echo "⚔️  $fails seal(s) unbroken — return to the domain and finish the work."; exit 1; }
EOF
chmod +x validate-capstone.sh && ./validate-capstone.sh

Adjust paths to match where your trial actually put each artifact — the script encodes the contract (every seal leaves evidence), not a sacred directory layout. A capstone whose validator passes on the first try was written after the artifacts; one that fails a few times first was written honestly.

---

🏆 The Agentic Codex — Complete Arc Links

Quest	Domain	Link
Q1	D1	Agentic SDLC Integration
Q2	D1	Plan vs Action Boundaries
Q3	D1	Observability & Control
Q4	D2	Tool Selection & Permissions
Q5	D2	MCP Server Mastery
Q6	D2	Dev Environment Integration
Q7	D2	Safe Execution & Error Handling
Q8	D3	Memory Strategies
Q9	D3	State Persistence & Drift
Q10	D3	State Continuity Cross-Tools
Q11	D4	Success Criteria & Signals
Q12	D4	Failure Root Cause Analysis
Q13	D4	Behavior Tuning
Q14	D5	Multi-Agent Orchestration Patterns
Q15	D5	Multi-Agent Observability
Q16	D5	Multi-Agent Failure Recovery
Q17	D5	Multi-Agent Lifecycle Management
Q18	D6	Autonomy Levels Matrix
Q19	D6	Guardrails & HITL
CAP	All	You are here

🏆 Capstone Rewards

Reward	Details
🏆 Agentic Codex Master Badge	Earned on full completion
🎓 GH-600 Ready Certificate	Published to your IT-Journey profile
200 XP	Arc total: 2,020 XP
Arc Complete	The Agentic Codex arc is sealed

The Codex Master speaks: "The seals are broken. The knowledge is yours. Go now and build systems worthy of the Codex."

🕸️ Knowledge Graph

Structured wiki-links connect this quest to the IT-Journey knowledge graph. Open the Obsidian Graph View to explore connections.

Level hub: [[Level 1100 - Data & Templates]] Overworld: [[🏰 Overworld - Master Quest Map]] Study track: [[The Agentic Codex: GH-600 Study Hub]] · [[GH-600 Agentic AI Quick-Reference Notes]] · [[GH-600 Skills Checklist]] Prerequisites: [[Initiation Rites: Embedding Agents in the SDLC]] · [[The Three Sigils: Plan, Reason, Act]] · [[The All-Seeing Eye: Observability & Control for Autonomous Agents]] · [[Forging the Agent's Arsenal: Tool Selection & Permissions]] · [[The MCP Conclave: Mastering Model Context Protocol Servers]] · [[Bind the Agent to the Realm: Dev Environment Integration]] · [[The Shield of Retries: Safe Execution and Error Handling]] · [[Vaults of Recollection: Agent Memory Strategies]] · [[Anchoring the Drifting Agent: State Persistence and Drift Prevention]] · [[Crossing the Tool Planes: State Continuity Across Tools]] · [[The Oracle's Rubric: Defining Agent Success Criteria and Signals]] · [[The Necromancer's Inquest: Agent Failure Root Cause Analysis]] · [[Reforging the Agent's Mind: Behavior Tuning Through Instructions]] · [[The Council of Many: Multi-Agent Orchestration Patterns]] · [[The Scribe's Codex: Observability in Multi-Agent Systems]] · [[When Familiars Fall: Multi-Agent Failure Recovery]] · [[The Agent Pantheon: Multi-Agent Lifecycle Management]] · [[The Autonomy Scales: Mapping Agent Autonomy Levels]] · [[The Warden's Pact: Guardrails and Human-in-the-Loop Patterns]] Obsidian docs: [[Obsidian Knowledge Graph and Wiki Links]]