AI Enablement Engagement

Session 1 — Discovery & Current-State Assessment (Detailed Agenda)

Total Duration: 2 hours (120 minutes)
Phase / Week: Phase 1, Week 1 — next session, target week of June 8, 2026
Format: Remote working session — live build + governance decisions
Required attendees: Ronnie (lead / architect), Steve (Nubitz — facilitating and driving Claude Code), Donnell (sponsor, optional)

Reframed after the kickoff. The pilot is the Citizen Developer Portal, a new build, and most current-state discovery was already captured in Session 0. This session pivots from interview to action: vet the feature set, scaffold the shell live with Claude Code (Max), and decide where governance is inserted as the code is written. Working title: Build the Shell & Wire In Governance.

Pre-session prep

Nubitz (Steve) brings

  • The feature list and governance insertion-point menu (below)
  • AI-tool recommendation one-pager: Claude Code + Max as the core agentic tool, and how it fills the gap Continue / Google AI Studio can't (orchestrating multiple agents), while staying VS Code-friendly
  • Claude Code (Max) ready on screen; a starter repo template (React + MUI / .NET Core / SQL + EF) to scaffold from

Turner brings / confirms

  • Claude licenses provisioned (Ronnie on Max; team on Pro)
  • Azure DevOps project for the new repo, with rights to create it
  • Google SSO (GCP) app-registration path for the new app
  • The sister product (existing React + .NET app) to use as the conventions reference and Session 3 exercise target
  • Ronnie present with decision authority; named second developer if applicable

Agenda

0:00 – 0:10 (10 min) — Re-anchor & frame

  • Lead: Nubitz
  • Format: Briefing
  • Confirm pilot = Citizen Developer Portal (a new build). Recap what the kickoff nailed (stack, governance culture, security, CI/CD, tools). State today's output: a running shell + governance decisions. Note we're consciously blending build and governance.

0:10 – 0:30 (20 min) — Vet the feature list

  • Lead: Joint — Ronnie reacts, Nubitz facilitates
  • Format: Discussion / decision
  • Walk the proposed features; cut, add, reprioritize. Resolve the Internal Developer Portal scope question (separate project vs. fold in the API catalog). Lock the first vertical slice — recommended: SSO + Proposal Intake + Status Board.

0:30 – 0:40 (10 min) — AI-tool recommendation & working agreement

  • Lead: Nubitz
  • Format: Walkthrough / decision
  • Land the tool recommendation. Confirm Claude Code + Max as the build tool and why. Agree how we'll use the agent today: plan-first, review every diff.

0:40 – 1:00 (20 min) — Start the build: scaffold the shell

  • Lead: Nubitz driving, Ronnie co-piloting
  • Format: Live build
  • With Claude Code: create the repo and author CLAUDE.md first (governance, narrated); scaffold the React + MUI front end, .NET Core API, and SQL + EF; wire Google SSO and one protected route. Narrate the agentic workflow throughout — planning, reviewing diffs, stopping on risky actions.

1:00 – 1:10 (10 min) — Break

1:10 – 1:40 (30 min) — Build the first slice + wire governance as we go

  • Lead: Nubitz driving, Ronnie deciding
  • Format: Live build + decisions
  • Continue to a runnable state (submit a proposal → see it on the board). As each stage appears, pause and decide governance with Ronnie, standing up the recommended starter set live where practical: pre-commit hooks (format / lint / secret scan); plan-first + diff-summary discipline; PR template + branch protection + required checks; one custom skill (the PBI/work-item writer recommended — see "Recommended First Skills" below). For anything not built today, mark it Now / Later / Skip.

1:40 – 1:50 (10 min) — Decisions log & backlog

  • Lead: Nubitz
  • Format: Synthesis
  • Capture governance decisions (what, where, why), the next slices/features, and what rolls into Sessions 3–6 (skills depth → S4, full DevOps pipeline → S5, speed-vs-risk → S6).

1:50 – 2:00 (10 min) — Wrap & next steps

  • Lead: Nubitz
  • Format: Synthesis
  • What Ronnie runs with before next time. Confirm the sister-product reference. Prep and date for Session 3.

Governance Insertion-Point Menu

The reference for the "wire governance as we go" blocks. ★ marks what we recommend implementing for the pilot; the rest are optional, listed so we decide deliberately. Many recommended items simply formalize what Turner already does.

A. AI context & guardrails (everywhere the agent runs)

  • ★ CLAUDE.md / AGENTS.md — encode the stack, naming/formatting, "never roll your own auth," "don't trust the client," and scalability rules so the agent follows them by default.
  • ★ Custom skills / slash commands — e.g. a back-end review checklist and a PBI/doc writer (the doc-writing pain).
  • ★ Agent tool/permission allowlist — dangerous actions (prod DB, new dependencies, migrations) stop and ask. Counters "everyone just clicks Accept."
  • MCP server scoping — restrict which external tools the agent can reach. Optional now.

B. Local dev

  • ★ Shared formatter + lint config — standardize Prettier + ESLint (incl. the React-hooks plugin) and an .editorconfig for back-end formatting; format on save.
  • ★ Pre-commit hooks — format, lint, secret scan, fast tests before a commit exists.
  • ★ Local secret scanning — gitleaks / Snyk Code in the hook; catches the "API key in code" case.
  • Demo-to-another-dev gate — keep Turner's existing rule as-is.

C. Agentic dev (while Claude builds)

  • ★ Plan-first / spec-before-build — agent produces a short plan/PBI the dev approves before editing.
  • ★ Diff-review discipline — agent summarizes its own diff and flags risky changes (auth, migrations, deps, large rewrites).
  • ★ Dependency-addition guardrail — new packages surfaced, human-approved, Snyk re-scans (the npm supply-chain anxiety).
  • ★ Scoped autonomy by area — looser on the front end, mandatory human review on back end / auth / data.

D. PR creation & review

  • ★ PR template — description, acceptance criteria, dev notes, testing + a risk checklist (auth? migrations? new deps? multi-server?).
  • ★ AI-generated PR description / changelog — drafted from the diff.
  • ★ AI code-review pass — automated first pass against the back-end checklist (DevOps-vs-GitHub tradeoff noted — decide in S5).
  • ★ Keep "can't approve your own PR" + ≥1 reviewer, and ★ required status checks (build, lint, tests, Snyk) before review.
  • Reviewer routing by area (CODEOWNERS) — optional as teams grow.

E. Merge / commit

  • ★ Branch protection on main/release — no direct pushes; checks must pass.
  • ★ Migration review gate — any EF migration triggers mandatory human SQL review + a check for destructive/locking patterns (the mid-table-column rebuild trap).
  • Conventional commit messages (optionally AI-generated) — optional.

F. CI/CD (Azure DevOps)

  • ★ Build pipeline gates — compile, lint, unit/"unigration" tests, Snyk, secret scan as required stages.
  • ★ Promotion model — keep promote-the-same-build (test → stage → prod) with checks at each gate.
  • ★ Self-hosted artifacts — keep private NuGet/npm in DevOps Artifacts; pin/verify versions.
  • Migration-safety step; AI-augmented pipeline steps — mostly Session 5 territory.

G. Deployment

  • ★ Change-request linkage — deploy requires an approved change request (the Monday process), linked to the release.
  • ★ Migrations-run policy by environment — test auto-migrates; stage mixed; prod never auto-migrates.
  • ★ Prod access separation — service-account deploys; humans don't touch prod DB directly.
  • ★ Network exposure policy — only prod public-facing, app-by-app; dev/stage on-network.
  • Post-deploy smoke test + documented rollback — recommended as the app matures.

Recommended First Skills to Build

Custom skills (governance point A) are reusable, encoded procedures Claude runs on demand. Start with the ones that hit Session 1's loudest pains and get used on every feature — build the top one or two live in this session; the rest become Session 4 (Context Management & Custom Skills) material.

1. PBI / work-item writer — build first

  • What it does: turns a rough description — or a just-built prototype/diff — into a structured work item in Turner's format (description, acceptance criteria, dev notes / perspectives, testing), and can emit the matching HTML doc or Azure DevOps work item.
  • Why: kills the bottleneck Ronnie named most — "it takes too much time to formally write all this down." Used on every feature; immediate, low-risk ROI.

2. Back-end PR review checklist

  • What it does: reviews a back-end diff against Ronnie's "ilities" — scalability (no pulling whole tables, watch inner loops), authentication and authorization done correctly, new dependencies, multi-server hazards (multiple instances on one DB, caching, multi-tab), and "what could break production" — then writes up findings.
  • Why: encodes senior review knowledge so juniors and the agent apply it by default; reinforces the "rigorous on the back end" model and counters "people stopped reading the diff." Used on every PR.

3. Feature-slice scaffolder

  • What it does: scaffolds a new vertical slice in Turner's conventions — React + MUI component, .NET Core endpoint, EF model/migration — wired the house way so output is consistent from the first commit.
  • Why: matches the "slop out a prototype fast" workflow and keeps AI output on-convention while standing up a brand-new product. Most useful during this build and the capstone.

Next candidates (Session 4)

  • EF migration safety reviewer — flags destructive/locking migrations and multi-instance startup hazards (the 11-hour-deploy and mid-table-column rebuild scars) and routes them to manual SQL review.
  • Dependency / Snyk triage helper — on a new package or Snyk finding, separates real risk from known false positives (e.g. prototype pollution where no JS runs server-side) and drafts the exception rationale.
  • Documentation generator — writes and updates library and feature docs from the code, in the HTML-in-repo convention (a sibling of the PBI writer).

Talking points to land

  • CLAUDE.md is governance — the context file shapes everything the agent writes.
  • Make the dangerous things stop and ask — allowlists + plan-first answer the "everyone clicks Accept" worry without slowing the front-end work.
  • Front-end vs. back-end trust maps onto agent autonomy — loose on the front, rigorous on the back.
  • Most recommended gates just formalize what Turner already does — low friction to adopt.
  • AI kills the documentation bottleneck — PR descriptions, PBIs, plans.

Open questions to resolve

  • Internal Developer Portal — separate project, or fold any of it in now?
  • Repo home: Azure DevOps (keep) — add a GitHub mirror later for richer AI PR automations? (Revisit in S5.)
  • Sister product for Session 3 exercises — which existing app?
  • Named developer(s) beyond Ronnie who attend consistently
  • Mendix integration boundary — link-out only to start?
  • First skill to build live — recommended order: PBI/work-item writer → back-end review → feature-slice scaffolder (see "Recommended First Skills" above); confirm Ronnie's first pick.

What Nubitz produces after this session

  • The pilot's starter repo with CLAUDE.md and the agreed governance assets committed
  • A decisions log of governance insertion points (in / deferred / skipped)
  • Updated draft agendas for Sessions 3–6, tuned to the now-concrete pilot

Risks to manage

  • Scope creep on the feature vet: the feature discussion eats the build time. Time-box to 20 min and default to the recommended first slice if the room stalls.
  • Environment not ready: Claude licenses, repo location, or Google SSO registration not in place blocks the live build. Confirm all three in prep, not at 0:40.
  • Governance theater: deciding gates we never wire up. Stand up the starter set live so at least a few are real in the repo by end of session.