What actually changes, and why.
A run answers three independent questions, and the answers compose rather than multiply. Two of them usually stay at their default, and a default has no pack at all — a missing directory IS the null value, so there is nothing empty to maintain. Twelve combinations exist and ten are runnable; the two invalid ones are refused by name at resolution time rather than discovered halfway through a build.
What are you building on?
Where does the specification come from?
Who is operating the run?
What each dial actually does to the run.
Same thing, concretely. Step one is the engine with every dial at its default; each step after it turns exactly one dial and marks what that dimension added, replaced or dropped. The restrictions are the interesting part — the platform owns the beginning and the end and never the build span, the method is the only dimension permitted to remove a stage, and the audience adds and removes nothing at all.
coreThe engine, with every pack at its default
No platform, greenfield, developer. Eight stages, five operator gates and a delivery loop that runs per tranche. This is what is left when the domain has been taken out of it — and proving it still runs clean is the test that the domain really left.
/create-prd/architect/design/task-breakdown/implement/code-review/test/ship+ platform: content-sdkSix stages appear, and the release step changes meaning
The platform is what you build ON, so it owns the beginning and the end: read the content model before designing against it, stand the cloud up before building, and — because authoring happens against preview — put the whole content phase after ship, with one operator-confirmed publish as the only thing that goes live.
/discover-sitecoreairead the real content model first/create-prd/architect/design/task-breakdown/provision-sitecoreaiCM + editing host, idempotent/implement/code-review/test/shipcode only, deployed against preview/discover-componentsa visual map for the author/author-contentcopy and imagery into the tenant/test-contentan independent content audit/publishthe only step that goes live+ method: cloneThe spec stops being written and starts being measured
The method is where the specification comes FROM. Point it at a public site and the crawl replaces the interrogation outright — eleven questions, none of them greenfield. Design has nothing to diverge from, so it collapses into a parity phase, and "done" becomes a score per page per viewport instead of a feature list.
/source-analysisthe crawl becomes the blueprint/create-prdthe greenfield questions are dropped/architect/designthe source site IS the designparity loopbounded, with its own stop reason/task-breakdown/implement/code-review/test+ a 4-criterion parity matrix/ship+ audience: marketerThe same spine, a different conversation
Additive only — this dimension may never override a stage body, and a validator enforces that rather than a convention. Nothing is added or removed from the flow. What changes is what reaches the operator: a brief instead of a PRD, plain-language questions, technical answers derived instead of asked, and five dials preset so none of them ever gets surfaced.
/create-prda brief, and 7 plain questions/architect/design/task-breakdown/implement/code-review/testhuman half + a blocking machine half/shipnothing technical surfaced
+ added · ⇄ replaced · − dropped · everything unmarked is the same stage the engine already ran.
The standard flow, and the Sitecore branch.
Every project rides the same governed pipeline. Think of it as two transit routes that share their stations: the Standard line runs on every project, and the Content SDK line stops everywhere the Standard line does — then makes five extra Sitecore stops, to discover the model, provision the cloud, map the components, author the content, and publish it live.
/discover-sitecoreai/provision-sitecoreai/discover-componentsNEW/author-content/publishNEWSeven exports, generated from one engine.
Of the ten runnable compositions, seven are published as self-contained flow repos. An export is a composition, not a copy: the closure walks the dependency graph that already exists, so there is no hand-maintained file list to go stale, and the README, the command set and the docs are projected rather than subset-copied. Generated, never forked — a forked public repo would put the engine in two places and hand the sync problem straight back. Skills ship vendored, so a consumer clones one repo and has everything with no install step. And each export is correct only if the framework validator passes inside it, which is how a missed file surfaces as an unresolvable reference instead of a quietly broken flow.
Eleven skills that earn their keep.
These aren't a wishlist — they're the eleven my agents reach for most, out of 67 published across eight clusters. Ranked by how often they actually get pulled into real runs; the never-loaded ones are pruned on purpose. Each was distilled from a session — a trap I hit, a pattern worth keeping — and auto-surfaces by description match. An agent invokes one by bare name, so a reference never depends on how the skill happens to be packaged. Which ones earn their keep is measured, not guessed.
67 skills, eight clusters.
The eleven above are the ones that get loaded. Behind them sits the rest of the library, grouped by the surface it covers — because nobody needs all of it. A project installs only the clusters it actually builds on, and a name tells you which plugin it ships in: a skill is named <cluster>-<skill>, so the prefix is the packaging. That naming is deliberate — provenance used to be encoded twice, in the folder name and in the frontmatter, which meant it could drift.
Three audits, and each one can fail.
Every tranche exits through the same three scripts. They are read-only, need no tenant auth and no network, and each exits 1 on an unwaived defect — so a green run is a claim the build has to earn rather than a default. Deliberate exceptions are declared as waivers carrying their own mandatory reason; anything undeclared still fails.
The wins that paid for themselves.
Each of these turned a half-day debug session into a one-line rule the agents now follow — encoded as a skill or an always-on rule, and where possible enforced by one of the audits above. They are not aspirations; they are the operating playbook. Note the shape the newest ones share: every single one of them passed every gate that existed at the time. A page returning 200 while telling crawlers to go away, a dead link resolving to the homepage, a route form that only breaks once it is live — none of those look like failures from the inside, which is exactly why they cost what they cost.
The honest roadmap.
What's next, and what's deliberately deferred. Multilingual, fully autonomous runs, and a lot of testing and optimization are the forward bets; personalization and forms wait for a real project to ask. None of it is hidden.
Want a Content SDK head app built this way?
The flow has now taken a full brand site all the way to a published, live head app on a real tenant, and is being hardened run over run. If you have a head-app project on the horizon and want to be the next dogfood case, reach out.