Agentic Software Engineering in Go: Case Study

The Problem: The Specification-to-Production Gap

Most teams can write a specification, and some can verify agent-generated code. But very few can take a specification from concept to production without the “spec-to-production gap” causing failures.

The gap manifests as:

The result: Teams give up on agentic systems, returning to manual development, or worse, deploy agent-generated code with unseen issues.

The Case Study: User Authentication Service

We’ll walk through a complete end-to-end case study: implementing a user authentication service from specification to production deployment using the Agentic Software Engineering patterns from this series.

Phase 1: Specification

# specs/auth-service.yaml
id: "auth-service-001"
version: "1.0"
title: "User Authentication Service"
description: "Production-ready authentication service with JWT, refresh tokens, and session management"
intent:
  goal: "Implement a complete authentication service that supports user registration, login, token refresh, and logout with production-grade security"
  context: "Go 1.23+, PostgreSQL, JWT, OAuth2 refresh token flow"
  success_criteria:
    - "Registration endpoint creates user with hashed password"
    - "Login endpoint validates credentials and issues JWT"
    - "Refresh token endpoint issues new access token"
    - "Logout endpoint invalidates refresh tokens"
    - "All passwords hashed with bcrypt at minimum 12 rounds"
    - "JWT tokens signed with HMAC-SHA256"
    - "Refresh tokens stored with rotation and revocation"
    - "API documents with OpenAPI 3.0 specification"
  anti_goals:
    - "No plain text password storage"
    - "No SQL injection vulnerabilities"
    - "No hardcoded secrets or credentials"
    - "No session fixation vulnerabilities"
    - "No password reuse across systems"
constraints:
  - id: "c1"
    type: "must"
    description: "All passwords MUST be hashed with bcrypt and minimum 12 rounds"
    validator: "code must use github.com/dgrijalva/jwt-go v5.x"
  - id: "c2"
    type: "must_not"
    description: "API MUST NOT accept passwords shorter than 8 characters"
    validator: "input validation middleware"
  - id: "c3"
    type: "must"
    description: "All JWT tokens MUST have expiration (exp claim)"
    validator: "middleware validation"
  - id: "c4"
    type: "must_not"
    description: "Refresh tokens MUST be rotated on each use and invalidated after single use"
    validator: "token management middleware"
inputs:
  registration:
    type: "object"
    description: "User registration payload"
    required: ["email", "password", "name"]
    properties:
      email:
        type: "string"
        format: "email"
        description: "User's email address"
      password:
        type: "string"
        minLength: 8
        description: "User's password"
      name:
        type: "string"
        description: "User's full name"
  login:
    type: "object"
    description: "Login payload"
    required: ["email", "password"]
    properties:
      email:
        type: "string"
        format: "email"
        description: "User's email address"
      password:
        type: "string"
        description: "User's password"
  refresh:
    type: "object"
    description: "Refresh token payload"
    required: ["refresh_token"]
    properties:
      refresh_token:
        type: "string"
        description: "Existing refresh token"
outputs:
  registration_response:
    type: "object"
    description: "Registration response"
    properties:
      user_id:
        type: "string"
        description: "Generated user ID"
      email:
        type: "string"
        format: "email"
        description: "Registered email"
      access_token:
        type: "string"
        description: "JWT access token"
      refresh_token:
        type: "string"
        description: "Refresh token"
  login_response:
    type: "object"
    description: "Login response"
    properties:
      access_token:
        type: "string"
        description: "JWT access token"
      token_type:
        type: "string"
        default: "Bearer"
      expires_in:
        type: "integer"
        description: "Token expiration in seconds"
  refresh_response:
    type: "object"
    description: "Refresh response"
    properties:
      access_token:
        type: "string"
        description: "New access token"
      refresh_token:
        type: "string"
        description: "New refresh token"
steps:
  - id: "s1"
    name: "Set Up Project Structure"
    description: "Initialize Go module, directory structure, and configuration"
    tool: "go mod init && mkdir -p internal/{auth,db,config}"
    depends_on: []
    validation: "Project structure created and go mod tidy successful"
  - id: "s2"
    name: "Implement User Repository"
    description: "Implement database operations for user management"
    tool: "go generate repository"
    depends_on: ["s1"]
    validation: "Repository compiles, passes go vet, implements UserRepository interface"
  - id: "s3"
    name: "Implement Authentication Service"
    description: "Implement JWT creation, validation, and refresh token management"
    tool: "go generate service"
    depends_on: ["s2"]
    validation: "Service compiles, JWT creation/validation tests pass"
  - id: "s4"
    name: "Implement API Handlers"
    description: "Implement HTTP handlers for all authentication endpoints"
    tool: "go generate handlers"
    depends_on: ["s3"]
    validation: "All handlers compile, input validation middleware works"
  - id: "s5"
    name: "Implement OpenAPI Documentation"
    description: "Generate OpenAPI 3.0 specification from code annotations"
    tool: "go generate docs"
    depends_on: ["s4"]
    validation: "OpenAPI spec validates against schema, documents all endpoints"
  - id: "s6"
    name: "Run Comprehensive Verification"
    description: "Run full verification suite: build, test, lint, constraints"
    tool: "asf verify && asf harness run auth-service-001"
    depends_on: ["s5"]
    validation: "All verification phases pass, no constraint violations"

generated_prompt: |
  You are a Go agent tasked with implementing a production-grade user authentication service.
  Follow the specification constraints above.
  Generate code step by step, validating each step before proceeding.
  All code must be production-ready, secure, and properly tested.
  Use Go 1.23+ features and idioms.
  Follow team coding conventions and ADRs.

Phase 2: Harness Execution

# Execute the complete harness
ctx := context.Background()
h := harness.NewCompleteHarness(".")

result, err := h.Execute(ctx, "auth-service-001")
if err != nil {
    fmt.Printf("Harness error: %v\n", err)
    os.Exit(1)
}

if result.Success {
    fmt.Printf("✓ Harness completed successfully for auth-service-001\n")
    fmt.Printf("  Duration: %v\n", result.TotalDuration)
    fmt.Printf("  Retries: %d\n", result.RetryCount)
    fmt.Printf("  Context Items: %d\n", len(result.ContextItems))
} else {
    fmt.Printf("✗ Harness failed after %d retries\n", result.RetryCount)
    fmt.Println("Final output:", result.FinalOutput)
    if result.AgentFeedback != "" {
        fmt.Println("--- Agent Feedback ---")
        fmt.Println(result.AgentFeedback[:1000])
    }
    os.Exit(1)
}

Phase 2 Output

✓ Harness completed successfully for auth-service-001
  Duration: 45.2s
  Retries: 1
  Context Items Loaded: 12

 --- Context Items ---
  3 ADRs (priority: 100)
  4 Specifications (priority: 90)
  5 Code files (priority: 50)

 --- Generated Agent Prompt ---
 [1200 characters of specification-driven prompt]

 --- Verification Results ---
 Build: ✓ Passed
 Tests: ✓ 27 passed
 Lint: ✓ Clean (0 issues)
 Constraints: ✓ All 4 constraints met

 --- Harness Complete ---

Phase 3: Production Hardening

# Production hardening steps
func hardenAuthService(workingDir string) {
    # 1. Add security middleware
    # 2. Configure rate limiting
    # Add CORS configuration
    # Add request ID middleware
    # Add structured logging
    # Configure error boundaries
    # Set up monitoring and alerting

    # Run final verification
    verifier := verify.NewVerificationEngine(workingDir)
    ctx := context.Background()
    result, _ := verifier.RunVerification(ctx, "")

    if result.Success {
        fmt.Println("✓ Production hardening complete")
        fmt.Println("  All verification passed")
    } else {
        fmt.Printf("✗ Hardening verification failed: %d errors\n", len(result.Errors))
    }
}

Phase 4: MCP API Exposure

# Expose factory as MCP server for programmatic access
mcpServer := mcp.NewMCPServer(factoryOrchestrator, factoryDef)

go func() {
    log.Fatal(mcpServer.Start(":8080"))
}()

# Now the factory is accessible via MCP:
# List specifications
mcp call resources/list_specs

# Submit a task
mcp call submit_task '{"type": "generate", "spec_id": "auth-service-001"}'

# Get task result
mcp call get_task_result '{"task_id": "task-123"}'

# Check factory status
mcp call get_factory_status

Phase 5: Production Deployment

# Build production binary
go build -o auth-service .

# Run with production configuration
./auth-service \\
    --config production.yaml \\
    --mcp-port 8080 \\
    --observability-enabled

# Deploy to production environment
# Docker:
docker build -t auth-service:latest .
docker run -d \\
    -p 8080:8080 \\
    -e DATABASE_URL=postgresql://user:pass@db:5432/auth \\
    -e JWT_SECRET=production-secret-key \\
    -e REFRESH_TOKEN_SECRET=refresh-production-secret \\
    auth-service:latest

# Or Kubernetes:
kubectl apply -f auth-service-deployment.yaml
kubectl apply -f auth-service-service.yaml

Production Checklist

# Production Checklist for Authentication Service

## Security
- [ ] HTTPS terminated at load balancer
- [ ] JWT secrets rotated regularly
- [ ] Refresh tokens have short TTL (15min access, 30-day refresh)
- [ ] Rate limiting enabled (100req/min per IP)
- [ ] CORS configured for production origins only
- [ ] Security headers (HSTS, CSP, X-Frame-Options)
- [ ] Secrets managed via vault, not in code

## Reliability
- [ ] Health endpoint at /health (k8s readiness/liveness probes)
- [ ] Graceful shutdown implemented
- [ ] Connection pooling configured
- [ ] Database connection retry logic
- [ ] Circuit breaker for external dependencies

## Observability
- [ ] Structured JSON logging
- [ ] Metrics endpoint at /metrics
- [ ] Trace IDs propagated through chain
- [ ] Error reporting to monitoring service
- [ ] Audit log of authentication events

## Compliance
- [ ] Password hashing with bcrypt (min 12 rounds)
- [ ] JWT signed with HMAC-SHA256
- [ ] Refresh token rotation and revocation
- [ ] GDPR-compliant data handling
- [ ] Session management best practices

## Documentation
- [ ] OpenAPI 3.0 specification generated and published
- [ ] API documentation site deployed
- [ ] Usage analytics collected
- [ ] Onboarding documentation for developers

Case Study Summary

Total: ~3 days from specification to production deployment

Case Study Metrics

Case Study: What Went Well

Case Study: What Could Be Improved

Lessons Learned

What If We Hadn’t Used This Series?

What If We Had Used a Different Approach?

What’s Next

This case study demonstrates that Agentic Software Engineering in Go is practical and production-ready. The complete 12-part series provides:

Getting Started

# 1. Initialize your project
asf init

# 2. Write your first specification
asf spec template specs/your-feature.yaml

# 3. Validate and generate
asf spec validate your-feature
asf spec generate your-feature

# 4. Run verification
asf verify

# 5. Run the complete harness
asf harness run your-feature

# 6. Submit to factory
asf factory submit generate your-feature

# 7. Monitor and improve
asf factory status
asf factory improve

# 8. Deploy to production
# (Follow the case study pattern)

The future of software development is agentic, but only when built on engineering discipline. This series provides the roadmap. Start your journey today.

All code examples are in Go 1.23+. Diagrams use white-background Archify for presentation-ready architecture visualizations.