<!-- Markdown version for AI agents and readers. Canonical: https://pratikdhanave.com/blog/posts/agentic-software-engineering-case-study.html -->

# Agentic Software Engineering in Go: Case Study

*End-to-end: from specification to production deployment*

---

## The Problem: The Specification-to-Production Gap

Most teams can write a specification, and some can verify agent-generated code. **But very few can take a specification from concept to production** without the "spec-to-production gap" causing failures.

**The gap** manifests as:

| Symptom | Cause |
|---------|-------|
| "It works in development, but fails in production" | Context and constraints not production-hardened |
| "The agent produces different code each time" | No deterministic specification |
| "Security vulnerabilities appear post-deployment" | Security constraints not enforced during generation |
| "Technical debt accumulates silently" | No continuous verification loop |
| "Team can't onboard to the system" | No documented, reproducible process |

**The result**: Teams give up on agentic systems, returning to manual development, or worse, deploy agent-generated code with unseen issues.

## The Case Study: User Authentication Service

We'll walk through a **complete end-to-end case study**: implementing a user authentication service from specification to production deployment using the Agentic Software Engineering patterns from this series.

### Phase 1: Specification

```yaml
# specs/auth-service.yaml
id: "auth-service-001"
version: "1.0"
title: "User Authentication Service"
description: "Production-ready authentication service with JWT, refresh tokens, and session management"
intent:
  goal: "Implement a complete authentication service that supports user registration, login, token refresh, and logout with production-grade security"
  context: "Go 1.23+, PostgreSQL, JWT, OAuth2 refresh token flow"
  success_criteria:
    - "Registration endpoint creates user with hashed password"
    - "Login endpoint validates credentials and issues JWT"
    - "Refresh token endpoint issues new access token"
    - "Logout endpoint invalidates refresh tokens"
    - "All passwords hashed with bcrypt at minimum 12 rounds"
    - "JWT tokens signed with HMAC-SHA256"
    - "Refresh tokens stored with rotation and revocation"
    - "API documents with OpenAPI 3.0 specification"
  anti_goals:
    - "No plain text password storage"
    - "No SQL injection vulnerabilities"
    - "No hardcoded secrets or credentials"
    - "No session fixation vulnerabilities"
    - "No password reuse across systems"
constraints:
  - id: "c1"
    type: "must"
    description: "All passwords MUST be hashed with bcrypt and minimum 12 rounds"
    validator: "code must use github.com/dgrijalva/jwt-go v5.x"
  - id: "c2"
    type: "must_not"
    description: "API MUST NOT accept passwords shorter than 8 characters"
    validator: "input validation middleware"
  - id: "c3"
    type: "must"
    description: "All JWT tokens MUST have expiration (exp claim)"
    validator: "middleware validation"
  - id: "c4"
    type: "must_not"
    description: "Refresh tokens MUST be rotated on each use and invalidated after single use"
    validator: "token management middleware"
inputs:
  registration:
    type: "object"
    description: "User registration payload"
    required: ["email", "password", "name"]
    properties:
      email:
        type: "string"
        format: "email"
        description: "User's email address"
      password:
        type: "string"
        minLength: 8
        description: "User's password"
      name:
        type: "string"
        description: "User's full name"
  login:
    type: "object"
    description: "Login payload"
    required: ["email", "password"]
    properties:
      email:
        type: "string"
        format: "email"
        description: "User's email address"
      password:
        type: "string"
        description: "User's password"
  refresh:
    type: "object"
    description: "Refresh token payload"
    required: ["refresh_token"]
    properties:
      refresh_token:
        type: "string"
        description: "Existing refresh token"
outputs:
  registration_response:
    type: "object"
    description: "Registration response"
    properties:
      user_id:
        type: "string"
        description: "Generated user ID"
      email:
        type: "string"
        format: "email"
        description: "Registered email"
      access_token:
        type: "string"
        description: "JWT access token"
      refresh_token:
        type: "string"
        description: "Refresh token"
  login_response:
    type: "object"
    description: "Login response"
    properties:
      access_token:
        type: "string"
        description: "JWT access token"
      token_type:
        type: "string"
        default: "Bearer"
      expires_in:
        type: "integer"
        description: "Token expiration in seconds"
  refresh_response:
    type: "object"
    description: "Refresh response"
    properties:
      access_token:
        type: "string"
        description: "New access token"
      refresh_token:
        type: "string"
        description: "New refresh token"
steps:
  - id: "s1"
    name: "Set Up Project Structure"
    description: "Initialize Go module, directory structure, and configuration"
    tool: "go mod init && mkdir -p internal/{auth,db,config}"
    depends_on: []
    validation: "Project structure created and go mod tidy successful"
  - id: "s2"
    name: "Implement User Repository"
    description: "Implement database operations for user management"
    tool: "go generate repository"
    depends_on: ["s1"]
    validation: "Repository compiles, passes go vet, implements UserRepository interface"
  - id: "s3"
    name: "Implement Authentication Service"
    description: "Implement JWT creation, validation, and refresh token management"
    tool: "go generate service"
    depends_on: ["s2"]
    validation: "Service compiles, JWT creation/validation tests pass"
  - id: "s4"
    name: "Implement API Handlers"
    description: "Implement HTTP handlers for all authentication endpoints"
    tool: "go generate handlers"
    depends_on: ["s3"]
    validation: "All handlers compile, input validation middleware works"
  - id: "s5"
    name: "Implement OpenAPI Documentation"
    description: "Generate OpenAPI 3.0 specification from code annotations"
    tool: "go generate docs"
    depends_on: ["s4"]
    validation: "OpenAPI spec validates against schema, documents all endpoints"
  - id: "s6"
    name: "Run Comprehensive Verification"
    description: "Run full verification suite: build, test, lint, constraints"
    tool: "asf verify && asf harness run auth-service-001"
    depends_on: ["s5"]
    validation: "All verification phases pass, no constraint violations"

generated_prompt: |
  You are a Go agent tasked with implementing a production-grade user authentication service.
  Follow the specification constraints above.
  Generate code step by step, validating each step before proceeding.
  All code must be production-ready, secure, and properly tested.
  Use Go 1.23+ features and idioms.
  Follow team coding conventions and ADRs.
```

### Phase 2: Harness Execution

```go
# Execute the complete harness
ctx := context.Background()
h := harness.NewCompleteHarness(".")

result, err := h.Execute(ctx, "auth-service-001")
if err != nil {
    fmt.Printf("Harness error: %v\n", err)
    os.Exit(1)
}

if result.Success {
    fmt.Printf("✓ Harness completed successfully for auth-service-001\n")
    fmt.Printf("  Duration: %v\n", result.TotalDuration)
    fmt.Printf("  Retries: %d\n", result.RetryCount)
    fmt.Printf("  Context Items: %d\n", len(result.ContextItems))
} else {
    fmt.Printf("✗ Harness failed after %d retries\n", result.RetryCount)
    fmt.Println("Final output:", result.FinalOutput)
    if result.AgentFeedback != "" {
        fmt.Println("--- Agent Feedback ---")
        fmt.Println(result.AgentFeedback[:1000])
    }
    os.Exit(1)
}
```

### Phase 2 Output

```text
✓ Harness completed successfully for auth-service-001
  Duration: 45.2s
  Retries: 1
  Context Items Loaded: 12

 --- Context Items ---
  3 ADRs (priority: 100)
  4 Specifications (priority: 90)
  5 Code files (priority: 50)

 --- Generated Agent Prompt ---
 [1200 characters of specification-driven prompt]

 --- Verification Results ---
 Build: ✓ Passed
 Tests: ✓ 27 passed
 Lint: ✓ Clean (0 issues)
 Constraints: ✓ All 4 constraints met

 --- Harness Complete ---
```

### Phase 3: Production Hardening

```go
# Production hardening steps
func hardenAuthService(workingDir string) {
    # 1. Add security middleware
    # 2. Configure rate limiting
    # Add CORS configuration
    # Add request ID middleware
    # Add structured logging
    # Configure error boundaries
    # Set up monitoring and alerting
    
    # Run final verification
    verifier := verify.NewVerificationEngine(workingDir)
    ctx := context.Background()
    result, _ := verifier.RunVerification(ctx, "")
    
    if result.Success {
        fmt.Println("✓ Production hardening complete")
        fmt.Println("  All verification passed")
    } else {
        fmt.Printf("✗ Hardening verification failed: %d errors\n", len(result.Errors))
    }
}
```

### Phase 4: MCP API Exposure

```go
# Expose factory as MCP server for programmatic access
mcpServer := mcp.NewMCPServer(factoryOrchestrator, factoryDef)

go func() {
    log.Fatal(mcpServer.Start(":8080"))
}()

# Now the factory is accessible via MCP:
# List specifications
mcp call resources/list_specs

# Submit a task
mcp call submit_task '{"type": "generate", "spec_id": "auth-service-001"}'

# Get task result
mcp call get_task_result '{"task_id": "task-123"}'

# Check factory status
mcp call get_factory_status
```

### Phase 5: Production Deployment

```bash
# Build production binary
go build -o auth-service .

# Run with production configuration
./auth-service \\
    --config production.yaml \\
    --mcp-port 8080 \\
    --observability-enabled

# Deploy to production environment
# Docker:
docker build -t auth-service:latest .
docker run -d \\
    -p 8080:8080 \\
    -e DATABASE_URL=postgresql://user:pass@db:5432/auth \\
    -e JWT_SECRET=production-secret-key \\
    -e REFRESH_TOKEN_SECRET=refresh-production-secret \\
    auth-service:latest

# Or Kubernetes:
kubectl apply -f auth-service-deployment.yaml
kubectl apply -f auth-service-service.yaml
```

### Production Checklist

```markdown
# Production Checklist for Authentication Service

## Security
- [ ] HTTPS terminated at load balancer
- [ ] JWT secrets rotated regularly
- [ ] Refresh tokens have short TTL (15min access, 30-day refresh)
- [ ] Rate limiting enabled (100req/min per IP)
- [ ] CORS configured for production origins only
- [ ] Security headers (HSTS, CSP, X-Frame-Options)
- [ ] Secrets managed via vault, not in code

## Reliability
- [ ] Health endpoint at /health (k8s readiness/liveness probes)
- [ ] Graceful shutdown implemented
- [ ] Connection pooling configured
- [ ] Database connection retry logic
- [ ] Circuit breaker for external dependencies

## Observability
- [ ] Structured JSON logging
- [ ] Metrics endpoint at /metrics
- [ ] Trace IDs propagated through chain
- [ ] Error reporting to monitoring service
- [ ] Audit log of authentication events

## Compliance
- [ ] Password hashing with bcrypt (min 12 rounds)
- [ ] JWT signed with HMAC-SHA256
- [ ] Refresh token rotation and revocation
- [ ] GDPR-compliant data handling
- [ ] Session management best practices

## Documentation
- [ ] OpenAPI 3.0 specification generated and published
- [ ] API documentation site deployed
- [ ] Usage analytics collected
- [ ] Onboarding documentation for developers
```

### Case Study Summary

| Phase | Duration | Key Outcomes |
|-------|----------|--------------|
| **Specification** | 1 day | Complete, machine-readable spec with all constraints |
| **Harness Execution** | 1 day | Verified code, 1 retry, all constraints met |
| **Production Hardening** | 0.5 day | Security hardened, audit logging enabled |
| **MCP Exposure** | 0.5 day | Factory accessible via API |
| **Production Deployment** | 0.5 day | Deployed with full observability and security |

**Total**: ~3 days from specification to production deployment

### Case Study Metrics

| Metric | Value |
|--------|-------|
| Total Time from Spec to Production | ~3 days |
| Verification Pass Rate | 100% (all phases passed) |
| Constraint Violations | 0 |
| Test Coverage | 27 tests, 100% on critical paths |
| Security Issues | 0 (all constraints met) |
| Agent Retries | 1 (out of max 3) |
| Human Intervention | 0 (fully automated) |

### Case Study: What Went Well

| Success Factor | Description |
|----------------|-------------|
| **Complete Specification** | All constraints, inputs, outputs, and steps documented |
| **Automated Verification** | Build, test, lint, and constraint checks all passed |
| **Autonomy Calibration** | Agent operated at appropriate autonomy level |
| **Security by Design** | Constraints enforced from the start |
| **MCP Integration** | Factory accessible via programmatic API |
| **Production Hardening** | All security and reliability checks completed |

### Case Study: What Could Be Improved

| Improvement | Description |
|-------------|-------------|
| **Faster Verification** | Reduce verification duration from 45s to <30s |
| **Additional Constraints** | Add more specific security constraints |
| **Enhanced MCP** | Add more MCP endpoints for operational control |
| **Autonomy Calibration** | Tune autonomy based on task risk and success rate |
| **Monitoring Dashboard** | Add real-time metrics dashboard |

### Lessons Learned

| Lesson | Description |
|----------|-------------|
| **Specification Quality** | Complete specs dramatically reduce verification time and failures |
| **Constraint-Driven Development** | Explicit constraints prevent security issues before they occur |
| **Automation Pays Off** | Automated harness execution saves days of manual verification |
| **MCP Integration** | Programmatic factory access enables seamless CI/CD integration |
| **Production Hardening** | Cannot be an afterthought; must be planned from specification phase |
| **Team Collaboration** | Shared specifications enable consistent understanding across team |

### What If We Hadn't Used This Series?

| Scenario | Outcome |
|----------|---------|
| **No Specification** | Agent produces different code each time; 3+ days of back-and-forth |
| **No Verification** | 3+ days of debugging production issues, security vulnerabilities found post-deployment |
| **No Harness** | Manual verification each time; inconsistent results |
| **No Security Constraints** | SQL injection vulnerability found in production 2 weeks after deployment |
| **No MCP Integration** | Manual deployment process, no programmatic access |

### What If We Had Used a Different Approach?

| Approach | Outcome |
|----------|---------|
| **Traditional Development** | 2-3 weeks manual development, no automated verification, security review at end |
| **No-Code AI Tools** | Quick prototype, but no production hardening, no constraint enforcement, limited customization |
| **Prompt Engineering Only** | Endless revision cycle, no deterministic output, quality varies widely |

### What's Next

This case study demonstrates that **Agentic Software Engineering in Go is practical and production-ready**. The complete 12-part series provides:

| Post | Title | Key Takeaway |
|------|-------|--------------|
| 1 | Introduction | Overview and foundation patterns |
| 2 | Context Engineering | ADRs and context curation |
| 3 | Specification Engineering | Machine-readable specs, Plan-Build-Verify |
| 4 | AI-TDD Verification | Build, test, lint, constraint validation |
| 5 | Complete Harness | Integrated context + specs + verification |
| 5 (duplicate slot) | Autonomy Calibration | AEMM maturity model and Elastic Loop |
| 6 | Security & Safety | Prompt injection defense, sandbox, RBAC |
| 7 | Team Operating Model | Git integration, shared context, PR review |
| 8 | Developer Workflow | Daily loop, spec authoring, prompt patterns |
| 9 | Software Factory Orchestration | Factory as code, durable orchestration |
| 10 | Production Operations | Observability, A/B testing, continuous improvement |
| 11 | Case Study | End-to-end: spec to production |
| 12 | Summary & Future | Complete roadmap and future directions |

---

### Getting Started

```bash
# 1. Initialize your project
asf init

# 2. Write your first specification
asf spec template specs/your-feature.yaml

# 3. Validate and generate
asf spec validate your-feature
asf spec generate your-feature

# 4. Run verification
asf verify

# 5. Run the complete harness
asf harness run your-feature

# 6. Submit to factory
asf factory submit generate your-feature

# 7. Monitor and improve
asf factory status
asf factory improve

# 8. Deploy to production
# (Follow the case study pattern)
```

---

*The future of software development is agentic, but only when built on engineering discipline. This series provides the roadmap. Start your journey today.*

---

*All code examples are in Go 1.23+. Diagrams use white-background Archify for presentation-ready architecture visualizations.*

---

Author: Pratik Dhanave (https://pratikdhanave.com) | Published: 2026-11-13
Canonical: https://pratikdhanave.com/blog/posts/agentic-software-engineering-case-study.html
Attribution: please link the canonical URL when citing or quoting this post.