The Maturity Model
Status: Complete · Five levels of practice — from ad-hoc AI coding to a self-healing sovereign loop. Each level is defined by observable behaviours and the one metric that proves you're there, not the one you aspire to.
Most teams using AI to write code are at Level 1 and quietly believe they're at Level 3. The gap between "we use AI heavily" and "we have a disciplined practice" is exactly the gap between generating code fast and trusting what you ship. This page gives you a ladder to locate yourself honestly — and the uncomfortable rule that you cannot skip a rung.
Maturity here is not "how much AI you use." A team that generates 100% of its code with zero specs and zero independent verification is less mature than a team that generates 40% with a versioned spec and an adversarial review. The axis is discipline, not volume. That is the whole SAE thesis (First Principles) applied to your own org: speed is free; the levels measure what you did with the freed capacity.
Every level below is anchored to a First Principle and a proof metric from KPIs and Metrics. The proof metric matters more than the behaviours: behaviours are claims, metrics are evidence (P7). If you exhibit the behaviours but the metric isn't moving, you are aspiring to the level, not at it.
| Level | One-line definition | Anchored principle | The metric that proves it |
|---|---|---|---|
| L1 — Ad-hoc | Prompt, paste, ship. No durable artifact but the code. | (none — pre-SAE) | None tracked — that's the tell |
| L2 — Spec-driven | Intent lives in a versioned spec; code is regenerated from it. | P2 | Spec coverage → 100% |
| L3 — Adversarially-verified | A fresh, independent context refutes every change. | P3 | Guardian catch rate ↑ |
| L4 — Metric-instrumented | Flow, quality and drift are measured and read together. | P1, P7 | Spec drift time → same-day |
| L5 — Self-healing / Sovereign | Incidents close the loop back into the spec automatically. | the full loop | MTTR ↓ with escape rate flat |
Definition. You prompt a model, read the answer, paste it, and ship. The only durable artifact is the code itself.
Observable behaviours.
- Intent lives in chat history and your head — there is no spec, or a
READMEthat's already stale. - "Verification" is the same context that wrote the code agreeing that it looks right.
- You hand-edit generated code freely and never feed the edit back anywhere.
- Asked why a function exists, the honest answer is "the model wrote it that way."
The metric that proves it. None. L1 is defined by the absence of any tracked metric from KPIs and Metrics. If you can't answer "what's your regression escape rate?" you are at L1, regardless of how sophisticated your prompts are.
Dominant risk. Invisible decay. Code volume outruns understanding; the codebase becomes a thing you operate rather than own, which is a direct violation of P6 — you own the output. Bugs are discovered by users, not by you.
What unlocks L2. Stop treating the code as the source of truth. Externalise intent into a versioned Markdown spec committed alongside the code. The moment the spec — not the chat log — is the thing you change first, you've crossed into L2.
Reality check. This is where almost everyone is. "We use Copilot / Claude / Cursor heavily" is an L1 statement. Heavy usage is not maturity — it is the condition that makes maturity necessary, because volume without a source of truth is how the 12 Layers of Friction compound silently.
Definition. The Markdown spec is the supreme artifact; code is a build output you regenerate from it. This is P2 made operational, and it is the prior art SAE inherits (Spec Kit, Kiro).
Observable behaviours.
- Bugs and changes are fixed in the spec first, then regenerated — not patched in code.
-
specs/is versioned in the same commit assrc/. A diff to behaviour is a diff to the spec. - You can hand a fresh context the spec alone and it can reconstruct the feature.
- New work starts with an SDD spec template, not a blank editor.
The metric that proves it. Spec coverage → 100% — the percentage of shipped features that have a current spec. L2 means you're closing the gap; "a spec exists somewhere" is not the same as "every shipped feature has one."
Dominant risk. Spec drift. The spec and the code diverge after a pressured hot-fix and nobody reconciles them. A stale spec is worse than none — agents and humans both trust it, so it actively misleads. At L2 you have the artifact but not yet the discipline to keep it honest.
What unlocks L3. A spec you trust still has nobody checking whether the generated code actually satisfies it — and the worst possible judge is the context that wrote it. You unlock L3 the day you delegate verification to a separate, fresh context briefed to refute.
Reality check. Most "spec-driven" teams are really L2-on-paper: they write a spec at the start, then never touch it again. Spec coverage measured at ship time (not at kickoff) is the honest test. If your specs describe what you meant to build six weeks ago, you're standing on the L1/L2 line.
Definition. Every change is reviewed by an independent Guardian with a clean context whose job is to refute, not approve. This is Adversarial Independence — P3 — a co-equal moat alongside Context Entropy.
Observable behaviours.
- Verification runs in a fresh context that did not write the code; it reviews the diff, not its own output.
- The Guardian is briefed to find what's wrong (grey-box refutation), and an unrefuted change is the pass condition — confirmation is not.
- High-stakes changes get diverse lenses, not one identical check repeated.
- You catch defects before production, in review, as the normal case.
The metric that proves it. Guardian catch rate ↑ — defects caught in Guard ÷ total defects found, trending up over time. Paired with a falling regression escape rate. If bugs are still mostly found in production, your "review" is theatre, not adversarial independence.
Dominant risk. Verification collapse into confirmation. The Guardian quietly drifts toward rubber-stamping — reusing the writer's assumptions, running one shallow check, blessing instead of refuting. A falling catch rate with steady bug counts means Guard is weakening even though the ritual still happens.
What unlocks L4. You're catching defects, but you're judging your practice by feel. You unlock L4 when you start measuring — instrumenting flow, quality and spec health as a system and reading them together, so decay becomes visible early instead of in hindsight.
Reality check. "We do code review" is not L3 if the reviewer shares the author's context — and with AI, the author's context is the model that just wrote it. Genuine P3 requires a fresh context with an adversarial brief. A second prompt in the same thread saying "is this correct?" is L1 wearing an L3 costume.
Definition. Your practice is measured. Flow, quality and spec health are tracked as a system, paired to resist gaming, and read together. This operationalises P1 (you find where time actually goes) and P7 (decay is made visible, honestly).
Observable behaviours.
- You run the minimal scorecard: cycle time, regression escape rate, spec drift time, blast-radius incidents.
- Flow metrics are never read alone — every speed number is paired with a quality number.
- Spec drift time is treated as the canary: when it grows, you stop and reconcile.
- Changes carry a blast-radius classification (P5); irreversible operations are gated, not auto-applied.
The metric that proves it. Spec drift time → same-day reconcile. This is the leading indicator of framework decay. A team that measures drift and drives it to zero is demonstrably at L4; a team that assumes drift away is back at L2 no matter how many dashboards it has.
Dominant risk. Metric gaming. Any metric becomes a target. The classic SAE trap: optimising autonomy ratio ("look, no hand-edits!") while the regression escape rate quietly climbs. At L4 the danger isn't lack of data — it's trading the metric you can't see for the one you can.
What unlocks L5. You measure decay, but a human still drives every reconciliation. You unlock L5 when an incident closes its own loop — detection feeds a spec fix that regenerates the code, with the human gating only the irreversible.
Reality check. Instrumentation is where dashboards breed and meaning dies. The metrics are personal instruments to catch decay early, not a performance review for someone else. Four honest numbers read together beat twenty vanity numbers (LOC, commit count, velocity) on a wall.
Definition. The system closes its own loop: an incident is detected, root cause lands in the spec, the code is regenerated, the Guardian refutes the fix, and a human gates only the irreversible. The full set of principles operating as a feedback loop.
Observable behaviours.
- Incidents trigger a spec-first fix path automatically — the fix updates the source of truth, not just the symptom (P2).
- The self-healing loop runs end to end with the operator as gate-keeper on high-blast-radius steps (P5), not as the executor of every step.
- Drift is structurally near-impossible because the only path to fixing code runs through the spec.
- Accountability is explicit and undelegated — P6 holds even as execution automates.
The metric that proves it. MTTR (self-healing loop) ↓ while regression escape rate stays flat and blast-radius incidents stay at zero. Falling MTTR alone is a trap — fast fixes that mask root cause. L5 is fast recovery that does not trade away quality or breach the lines you don't cross.
Dominant risk. Automation outrunning accountability. The loop becomes trusted enough that the operator stops reading what it ships — silently sliding back to L1's core failure (operating, not owning) but now at machine speed. And concentrating the loop on one operator is a genuine single point of failure; the spec is the only succession plan, and only if it's truly current.
What unlocks "beyond"? Nothing in this model. L5 is not a finish line — it's a steady state you have to defend. The work at L5 is preventing regression down the ladder.
Reality check. "Self-healing" is the most over-sold phrase in the industry, so hold it to P7: an automated fix that closes a ticket without correcting the spec is not self-healing — it's automated symptom-suppression, and it raises spec drift while lowering MTTR. That combination is the signature of a team that thinks it's at L5 and is actually decaying fastest of all.
The levels are a dependency chain, not a menu:
- L3 without L2 is noise. A Guardian that refutes against no spec has nothing authoritative to check the code against — it can only check the code against the model's own assumptions, which is L1's failure with extra steps.
- L4 without L3 measures the wrong thing. Instrumenting a practice that has no independent verification just gives you precise numbers about an unverified system. Guardian catch rate is undefined when there's no Guardian.
- L5 without L4 is unguarded automation. A self-healing loop you can't measure is a self-harming loop you can't see. MTTR and escape rate are the only things that distinguish healing from suppression.
The honest sequencing rule: the proof metric of level N must be live and trending before you claim level N+1. Each rung's metric is the foundation the next rung stands on.
Reality check. Teams skip because the vendor demo skipped — "watch the agent fix the bug and ship" is an L5 theatre with none of L2–L4 underneath. It works in the demo and collapses in your codebase, because the demo had no production, no blast radius, and no spec to drift. Buy the discipline, not the highlight reel.
Run this in ninety seconds:
- Can you point to a current spec for the last feature you shipped? No → L1.
- Is spec coverage tracked and near 100% at ship time? No → you're parked at L2.
- Does a fresh, adversarial context review your diffs, and is Guardian catch rate rising? No → L3 is your ceiling, not your floor.
- Do you read flow and quality metrics together, with spec drift driven to same-day? No → you instrument nothing; L4 is aspirational.
- Do incidents close the loop back into the spec, with MTTR falling and escape rate flat? No → L5 is marketing.
Your level is the highest rung where the proof metric is real, not the highest behaviour you can describe. When you find your honest level, the next steps live in The Adoption Roadmap; the failure modes that drag you back down a rung live in the Anti-Pattern Catalog.
See also: KPIs and Metrics (the proof metrics in full) · First Principles (P1–P7) · The Adoption Roadmap · Anti-Pattern Catalog · The Verification Doctrine · Operator Competency Model · The End-to-End Lifecycle.