How I turned 11 months of prompt engineering lessons into a system that makes AI coding safe, auditable, and production-ready
My Saturday started like any other vibe coding session. Coffee ready, music on, Claude Code open. I was building a feature and feeling productive until I hit the API selection.
The AI confidently chose an API. I implemented it. Tests failed. I asked the AI to fix it. It chose the same API again. Different approach, same deprecated API. After the fifth iteration, I realized: the AI was stuck in a loop, and it was absolutely convinced this deprecated API was the right choice.
“But this API is deprecated,” I’d say.
“You’re right, let me use the current one,” it would respond.
Next prompt? Back to the deprecated API. With complete confidence.
That moment crystallized a problem I’d been dancing around for months: vibe coding is powerful, but it’s also frustrating as hell. And I’m not alone in this realization.
The AI development community is having a reckoning. We’ve moved past the honeymoon phase of “wow, AI can code!” and into the uncomfortable reality of production deployments. The criticisms are everywhere:
- “AI coding tools create security holes”
- “The context window breaks on real projects”
- “My AI gets stuck in infinite loops”
- “This code isn’t production ready”
- “It’s just glorified autocomplete – another hype bubble”
As an Engineering Manager with 18 years of experience and founder of DS APPS Inc, I’ve seen both sides. I’ve used AI to ship Android apps and open-source projects faster than ever before. But I’ve also seen the chaos that emerges when you let AI run wild without structure.
So I spent the past 8-12 months mastering prompt engineering, learning from failures, and documenting what actually works. The result is DevFlow – a framework that turns any AI coding assistant into a disciplined software development team.
And here’s the radical part: it’s not software. It’s pure prompt engineering.
The Three Struggles That Led to DevFlow
My journey with AI coding tools started like most developers: excitement mixed with frustration. As I pushed beyond simple scripts into real projects, three critical problems emerged:
1. The Prompt Paralysis Problem
In the beginning, every interaction with the AI was a negotiation. How do I phrase this? What context do I include? Should I be specific or let the AI decide? I was spending more time crafting prompts than I would have spent just writing the code myself.
The AI would make architectural decisions without asking me. It would choose library versions arbitrarily. It would implement features in ways that didn’t align with my project’s patterns. I felt like I was managing a developer who wouldn’t ask questions.
2. The Context Catastrophe
As projects grew beyond a few hundred lines, the context window became my enemy. The AI would forget critical constraints from earlier in the conversation. It would contradict its own earlier decisions. It would recreate functionality that already existed.
I needed sub-agents – separate contexts for separate concerns – but managing that manually was exhausting.
3. The Autonomy Paradox
I wanted the AI to work while I slept. I wanted to delegate entire features and wake up to completed, tested code. But every attempt at autonomous AI coding ended in one of two ways:
- The AI asked me a question and sat idle for 8 hours
- The AI made assumptions and built the wrong thing
What I needed was a system that could operate autonomously but tracked every decision it made, creating an audit trail I could review and question later.
The Insight: AI Doesn’t Need Better Models, It Needs Better Process
After months of iteration, I had a realization: the problem wasn’t the AI’s capabilities – it was the lack of engineering discipline.
Traditional software development has structure for a reason:
- Product managers define requirements
- Architects make technical decisions
- Developers implement code
- QA tests everything
- Security reviews for vulnerabilities
Why were we throwing all of that away just because AI was doing the typing?
That’s when DevFlow clicked into place. What if I could encode software engineering methodology into a prompt engineering framework? What if the AI could role-play different team members, each with their own responsibilities and quality gates?
DevFlow: Where AI Meets Engineering Discipline
DevFlow is a config-driven framework that orchestrates AI coding assistants through structured prompts. It’s not a new tool you need to install – it works with Claude Code, Cursor, Gemini CLI, or any AI assistant.
Here’s how it works:
1. Clone DevFlow Into Your Project
cd YourProject
git clone https://github.com/dondetir/DevFlow.git DevFlow
echo "DevFlow/" >> .gitignore
2. Add ONE Line to Your AI Tool’s Config
For Claude Code (claude.md):
# DevFlow Orchestration
Read and follow: ./DevFlow/ORCHESTRATOR.md
For Cursor (.cursorrules), Gemini CLI (gemini.md), or other tools – same line, different config file.
3. Start Your AI Tool
That’s it. The AI will:
- Auto-initialize the
.devflow/structure - Show you a status banner
- Ask what you’re building
- Guide you through the right workflow
The Architecture: 9 Agents, 5 Workflows, Pure Prompts
DevFlow introduces 9 specialized AI agents, each with distinct behaviors defined in YAML files:
- Project Manager – Routes tasks to the right workflow
- Product Owner – Writes user stories and requirements
- Architect – Designs technical solutions and presents options
- Backend Dev – Implements server-side code
- Frontend Dev – Builds user interfaces
- ML Engineer – Handles AI/ML components
- DevOps – Manages deployment and infrastructure
- QA Automation – Writes and runs tests
- Security Expert – Reviews code for vulnerabilities
The same AI (Claude Sonnet 4.5, Gemini 2.5 Pro, or any other model) role-plays each agent by reading their YAML-defined behaviors. This isn’t specific to one AI provider DevFlow works across any coding agent that can read config files. It’s prompt engineering at scale.
5 Specialized Workflows
DevFlow automatically routes your request to the appropriate workflow:
🚨 Emergency Hot-Fix (2 gates, 30-120 min)
- Rapid production issue resolution
- Compressed decision-making
- Emergency approval process
🐛 Bug Fix (2 gates, 45-90 min)
- Fast analysis and targeted fix
- Root cause identification
- Regression testing
🔄 Refactor (3 gates, 2h-3 days)
- Code quality improvement without behavior changes
- Metrics-driven approach
- Incremental refactoring with continuous testing
✨ Feature Development (3 gates, 1-5 days)
- Balanced design and implementation
- User story driven
- Component-level development
🚀 New Project (4 gates + execution, weeks-months)
- Full architecture and planning
- Epic and story creation
- Sprint-based autonomous execution
The Two-Prompt Magic: From Idea to Autonomous Execution
The genius of DevFlow is its simplicity. You give it two prompts, and then it can run autonomously:
Prompt 1: “Here’s what I want to build…” The AI creates a Product Strategy Assessment (PSA), breaks it into epics and user stories, and documents the business requirements.
Prompt 2: “I choose Architecture Option B” The AI has presented you with 2-3 architectural approaches. You pick one. Now it has everything it needs to execute.
After those two decisions, the AI can work autonomously while you sleep, with every decision documented in .devflow/ status files.
Real-World Proof: Building Simple MCP in One Session
To test DevFlow, I built Simple MCP – an educational Model Context Protocol server designed to teach developers how MCP works.
MCP is hot right now (GitHub just launched their MCP Registry in September 2025), and building a server from scratch typically requires:
- Understanding the JSON-RPC 2.0 protocol
- Implementing STDIO transport
- Defining tools, resources, and prompts
- Writing comprehensive documentation
- Testing with multiple MCP clients
My DevFlow experience:
- I cloned DevFlow into the project
- I gave it one prompt: “Build an educational MCP server that demonstrates basic MCP concepts”
- The Architect agent presented 3 implementation approaches
- I chose Option B (balanced complexity)
- DevFlow executed autonomously
The result? A working MCP server with:
- Clean, documented code
- Multiple example tools
- README with setup instructions
- Test cases
- Security review completed
No back-and-forth prompting. No context loss. No security holes. Just a production-ready educational tool.
How DevFlow Solves the “Vibe Coding” Criticisms
Let me address each criticism directly:
“AI Coding Creates Security Issues”
DevFlow’s Solution: The Security Expert agent reviews every piece of code with a security-focused lens. It checks for common vulnerabilities (injection attacks, authentication bypasses, data exposure) and provides recommendations. Everything is documented in the audit trail.
You still need to review it – DevFlow handles about 80% of the security analysis – but you have a structured security assessment rather than hoping you caught everything manually.
“Context Loss Breaks Real Projects”
DevFlow’s Solution: Sub-agents with separate contexts. Each agent (Backend Dev, Frontend Dev, etc.) maintains its own context window. The .devflow/ status files persist state across sessions, so context is never lost between conversations.
When you return after 8 hours, DevFlow reads the status files and knows exactly where it left off.
“AI Gets Stuck in Infinite Loops”
DevFlow’s Solution: Quality gates ensure understanding before implementation. The AI can’t start coding until it’s completed the analysis phase. It can’t mark a story complete until different agents have reviewed and tested it.
The workflow structure prevents the “regenerate the same buggy code 10 times” problem because gates force the AI to move through distinct phases.
“AI Code Isn’t Production Ready”
DevFlow’s Solution: Three-agent quality process:
- A Dev agent writes the code
- A different Dev agent reviews it (peer review simulation)
- QA agent tests it and verifies acceptance criteria
This catches about 80% of production readiness issues. The human still needs to do final review, but DevFlow handles the bulk of quality assurance.
“It’s Just Hype – AI Can’t Really Code”
DevFlow’s Solution: I take the middle stance. AI coding is a tool – used wisely, it’s transformative. Used carelessly, it’s destructive.
DevFlow encodes the “wisely” part. It’s not about making AI smarter; it’s about making AI more disciplined.
The 80% Rule: What DevFlow Automates (And What It Doesn’t)
Let me be clear about what DevFlow does and doesn’t do:
DevFlow Automates (≈80%):
- Requirement analysis and story creation
- Architecture option generation
- Code implementation
- Peer code review
- Test case generation and execution
- Security vulnerability scanning
- Documentation generation
- Progress tracking
Humans Must Still (≈20%):
- Make strategic architecture decisions
- Review security findings
- Verify acceptance criteria
- Make final production approval
- Handle edge cases the AI missed
- Understand the business context
DevFlow isn’t trying to replace developers. It’s trying to give developers a disciplined AI development team that does the grunt work while preserving human judgment for critical decisions.
Why This Matters: Democratizing AI Development
The promise of AI coding tools was supposed to be democratization – anyone could build software. But the reality has been gatekeeping by expertise: only people who master prompt engineering can use AI tools effectively.
DevFlow flips this. You don’t need to be a prompt engineering expert. You don’t need to know how to structure agent conversations or manage context windows or prevent infinite loops.
DevFlow encodes that expertise for you.
This matters for:
Junior Developers learning software engineering – DevFlow teaches them process while they build
Solo Founders building MVPs – DevFlow gives them a full dev team without hiring costs
Companies Afraid of AI Risk – DevFlow provides the audit trail and quality gates they need
Experienced Developers wanting to ship faster – DevFlow handles the boilerplate so they focus on hard problems
The Technical Deep Dive: How It Actually Works
For the engineers reading this who want to understand the mechanics:
DevFlow is a collection of:
- YAML config files defining agent behaviors, workflow rules, and quality gates
- Markdown templates for documents (PSA, stories, architecture proposals)
- Status files (JSON) tracking progress across sessions
- An orchestrator prompt (
ORCHESTRATOR.md) that the AI reads
When you start your AI tool, it reads ORCHESTRATOR.md which references all the other configs. The AI essentially “compiles” the framework by reading these prompts.
No code execution. No dependencies. No binary. Just the AI following structured instructions.
The workflows are defined as state machines:
workflow: bug_fix
phases:
- name: analysis
agents: [architect]
gates: [root_cause_identified]
- name: implementation
agents: [backend_dev, frontend_dev]
gates: [code_reviewed, tests_passing]
The AI reads this, understands the flow, and orchestrates itself through the phases.
It’s prompt engineering as infrastructure.
Getting Started: Your First DevFlow Project
Ready to try it? Here’s how to start:
1. Pick a Project
Start with something small – a feature, a bug fix, or a simple utility. Don’t start with your production codebase.
2. Clone and Configure
git clone https://github.com/dondetir/DevFlow.git DevFlow
Add the orchestrator line to your AI tool’s config (claude.md, .cursorrules, etc.)
3. Start Your AI Tool
Launch Claude Code, Cursor, or your preferred tool. DevFlow will initialize automatically.
4. Answer Two Questions
- What are you building?
- Which architecture approach?
5. Let It Run
DevFlow will execute autonomously. Check the .devflow/ folder to see progress.
6. Review and Approve
When DevFlow completes a phase, review the documents it created. Approve or request changes.
The Future: Community Workflows and Beyond
DevFlow is MIT licensed and actively evolving. Here’s what I’m thinking about:
Custom Workflows – Imagine a community repository of workflows:
- Mobile app development workflow
- Data science pipeline workflow
- Infrastructure as code workflow
Metrics and Analytics – Track DevFlow’s effectiveness:
- Time saved vs. traditional development
- Defect rates for DevFlow projects
- Quality gate pass/fail rates
Integration with Project Management – Export DevFlow status to Jira, Linear, GitHub Projects
Multi-Model Support – Let different agents use different models (GPT for architecture, Claude for coding, etc.)
But I need your help to build this.
A Note for Leaders and Companies
If you’re a CTO, engineering manager, or founder concerned about AI development risks, DevFlow addresses your core worries:
✅ Audit Trail – Every decision documented
✅ Quality Gates – No incomplete work marked as done
✅ Security Review – Automated vulnerability scanning
✅ Peer Review – Different agents review each other’s code
✅ Context Preservation – State persists across sessions
You get the velocity of AI development with the safety of traditional software engineering.
The Honest Take: DevFlow Isn’t Perfect
Let me be transparent about limitations:
- DevFlow requires an AI tool that supports reading config files (Claude Code, Cursor, etc. work; basic ChatGPT doesn’t)
- The initial setup requires understanding your AI tool’s config system
- DevFlow is still evolving – you’ll encounter rough edges
- It works best with projects that fit standard workflows (custom workflows need more work)
- The AI can still make mistakes – the 80% rule is real
But even with these limitations, DevFlow has fundamentally changed how I build software. I ship faster, with fewer bugs, and with complete documentation of every decision made.
Your Turn: Share Your Experience
I’m releasing DevFlow as open source because I believe structured AI development is too important to be proprietary. I want to see what you build with it.
Try DevFlow on your next project:
- GitHub: https://github.com/dondetir/DevFlow
- Example Project: https://github.com/dondetir/simpleMCP
Share your experience:
- What workflows did you use?
- What worked well?
- What broke?
- What would make DevFlow better?
Contribute:
- Submit custom workflows
- Report bugs
- Improve documentation
- Add new agent types
Questions? Open an issue on GitHub or reach out. I’m actively developing DevFlow and want to hear what real developers need.
The AI revolution in software development is happening. But it doesn’t have to be chaotic. We can have both the velocity of AI and the discipline of engineering.
DevFlow is my answer to making AI coding safe, auditable, and production-ready. It’s not about replacing developers with AI – it’s about giving developers AI teammates that follow the same rigorous processes we expect from human engineers.
The code we write with AI should be as trustworthy as the code we write ourselves. DevFlow is how we get there.
Now it’s your turn. Clone the repo. Build something. Break something. Learn something. And share what you discover.
Because the best way to solve the vibe coding problem isn’t to stop using AI – it’s to give AI better guardrails.
About the Author: I’m an Engineering Manager with 18 years of experience and founder of DS APPS Inc, a nonprofit publishing free Android apps and open-source AI applications. I’ve been deep in the AI coding tools space, contributing to OpenSIPS, building MCP servers, and exploring multi-agent systems. DevFlow is my contribution to making AI development more accessible and safe.
