change Software Delivery with AI Agents and Automated Pipelines

The PR arrives already merged — security scan, canary, rollback, root-cause PR, browser-verified UI, all in one loop, no human in the chain. OpsMatters' Claude Code + Harness: Software Delivery for the Agent Era (opsmatters.com) demos it on a broken banking app, and the quiet thesis is this: Claude Code writes the code; Harness decides whether you trust it to ship.

Writing software has been the slow part for so long we'd forgotten it isn't, really. Shipping it safely has been the slower part, and the bottleneck is not an engineer who can't type — it's a pipeline that can't decide. A failed canary at 3am. A rollback that takes longer than the deploy. A post-mortem that waits a sprint. A security finding that blocks a release for a week.

The OpsMatters walkthrough threads a single ticket — a broken banking app UI — through the entire Harness AI SDLC pipeline. Four capabilities carry it end to end.

Autonomous fixes, IDE-native

The first thing Claude Code does isn't impressive because it's new — it's impressive because it doesn't leave the IDE. It explores the codebase, drafts a plan, writes the code, opens the PR. The PR is still reviewable; it just arrives pre-built.

The shape of the velocity curve changes when the planner, the coder, and the PR-opener are one agent. A bug that used to be a half-day of context-switching becomes a thing that lands in your queue while you're still in the previous one.

What this gets the team: a faster path from "I know what's wrong" to "here's a diff." What it doesn't get you — and what Harness is the answer to — is trust that the diff is safe to ship.

Security scanning that pages an agent, not a person

Harness auto-detects security findings and triggers remediation agents to patch vulnerabilities in minutes. The shift isn't speed alone — it's that security is no longer a gate outside the loop. Security findings become inputs to the same pipeline that builds, tests, and deploys.

# harness.yaml — security agent stage
stages:
  - name: security_scan
    type: security
    triggers:
      - finding
    remediation:
      agent: claude-code
      open_pr: true
      sla_minutes: 30

The remediation.agent block is the bit the older pipelines don't have. A CVE used to page a person; now it pages an agent. The PR lands in the same review queue as a human-authored one. The exposure window drops from "until next sprint" to "until the next deploy."

Self-healing pipelines

The canary fails. What happens next used to be a person waking up.

// canary stage — auto-rollback + RCA
if (canary.errorRate > 0.02) {
  await pipeline.rollback()                        // automatic
  const rca = await agents.rootCause(canary.logs)   // AI-driven
  const pr  = await agents.fix(rca)                // opens a follow-up PR
  return { status: 'rolled_back', rca, pr }
}

Self-healing pipelines roll back failed canary deployments automatically, then run AI-driven root-cause analysis and generate a follow-up PR. The pipeline doesn't just fail loudly — it fails usefully. The post-mortem arrives in the same reviewable form as the original fix.

This is the part that changes how teams feel about Friday deploys. The deploy is no longer the riskiest thing in the release — the rollback is automatic, the RCA is automatic, the fix that follows is a PR like any other.

End-to-end verification with browser agents

Unit tests answer the wrong question. They tell you the function works; they don't tell you the button renders, the click lands, the redirect happens. Harness closes that gap with an AI browser agent that tests and verifies UI fixes as a real user before production.

// verify stage — AI browser agent
await browserAgent.run({
  goal: 'log in, navigate to dashboard, confirm no 404 on widgets',
  record_video: true,
  fail_on: ['404', 'console_error', 'unhandled_rejection'],
})

The agent gets a goal in plain English and a failure surface. It walks the UI the way a user would. If it finds a 404, a console error, or an unhandled rejection, the pipeline stops before the user sees it. The OpsMatters walkthrough makes this concrete at timestamp 04:59 — the AI browser agent signs off on the production rollout before a human ever touches it.

Wiring it up — the full pipeline

A minimal Harness pipeline that ties the four stages together:

pipeline:
  name: ai_sdlc
  trigger:
    - ticket
    - pull_request

  stages:
    - name: fix
      agent: claude-code
      output: pull_request

    - name: security
      type: security_scan
      on_finding:
        agent: claude-code
        open_pr: true

    - name: canary
      type: deploy
      strategy: canary
      on_failure:
        rollback: true
        rca: ai
        follow_up_pr: true

    - name: verify
      agent: browser
      goal: 'smoke test as a real user, fail on 404 or console error'
      record: true

    - name: production
      depends_on: [fix, security, canary, verify]

Each stage's output is the next stage's input. The PR feeds the security scan. The security scan feeds the canary. The canary feeds the browser verification. The browser verification gates production. Drop any stage and the loop stops compounding.

What this enables

The wins are layered, and they only matter when the loop runs end to end:

• Velocity. Claude Code's IDE-native fix loop removes the context-switching tax between "found the bug" and "PR is open." A bug report that used to be a half-day becomes a PR you review the next morning.
• Exposure window. Vulnerabilities are patched in minutes — not at the end of the next sprint. The agent pages itself; the PR lands in the same queue as a human-authored one.
• Recovery cost. Auto-rollback plus AI-driven RCA means a failed canary is a follow-up PR, not a war room. The post-mortem arrives pre-built.
• Confidence at the boundary. AI browser agents verify the UI as a real user, closing the gap that unit tests can't. The button renders, the click lands, the redirect happens — confirmed before production.

These aren't four separate bets. They're one loop. Pull any stage and the others stop compounding.

Where the durable layer lives

This is where the agent era gets interesting, and a little uncomfortable. The model changes every quarter. The harness evolves. The browser agent gets faster. None of that is the durable layer.

The durable layer is what survives model churn: the component contract, the cross-platform UI behavior, the single API that produces the same Button on web, iOS, and Android. When an AI agent fixes a UI bug autonomously, the fix has to land somewhere where the component still looks and behaves the same on every surface — otherwise the agent's fix in one place becomes a regression in another.

Use Claude Code + Harness for the loop. The thing underneath the loop — the shared component surface — is the layer worth investing in once. OTF ships exactly that: one component API, web + iOS + Android, the same Button, the same Card, the same behavior. The model churns above. The components stay.