The AI does the typing. People make the decisions. Tests prove it. One small feature, a class waitlist, goes through every step with the tools Corewell has today: Jira, GitHub, GitHub Copilot in VS Code, Actions, and Playwright.
Rule of thumb: AI writes, people decide, the pipeline proves. No AI output reaches users without a human approval and a green build.
Copilot reads the card and writes business rules R1–R6 with exact numbers, Given/When/Then acceptance criteria, and a list of open questions it will not guess.
A person answers the open questions and approves the rules, not the code. The card moves to Spec Approved. Nothing is built before this.
"The business owner approves the rules. Product and QA agree before anyone builds."
Copilot scores the risk: PHI, auth, payments, size. The score sets the review path. CSD-1 is Low. CSD-3 (phone and date of birth on the roster) is High.
Each acceptance criterion becomes one Playwright test with the same ID (AC1–AC7). They fail, because the code does not exist yet. The proof comes before the code.
Copilot writes the code until the tests pass. The change is small: one logic file and one data file. GitHub Actions runs 3 jobs on the pull request: code quality, security, and tests.
Copilot code review checks the PR against the spec. Two planted problems show the gates: a one-line logic bug (AC4 and AC6 fail), and CSD-3 built without approval. Its tests pass, but the PHI guard and Semgrep stop it.
Every branch gets a preview URL. The same Playwright tests can run against the preview. CI publishes a change record and posts its link on the PR and the Jira card.
| Rule | What it says | Test | Green build | Broken build |
|---|---|---|---|---|
| R1 | Confirmed plus offered seats can never be more than the class capacity. | AC7 | Pass | Pass |
| R2 | When a class is full, a new person joins the waitlist and sees their position (#1, #2). | AC1, AC2 | AC1AC2 | AC1AC2 |
| R3 | One email holds only one place per class, a seat or a waitlist place. Case and spaces do not matter. | AC3 | Pass | Pass |
| R4 | When a seat opens, the first person on the waitlist gets a seat offer and a notice. | AC4 | Pass | Fail |
| R5 | A seat offer is held for 24 hours. The person can accept it in that time. | AC5 | Pass | Pass |
| R6 | An offer not accepted in 24 hours expires. The seat goes to the next person. | AC6 | Pass | Fail |
Rules come from the approved spec: CSD-1-class-waitlist.md. Click a result to open that test in the Playwright report.
Playwright is a free, open-source testing tool from Microsoft. It opens a real browser and uses the app the way a person does: it types, clicks, and reads the screen. Then it compares what it sees with what the rule says. If they do not match, the test fails.
npm test) and in GitHub Actions on every pull request.open CPR & First Aid (3 seats, 2 taken) register Jordan Kim → class is full register Riley Chen → waitlist #1 register Morgan Diaz → waitlist #2 click Cancel on Sam Lee → Riley gets the offer click +23 hours ✓ Riley still "Offered" click +1 hour ✓ Riley's offer expired ✓ Morgan now "Offered"
It tests both sides of the 24-hour limit. In the broken build, Morgan gets the first offer, so this test fails.
| Check | Tool | What it catches | Config |
|---|---|---|---|
| Code quality | ESLint | Bugs, unused code, functions too complex to review (complexity over 12) | eslint.config.js |
| Accessibility | axe + Playwright | WCAG 2.1 A and AA problems: contrast, labels, keyboard use | accessibility.spec.js |
| PHI guard | Custom script | Patient data patterns: phone, SSN, date of birth, MRN fields, real emails | phi-guard.mjs |
| Code security | Semgrep | Cross-site scripting (HTML from variables), eval, sensitive data in browser storage | .semgrep.yml |
| Secrets | Gitleaks | API keys, passwords, and tokens in code | .gitleaks.toml |
| Dependencies | npm audit | Packages with known high-severity vulnerabilities | package.json |
| Behavior | Playwright | Every acceptance criterion in the approved spec | waitlist.spec.js |
CSD-3 asks to show phone and date of birth on the roster. The assessment says High risk, but in this branch someone built it anyway. All 11 tests pass. The security job fails:
innerHTML, which allows cross-site scripting.The check results page shows every check on every branch, with the real tool output.
"Passing tests is not enough. The pipeline also checks for patient data, unsafe code, and secrets."
"The approver does not need GitHub access. They open one link and see what changed, what was checked, and the result."
Built by change-record.mjs in the workflow. Also kept 90 days as a GitHub Actions artifact.
Before: no waitlist. "Sorry, this class is full."
Open report → CSD-1-tests4 / 11Tests written from the spec. 7 fail on purpose.
Open report → CSD-1-waitlist11 / 11Code added. Every acceptance criterion and accessibility check passes.
Open report → demo-broken-waitlist9 / 11One-line bug. AC4 and AC6 catch it.
Open report → demo-security-issue2 gatesAll tests pass. PHI guard and Semgrep fail.
Open findings →Since June 1, 2026, GitHub Copilot bills AI use by tokens at each model's API rate, paid from monthly AI Credits. Copilot Business includes $19 of credits per user each month. Code completions stay included. The table below is an estimate for one story like CSD-1. Change the rates to match the model you pick.
| AI step | Input tokens | Output tokens | Cost |
|---|---|---|---|
| Total per story |
The coding agent and code review also use GitHub Actions minutes, which are not in this number.
| Step | Corewell today | What the demo shows |
|---|---|---|
| Card → spec | Requirements live in different places | One shared spec per card, in the repo |
| Approval | Informal | A clear human gate in Jira |
| Assessment | Not done | Risk level sets who must review |
| Tests first | QA writes Playwright after the build | Tests from acceptance criteria, before code |
| AI review | Copilot code review is off | Review against the spec, with a test gate |
| Traceability | Hard to follow a rule to its test | Rule → AC → test → report → PR → card |
Same tools you have today. What changes is the order: rules first, tests second, code third, with a person approving at each gate.