Closed-Loop Autonomous Software Development via Jira-Integrated Backlog Orchestration: A Case Study in Deterministic Control and Safety-Constrained Automation
Organizations: Swift North AI Lab, The Swift Group, LLC, Maryland, USA.
Abstract
This paper presents a closed-loop system for software lifecycle management framed as a control architecture rather than a code-generation tool. The system manages a backlog of approximately 1,602 rows across seven task families, ingests 13 structured source documents, and executes a deterministic seven-stage pipeline implemented as seven scheduled automation lanes. The automation stack comprises approximately 12,661 lines of Python across 23 scripts plus 6,907 lines of versioned prompt specifications, with checkpoint-based time budgets, 101 exception handlers, and 12 centralized lock mechanisms implemented through four core functions and eight reusable patterns. A Jira Status Contract provides externally observable collision locking, and a degraded-mode protocol supports continued local operation when Jira is unavailable. Artificial-intelligence assistance is bounded by structured context packages, configured resource caps, output re-validation, and human review gates. A formal evaluation of the initial 152-run window yielded 100% terminal-state success with a 95% Clopper-Pearson interval of [97.6%, 100%]; the system has since accumulated more than 795 run artifacts in continuous operation. Three rounds of adversarial code review identified 51 findings, all closed within the study scope (48 fully remediated, 3 closed with deferred hardening), with zero false negatives within the injected set. In an autonomous security ticket family of 10 items, six were completed through pipeline-autonomous dispatch and verification, two required manual remediation, and two were closed by policy decision. The results indicate that bounded, traceable lifecycle automation is practical when autonomy is embedded within explicit control, recovery, and audit mechanisms.
Figures & tables
| Failure Mode | Sev. | Detection Mechanism | Recovery Action | Residual Risk |
|---|---|---|---|---|
| Duplicate posting to Jira | I | Receipt log + Jira comment history | Abort post; log duplicate event | Negligible |
| State mutation during verify-only | III | FAIL_VERIFY_MUTATED_STATE flag | Discard worktree; require manual review | Marginal |
| Process hang beyond timeout | III | Checkpoint model + hard-stop timer | USR1 warning; SIGKILL after 30 s | Marginal |
| Jira rate-limit or retryable failure | II | MCP error classification / retryable signal | Exponential back-off 10% jitter | Negligible |
| Snapshot restore corruption | III | SHA-1 checksum comparison on restore | Re-checkout from origin; flag run | Negligible |
| Race condition on receipt | II | 12 centralized lock mechanisms | Retry with jittered back-off | Negligible |
| Metric | Value | Notes |
|---|---|---|
| Total LOC (automation) | 12,661 + 6,907 PROMPT | 23 scripts + 7 prompt files; consolidated from 51 |
| Total LOC (application) | 1,290,158 | 15,840 source files: JS/TS/CSS, Python, Shell, Config |
| Backlog rows | 1,602 | 7 families; CERTREQ removed, AUTO-DROP and AUTO-TECH added |
| Environment variables | Per lane | Time budgets, ticket caps, MCP rate limits by lane |
| CLI argparse arguments | 77 | 60 with configurable defaults across 9 scripts |
| Timeout boundaries | 17 | 45-min standard, 120-min nightly, 10-min progress check |
| Run Type | CLEAN | DEGRADED | Success | 95% CI | |
|---|---|---|---|---|---|
| Nightly full sweeps | 82 | 17 (20.7%) | 65 (79.3%) | 100% | [95.6%, 100%] |
| Executor runs | 29 | 25 (86.2%) | 4 (13.8%) | 100% | [88.1%, 100%] |
| Remediation runs | 41 | 33 (80.5%) | 8 (19.5%) | 100% | [91.4%, 100%] |
| Overall | 152 | 75 (49.3%) | 77 (50.7%) | 100% | [97.6%, 100%] |
| Rnd | Injection Focus | P0 | P1 | P2 | P3 | Tot. | Res. |
|---|---|---|---|---|---|---|---|
| 1 | Lock handling, race conditions, TOCTOU | 1 | 3 | 4 | 5 | 13 | 100% |
| 2 | Subprocess mgmt, Jira API, shell compat. | 3 | 6 | 7 | 6 | 22 | 100% |
| 3 | Symlink traversal, clock skew, resources | 0 | 4 | 7 | 5 | 16 | 100% |
| All | All rounds | 4 | 13 | 18 | 16 | 51 | 100% |
| ID | Type | Tools Invoked | Status | Completion Mode |
|---|---|---|---|---|
| SEC-001 | Runtime dependency remediation (npm audit) | security-audit.sh | Done | Autonomous (verified) |
| SEC-002 | Auth token storage hardening | verify_bl_sec_ticket.py | Done | Autonomous (verified) |
| SEC-003 | dangerouslySetInnerHTML boot script | Human code edit | Done | Autonomous (verified) |
| SEC-004 | innerHTML/XSS surface hardening | verify_bl_sec_ticket.py | Done | Autonomous (verified) |
| SEC-005 | child_process hardening and allowlist | Human code edit | Done | Autonomous (verified) |
| SEC-006 | Dev-tool dependency remediation (npm audit moderate) | security-audit.sh | Done | Autonomous (verified) |
Workflow Automation
Workflow automation coordinates multi-step tasks across applications, tools, and people using software, AI agents, and explicit process logic.
See all 62 papers