Your software's meaning lives in its types. The compiler proves it correct.
You work with a crew of AI agents. They help you describe features.
They help you model types. Then they build your program from those types without guessing.
For decades, the best engineers argued that meaning belongs in the types: model the domain, make illegal states impossible to construct, and let a value's existence prove its own correctness instead of bolting validation on after the fact.
They were right.
But that discipline was always hard to hold under deadline, because project management usually obeys one rarely stated rule:
We separate the cost of finishing the first task from the lifetime cost of what we build.
Or, more bluntly: cut the initial task by 75%, agree to pay 10x more every month forever, and we take the trade every time. That is what imperative procedural code inside a poorly typed architecture really is: a lifetime of bug-interest toil.
A model changes the math. Radically. The well-typed architecture that used to cost you 4x the time now costs less than the cheap one ever did, and you stop paying the 10x. Why? Because the LLM reads your field names, your variants, and your type structure en masse, and works through the model with you at speed.
That opens a second, deeper benefit.
A type is an instruction. The same types that prove your code correct to the compiler now tell the AI exactly what exists, and, more importantly, what cannot exist. Strong types become two things at once:
- The constraint that stops a generator from inventing.
- The context that tells it what you meant.
The model becomes the single source of truth. Design, code, and docs stop drifting as separate copies; they collapse into one durable structure. The rigor that used to be good taste is now what makes AI-built software trustworthy.
The SDLC was never about building. It is a coordination protocol for multiple humans at human speed: the requirements doc, the handoffs, the standup, the roles, all of it exists to keep work split across many brains from contradicting itself. Remove the need to split the work, and the apparatus is just overhead.
So this drops the apparatus. You own the product. A crew of specialized agents does the labor, each one allowed a single job:
- The main agent orchestrates the crew, guards the context, reviews each result, and diagnoses every block. It models nothing and writes no code.
tca-productrecords what the product is for. It names nothing technical, so it cannot smuggle a design into the requirements.tca-ontologyturns that into a typed model and decides where each meaning lives. It writes no code.tca-devwrites the code from the model, one file at a time. It decides nothing; a choice it makes on its own is a bug.- The gate proves every file matches the model. It is plain code, not another model, so the verdict never varies and costs nothing.
You make the calls only you can make. The walls the last era fought to tear down, dev from ops and the deeper one between the people who know the business and the people who build it, fall here for the same reason: one builder, holding the meaning, commands the whole line.
It works for a team, exactly as well. What it makes newly possible is one person owning a product at a scale that used to take a room, and the process to keep the room in sync.
The agent reaches for the shortcut every model reaches for:
class Price(BaseModel):
value: floatThe gate stops it before it touches the disk:
TCA gate denied this write.
- bare primitive field `value`; use a semantic scalar (line 2)
- Price is a modeled semantic scalar; the shape is class Price(RootModel[...], frozen=True) (line 1)
Because you had already said, in one line, what a Price is:
{ "construct": "semantic scalar", "name": "Price", "primitive": "Decimal", "constraint": "gt=0, decimal_places=8" }And from that line, one shape is legal. It is the only thing tca-dev is allowed to write:
class Price(RootModel[Decimal], frozen=True):
root: Decimal = Field(gt=0, decimal_places=8)You say what a thing means once. The build holds to it and cannot wander off, not on the first try, not three files later when a model would have forgotten.
Before a line is written, the gate reads your model, proves it holds together, and prints the order to build it:
1. semantic scalar Price -> domain/orders/type.py
2. semantic scalar Quantity -> domain/orders/type.py
The crew builds in that order, and the gate checks each file the moment it lands:
tca gate: 0 violation(s) across 1 file(s)
When a meaning will not fit, because the design needs a decision no rule can make for it, the crew does not guess past it. It hands you exactly what it could not settle, and stops:
BLOCKED
row: <name and construct>
card: <the construct card it could not satisfy>
would not fit: <what the card could not express, in one sentence>
built before halt: <the rows it finished, and their files>
You make the call, fix the model, and the build resumes where it stopped. The machine does what is mechanical. You do what needs an architect.
You pull the repo, define your product, and run the loop. The starter app is a placeholder; the crew overwrites it with the system built from your model, so you begin from a clean shape and end with your own. What is here today scaffolds the application. Templatizing the infrastructure beneath it, at cloud scale, is the next chapter.
| Typical AI coding | Spec-driven (Spec Kit, Kiro, BMAD) |
TCA | |
|---|---|---|---|
| Who picks the structure | the model, mid-keystroke | a written spec it can read past | you, in the model |
| What stops a wrong write | nothing | nothing | a gate, before it lands |
| When it is not sure | it guesses | it guesses | it stops and asks you |
| Who reviews the output | you, every line | you, every line | the gate; you review the design |
The spec-driven tools split the work across a pretend team, one agent each playing analyst, PM, architect, scrum master: waterfall with robots. The benchmarks show the bill, slower than writing the code yourself and more tokens spent re-reading its own rules than doing the work. TCA has no manager agents, because there is no room of humans to coordinate. The split is by authority, and the gate, not your patience, holds the line.
You build your whole domain from fifteen constructs. There is no sixteenth, and reaching for one is the single move the system will not allow. Each carries one meaning and rejects the shapes that bury it: the bare primitive, the if/elif ladder, the mapper, the stray helper.
| Construct | What it means | What it replaces |
|---|---|---|
| semantic scalar | one atomic domain value | the bare primitive standing in for a domain value |
| value object | a small value made of scalars, with no identity | the tuple or dict of primitives |
| concept model | one full domain thing or fact, made of declared types | the dataclass, the T | None field, the validator |
| collection | a sequence that is its own domain thing | the raw list / set / dict field |
| union | a closed choice over one axis, each case naming its kind | the bool, the if/elif, the isinstance ladder |
| ordered union | outside data tried in order, allowed to fail | the try/except that returns a default |
| derivation | a fact worked out from a value's own proven fields | the helper, the util, the stored computed field |
| foreign model | another system's shape, taken in whole at the edge | the mapper, the adapter, the DTO |
| contract model | your own API request or reply shape | reusing a foreign shape as your contract |
| consistency model | the one live spot where changing state collects | the manager, the engine, the module-level client |
| verb | one change of state on the consistency model | the multi-step service method |
| binding | the clients tied to the consistency model | the repository |
| route | the edge: build a value, send it in, return the reply | the handler that parses, computes, and decides |
| config | the environment read once into a typed value | scattered os.environ reads |
| composition root | the start that wires config, clients, bindings, routes | the runner, the orchestrator, the step list |
Every shape it rejects is one of four mistakes: a meaning with no type to hold it, the same meaning kept in two places by hand, a type that means nothing, or one type trying to mean two things. There is no fifth. That is the whole test, and it runs on every file you write.
- You do not pay the model to redesign on every run. Your design is saved as data.
tca-devreads a row; it does not work out what aPriceis again. - The check is free. Proving a file matches its row is plain code, not another model call. Zero tokens.
- It stops instead of thrashing. When a row will not build, the run ends and tells you. It cannot spin for an hour down a dead path.
- You pay for the strong model only where it earns it. A capable model to design with you, a cheap one to write near-mechanical files, no model at all to check.
It is the good half of typed functional programming, domain-driven design, and a few older schools, pulled together and made to hold under one test. Two camps spent decades saying the domain's structure should come first. They were right, and ignored, because the systems that ran the work never read what they wrote. A model reads it now, and the gap they were marginalized for is the gap that costs you on every run.
git clone https://github.com/kylejtobin/tca && cd tca
uv sync- The whole idea, the one rule and the four ways it breaks:
docs/definition.md - Why the domain belongs in the running code now:
docs/executable-ontology.md - Learn it by building:
docs/learning-path.md - The crew, the gate, and the loop in full:
.claude/README.md