AI-SDLC
v1alpha1 · Apache 2.0

Tell it what you want. It ships.

AI-SDLC surfaces the decisions that actually matter, turns your answers into a spec, and lands the work: PRs opened for you to merge, or merged on green.

Get Started Star on GitHub

What the agent runs once you have decided

pipeline.yaml
apiVersion: ai-sdlc.io/v1alpha1
kind: Pipeline
metadata:
  name: feature-delivery
spec:
  triggers:
    - event: issue.assigned
  stages:
    - name: implement
      agent: coding-agent
    - name: review
      qualityGates: [coverage, security]
    - name: deploy

Why isn't this already how it works?

Agents write code faster than your team can read it, and someone still has to check.

66%
use coding assistants or agents

Stack Overflow Developer Survey 2026, 30,000+ respondents

91.5%
of agent misalignments needed a human to step in

arXiv 2605.29442, 20,574 real sessions, 2026

30%
have little or no trust in AI-written code

Google DORA 2025, ~5,000 respondents

441%
longer median review time in high-AI-adoption teams

Faros AI 2026, ~22,000 developers, vendor telemetry

The root cause isn't that agents write bad code. It's that leaders are checking up on agents instead of deciding.

Review the spec, not the diff.

You decide once. The agent does the rest.

You

  • State what you want.
  • Answer the open questions the agent surfaces, so the feature becomes a spec.
  • Decide what merges on green and what waits for you.

The agent

  • Captures the work and its open questions.
  • Admits it only when the spec is ready.
  • Dispatches developer agents in isolated environments.
  • Runs independent review on a separate harness.
  • Signs the proof, then opens the PR or merges on green.

You review the spec. The agent ships it as specified, and shows you the proof. See the full lifecycle.

Declarative resources for the whole lifecycle

Every resource follows the spec/status split — you declare what you want, the orchestrator makes it happen. Validated against JSON Schema (draft 2020-12).

Pipeline

A complete SDLC workflow: triggers, providers, stages, DoR gate config, and dependency-aware routing.

kind: Pipeline
spec:
  triggers:
    - event: issue.assigned
  stages:
    - name: implement
      agent: coding-agent

Decision

An open question routed to an actor (Engineering, Product, Design, operator, or framework when LLM-eligible) with recommendation, counter-arguments, and sub-decision graph.

kind: Decision
spec:
  summary: "Which auth flow does 'fix login' refer to?"
  options:
    - id: opt-a
      description: "OAuth (current flow)"
    - id: opt-b
      description: "Magic link (Q3 migration)"

AgentRole

An AI agent's identity, tools, constraints, harness adapter, handoff contracts, and discovery info.

kind: AgentRole
spec:
  role: "Software Engineer"
  tools: [code_editor, terminal]
  constraints:
    maxFilesPerChange: 10

QualityGate

Policy rules with scope targeting, graduated enforcement (advisory → hard-mandatory), and evaluation config.

kind: QualityGate
spec:
  gates:
    - name: test-coverage
      enforcement: hard-mandatory
      rule:
        metric: line-coverage
        threshold: 80

AutonomyPolicy

Optional graduated permissions and oversight thresholds for routine agent work — guardrails and promotion criteria stay declarative.

kind: AutonomyPolicy
spec:
  levels:
    - level: 1
      name: "Junior"
      guardrails:
        requireApproval: all

AdapterBinding

Tool integration declaring which interface it implements, its config, and health checks.

kind: AdapterBinding
spec:
  interface: IssueTracker
  provider: linear
  config:
    apiUrl: https://api.linear.app

It lands as specified. You never check up on it.

Each tile below is one proof of the promise: the work lands as specified, and you never check up on the agent.

You decide once, up front; nothing stalls waiting on you later.

Decision Engine

Frontload operator decisions through a deterministic-first evaluation ladder. The framework recommends with confidence and counter-arguments; you decide; it executes.

Ready work becomes a pull request without you typing a command.

Autonomous Orchestrator

cli-orchestrator walks the dependency graph, admits ready work, dispatches developer subagents in isolated worktrees, and opens PRs — without operator typing.

Vague work is stopped before it can produce a half-right result.

Definition-of-Ready Gate

Every contract passes a deterministic-first DoR rubric before dispatch. Well-formed work hits the orchestrator in seconds; under-specified work surfaces clarifications, not failed dispatches.

The model that wrote the code never grades its own work.

Cross-Harness Review

Reviewer subagents run on a harness independent of the implementer (Claude can't review what Claude wrote). Choose the three-reviewer set or the staged pipeline per repository; both produce the same attested verdict.

You see only the decisions that need you.

Operator TUI

Decisions-pending pane, dependency graph, pipeline overview, config editor, usage analytics. Foregrounds the load-bearing decisions and stays out of the way otherwise.

Nothing merges until the checks you chose have passed.

Quality Gates

Graduated enforcement: advisory, soft-mandatory, hard-mandatory. AI-specific gates for provenance, attribution, and security. Compliance posture derives the strictness.

Routine work runs unattended; high-stakes work always gets a human.

Autonomy Policies

Declarative AutonomyPolicy resource: declare promotion criteria, guardrails, and oversight thresholds in YAML. Routine work runs unattended; high-stakes work always has human review.

Switch coding agents without redoing your pipeline.

Agent-Agnostic

Works with Claude Code, Copilot, Cursor, Codex, Aider, or any LLM through a standard AgentRunner interface. Harness adapter pattern keeps you portable.

Keep your tracker and host; the pipeline stays the same.

Adapter Contracts

Swap Linear for Jira, GitHub for GitLab, OpenAI embeddings for self-hosted — pipeline definitions remain unchanged. Terraform-style provider pattern.

Audit evidence is produced as a side effect of the work.

Compliance Posture

Declare your compliance posture; the framework derives gate defaults, attestation requirements, and retention. Maps to EU AI Act, NIST AI RMF, ISO 42001.

Agents cannot do what your repo forbids, and enforcement matches the narration.

Action Governance

Hard rules live in your repo's agent-role.yaml and are rendered into every session from one resolved policy. Strict by default; a repo relaxes a rule with one declaration, and enforcement matches the narration.

Reviews flag what matters and skip the noise.

Review Calibration

Deterministic-first review: AST preprocessing, confidence-tiered LLM filtering, evidence requirements, meta-review pass. Calibrate with YAML exemplars, not code rules.

You can verify that a review ran against this exact diff.

Proof of Execution

A Merkle root over the reviewers' own transcripts, signed and committed next to the code. Proves a review ran against this exact diff; survives rebases; verifiable against any historical commit.

Cheap, fast answers front the expensive agents.

Judgment Layer

Closed-set questions answered with a probability distribution in one fast call, no generated text. Fronts the expensive agents, replaces regex heuristics, ships in shadow and promotes only on measured precision.

You know what each model call cost and why that model was chosen.

Usage Ledger & Model Routing

One record per model call, by role, task and billing pool, read from the harness's own transcripts. A routing table assigns models per role, and every entry cites the scorecard evidence behind it.

Deep review at lower cost, with the same attested verdict.

Staged Review

Code gathers diff facts, the judgment layer maps risk, the strongest model plans, cheaper models probe, the strong model writes the verdict. Same envelope, same attestation, promoted only on replay evidence.

SDKs for every stack

First-class support for TypeScript, Python, and Go. Build custom integrations, adapters, and agent runners in your language of choice.

TypeScript

$ npm install @ai-sdlc/sdk
import { PipelineBuilder } from "@ai-sdlc/sdk";

const pipeline = new PipelineBuilder("delivery")
  .addTrigger("issue.assigned")
  .addStage("implement", "coding-agent")
  .addStage("review", "human")
  .build();

Python

$ pip install ai-sdlc-framework
from ai_sdlc import PipelineBuilder

pipeline = (PipelineBuilder("delivery")
  .add_trigger("issue.assigned")
  .add_stage("implement", "coding-agent")
  .add_stage("review", "human")
  .build())

Go

$ go get github.com/ai-sdlc-framework/ai-sdlc/sdk-go
p, _ := builders.NewPipelineBuilder("delivery").
  AddTrigger("issue.assigned", nil).
  AddStage("implement", "coding-agent", nil).
  AddStage("review", "human", nil).
  Build()

Works with every AI coding tool

The orchestrator is agent-agnostic. It invokes AI coding agents through a standard AgentRunner interface. Set the auth token and the runner becomes available.

CC
Claude Code
Anthropic
C
Copilot
GitHub
C
Cursor
Cursor AI
C
Codex
OpenAI
AL
Any LLM
OpenAI-compatible API
All runners follow the same pattern: build prompt, spawn CLI, collect output, stage and commit

When the auditor asks, the evidence already exists.

Because the work lands as specified, the evidence already exists. Lifecycle phases and controls map directly to major regulatory frameworks.

EU AI Act

Risk-tier classification maps to complexity-based routing. Transparency requirements map to provenance tracking.

NIST AI RMF

Govern, Map, Measure, Manage — each function maps directly to AI-SDLC resource types and reconciliation.

ISO 42001

Plan-Do-Check-Act maps to Pipeline spec, Agent execution, Quality gates, and Auto-remediation.

Solutions by industry

AI-SDLC adapts to your industry's compliance requirements, risk posture, and team structure — the framework fits your workflow, not the other way around.

Financial Services

Govern AI coding agents across your financial services SDLC with PCI-DSS, SOX, and EU AI Act compliance built in.

Learn more

Healthcare

Govern AI coding agents in healthcare with HIPAA, FDA 21 CFR Part 11, and EU AI Act compliance built into your SDLC.

Learn more

Government & Defense

Govern AI coding agents in government and defense with FedRAMP, NIST AI RMF, and CMMC compliance built into your SDLC.

Learn more

SaaS & Developer Tools

Govern AI coding agents in your SaaS development workflow with SOC 2 and ISO 42001 compliance and quality gates that scale.

Learn more

Fintech

Govern AI coding agents in fintech with PCI-DSS, SOC 2, and EU AI Act compliance — plus the quality gates fast-moving teams need.

Learn more

Platform Engineering

Add AI agent governance to your internal developer platform. Kubernetes-native declarative model, adapter architecture, and cross-industry compliance.

Learn more
Apache 2.0

Open source, open governance

The AI-SDLC Framework is fully open source. Contribute adapters, quality gates, agent runners, or the spec itself. Community-driven.

Star on GitHubRead the Docs

Want hands-on help adopting it?

There is no paid edition. The framework is open source, and the only paid help is three consulting engagements: an audit, a pilot, and a decision context engine.

See the engagements