Proof index
Every claim ai-sdlc.io makes, and the page in the documentation or specification that backs it.
Claims for buyers
AI-SDLC is a vendor-neutral open specification, and the full framework is open source under Apache 2.0
A Definition-of-Ready gate refuses vague work before any agent is dispatched
Stated on: Home, /faq, /services, /security
Proof: Definition-of-Ready gate
Independent reviewers, on a different harness than the implementer, check the work
Each review ends in a signed Proof of Execution that stays verifiable against any historical commit
Autonomy widens only as measured reliability supports it, across four levels
Stated on: /faq
A usage ledger and model routing bound model spend, and the routing table cannot be changed by a pull request
Proof: Usage ledger and model routing, Model routing cost guide, Cost reference
It works with Claude Code, GitHub Copilot, Cursor, OpenAI Codex and any OpenAI-compatible LLM
You bring your own API keys: AI-SDLC orchestrates your coding tools and provides no LLM inference
Proof: Agent runners reference
AI-SDLC is self-hosted: there is no hosted version
Proof: Getting started guide
AI-SDLC is a governance layer that composes with other agent tools rather than replacing them
Stated on: /faq
Claims for buyers and engineers
Pull requests from untrusted contributors are verified without privilege escalation or credential exposure
Stated on: /security, /pricing
Proof: Zero-trust PR verification, Untrusted contributor verification white paper
Controls map to the EU AI Act, NIST AI RMF and ISO 42001, and audit evidence is produced as a side effect of the work
Proof: Compliance reference
Claims for engineers
An append-only, hash-chained audit log records agent actions (tamper-evident audit trail)
Stated on: /security
Proof: Audit reference
Agents run sandboxed with just-in-time credentials, kill switches and approval workflows
Stated on: /security
Proof: Security reference
Runtime governance blocks dangerous agent actions such as merging pull requests, force-pushing or deleting branches
Stated on: /security
Proof: Action governance reference
Each repository declares its own hard rules for agents in version-controlled configuration
Proof: Per-repo governance
Found a claim on this site that is not backed by a page here? Please open an issue on GitHub.