ai-sdlc-framework/ai-sdlc

What it solves

AI agents are great at small greenfield projects but fail on mature codebases. Studies cited in the README show developers using AI tools are actually 19% slower on mature codebases, refactoring drops, stability declines, and only 3% of developers trust AI output. The root cause is that nobody orchestrates how agents work as code grows — every decision gets deferred to the worst moment, made by the actor with the least context. AI-SDLC flips this by moving load-bearing decisions upfront to a human operator and letting AI execute well-specified contracts deterministically.

How it works

AI-SDLC is a "Decision Engine" that wraps AI agents with structure. It has five pillars:

1. Definition-of-Ready (DoR) gate — refuses to dispatch tasks the operator hasn't actually decided yet. A Decision Catalog surfaces open questions ranked by leverage, with recommendations and counter-arguments.
2. Session hierarchy — cli-hierarchy up starts a planner, a dispatch session, and up to five executors, each a Claude Code session in its own tmux. Dispatch walks the dependency graph and hands admitted tasks to executors in isolated git worktrees running a Step 0-13 pipeline (dev agent → reviewers → attestation → PR).
3. Cross-harness review — reviewers from different harnesses (e.g., Claude vs. Codex) verify changes in parallel. DSSE attestations carry a harness field, and independence is enforced: if Claude implemented, Claude can't be the reviewer. Reviewer collusion is mechanically impossible.
4. Operator surface — operators work through cli-hierarchy (status, attach, brief, down) and the Decision Catalog, monitoring rather than typing.
5. Declarative governance — resources like Pipeline, Decision, AgentRole, QualityGate, AutonomyPolicy, AdapterBinding live as JSON Schema resources. Quality gates run advisory → soft-mandatory → hard-mandatory, and compliance postures derive defaults from EU AI Act, NIST AI RMF, ISO 42001.

Installation is via a Claude Code plugin, then ai-sdlc init, ai-sdlc doctor, and dispatch like /ai-sdlc execute AISDLC-42. The framework is agent-agnostic (Claude Code, Codex, Cursor, Copilot, Aider, or OpenAI-compatible APIs).

Who it's for

Teams that want to use AI agents for software development but need governance, reliability, and accountability. It's for operators who become "decision stewards" — framing open questions, resolving them, and monitoring the pipeline — while the framework handles typing and rubber-stamping. It targets mature codebases where ungoverned AI causes quality and stability regressions.

Highlights

• Cost asymmetry — operator decisions made upfront with full context are cheap and mostly correct; mid-execution AI decisions are expensive and often wrong.
• DoR gate prevents dispatch until the operator actually decides.
• Cross-harness review enforces reviewer independence by construction, making collusion impossible.
• DSSE attestations seal every change, and merging follows governance.allowMerge rules.
• Kubernetes-style API maturity — v1alpha1 spec with JSON Schemas, RFC process, and a conformance test suite.
• Multiple SDKs — TypeScript, Python, Go, plus a Claude Code plugin and MCP server.
• Declarative governance — quality gates and compliance postures (EU AI Act, NIST AI RMF, ISO 42001) as resources.