v1.0.0 — Reviewable AI-assisted delivery

AgentFlow SDLC v1.0.0 — Reviewable AI-assisted delivery

AgentFlow SDLC 1.0 is the first stable release of the framework: a process layer for teams that want the speed of AI-assisted development without losing clarity, review, or control. It works with your repository and GitHub workflow rather than replacing them.

What you can do with AgentFlow 1.0

Adopt a shared AI delivery process without surrendering project ownership

• Start a new adoption with guided, review-first onboarding that inspects the target repository before proposing changes.
• Update an existing installation through deterministic planning, ownership-aware file classification, conflict detection, and explicit approval before sync.
• Keep project-owned configuration and conventions intact through managed, seed-once, hand-merged, and extension ownership rules.
• Check environment, installation, framework drift, configuration, and migration readiness from the CLI.

Move work from request to pull request through visible roles

• Use one accountable executor by default across product framing, analysis, architecture, planning, implementation, testing, review, documentation, and PR readiness.
• Choose bounded, standard, high-assurance, or exploratory workflow profiles based on scope and risk.
• Enforce allowed phase transitions, branch strategy, issue standards, review policy, and PR closeout expectations.
• Route selected roles to another registered runtime when a project deliberately configures that ownership.
• Preserve unfinished work with explicit next-phase contracts instead of relying on private chat history.

Make evidence portable, durable, and reviewable

• Record requirement, decision, validation, review, documentation, and handoff evidence in issues, comments, commits, and PR bodies.
• Use canonical artifact references, lifecycle events, delivery handoffs, action boundaries, and transition envelopes across tools.
• Distinguish the platform that produced evidence from the execution target, transport, delegation boundary, context boundary, and model used.
• Validate role passes, handovers, PR manifests, attribution, lifecycle contracts, and evidence envelopes before they become delivery claims.
• Keep local .agent-runs/ data as disposable scratch while durable GitHub evidence remains resumable by humans or another agent.

Scale intelligence without turning agent count into the goal

• Keep clear work single-agent and add focused advisory review, councils, parallel discovery, isolated spikes, or human gates only when they improve a decision.
• Resolve portable capabilities such as plan-before-edit, workflow orchestration, bounded loops, and delegated subagents against the selected harness.
• Record whether a capability was native, package-backed, framework-emulated, manual, optional-unavailable, or required-unavailable.
• Validate collaboration evidence and reject false claims such as presenting self-review as independent review or a provider model call as a local agent runtime.

Preserve human authority where consequences are higher

• Require human security and acceptance review for high-assurance work.
• Separate workflow profile from action authority so an agent can observe, propose, edit, open a PR, or perform an external action only within the approved boundary.
• Keep guarded actions previewable and auditable, with confirmation and authorization requirements for consequential writes.
• Turn out-of-scope findings into visible follow-up issues instead of hidden TODOs or silent scope growth.

Validate the framework and the work deterministically

• Use CLI checks for issues, specs, branches, configuration, roles, skills, agents, extensions, evidence, lifecycle state, collaboration, PRs, releases, and migrations.
• Run executable agent evals against versioned fixtures and manifests rather than relying only on prose review.
• Validate the publishable npm payload, native harness manifests, structural settings merges, sandbox behavior, and Cockpit smoke paths through one release gate.
• Derive outcome metrics such as cycle time, first-pass validation, review latency, release lead time, follow-up age, and incident-to-regression-eval time from lifecycle evidence.

Use the framework across supported AI work surfaces

• Install canonical adapters, manifests, skills, and settings for Claude Code, Codex, Agy, and Pi.
• Register ChatGPT, Cowork, Antigravity, human work, and project-specific future platforms as truthful evidence identities without implying unsupported execution routing.
• Package the same SDLC definition, schemas, validators, role contracts, and evidence vocabulary for consuming repositories.
• Add optional extension packs without changing the stable core contract or silently enabling new policy.

Operate visually when a command center helps

• Use the optional AgentFlow Cockpit to view goals, epics, selected paths, role flow, readiness, releases, approvals, follow-ups, and replayable goal stories.
• Keep GitHub as the durable source of truth while Cockpit provides a goal-centered operational lens.
• Run the CLI and GitHub workflow without Cockpit; the visual interface remains optional.

Govern integration and releases as part of the SDLC

• Project integrated issues from development into release state with explicit lifecycle metadata.
• Plan versions with configurable strategies, validate release notes and package metadata, and verify tag-to-release closeout.
• Keep release notes focused on what adopting teams can do, with issue and PR references as supporting evidence.

Getting started

AgentFlow 1.0 requires Node.js 20 or newer. The supported path for this release is source-based adoption:

node bin/cli.mjs doctor-env --target /path/to/your-project
node bin/cli.mjs onboarding-prompt --target /path/to/your-project

If your repository already uses AgentFlow, generate the assisted-update handoff instead:

node bin/cli.mjs update-prompt --target /path/to/your-project

Review the generated plan before initialization, sync, settings changes, commits, pushes, or PR creation. See Get started and Assisted update for the full workflows.

Compatibility and boundaries

• Version 1.0 establishes the stable mainline contract after v0.7.0; adopters should use the assisted-update flow because policy, evidence, packaging, and generated adapter surfaces have materially expanded.
• The agentflow-sdlc npm package is validated as publishable but is not published to npm as part of this GitHub release. Use the repository source until npm availability is announced.
• Cockpit is optional and GitHub-backed. CLI and repository workflows remain fully usable without it.
• Registered platform identity does not automatically make a platform routable, and optional multi-agent support never removes the required phase or evidence model.
• High-assurance security and acceptance decisions still require a human reviewer.

Release confidence

The maintained v1 gate covers the full automated test suite, executable agent evals, sandbox and Cockpit smoke tests, npm payload validation, harness plugin manifests, and structural settings merge checks. The release is published only after that gate, versioning validation, promotion-PR checks, and tag/release closeout verification pass.

Supporting delivery history

The v1 product line integrates the SDLC definition kernel, migration and audit scaffolding, Cockpit Goal Command Center, release lens, publish-grade harness packaging, runtime identity registry, executable evidence contracts, evals, and user documentation delivered across PRs #173 through #183.

Increase intelligence per decision, not agents per task.