For managers and leads
What SDLP is
SDLP is Techvify's stage-gated backbone for software delivery: 5 stages, 5 Quality Gates, from Initiation to Closeout. It applies to both Fixed-Price (PB) and ODC projects, and it runs in two lanes — a Standard Lane and an AI-Assisted Lane (ADLC) — chosen per stage at planning time and recorded in the Project Plan.
SDLP is not a way of working
Quoted from the source document: "SDLP is a stage-gate governance framework, NOT a lifecycle/execution model like Agile, Scrum, or Waterfall — teams choose their own execution methodology within each stage; the SDLP only fixes the objective and the Gate." That is why the two D3 runbooks sit underneath this page, not beside it: they describe how work actually runs inside these stages.
Before a project starts — agreeing what applies
D3 practice
Before a project starts, the PM sits down with PQA and agrees the process for that specific project. Not every project applies the whole framework. What the two of them agree is recorded in the Project Plan, and that becomes the version of SDLP the project is audited against.
What the source document says
- The lane is chosen per stage — Standard, AI-Assisted, or a mix of both — decided at planning time by DM/PM and documented in the Project Plan tailoring section.
- Waived items are marked N/A with the reason recorded, and the tailoring is approved per the Process Tailoring guideline.
- At a gate, any item not met needs a waiver approved by the DM before sign-off.
- PQA is a service role, not present on every project by default. When PQA is not engaged, PM / Tech Lead / QA Lead perform the same checks themselves against the same criteria.
The 5 stages
1Initiation
Scope and operating model established.
Charter & plan approved; requirements signed off; risks & environment ready.
Gate 1
2Definition
What will be built is agreed and baselined.
Requirements baselined; scope committed in writing; backlog & test strategy set.
Gate 2
3Solution & Architecture
The solution is decided and made buildable.
Design & decisions approved; security reviewed; pipeline & work breakdown ready.
Gate 3
4Execution & Testing
Built and verified until fit to release.
Quality thresholds met; no critical defects open; release candidate verified.
Gate 4
5Deployment & Closeout
Released, accepted and formally closed.
Release validated; client acceptance obtained; closure & lessons recorded.
Gate 5
Stage detail — both lanes
Every activity from the source workbook, side by side. Open a stage to see what each lane does, who is accountable, and what comes out.
1
Charter & plan approved; requirements signed off; risks & environment ready.
Standard Lane
1Open the project and register it in the Project Archive Library (PAL).
2Conduct the project kick-off meeting with key stakeholders and confirm the agenda.
3Create the Project Plan, covering schedule, resources, communication, quality and budget, and establish the Risk Register.
4Elicit the Business Requirements Document (BRD), obtain written sign-off, and initialize the security requirements.
5Prepare the development environment and tooling by provisioning dev, test and staging infrastructure, and configuring IDEs, ticketing and internal tools.
AI-Assisted Lane (ADLC)
1Open the project and register it in the Project Archive Library (PAL) — the same administrative step as the Standard lane, since it happens before any AI tooling is engaged.
2Conduct the kick-off meeting together with the Standard lane team, confirming the AI-Assisted lane as one of the topics agreed at this meeting.
3Let AI analyze historical project data to benchmark estimates and detect risk patterns, then draft a Project Plan for the PM to review.
4Elicit the BRD and obtain written sign-off, then initialize the security requirements, using the same approach as the Standard lane.
5Install the SpecKit toolkit, set up the project's constitution file defining its coding principles, capture the environment profile, and enable real-time security scanning in the IDE.
Gate 1 criteria — applies to both lanes
Kick-off minutes signed; Project Plan approved (incl. Quality Plan + budget); BRD written sign-off; Risk Register initialized; Security Requirements in BRD; dev/test environment ready.
2
Requirements baselined; scope committed in writing; backlog & test strategy set.
Standard Lane
1Elicit user and business requirements, then produce the User Requirements Document (URD) with all open questions resolved.
2Translate the URD into the Software Requirements Specification (SRS), then have it reviewed and approved by the PM and the client.
3Create Figma mockups and prototypes to visualize the proposed design.
4Build the Product Backlog with prioritized user stories and acceptance criteria, approved by the Product Owner.
5Create the Test Plan with a defined pass-rate threshold, and build the Requirements Traceability Matrix (RTM).
AI-Assisted Lane (ADLC)
1Elicit requirements and produce the URD with all questions resolved — the same human-led step used in the Standard lane, feeding the same URD into the AI-generated specification.
2Create the Figma design with node IDs, design tokens, component states and responsive breakpoints, so it is fully machine-readable before the AI analysis stage begins.
3Let AI generate the specification document by reconciling the user story, the Figma design and prior analysis into structured user stories, testable acceptance criteria and functional requirements.
4Confirm the Product Backlog directly from the specification document, ensuring every backlog item is linked to a specification artifact.
5Create the Test Plan and, optionally, let AI expand it into detailed test cases, tracing back to the specification instead of a separate traceability matrix.
Gate 2 criteria — applies to both lanes
SRS approved; scope committed in writing; Q&A resolved; Product Backlog + Test Plan approved; traceability established (RTM).
3
Design & decisions approved; security reviewed; pipeline & work breakdown ready.
Standard Lane
1Design the High-Level Design (HLD) and the accompanying Architecture Decision Records (ADRs).
2Produce the Low-Level Design (LLD), including UML diagrams and API contracts.
3Conduct a Security Design Review following OWASP guidelines.
4Set up the CI/CD environments and define the team's coding conventions.
5Decompose the HLD into a Technical Backlog, and produce the PI Plan and Integration Checklist.
AI-Assisted Lane (ADLC)
1Design the HLD and ADRs with AI support for anti-pattern review, while the Solution Architect retains ownership of the final architectural decision.
2Let AI generate the technical plan once the specification is approved, covering the constitution compliance check, data model, API contracts and project structure.
3Let AI break the technical plan down into an ordered task list, naming exactly what each task touches.
4Note that translating the design into code happens later, as part of implementation in the Execution & Testing stage, not as a separate architecture-stage activity.
5Draft a threat model and testable security requirements from the specification before coding begins, keeping security a checkpoint in the pipeline rather than a review at the end.
6Set up the CI/CD environment as in the Standard lane, plus configure the repository-indexing tool that lets AI reason over the whole codebase once implementation begins in the next stage.
Gate 3 criteria — applies to both lanes
HLD/LLD approved; ADRs documented; CI/CD operational; PI Plan/Checklist completed; Tech Backlog ready.
4
Quality thresholds met; no critical defects open; release candidate verified.
Standard Lane
1Plan the iteration by defining its objective, completion criteria and task list.
2Develop features through self-review, peer review and Tech Lead approval, with CI/CD running on every commit.
3Execute unit, integration and regression testing per the Test Plan to reach a pass rate of at least 95%, and run performance and load testing against the defined thresholds.
5Conduct the increment review and retrospective, then publish the Progress Report comparing planned versus actual effort and recording any corrective action.
AI-Assisted Lane (ADLC)
1Confirm the task list scope fits the iteration capacity before the iteration starts.
2Review all approved artifacts, then let AI implement the code phase by phase from the task list, reading the design tokens from the earlier analysis, with security gates running on every commit.
3Prepare the test environment, then let AI run the automated test pipeline end to end: inspecting the application, generating test scenarios and page objects, executing the full suite, and running load testing.
4Have a named engineer review the AI-generated QA report and make the mandatory go or no-go decision before the pull request can proceed.
5Conduct the increment review and retrospective, then publish the Progress Report — the same ceremony as the Standard lane, with an additional audit of AI artifact completeness where PQA is engaged.
Gate 4 criteria — applies to both lanes
Test pass rate >=95%; performance/load test meets defined thresholds; no open Critical/High bugs; code review + SAST clean.
5
Release validated; client acceptance obtained; closure & lessons recorded.
Standard Lane
1Perform the Final Inspection (FI), a comprehensive pre-release check of the release candidate.
2Prepare the Deployment Checklist, covering the go/no-go decision, backup plan and rollback trigger.
3Deploy to production and monitor the system for 24 to 48 hours afterward.
4Support User Acceptance Testing (UAT) and any resulting hotfixes, then obtain the UAT sign-off.
5Prepare the Quality Report and handover materials, conduct the post-mortem, and record the Lesson Learned before archiving in the QMS.
AI-Assisted Lane (ADLC)
1Perform the Final Inspection, the same comprehensive pre-release check used in the Standard lane, since it validates the release itself rather than how it was built.
2Prepare the Deployment Checklist as in the Standard lane, with AI log monitoring configured and production promotion gated through an automated release pipeline that always starts in a lower environment first.
3Promote to production automatically through the CI/CD release pipeline, with AI monitoring logs for anomalies.
4Support User Acceptance Testing and any hotfixes, then obtain sign-off — the same process as the Standard lane, since UAT validates business behavior regardless of which lane built the release.
5Let AI draft the Lesson Learned from tickets, commits and the QA report for human review, and automatically score how closely delivery followed the process, feeding any gaps back into the next project cycle.
Gate 5 criteria — applies to both lanes
FI (Final Inspection) passed; UAT signed off; go-no-go + backup/recovery + rollback trigger + post-deploy monitoring met; Acceptance Note signed; CSS + Lesson Learned + QMS archive complete.
The 5 Quality Gates
This is the acceptance criteria list a project is signed off against. Every item must be Required-and-Met, or carry a waiver approved by the DM, before the gate is passed. Open a gate to see its criteria.
Generic criteria — apply at every gate
- G1Have the objectives / exit criteria of this stage been completely satisfied AND approved by the appropriate person (not just completed)?
- G2Are all work products of this stage completed, reviewed, and stored per the QMS artifact convention?
- G3Does the NEXT stage's plan (process, resource, effort, schedule, quality) provide sufficient assurance of good-quality output?
- G4Is the quality of inputs being handed to the NEXT stage good enough to ensure good-quality work product there?
Legend✓required in that lane–not applicableRTM req.required, but through a different artifact
1
#GroupCriterionStdAIVerifierEvidence
1GovernanceKick-off meeting conducted; minutes signed and archivedStandard✓AI lane✓DM/PMMinutes document
2PlanningProject Plan approved by DM (schedule, resource, Quality Plan, budget, tailoring lane)Standard✓AI lane✓DMProject Plan
3RequirementsBRD approved - written sign-off (verbal not acceptable)Standard✓AI lane✓PM/ClientSigned BRD
4RiskRisk Register initialized (>=5 risks, mitigation + probability)Standard✓AI lane✓PMRisk Register
5SecuritySecurity requirements section in BRDStandard✓AI lane✓BABRD section
6ToolingProject Folder created; project registered in PALStandard✓AI lane✓PMFolder + PAL
7TimingGate completed within 7 working days from Actual Start DateStandard✓AI lane✓PMTimeline
2
#GroupCriterionStdAIVerifierEvidence
1RequirementsSRS approved by PM + Client - written sign-offStandard✓AI lane–spec.mdPM/ClientSigned SRS
2Requirementsspec.md approved by PO/BA [AI lane]Standard–AI lane✓PO/BAspec.md in repo
3RequirementsScope formally committed in writingStandard✓AI lane✓PMWritten commitment
4RequirementsAll Q&A items resolved - zero blocking questionsStandard✓AI lane✓BAQ&A File
5AI Artifactspreplan.md committed to repoStandard–AI lane✓SERepo: preplan.md
6AI Artifactsspec.md + checklists/requirements.md committedStandard–AI lane✓SERepo: spec.md
7BacklogProduct Backlog created (User Stories + AC) in Jira/ADOStandard✓AI lane✓PMJira/ADO
8TestingTest Plan approved with pass-rate threshold definedStandard✓AI lane✓QA LeadTest Plan
9TraceabilityTraceable BRD->SRS->Test Cases [Std: RTM / AI: spec chain]StandardRTM req.AI laneSpec chain req.BA/QC/PQARTM or repo
10SecuritySecurity NFRs included in SRS/spec.mdStandard✓AI lane✓BASRS/spec.md
3
#GroupCriterionStdAIVerifierEvidence
1DesignHLD approved by DM/HOD + ClientStandard✓AI lane✓DM/HODHLD document
2DesignLLD approved by Tech LeadStandard✓AI lane✓Tech LeadLLD document
3DesignADRs documented for key decisionsStandard✓AI lane✓SA/TLADR document
4AI Artifactsplan.md reviewed (Constitution Check = PASS) [AI lane]Standard–AI lane✓Tech Leadplan.md in repo
5AI Artifactstasks.md reviewed by PM/SE [AI lane]Standard–AI lane✓PM/SEtasks.md in repo
6SecuritySecurity design review completed; threats in ADRStandard✓AI lane✓SA/TLADR (security)
7InfrastructureCI/CD pipeline operationalStandard✓AI lane✓DevOpsPipeline demo
8InfrastructureCoding convention publishedStandard✓AI lane✓Tech LeadConvention doc
9IntegrationPI Plan + integration checklist completedStandard✓AI lane–Tech LeadPI Plan
10PlanningTech Backlog / tasks.md ready for the first iterationStandard✓AI lane✓PMBacklog/tasks.md
4
#GroupCriterionStdAIVerifierEvidence
1QualityAll Iteration Objectives met - completion criteria (Definition of Done or equivalent) verifiedStandard✓AI lane✓PMIteration/progress reports
2QualityTest pass rate >= 95% regression; performance/load test meets defined thresholds, 0 regressionsStandard✓AI lane✓QCTest Report
3QualityNo open Critical/High bugs at Code FreezeStandard✓AI lane✓QC/PMBug tracker
4CodeCode Review completed on all PRsStandard✓AI lane✓Tech LeadPR history
5CodeSAST clean - SonarQube Quality Gate PASSStandard✓AI lane✓DevOps/TLSonarQube report
6AI ArtifactsAll 5 mandatory artifacts in PR presentStandard–AI lane✓PQAPR artifacts
7AI ArtifactsQualityGatekeeper review completedStandard–AI lane✓SE/QCqa-report.md
8TestingDAST test completed in STGStandard✓AI lane✓QC/DevOpsDAST Report
9BuildRelease Candidate deployed to STG; smoke test passedStandard✓AI lane✓DevOpsSTG deployment
10ReportingPlanned-vs-actual reported, overruns resolvedStandard✓AI lane✓PMWeekly Report
11Sign-offPM + Tech Lead both sign off Code FreezeStandard✓AI lane✓PM/TLSign-off doc
5
#GroupCriterionStdAIVerifierEvidence
1UATUAT completed and signed off by ClientStandard✓AI lane✓Client/PMUAT Sign-off
2UATCritical/High UAT defects resolved and re-testedStandard✓AI lane✓QC/PMBug tracker
3DeploymentGo-no-go criteria metStandard✓AI lane✓PM/TLChecklist
4DeploymentBackup/recovery point confirmedStandard✓AI lane✓DevOpsBackup log
5DeploymentPost-deploy monitoring >= 24hStandard✓AI lane✓DevOpsMonitoring log
6DeploymentRollback trigger defined and team briefedStandard✓AI lane✓PM/DevOpsRunbook
7SecurityFinal DAST scan before go-liveStandard✓AI lane✓DevOps/QCDAST report
8HandoverAcceptance Note signed by ClientStandard✓AI lane✓Client/PMAcceptance Note
9HandoverUser Manual + Installation Guide deliveredStandard✓AI lane✓BAHandover package
10ClosureCSS submittedStandard✓AI lane✓PMCSS record
11ClosureLesson Learned documented (structured)Standard✓AI lane✓PMLesson Learned
12ClosureArtifacts uploaded to QMS/PAL with metadataStandard✓AI lane✓PM/PQAPAL/QMS
13ClosureClosure Report approved by DMStandard✓AI lane✓DMClosure Report
PQA performs this if the PQA service is engaged on the project; otherwise QA Lead + Tech Lead self-check. FI is distinct from PCV: PCV audits whether the team followed the process, FI inspects whether the product itself is ready for release.
#GroupCriterionStdAIVerifierEvidence
1CodeCode freeze confirmed - no changes to Release Candidate since Gate 4Standard✓AI lane·Tech LeadGit tag / release record
2TestingAll test results (Unit/Integration/System/Regression) documented and archivedStandard✓AI lane·QCTest Report
3DocumentationUser Manual, Installation Guide, and Release Note finalizedStandard✓AI lane·BAHandover package
4SecuritySAST/DAST results clean - no unresolved Critical/High vulnerabilitiesStandard✓AI lane·DevOps/QCScan report
5ComplianceLicense / IP compliance verified - no unauthorized dependenciesStandard✓AI lane·Tech LeadDependency audit
6Build IntegrityDeployment package matches signed-off Release Candidate (version/checksum)Standard✓AI lane·DevOpsBuild manifest
7RollbackRollback plan tested and confirmed readyStandard✓AI lane·DevOpsRollback runbook
Mandatory work products
Per feature, from the ADLC guideline. A pull request missing one of these fails the PQA audit.
preplan.mdMandatory
Figma node inventory, UI analysis per screen, mismatch report, resolved PO Q&A, implementation directives.
spec.mdMandatory
User Stories, Acceptance Criteria (BDD), FR-xxx requirements, non-functional requirements.
plan.mdMandatory
Constitution PASS gate, data model, API contracts (OpenAPI YAML), project file structure.
tasks.mdMandatory
Atomic task breakdown, phased, dependency-ordered, effort estimated. Input to /speckit-implement.
qa-report.mdMandatory
BDD pass/fail per test scenario, FR coverage map, root cause analysis, QualityGatekeeper decision.
BRDMandatory
Business Requirement Document: scope, business use cases, rules, ACs, risks, stakeholder list.
Figma DesignMandatory
UI/UX mockup with node IDs, design tokens, component states, and responsive breakpoints.
Production CodeMandatory
Frontend (Vue 3/TS) + Backend (.NET Clean Architecture) + database migrations.
E2E Test FilesMandatory
Playwright BDD test suite: Gherkin .feature files + Page Object TypeScript classes.
API Contracts (OpenAPI)Mandatory
OpenAPI specifications for all new or modified endpoints introduced by the feature.
research.mdMandatory
Technology decisions, library evaluations for Phase 0 Research.
Change Request DocConditional
Formal scope change record per Change Request Process.
constitution.mdConditional
Project-specific engineering principles and non-negotiable coding rules.
PR descriptionMandatory
Pull Request summary: artifact checklist, QA summary, Constitution compliance, test coverage overview.
Roles
Delivery Manager (DM)
Approve Project Plan, Charter, Architecture, and Closure. Governance oversight of all stage-gate decisions. Escalation point for risks and issues.
Project Manager (PM)
Own Project Plan, schedule, Risk Register, Quality Plan, budget, communication. Track planned-vs-actual effort with corrective action. Gate sign-off coordination. Weekly reporting.
Business Analyst (BA)
Analyze and document requirements (URD, BRD, SRS). Review spec.md for business intent [AI lane]. Maintain traceability. Obtain formal written scope sign-off.
Solution Architecture (SA)
Design HLD and lead Architecture Decision Records. Review AI-assisted architecture analysis; owns final architecture decisions.
Technical Leader (TL)
Review plan.md for architecture/DDD/API contracts [AI lane]. Set up constitution.md [AI lane]. Approve Pull Requests. Sign-off on Code Freeze. Co-owns FI (Final Inspection) with QA Lead before production deployment at Stage 5.
Software Engineer (Developer) (SE)
Execute SpecKit workflow commands [AI lane]. Review EVERY AI-generated code block. Perform QualityGatekeeper review before PR creation [AI lane]. Own all engineering decisions.
Quality Control (QC)
Execute Unit/Integration/System/Regression testing per pass-rate threshold. Review qa-report.md and validate QualityGatekeeper decisions [AI lane].
DevOps (DevOps)
Set up CI/CD; configure SAST/DAST tools; execute production deployments; own backup/recovery and rollback procedures.
AI Engineer (AI Engineer)
Develop and maintain AI-powered applications; support AI tooling configuration for ADLC-adopting projects.
UI/UX Designer (UI/UX)
Prepare Figma mockups with node IDs, design tokens, component states. Ensure Figma is ready before /speckit-preplan [AI lane].
Comtor (Comtor)
Interpret in client meetings; translate documents and technical materials.
Product Owner (PO)
Define product vision; manage Product Backlog; approve BRD/spec.md before technical planning; validate delivered features during UAT.
Bridge Software Engineer (BrSE)
Understand and analyze requirements from clients; bridge communication between client and delivery team.
Process Quality Assurance (PQA)
PQA is a SERVICE role, not present on every project by default - engaged per project agreement. When engaged: conducts Process Compliance Verification (PCV) at stage boundaries via the 6-step Quality Gate Review (tailor checklist, audit OK/NOK/N/A, evaluate performance, summarize, report, follow up Findings), audits mandatory artifacts and QualityGatekeeper completion [AI lane], and performs Final Inspection (FI) at Stage 5. See 04_Quality Gate Checklist for full workflow. When PQA is NOT engaged, these checks are self-performed by PM/Tech Lead/QA Lead using the same Gate criteria.
Account Manager (AM)
Engage customers on needs/expectations; facilitate commercial discussions; present at Kick-off.
Technical Consultant (Tech Consultant)
Analyze, consult, and propose technical solutions for complex or specialized engagements.
RACI matrix
R = Responsible · A = Accountable · C = Consulted · I = Informed
| Activity / Deliverable | Stage | PM | DM | BA | TL | SE | QC | PQA | PO | DevOps |
|---|---|---|---|---|---|---|---|---|---|---|
| Project Charter & Plan | S1 | R | A | C | - | - | - | I | - | - |
| BRD (Business Requirement Doc) | S1 | C | I | R | - | - | - | I | A | - |
| Risk Register | S1 | R | A | C | - | - | - | I | - | - |
| URD + SRS / spec.md | S2 | C | I | R | C | C | - | I | A | - |
| Figma Design | S2 | R | I | R | C | I | I | I | A | - |
| Test Plan | S2/3 | C | I | C | C | - | R | I | - | - |
| preplan.md / spec.md [AI] | S2 | I | I | C | - | R | - | I | A | - |
| HLD + LLD + ADR | S3 | C | A | I | R | C | - | I | - | - |
| plan.md + tasks.md [AI] | S3 | C | I | - | A | R | - | I | - | - |
| constitution.md [AI] | S3 | I | I | - | R | C | - | I | - | - |
| CI/CD Pipeline Setup | S3 | I | I | - | A | C | - | I | - | R |
| Iteration Plan (each iteration) | S4 | R | I | I | R | I | I | I | - | - |
| Source Code + PR | S4 | I | I | - | A | R | C | I | - | - |
| Test Case + Test Report | S4 | I | I | - | C | C | R | I | - | - |
| qa-report.md + QualityGatekeeper [AI] | S4 | I | I | - | C | R | R | I | - | - |
| Weekly Report (planned-vs-actual) | S4 | R | I | - | I | I | I | C | - | - |
| PQA Artifact Audit [AI] (if PQA service engaged) | S4 | I | I | - | I | C | C | R | - | - |
| FI - Final Inspection (pre-release) [PQA Service - if engaged] | S5 | A | I | - | R | I | R | C | - | I |
| Deployment Checklist + Go-live | S5 | R | A | - | C | C | I | I | - | R |
| UAT Support | S5 | R | A | C | C | C | R | I | A | - |
| Quality Report | S5 | A | I | I | C | I | R | C | - | - |
| Lesson Learned + QMS Archive | S5 | R | A | C | C | C | C | C | - | - |
| Customer Satisfaction Survey | S5 | R | A | I | - | - | - | I | - | - |
| Stage Gate Sign-offs (all) | All | R | A | C | C | I | C | I | - | - |
How work runs inside these stages
SDLP fixes the objective and the gate. These two runbooks describe the execution model D3 uses inside them.
Sprint Operating Runbook
The AI-Assisted Lane in operational form — SpecKit, the spec chain, QualityGatekeeper. For T&M and staff-aug work.
Fixed-Price Project Runbook
The Standard Lane in operational form — milestones, Change Request workflow, risk and reserve. For fixed-scope contracts.
Source: SDLP_v1.1.xlsx — QMS, Techvify Delivery. This page reproduces that workbook; the workbook remains the source of truth.