Process Modernization Playbook
How SDLC.ai agents support the VIRIM IT Process Center lifecycle: deliverable coverage, gate classification, phase-by-phase activities, and human governance boundaries.
SDLC.ai — AI Agents for the VIRIM IT Delivery Process
VIRIM IT delivers projects following the IT Process Center lifecycle, starting with demand intake and running through BRD, SRS, SAD, SES, testing, and deployment, with 29 governance gates and multiple QDRT quality reviews along the way. Delivery teams spend a significant portion of each project on document production, gate evidence assembly, and completeness checks. This work is systematic and repeatable, yet currently done manually on every project. SDLC.ai is a set of AI agents that covers that repeatable work: generating first drafts of deliverables, checking completeness before QDRT submissions, assembling gate evidence packages, and reading existing codebases to produce architecture documentation and change-impact analysis for brownfield projects. Agents run inside VS Code and GitHub Copilot. No new tools or platforms are needed. Approval decisions, governance authority, and sign-off responsibility stay with the people who own them.
How the VM Delivery Process Is Supported
| Phase | Key Activities | AI Role |
|---|---|---|
| PLAN |
Demand intake, BRD authoring, ROM estimate, SOW, gate packages G0–G6
Human: IT Board (G3), Final Funding (G6/G7), SDC AVD go/no-go
|
GEN ASST |
| DELIVER Solution Analysis |
BRD detailed sections, SRS, SAD, RTM (BRD→SRS→SAD), Master Test Strategy, QDRT-1, QDRT-2
Human: OU BRD sign-off, SDC SAD review, QDRT team findings
|
GEN VAL |
| DELIVER Solution Engineering |
SES authoring, RTM (SAD→SES), solution test plan, test cases, QDRT-3
Human: SDC SES review, Security sign-off, standards deviations
|
GEN ASST |
| DELIVER Solution Build |
Code generation, unit tests, code review, security review, QDRT-4
Human: SDC code/config approval, CAB Normal Change, UAT execution
|
ASST GEN |
| DELIVER Test Management |
Test execution, test data, defect logging, performance testing, test reports, STPS Gate 3
Human: UAT sign-off, P1 escalation, test scope decisions
|
AUTO GEN |
| RUN |
CRQ assembly, deployment readiness, release notes, project close, STPS Gate 4
Human: CAB approval, PIV confirmation, PGC Gate 7 closure
|
AUTO ASST |
Where AI Generates, Assists, and Validates
Agent-Generated First Drafts GEN
BRD, SRS, SAD, SES, ROM Estimate, SOW, Master Test Strategy, RTM, User Stories, Test Cases, Test Reports, CRQ package, Release Notes, Developer Documentation.
Agent-Assisted Preparation ASST
Gate checklist population (STPS Gates 1–4, PGC Gates 1–7), QDRT pre-submission completeness validation, RTM chain extension, CRQ evidence assembly, deployment readiness checks.
Agent-Validated Quality Gates VAL
RTM completeness, VM template compliance, OWASP/CWE security scan, SOX ITGC control evidence, architecture governance criteria (SDC entrance criteria), QDRT pre-submission checks.
Existing System Analysis
For projects with existing systems, the Reverse Engineering Agent produces architecture documentation and a dependency map. Change Impact Analysis flags which modules are affected before design begins. Security Analysis scans for OWASP Top 10 gaps.
Multi-Archetype Support
Agents support all 11 VM project archetypes: Custom Application (CA), LCNC/RPA, SAP, COTS, Cloud Migration, Data Platform, and Infrastructure. The SES Generation Orchestrator routes to the correct platform-specific sections based on archetype.
How to Navigate This Playbook
Deliverable Map tab
Which deliverables have agent coverage, what enhancements are still required (MCP integration, knowledge corpus), and what is still missing from the portfolio.
Phase tabs (PLAN / DELIVER / RUN)
Phase-by-phase breakdown: which activities change, which agents are involved, and where approval authority stays with people.
All Gates tab
Classification of all 29 VM governance gates: which are agent-prepared, agent-assisted, or fully human.
Persona Changes tab
How each role shifts from producing documents to reviewing and validating what agents produce.
VM Deliverable Map — Agent Coverage, Status, and Enhancement Required
Process Deliverables, Agent Presence, and What Each Agent Still Needs
| Phase | Deliverable | Agent(s) Built | Status | Notes and Enhancement Required |
|---|---|---|---|---|
| PLAN | Investment Proposal |
None built yet | MISSING | No dedicated agent in the current portfolio. Candidate for later-wave development. Would depend on SharePoint historical proposal corpus and BRD generation maturity.
|
| PLAN | IT Operating Plan |
None (human-only) | HUMAN | Explicitly classified as human-only in current analysis. Portfolio-level prioritization and budget decisions are not candidates for AI generation. |
| PLAN / DELIVER | BRD |
2-BRD-Interview-Agent 2-BRD-Generation-Agent | PRESENT / VERIFY |
Both agents are built. Interview agent conducts structured stakeholder discovery. Generation agent drafts BRD using the real 6-part VM BRD template structure (v1.1.0 — corrected from synthesized model; User Stories/Features as Part 3). Scope verification needed against final VM BRD authoring workflow.
MCP: SharePoint read — for accessing historical OU BRDs as generation context.
Corpus: VM BRD template library and prior approved BRDs required for full accuracy. |
| PLAN / DELIVER | SRS |
2-SRS-Generation-Agent | PRESENT / MCP |
Agent is built and generates SRS from BRD input. Planned enhancement is SharePoint MCP read for historical SRS context and tighter VM regulatory-mapping templates.
MCP: SharePoint read — historical SRS documents as generation context.
Corpus: VM SRS template and regulatory applicability corpus (NERC, FERC, CPUC mappings). |
| PLAN / DELIVER | SAD |
2-SAD-Generation-Agent | PRESENT / VERIFY |
Agent is built and generates SAD from SRS and AVD inputs. Needs scope verification for logical-architecture completeness and SDC entrance criteria alignment.
MCP: SharePoint read — prior approved SADs for pattern reuse and brownfield context.
Corpus: VM architecture patterns, technology standards catalogue, SDC entrance criteria. |
| PLAN | ROM Estimate |
2-ROM-Estimation-Agent | PRESENT / VERIFY |
Agent is built. Produces ROM range from BRD scope using archetype-calibrated multipliers. Calibration to VM historical actuals will significantly improve accuracy.
Corpus: VM historical actuals database (actuals vs estimates per project type, size, archetype). Currently uses generic industry calibration factors.
|
| PLAN | AVD (Architecture Vision Document) |
2-AVD-Generation-Agent | PRESENT |
2-AVD-Generation-Agent built from VM AVD Template v3.0. Covers all 3 sections and 8 subsections. Includes SDC Review Prep Checklist (10 questions). Gate: QDRT-1. SharePoint historical AVD context pending MCP integration.
|
| PLAN / DELIVER | SOW |
2-SOW-Generation-Agent | PRESENT / VERIFY |
Agent is built. Generates SOW from BRD and project context. Needs verification of fit to MSP-focused VM SOW structure and access to SharePoint template sources.
MCP: SharePoint read — VM SOW templates and prior approved SOWs as formatting reference.
|
| PLAN / DELIVER | Solution Analysis Estimate |
2-Solution-Analysis-Estimation-Agent | PRESENT / VERIFY |
Agent is built. Combines ROM with SAD architectural complexity to produce Step 2 funding estimate. Scope verification needed for PPGC submission requirements and dependency on SAD maturity.
|
| PLAN / DELIVER | User Stories |
2-User-Story-Agent | PRESENT / MCP |
Agent is built and decomposes BRD into stories with acceptance criteria. Currently writes to local files. Planned enhancement is direct Octane integration for write-back and Jira as an alternative ALM path.
MCP: Octane write — upload generated stories directly to Octane ALM. Jira write — alternative path for teams using Jira. Octane read — read existing stories to avoid duplication.
|
| PLAN / DELIVER | RTM (Requirements Traceability Matrix) |
2-Lifecycle-Traceability-Agent | PRESENT / MCP |
Agent is built and generates RTM across the BRD→SRS→SAD→Code→Test chain. Planned expansion adds test reports, defect records, CRQ artifacts, and deployment evidence to cover the full delivery chain.
MCP: Octane read — test execution and defect data; Helix read — CRQ and deployment evidence. Needed to complete the downstream half of the RTM chain.
|
| PLAN / DELIVER | Master Test Strategy |
2-Test-Strategy-Agent | PRESENT / VERIFY |
Agent is built. Generates Master Test Strategy from SRS and project context. Needs scope verification against VM TCoE Test Management Process and confirmation that the strategy scope does not overlap with test-case-level generation agents.
Corpus: VM historical test strategies and TCoE test classification standards for accurate test type inclusion.
|
| DELIVER | SDS (Software Design Specification) |
4-SDS-Generation-Agent | PRESENT |
Agent is built. Generates Software Design Specification from SRS using the 8-section VM SDS template: use-case model, class/state/sequence diagrams, screen and component design specs, business service specifications, and deployment notes. Applies to Custom Application archetypes (A1–A4). Gate: QDRT-3.
Corpus: Prior approved SDS documents as formatting and use-case reference. VM SDS template library for CA archetype variants.
|
| DELIVER | FDS (Functional Design Specification) |
4-FDS-Generation-Agent | PRESENT |
Agent is built. Generates Functional Design Specification per VM RICEF template v2.1 for SAP/ERP development objects (Forms, Reports, Interfaces, Enhancements, Workflows). Operates in batch-production mode — one FDS per development object. Applies to SAP/ERP archetype (A6). Gate: QDRT-3.
Corpus: Prior approved FDS documents and VM RICEF specifications per development object type for accuracy calibration.
|
| DELIVER | SES (System Engineering Specification) |
4-SES-Generation-Orchestrator 4-Solution-Design-Agent 4-API-Design-Agent 4-Data-Model-Design-Agent | PRESENT / VERIFY |
Orchestrator and all specialist sub-agents are built. Orchestrator coordinates business, information, technical, security, and decommissioning SES sections. Needs scope verification for consolidated SES packaging and QDRT-3 evidence submission format.
Corpus: Prior approved SES documents as formatting and content reference. VM SES template library for each archetype variant (CA, LCNC, SAP, COTS).
|
| DELIVER | Test Cases and Automated Scripts |
5-Test-Case-Design-Agent 5-Test-Automation-Agent | PRESENT / MCP |
Both agents are built. Test Case Design Agent generates test catalog from SRS and BRD. Test Automation Agent converts to executable suites with CI workflows. Planned improvement is Octane write-back for direct ALM integration.
MCP: Octane write — upload generated test cases to Octane ALM for traceability and execution tracking.
|
| DELIVER | Test Reports |
5-Test-Report-Agent | PRESENT / MCP |
Agent is built. Generates structured test execution reports from available results data. Currently relies on exported test files. Full capability requires live Octane MCP read for real-time execution data.
MCP: Octane read — live test execution counts, pass/fail status, and defect linkage for real-time report generation.
|
| DELIVER | Defect Records |
5-Defect-Management-Agent | PRESENT / MCP |
Agent is built. Classifies, deduplicates, and triages defects from test execution and code review findings using the VIRIM TCoE taxonomy. Currently produces defect records as output files. Full capability requires direct Octane write.
MCP: Octane write — create and update defect records directly in Octane with consistent taxonomy.
|
| DELIVER | Performance Test Scripts and Report |
5-Performance-Testing-Agent | PRESENT / VERIFY |
Agent is built. Generates k6/JMeter/LoadRunner scripts from SRS NFR thresholds and produces a gate-ready performance evidence report. Needs scope verification for execution-environment assumptions and NFR baseline sourcing.
|
| RUN | CRQ (Change Request) |
6-CRQ-Creation-Agent | PRESENT / BLOCKED |
Agent is built and assembles a complete CRQ evidence package from prior agent artifacts. However, automated submission to Helix / Remedy is blocked until the Helix MCP integration exists. Currently produces a manual submission-ready package.
Blocked on: Helix / Remedy MCP. Full automation (direct CAB submission, status tracking) requires MCP availability. Manual package submission is the current degraded mode.
|
| RUN | Release Notes |
6-Release-Notes-Agent | PRESENT |
Agent is built. Generates structured release notes from git history and PR metadata. Operational today. Octane MCP linkage would add sprint story and defect context to enrich the release narrative.
MCP (optional): Octane read — sprint story and defect closure data to enrich release notes with ALM context beyond git history.
|
| RUN | Deployment Readiness Package |
6-Deployment-Readiness-Agent | PRESENT |
Agent is built. Validates SDLC gate checklists, aggregates test, security, risk, and code review signals into a go/no-go assessment. Operational today as part of the CRQ evidence chain.
|
| RUN | Project Close / STPS Gate 4 Package |
VM-project-checklist-validator 3-Executive-Summary-Agent | PARTIAL |
Checklist validation support exists via skill. Executive Summary Agent can distill project artifacts. However, there is no dedicated user-facing "Project Close" agent that produces a complete STPS Gate 4 package as a single deliverable. Planned for a later wave.
|
PLAN Phase — Intake, Demand and Portfolio Governance
What Changes in This Phase
Demand Intake
Agent pre-fills the intake form from prior OU requests in SharePoint. BRM reviews and adds their own context rather than starting from a blank form.
Investment Proposal
Agent drafts full Investment Proposal from intake form and historical OU proposals. BRM reviews the draft rather than authoring from scratch.
Technology Assessment
Reverse Engineering Agent reads and documents the existing system's architecture. Security Analysis Agent checks it for known vulnerabilities. Solution Architect validates both before the assessment is submitted.
ROM Estimate
Agent generates a parametric ROM range from BRD scope and AVD using archetype-calibrated multipliers. Solution Architect reviews for project-specific adjustments.
Architecture Vision Definition (AVD)
Agent drafts AVD from BRD and prior AVDs when available. Enterprise Architect reviews, amends, and owns the architectural judgment before SDC review.
Step 1 Gate Package
Agent assembles the Project Charter, SA Plan, and Estimate into a gate-ready submission package. No manual evidence collection by the PM.
Agents Involved
| Agent | Status | Purpose |
|---|---|---|
| 2-BRD-Interview-Agent | VERIFY | Structured stakeholder interview; captures BRD input |
| 2-BRD-Generation-Agent | VERIFY | Drafts Investment Proposal and BRD from intake + historical context |
| 2-ROM-Estimation-Agent | VERIFY | Generates ROM estimate from BRD scope |
| 2-SOW-Generation-Agent | VERIFY | Generates SOW for MSP engagement |
| 2-Solution-Analysis-Estimation-Agent | VERIFY | Step 2 estimate from ROM + SAD complexity |
| 3-Reverse-Engineering-Agent | PRESENT | Reads and documents the existing system for Technology Assessment |
| 3-Security-Analysis-Agent | PRESENT | Security landscape assessment during Technology Assessment |
| 0-Agent-Coaching-Insights-Agent | PRESENT | Analyzes agent telemetry to produce coaching insights and reduce manual steering |
| 0-Workspace-Bootstrap-Orchestrator | PRESENT | Bootstraps project workspace with intent, repository clone, and toolkit agent recommendations |
| 1-Implementation-Planning-Agent | PRESENT | Turns approved BRD into a phased implementation plan with vertical slices and acceptance criteria |
| 2-Change-Impact-Analysis-Agent | PRESENT | Blast radius analysis for requirement changes against an existing codebase |
| 2-Cloud-Migration-Assessment-Agent | PRESENT | Cloud migration readiness assessment with 6R strategy classification (Archetype 8) |
| 2-Infrastructure-Change-Impact-Agent | PRESENT | Application blast radius from infrastructure changes and CMDB dependencies (Archetype 9) |
| 2-Requirement-Gap-Analyzer-Agent | PRESENT | Identifies gaps between specification and current codebase implementation |
| 2-Transcript-Reconciliation-Agent | PRESENT | Reconciles meeting transcripts against BRD and user stories to catch missed requirements |
How This Phase Changes
BRD and Investment Proposal Authoring
Teams shift from blank-page authoring to reviewing and refining an agent-produced first draft. Prior OU requests and historical proposals provide the baseline context.
ROM and SA Estimates
Agent generates the parametric estimate structure. SA reviews for project-specific calibration rather than building the estimate spreadsheet from scratch.
Gate Package Assembly
Agent assembles gate submission packages from delivery artifacts. PM reviews and submits rather than manually collecting evidence from multiple sources.
QDRT and Gate Recycling
Agent checks completeness before QDRT and gate submissions, catching gaps before the review team sees the package.
What Will Not Change (Human Gates)
G3 — IT Board Approval
Binding investment authorization with delegated fiduciary authority. Cannot be automated.
G6 / Step 2 Gate — Final Project Funding (PPGC)
Capital budget commitment with regulatory filing implications.
G7 — Finance Review (Treasurers / FRM)
Financial governance threshold above $10M.
OU Relationship and Sponsorship Confirmation
Executive alignment and organizational readiness. This judgment cannot be delegated to an agent.
SDC Go/No-Go on AVD
Architecture governance authority belongs to SDC Chair.
Strategic Priority Trade-offs
Portfolio leadership judgment on competing OU priorities.
DELIVER Phase — Solution Analysis
What Changes in This Phase
BRD Detailed Sections
Agent drafts BRD Sections 2+ from interview transcripts, BRD Section 1, and historical BRDs from SharePoint. OU reviews and approves rather than authoring from scratch.
SRS Authoring
Agent generates SRS from BRD with prior SRS as context. Regulatory mapping is filled in automatically. SA validates and approves rather than authors from scratch. Traceability links to BRD are pre-built.
QDRT-1 (BRD/SRS Review)
Agent checks completeness before submission against the VM completeness rules. Any gaps are resolved before the review team sees the package.
SAD Authoring
Agent drafts from SRS, AVD, and prior SADs. Project Architect reviews and owns architectural decisions. When a Reverse Engineering run exists, those findings are pulled into the SAD automatically.
RTM (BRD → SRS → SAD)
Built from the BRD, SRS, and SAD document chain rather than assembled manually. Checked against the RTM completeness rules before each QDRT submission.
Master Test Strategy
Agent generates from SRS and historical test strategies. QA Lead reviews for project-specific test type inclusions and risk-based adjustments.
Agents Involved
| Agent | Status | Purpose |
|---|---|---|
| 2-BRD-Generation-Agent | VERIFY | Drafts BRD Sections 2+ from transcripts and historical BRDs |
| 2-SRS-Generation-Agent | MCP | Generates SRS from BRD with regulatory auto-mapping |
| 2-Test-Strategy-Agent | VERIFY | Generates Master Test Strategy from SRS |
| 2-SAD-Generation-Agent | VERIFY | Drafts SAD from SRS + AVD + prior SADs |
| 2-Lifecycle-Traceability-Agent | MCP | Auto-generates RTM across BRD → SRS → SAD chain |
| 5-Continuous-Quality-Gate-Agent | PRESENT | Pre-validates documents before QDRT-1 and QDRT-2 submission |
| 3-Code-Optimization-Agent | PRESENT | Code quality, dead code, and performance bottleneck analysis |
| 3-Documentation-Generation-Agent | PRESENT | Generates developer docs, API reference, and onboarding guides from RE Agent output |
| 3-Document-Export-Agent | PRESENT | Converts Markdown documents with Mermaid diagrams to DOCX or PDF |
| 3-ITIL-Incident-Intelligence-Model-Builder | PRESENT | Builds ML classifiers for live ITIL incident routing and auto-categorization |
| 3-L3-User-Flow-Analysis-Agent | PRESENT | L-3 root cause analysis of incident clusters mapped to application user flows |
| 3-Migration-Strategy-Agent | PRESENT | Migration Strategy document for code modernization projects (Archetype 3) |
| 3-Tech-Debt-Review-Agent | PRESENT | Prioritized tech debt register with HTML report and optional GitHub issue creation |
| 3-Test-Evidence-System-Appreciation-Agent | PRESENT | System appreciation baseline from test artifacts when source code is unavailable |
How This Phase Changes
Document Authoring
BRD sections, SRS, SAD, and RTM are all generated by agents as first drafts. Teams shift from writing to reviewing and refining, adding architectural judgment, regulatory context, and business nuance that AI cannot supply.
QDRT Pre-Validation
Agent checks completeness before every QDRT-1 and QDRT-2 submission. Missing sections and broken links are flagged before submission, not during the review.
RTM Generation
The RTM is built from the document chain rather than assembled manually, and updated when source documents change. Completeness is checked before each gate submission.
SharePoint Context (Enhancement Pending)
Full capability for BRD, SRS, and SAD generation depends on SharePoint MCP read access to retrieve historical approved documents as generation context. Without it, agents rely on what is provided locally.
What Will Not Change (Human Gates)
SDC SAD Review Go/No-Go
Architectural governance authority. SDC Chair must own the decision.
QDRT Team Findings Sign-off
Independent quality assurance. QDRT represents a human checks-and-balances control.
Cybersecurity Data Criticality Classification
Security officer judgment on data classification has regulatory implications.
IT Compliance Impact Assessment
SOX, NERC, FERC compliance officers own the regulatory determination.
Stakeholder Sign-off on BRD
Business requirements ownership stays with the Operating Unit.
DELIVER Phase — Solution Engineering
What Changes in This Phase
SES Authoring (Solution Engineering Specification)
The SES Generation Orchestrator coordinates multiple specialist agents to produce all SES sections: business, information, technical, security, decommissioning, and operational. Technical Architect reviews and approves.
RTM Update (SAD → SES)
Lifecycle Traceability Agent extends the RTM chain from SAD to SES. RTM completeness checker validates before QDRT-3 submission.
Solution Test Plan
Agent generates test plan from SRS and SAD produced in the prior phase, with no additional interviews needed.
Test Cases and Scripts
Test Case Design Agent and Test Automation Agent generate test suites from SES and SRS. QA Lead reviews for business alignment and edge-case coverage.
SDS and FDS Authoring
SDS Generation Agent produces the Software Design Specification (use cases, screen specs, class/sequence diagrams) from SRS for Custom Application projects. FDS Generation Agent produces Functional Design Specifications per RICEF template for SAP/ERP objects. Both feed directly into SES authoring.
STPS Gate 2 Checklist
Project Checklist Validator fills the gate checklist from existing delivery artifacts. No manual assembly by PM.
Agents Involved
| Agent | Status | Purpose |
|---|---|---|
| 4-SDS-Generation-Agent | PRESENT | Software Design Specification — use cases, screen specs, class/sequence diagrams (Archetypes 1–4) |
| 4-FDS-Generation-Agent | PRESENT | Functional Design Specification per RICEF template for SAP/ERP objects (Archetype 6) |
| 4-SES-Generation-Orchestrator | VERIFY | Orchestrates all SES sections across specialist sub-agents |
| 4-Solution-Design-Agent | PRESENT | Solution design sections of SES |
| 4-API-Design-Agent | PRESENT | API engineering sections of SES |
| 4-Data-Model-Design-Agent | PRESENT | Data model sections of SES |
| 3-NFR-Analysis-Agent | PRESENT | NFR and performance sizing sections |
| 2-Lifecycle-Traceability-Agent | MCP | Extends RTM from SAD to SES |
| 5-Test-Case-Design-Agent | MCP | Generates test cases from SES + SRS |
| 5-Test-Automation-Agent | MCP | Generates automated test scripts from test cases |
| VM-project-checklist-validator | PRESENT | Auto-populates STPS Gate 2 from delivery artifacts |
| 4-Architectural-Review-Agent | PRESENT | Reviews codebase architecture for SOLID, layering, and scalability anti-patterns |
| 4-Database-Migration-Agent | PRESENT | Schema conversion specification for database replatforming (Archetype 4) |
How This Phase Changes
SES Authoring
The SES is the most document-intensive deliverable in the lifecycle. The orchestrator coordinates specialist agents to cover each section (business, information, technical, security, and operational) in parallel, with the Technical Architect reviewing and holding design authority.
Test Planning and Case Design
Test plan and test case catalog are generated from SES and SRS inputs directly. QA Lead shifts from authoring to reviewing agent outputs for business-scenario completeness and edge-case coverage.
Gate Checklist Automation
STPS Gate 2 checklist is filled from delivery artifacts. PM confirms the package rather than manually tracking and collecting evidence items.
SES Corpus (Enhancement Pending)
Full SES generation quality depends on VM SES template corpus and prior approved SES documents as reference. Archetype-specific sections (LCNC, SAP, COTS) benefit most from prior-example context.
What Will Not Change (Human Gates)
SDC SES Review Go/No-Go
Code development cannot begin without SDC authorization on the engineering spec.
Security Engineering Sign-off
Cybersecurity Officer must own the security architecture decision.
Standards Deviation Approval
Deviations from VM technology standards require SDC Chair sign-off.
Performance and Sizing Decisions
Infrastructure sizing has cost and capacity implications requiring human judgment.
DELIVER Phase — Solution Build
What Changes in This Phase
Code Development
Application Development Orchestrator generates code from SES specifications. Language-specific builder sub-agents (React, .NET, Java, Python) produce implementation. Developers review and refine rather than author from scratch.
Unit Tests
Builder sub-agents generate TDD-style unit tests alongside every code module automatically. No separate unit testing sprint is required.
Code and Security Review
Code Review Agent provides an automated first pass against SES intent, OWASP Top 10, and RTM coverage. Security Analysis Agent runs concurrently. Reviewers focus on flagged exceptions only.
QDRT-4 Build Review
Continuous Quality Gate Agent checks RTM coverage, test coverage, peer review completion, and standards compliance before submission.
CRQ Assembly
CRQ Creation Agent collects all required evidence from prior agent outputs and packages it into a compliant Helix Change Request. Standard changes go through without manual assembly. Full Helix submission requires Helix MCP integration (currently pending).
Agents Involved
| Agent | Status | Purpose |
|---|---|---|
| 5-Application-Development-Orchestrator | PRESENT | Orchestrates code generation from SES |
| 5a-Dev-React-Builder | PRESENT | React/TypeScript code + unit tests |
| 5b-Dev-DotNet-Builder | PRESENT | .NET/C# code + unit tests |
| 5c-Dev-Java-Builder | PRESENT | Java/Spring code + unit tests |
| 5d-Dev-Python-Builder | PRESENT | Python code + unit tests |
| 5-Code-Review-Agent | PRESENT | Automated first-pass review + OWASP + RTM coverage |
| 3-Security-Analysis-Agent | PRESENT | Security review concurrent with code development |
| 5-Continuous-Quality-Gate-Agent | PRESENT | Pre-validates build before QDRT-4 submission |
| 6-CRQ-Creation-Agent | BLOCKED (MCP) | Auto-assembles Helix CRQ evidence package |
| 5-Bug-Triage-Agent | PRESENT | Root cause investigation with TDD-based fix plan and GitHub issue creation |
| 5-Dependabot-Risk-Triage-Agent | PRESENT | Triages Dependabot updates by break risk with CI/runtime blocker identification |
| 5-Refactoring-Agent | PRESENT | Executes refactoring plans from Code Optimization or Architectural Review findings |
| 5e-Dev-Post-Build-Validator | PRESENT | Validates brownfield code changes across five dimensions: deterministic validation (lint/compile/test), NFR compliance, security scanning, test coverage assessment, and functional regression detection |
How This Phase Changes
Code Generation and Review
Developers shift from blank-page coding to reviewing and refining agent-generated code. The review focuses on business logic correctness, SES interpretation accuracy, and edge cases, not on boilerplate assembly. Security review runs concurrently, not as a separate later stage.
Unit Test Coverage
TDD-style unit tests are generated alongside every code module by builder sub-agents. Test coverage is no longer at risk of being deprioritized under schedule pressure.
QDRT-4 and Gate Prep
Quality gate validation runs automatically before QDRT-4 submission. Mechanical completeness checks (RTM coverage, test coverage, peer review status, standards compliance) are handled by the Continuous Quality Gate Agent.
CRQ Package Assembly
CRQ package is assembled from prior agent artifacts automatically. The Change Coordinator reviews and approves the package rather than manually collecting evidence from multiple systems. Helix submission is pending MCP integration.
What Will Not Change (Human Gates)
SDC Code/Config Final Approval
Code cannot go to production without SDC authorization.
CAB Normal Change Approval
CAB approval is a formal governance gate with regulatory traceability requirements.
UAT Execution
End users must validate business behavior. This cannot be delegated to an agent.
VM Approver / SME Sign-off on CRQ
Same-person UAT/implement restriction applies; SMOO approver must be human.
Architecture Deviation Decisions
Deviations from approved code patterns require SDC judgment.
DELIVER Phase — Test Management
What Changes in This Phase
Automated Test Execution
Test Automation Agent and UI Browser Testing Agent run automated regression and UI suites. Continuous execution replaces batch manual testing cycles.
Test Data Provisioning
Test Data Generation Agent generates synthetic test data from schema and business rules. No manual test data setup is required per test cycle.
Test Status Reporting
Test Report Agent generates from available execution data. With Octane MCP integration, reports would draw on live Octane data. QA Lead receives structured reports rather than compiling manual spreadsheets.
Defect Logging
Defect Management Agent classifies and logs defects with consistent taxonomy via the VM-defect-taxonomy-aligner skill. Octane write MCP integration needed for direct ALM logging.
Performance Testing
Performance Testing Agent generates k6/LoadRunner scripts directly from SRS NFRs. Executes tests and produces a performance evidence report automatically.
Test Summary and STPS Gate 3
Test Report Agent produces a full test report from execution data and performance results. STPS Gate 3 checklist is filled from test artifacts automatically.
Agents Involved
| Agent | Status | Purpose |
|---|---|---|
| 5-Test-Automation-Agent | MCP | Runs automated regression suites |
| 5-UI-Browser-Testing-Agent | PRESENT | Runs automated UI test suites |
| 5-Test-Data-Generation-Agent | PRESENT | Generates synthetic test data from schema + business rules |
| 5-Test-Report-Agent | MCP | Generates test reports (full capability needs Octane MCP) |
| 5-Defect-Management-Agent | MCP | Classifies defects (direct Octane write needs MCP) |
| 5-Performance-Testing-Agent | VERIFY | Generates and runs performance scripts from SRS NFRs |
| VM-project-checklist-validator | PRESENT | Auto-populates STPS Gate 3 from test artifacts |
How This Phase Changes
Test Reporting
Test status reports are generated from execution data rather than manually compiled from Octane exports and spreadsheets. QA Lead reviews the structured report output and adds analytical commentary. Full real-time capability requires Octane MCP read integration.
Defect Management
Defect logging is standardized using the VIRIM TCoE taxonomy via the defect taxonomy aligner skill. Consistent classification across MSP and internal teams. Direct Octane write requires Octane MCP integration.
Performance Testing Setup
Performance test scripts are generated directly from the NFR thresholds defined in the SRS. QA Lead defines acceptable performance thresholds; the agent generates the scripts and runs the tests.
Gate Checklist Population
STPS Gate 3 checklist is filled from test execution artifacts, defect counts, and performance evidence. PM confirms rather than manually assembles the gate package.
What Will Not Change (Human Gates)
UAT Execution and Sign-off
Business users must confirm that results match their process requirements.
P1 Defect Escalation Decisions
Production risk decisions require PM/SDM judgment.
Test Scope Change Decisions
Scope changes to the agreed test plan require SDM approval.
Performance Test Acceptance Thresholds
Business defines acceptable performance levels, not the agent.
Post-Test Retrospective Analysis
Lessons-learned judgment on what to improve is a human activity.
RUN Phase — Release, Transition and Stability
What Changes in This Phase
CRQ Creation and CAB Submission
CRQ Creation Agent collects all required evidence from prior agent artifacts and assembles a complete, compliant Helix Change Request package. Standard changes go through without manual assembly. Helix MCP integration needed for direct submission.
Deployment Execution
Deployment Readiness Agent validates the deployment checklist and flags any blocking issues. CI/CD pipeline executes the deployment. Human confirms via PIV after deployment.
Post-Implementation Verification (PIV)
Agent monitors deployment health and populates PIV evidence from deployment logs and monitoring data. Human confirms the outcome.
Release Notes
Release Notes Agent generates from GitHub commit history and PR metadata. Octane MCP integration would add sprint story and defect context.
Lessons Learned and Project Close
Agent produces a structured lessons-learned draft from QDRT findings, defect patterns, and gate delays. STPS Gate 4 checklist is filled from project close artifacts. PM reviews and approves.
Agents Involved
| Agent | Status | Purpose |
|---|---|---|
| 6-CRQ-Creation-Agent | BLOCKED (Helix MCP) | Auto-assembles full Helix CRQ evidence package |
| 6-Deployment-Readiness-Agent | PRESENT | Validates deployment checklist before execution |
| 6-Release-Notes-Agent | PRESENT | Auto-generates release notes from GitHub + PR history |
| 3-Incident-EASE-Analysis-Agent | PRESENT | Post-deployment stability monitoring and pattern detection |
| VM-project-checklist-validator | PRESENT | Auto-populates STPS Gate 4 from project close artifacts |
| 6-CICD-Pipeline-Agent | PRESENT | Generates CI/CD workflow files matched to tech stack from reusable workflow library |
| 6-Change-Management-Agent | PRESENT | Consolidates analysis findings into prioritized change plan with GitHub issues |
| 6-PR-Lifecycle-Automation-Agent | PRESENT | Automates post-commit branch orchestration, PR creation, and CI-check remediation |
| 6-Risk-Analysis-Agent | PRESENT | Structured risk register for planned code changes; feeds CRQ and CAB preparation |
| 6-Technology-Upgrade-Agent | PRESENT | Plans and stages technology stack upgrades with dependency-ordered migration steps |
How This Phase Changes
CRQ Package Assembly
The most manual and error-prone step in the RUN phase. Agent assembles the complete evidence package from prior agent outputs. Change Coordinator reviews and approves the pre-assembled package rather than manually collecting from multiple systems. Helix MCP integration is the key remaining dependency.
Release Notes
Generated from GitHub commit history at release cut. No manual compilation from Octane or Jira exports. Octane MCP linkage would enrich with sprint and defect context.
Gate Checklist Population
STPS Gate 4 (project close checklist) is filled from project artifacts. PM certifies the pre-filled package rather than assembling it manually.
Lessons Learned
Agent produces a structured draft from QDRT finding patterns, defect classification summaries, and gate delay signals collected over the project. PM reviews, adds their own observations and stakeholder feedback, and approves.
What Will Not Change (Human Gates)
CAB Approval (Normal Changes)
Formal governance gate with regulatory traceability requirement.
Emergency Change Bridge Call
Active P1 requires VM Manager authorization.
PGC Gate 7 — Ready to Close?
PM must formally certify project closure to governance.
Lessons Learned Approval
Institutional knowledge capture requires human judgment and PM ownership.
Project Sponsor Sign-off
Organizational accountability requires a named human authority.
All 29 Governance Gates — Classification Summary
Gate-by-Gate Classification
| Phase | Gate | Name | Classification | Rationale |
|---|---|---|---|---|
| PLAN | G0 | Demand Screening | ASSIST | Agent pre-scores demand; BRM makes decision |
| PLAN | G1 | Investment Proposal Review | REDUCE | Agent-drafted proposal reduces revision rounds |
| PLAN | G2 | Technology Assessment Review | REDUCE | Agent assessment reduces iteration |
| PLAN | IT Op Plan | IT Operating Plan Approval | ASSIST | Agent pre-assembles portfolio data; ITLT decides |
| PLAN | G3 | IT Board Approval | KEEP | Strategic investment decision; human authority |
| PLAN | G4 / AVD Review | Architecture Vision Review | REDUCE | Agent validates AVD; reduces SDC rounds |
| PLAN | Step 1 Gate | Solution Analysis Funding | ASSIST | Agent auto-assembles package; Portfolio Leadership decides |
| PLAN | G5 | Project Proposal Review | REDUCE | Agent-generated proposal reduces rework cycles |
| PLAN | G6 / Step 2 Gate | Final Project Funding | KEEP | Capital commitment; PPGC authority |
| PLAN | G7 | Finance Review | KEEP | Fiduciary authority; Treasurers/FRM |
| DELIVER | PGC Gate 1 | Ready to Start? | AUTO | Checklist-based; agent validates and packages |
| DELIVER | PGC Gate 2 | Ready to Execute? | AUTO | Checklist-based; agent validates and packages |
| DELIVER | QDRT-1 | BRD/SRS Quality Review | REDUCE | Agent pre-validates before submission; reduces review rounds |
| DELIVER | PGC Gate 3 | Ready to Design? | AUTO | Checklist-based; agent validates and packages |
| DELIVER | STPS Gate 1 | Pre-Design Quality Gate | AUTO | VM-project-checklist-validator auto-populates |
| DELIVER | QDRT-2 | SAD/RTM Quality Review | REDUCE | Agent pre-validates before submission; reduces review rounds |
| DELIVER | SAD Review (SDC) | Solution Architecture Review | ASSIST | Agent packages evidence; SDC makes go/no-go |
| DELIVER | PGC Gate 4 | Ready to Build? | AUTO | Checklist-based; agent validates and packages |
| DELIVER | STPS Gate 2 | Pre-Build Quality Gate | AUTO | VM-project-checklist-validator auto-populates |
| DELIVER | QDRT-3 | SES/RTM Quality Review | REDUCE | Agent pre-validates before submission; reduces review rounds |
| DELIVER | SES Review (SDC) | Engineering Spec Review | ASSIST | Agent packages evidence; SDC makes go/no-go |
| DELIVER | PGC Gate 5 | Ready to Test? | AUTO | Checklist-based; agent validates and packages |
| DELIVER | QDRT-4 | Code/Config Build Review | AUTO | 5-Continuous-Quality-Gate-Agent prepares evidence package |
| DELIVER | Code Review (SDC) | SDC Code Review | ASSIST | Agent packages metrics; SDC reviews flagged exceptions |
| DELIVER | CAB | Change Advisory Board | ASSIST | Agent prepares complete CRQ; CAB makes approval decision |
| DELIVER | PGC Gate 6 | Ready to Deploy? | AUTO | Agent validates deployment readiness checklist |
| DELIVER | STPS Gate 3 | Pre-Deploy Quality Gate | AUTO | VM-project-checklist-validator auto-populates |
| RUN | PGC Gate 7 | Ready to Close? | KEEP | PM certification of project closure |
| RUN | STPS Gate 4 | Project Close Quality Gate | AUTO | VM-project-checklist-validator auto-populates |
Persona Changes — Role Transformation Summary
BRM — Business Relationship Manager
Today
Spends the majority of time converting business requests into documents: Investment Proposals, BRD coordination, gate paperwork, and chasing completeness.
With Agents
Shifts from writing documents to reviewing and refining agent drafts. Reviews Investment Proposals and BRDs, then adds context agents cannot produce: stakeholder dynamics, political context, organizational readiness.
What Stays Human
Relationship advisory, OU sponsor alignment, strategic input, G3/G6/G7 gate participation.
Solution Architect / Project Architect
Today
Spends the largest portion of time on document authoring: ROM Estimates, AVDs, SADs, SESs, RTMs, and QDRT preparation. Acts as the bottleneck in every analysis and engineering phase.
With Agents
Shifts from document author to reviewer and approver. Reviews agent-drafted architecture documents, owns design decisions, adds standards deviation justifications, and presents to SDC.
What Stays Human
SDC presentation and defense, architectural go/no-go judgment, standards deviation decisions, QDRT response for complex findings.
Enterprise Architect
Today
Primary author of the AVD, which is the most effort-intensive PLAN phase deliverable.
With Agents
Agent drafts AVD from BRD and prior AVDs. Enterprise Architect reviews, amends, and holds architectural judgment. Deep knowledge is applied to reviewing and improving agent outputs rather than writing documents from scratch. Can cover more concurrent projects.
What Stays Human
SDC architectural governance, portfolio-level architectural decisions, AVD final sign-off.
QDRT Administration
Today
Coordinates project intake, staffs review teams, manages QDRT-1 through QDRT-4 submission logistics. This typically runs 10-12 review rounds per project, with heavy coordination overhead.
With Agents
Submissions arrive already checked. Reviewer role shifts from iterative gap-finding to exception review: confirming mechanical completeness was handled by agents and flagging issues that need judgment (architectural risk, regulatory gray areas).
What Stays Human
Independent quality assurance sign-off, complex architectural judgment, regulatory ambiguity resolution. QDRT teams can handle more concurrent reviews.
QA Lead / Test Manager
Today
Authors test strategies, manages test case creation, compiles status reports, logs defects into Octane manually, coordinates performance testing, produces Test Summary Report.
With Agents
Shifts to strategy ownership. Defines quality acceptance criteria, reviews agent-generated test cases for business alignment, interprets performance results in business context, owns UAT coordination and quality governance.
What Stays Human
UAT management and sign-off, test scope decisions, performance acceptance thresholds, post-test retrospective analysis, P1 escalation judgment.
Developer / MSP Build Team
Today
Writes code from SES specifications, authors unit tests, responds to code review findings. MSP teams often receive ambiguous specifications leading to quality inconsistency.
With Agents
Application Development Orchestrator generates code and unit tests from SES. Developers focus on reviewing and refining agent-generated code, handling complex logic flagged for human judgment, validating SES interpretation correctness.
What Stays Human
Complex logic decisions, architecture deviation calls, SDC code review participation, agent output validation, UAT defect resolution.
Project Manager
Today
Spends significant time on gate coordination, evidence assembly, document chasing, and checklist management across PGC Gates 1-7 and STPS Gates 1-4.
With Agents
STPS checklists 1-4 are filled from delivery artifacts. PGC gate packages are assembled from project outputs. PM focuses on stakeholder management, risk escalation, resource negotiation, and delivery coordination rather than document assembly.
What Stays Human
Stakeholder alignment, risk judgment, PGC Gate 7 closure certification, sponsor sign-off coordination, lessons-learned approval.
Change Coordinator
Today
Manually assembles 8-12 evidence items for every Normal Change CRQ in Remedy/Helix. Must hit Tuesday CAB cutoff.
With Agents
CRQ Creation Agent collects and assembles all evidence from prior agent outputs. Standard Changes go through without human assembly. Coordinator reviews and approves the agent-produced package rather than building it manually. Full Helix submission pending MCP integration.
What Stays Human
VM Approver sign-off on CRQ (SMOO restriction), Emergency Change bridge authorization, CAB attendance for complex changes.
Cybersecurity Officer
Today
Performs per-phase cybersecurity assessments manually. Reviews code, configuration, and data flows independently from the delivery chain.
With Agents
Security Analysis Agent produces OWASP Top 10 + CWE findings report. Cybersecurity Officer reviews agent output and provides regulatory classification and sign-off rather than conducting primary analysis from scratch.
What Stays Human
Data Criticality classification, security architecture final approval, standards deviation decisions, CAB security attestation.
Agent Status
PRESENT Agent is built and working
VERIFY Built — scope verification needed against VM workflow
UPDATE Built — planned enhancement queued
BLOCKED Built — blocked on external dependency
MISSING No agent exists yet for this deliverable
HUMAN Designated human-only — no AI role
MCP Built — operational today; full value requires MCP integration
CORPUS NEEDED Needs VM knowledge corpus
Process Capability
AUTO Agent runs end-to-end; human confirms
ASSIST Agent prepares 70–90%; human decides
REDUCE Fewer iteration rounds; gate unchanged
KEEP Fully human — fiduciary or governance authority
GEN Agent generates the first draft
ASST Agent-assisted preparation
VAL Agent validates the output
HUM Human-only deliverable