-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathframework.html
More file actions
675 lines (647 loc) · 42.5 KB
/
Copy pathframework.html
File metadata and controls
675 lines (647 loc) · 42.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>aidlc-sec.techanv.com — Framework — awslabs/aidlc-workflows Deep Dive</title>
<meta name="description" content="Deep dive into the AIDLC-Sec framework: three phases, 12 blocking security rules, design patterns, and the awslabs/aidlc-workflows repository structure.">
<link rel="stylesheet" href="styles.css">
</head>
<body data-page="framework">
<nav class="nav">
<div class="nav-inner">
<a href="index.html" class="nav-logo">
<span class="dollar">$</span> aidlc<span>-sec</span>
</a>
<div class="nav-subdomain">·<a href="https://techanv.com">techanv.com</a></div>
<ul class="nav-links">
<li><a href="framework.html" data-navitem="framework"><span class="n">01·</span>framework</a></li>
<li><a href="phases.html" data-navitem="phases"><span class="n">02·</span>phases</a></li>
<li><a href="tools.html" data-navitem="tools"><span class="n">03·</span>tools</a></li>
<li><a href="threats.html" data-navitem="threats"><span class="n">04·</span>threats</a></li>
<li><a href="resources.html" data-navitem="resources"><span class="n">05·</span>resources</a></li>
<li><a href="owasp.html" data-navitem="owasp"><span class="n">06·</span>owasp</a></li>
</ul>
<a href="framework.html" class="nav-cta">get started →</a>
</div>
</nav>
<div class="page">
<!-- PAGE HERO -->
<div class="page-hero">
<div class="container">
<div class="breadcrumb">
<a href="index.html">Home</a>
<span class="sep">/</span>
<span class="current">Framework</span>
</div>
<div class="page-hero-tag">🏗️ awslabs/aidlc-workflows v0.1.8</div>
<h1>The AIDLC-Sec Framework</h1>
<p>A deep dive into the AI-Driven Development Lifecycle — the three phases, 12 blocking security rules, design patterns, and the complete repository structure from AWS Labs.</p>
</div>
</div>
<!-- WHAT IS AI-DLC -->
<section class="section" id="overview">
<div class="container">
<div class="section-header">
<div class="section-tag">Overview</div>
<h2 class="section-title">What is the AI-DLC Methodology?</h2>
</div>
<div class="two-col-3" style="align-items:start;">
<div>
<p style="color:var(--text-secondary);line-height:1.75;margin-bottom:1.25rem;">
<strong style="color:var(--text-primary)">AI-DLC (AI-Driven Development Life Cycle)</strong> is a methodology and structured ruleset published by AWS Labs in November 2025. It is not a tool you run — it is a structured instruction set (markdown rules) loaded into existing AI coding agents that transforms them from open-ended code generators into phase-gated, human-supervised development lifecycle engines.
</p>
<p style="color:var(--text-secondary);line-height:1.75;margin-bottom:1.25rem;">
The key insight: AI coding agents produce better, more consistent, and more secure software when given a structured, phase-gated workflow with explicit human approval gates — rather than operating in an open-ended "generate anything" mode.
</p>
<div class="callout callout-blue">
<div class="callout-title">The Core Principle</div>
<p>"Version control for your thinking." Specs drive implementation, checklists, and task breakdowns, steering an AI agent towards the end goal. Specifications are first-class citizens in the SDLC.</p>
</div>
</div>
<div>
<div style="background:var(--bg-card);border:1px solid var(--border);border-radius:var(--radius);padding:1.5rem;margin-bottom:1rem;">
<h4 style="font-size:0.85rem;font-weight:700;text-transform:uppercase;letter-spacing:0.08em;color:var(--text-muted);margin-bottom:1rem;">FIVE CORE TENETS</h4>
<div style="display:flex;flex-direction:column;gap:0.75rem;">
<div style="display:flex;gap:0.75rem;align-items:flex-start;">
<span style="color:var(--accent-blue);font-weight:700;flex-shrink:0;">01</span>
<div><strong>No Duplication</strong> — Single source of truth; formats derived from source, not maintained separately</div>
</div>
<div style="display:flex;gap:0.75rem;align-items:flex-start;">
<span style="color:var(--accent-blue);font-weight:700;flex-shrink:0;">02</span>
<div><strong>Methodology First</strong> — No installation required; the methodology itself is the product</div>
</div>
<div style="display:flex;gap:0.75rem;align-items:flex-start;">
<span style="color:var(--accent-blue);font-weight:700;flex-shrink:0;">03</span>
<div><strong>Reproducible</strong> — Rules explicit enough that different models produce similar outcomes</div>
</div>
<div style="display:flex;gap:0.75rem;align-items:flex-start;">
<span style="color:var(--accent-blue);font-weight:700;flex-shrink:0;">04</span>
<div><strong>Agnostic</strong> — Works with any IDE, coding agent, or underlying model</div>
</div>
<div style="display:flex;gap:0.75rem;align-items:flex-start;">
<span style="color:var(--accent-blue);font-weight:700;flex-shrink:0;">05</span>
<div><strong>Human in the Loop</strong> — Critical decisions require explicit human confirmation; AI proposes, human approves</div>
</div>
</div>
</div>
<div style="background:var(--bg-card);border:1px solid var(--border);border-radius:var(--radius);padding:1.25rem;">
<div style="display:flex;gap:1rem;flex-wrap:wrap;">
<div><span class="badge badge-blue">2,077 GitHub Stars</span></div>
<div><span class="badge badge-gray">348 Forks</span></div>
<div><span class="badge badge-green">v0.1.8</span></div>
<div><span class="badge badge-orange">Apache 2.0</span></div>
</div>
<p style="font-size:0.82rem;color:var(--text-muted);margin-top:0.75rem;">Published November 2025 by AWS Labs. Works with Kiro, Amazon Q, Cursor, Cline, Claude Code, GitHub Copilot, OpenAI Codex, and any agent with a rules file.</p>
</div>
</div>
</div>
</div>
</section>
<div class="divider"></div>
<!-- SUPPORTED AGENTS -->
<section class="section section-alt">
<div class="container">
<div class="section-header center">
<div class="section-tag">Integration</div>
<h2 class="section-title">Supported AI Coding Agents</h2>
<p class="section-desc">AI-DLC installs as rules/steering files into any modern AI coding agent. Rules are loaded from agent-specific locations.</p>
</div>
<div class="table-wrap mt-4">
<table>
<thead>
<tr>
<th>Agent</th>
<th>Rules Location</th>
<th>Format</th>
<th>Notes</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Kiro (AWS)</strong></td>
<td><code class="font-mono">.kiro/steering/aws-aidlc-rules/</code></td>
<td>Kiro Steering Files</td>
<td>AWS's spec-driven agentic IDE; integrates with Security Hub MCP; Supervised mode for HITL</td>
</tr>
<tr>
<td><strong>Amazon Q Developer</strong></td>
<td><code class="font-mono">.amazonq/rules/aws-aidlc-rules/</code></td>
<td>Amazon Q Rules</td>
<td>Built-in SAST, SCA, secrets detection; HITL confirmation for sensitive commands (v1.24.0+)</td>
</tr>
<tr>
<td><strong>Claude Code</strong></td>
<td><code class="font-mono">CLAUDE.md</code> or <code class="font-mono">.claude/CLAUDE.md</code></td>
<td>Claude project memory</td>
<td>Anthropic's CLI agent; highly capable for complex multi-step workflows</td>
</tr>
<tr>
<td><strong>GitHub Copilot</strong></td>
<td><code class="font-mono">.github/copilot-instructions.md</code></td>
<td>Copilot custom instructions</td>
<td>Auto-runs CodeQL + secret scanning; cryptographically signed commits; cannot self-approve PRs</td>
</tr>
<tr>
<td><strong>Cursor IDE</strong></td>
<td><code class="font-mono">.cursor/rules/ai-dlc-workflow.mdc</code></td>
<td>Cursor Rules (MDC)</td>
<td>Popular IDE agent; watch for <code class="font-mono">.cursorrules</code> injection attacks</td>
</tr>
<tr>
<td><strong>Cline</strong></td>
<td><code class="font-mono">.clinerules/core-workflow.md</code></td>
<td>Cline Rules</td>
<td>Open-source VS Code agent with strong tool use capabilities</td>
</tr>
<tr>
<td><strong>OpenAI Codex</strong></td>
<td><code class="font-mono">AGENTS.md</code></td>
<td>Codex AGENTS.md convention</td>
<td>8.7 KB AGENTS.md mirrors core-workflow.md content in Codex format</td>
</tr>
</tbody>
</table>
</div>
</div>
</section>
<div class="divider"></div>
<!-- THREE PHASES -->
<section class="section" id="phases">
<div class="container">
<div class="section-header">
<div class="section-tag">Phases</div>
<h2 class="section-title">The Three Phases of AI-DLC</h2>
<p class="section-desc">Each phase has defined stages, outputs, and security enforcement points. No phase can advance without human approval.</p>
</div>
<!-- Phase 1 -->
<div style="margin-bottom:3rem;">
<div style="display:flex;align-items:center;gap:1rem;margin-bottom:1.5rem;padding-bottom:1rem;border-bottom:1px solid var(--border);">
<div style="background:rgba(0,180,255,0.12);border:1px solid rgba(0,180,255,0.3);border-radius:var(--radius-sm);padding:0.5rem 1rem;font-size:0.75rem;font-weight:700;color:var(--accent-blue);text-transform:uppercase;letter-spacing:0.1em;">Phase 1</div>
<h3 style="font-size:1.5rem;font-weight:800;">Inception — <span style="color:var(--text-secondary)">What and Why</span></h3>
</div>
<p style="color:var(--text-secondary);line-height:1.7;margin-bottom:1.5rem;max-width:800px;">Transform human intent into structured, reviewable requirements and architecture. The security extension opt-in occurs here — if opted in, SECURITY-01 through SECURITY-12 rules become blocking constraints for all subsequent stages.</p>
<div class="grid-3">
<div class="card">
<div class="rule-id">Stage 1</div>
<h3>Workspace Detection</h3>
<p><em>Always runs.</em> Determines if the project is greenfield (new) or brownfield (existing codebase). Sets the stage routing for subsequent phases.</p>
</div>
<div class="card">
<div class="rule-id">Stage 2</div>
<h3>Reverse Engineering</h3>
<p><em>Brownfield only.</em> Analyzes existing codebase to extract current architecture, identify existing security posture, and surface legacy vulnerabilities before new requirements are added.</p>
</div>
<div class="card">
<div class="rule-id" style="color:var(--accent-red);">Stage 3 — Security Gate</div>
<h3>Requirements Analysis</h3>
<p><em>Always runs.</em> Structured Q&A elicitation. <strong style="color:var(--accent-red)">Security extension opt-in occurs here.</strong> Once opted in, all 12 SECURITY rules are activated as blocking constraints.</p>
</div>
<div class="card">
<div class="rule-id">Stage 4</div>
<h3>User Story Generation</h3>
<p>Creates acceptance criteria per story. Security acceptance criteria included (e.g., "authentication must be implemented before data access").</p>
</div>
<div class="card">
<div class="rule-id">Stage 5</div>
<h3>Application Design</h3>
<p>Component architecture, data models, and API contracts. SECURITY rules already active: SECURITY-06 checked against IAM designs, SECURITY-07 against network topology.</p>
</div>
<div class="card">
<div class="rule-id">Stage 6</div>
<h3>Workflow Planning + Units</h3>
<p>Creates execution plan with stage list. For complex systems, breaks application into independently buildable units — each with its own security requirements.</p>
</div>
</div>
<div style="margin-top:1rem;">
<div class="callout callout-blue">
<div class="callout-title">Key Outputs</div>
<p><code class="font-mono">requirements.md</code> · <code class="font-mono">user-stories.md</code> · <code class="font-mono">application-design.md</code> · <code class="font-mono">execution-plan.md</code> · <code class="font-mono">units/</code></p>
</div>
</div>
</div>
<!-- Phase 2 -->
<div style="margin-bottom:3rem;">
<div style="display:flex;align-items:center;gap:1rem;margin-bottom:1.5rem;padding-bottom:1rem;border-bottom:1px solid var(--border);">
<div style="background:rgba(124,58,237,0.12);border:1px solid rgba(124,58,237,0.3);border-radius:var(--radius-sm);padding:0.5rem 1rem;font-size:0.75rem;font-weight:700;color:#A78BFA;text-transform:uppercase;letter-spacing:0.1em;">Phase 2</div>
<h3 style="font-size:1.5rem;font-weight:800;">Construction — <span style="color:var(--text-secondary)">How</span></h3>
</div>
<p style="color:var(--text-secondary);line-height:1.7;margin-bottom:1.5rem;max-width:800px;">Design, implement, test, and validate every component. SECURITY rules are enforced at each stage. Code generation cannot proceed if design violates SECURITY-06 (least privilege) or SECURITY-07 (network config).</p>
<div class="grid-3">
<div class="card">
<div class="rule-id" style="color:#A78BFA;">Stage 1</div>
<h3>Functional Design</h3>
<p>Component-level detailed design; API specifications; data flow diagrams. Security controls validated against functional design before code is permitted.</p>
</div>
<div class="card">
<div class="rule-id" style="color:#A78BFA;">Stage 2</div>
<h3>NFR Requirements</h3>
<p>Non-functional requirements including performance, scalability, availability — <strong>and security NFRs</strong>: encryption levels, auth standards, audit log requirements.</p>
</div>
<div class="card">
<div class="rule-id" style="color:#A78BFA;">Stage 3</div>
<h3>NFR Design</h3>
<p>Architecture patterns addressing NFRs (caching, scaling, redundancy). Security patterns: zero-trust, defense-in-depth, encryption-at-rest and in-transit.</p>
</div>
<div class="card">
<div class="rule-id" style="color:var(--accent-red);">Stage 4 — IaC Security</div>
<h3>Infrastructure Design</h3>
<p>IaC templates, cloud resource specifications, network topology. SECURITY-01, SECURITY-06, SECURITY-07, SECURITY-09 all enforced before IaC templates are written.</p>
</div>
<div class="card">
<div class="rule-id" style="color:var(--accent-red);">Stage 5 — Blocking Rules</div>
<h3>Code Generation</h3>
<p>Two-part process: AI presents code plan → human approves → AI generates code. <strong>AI never writes code before plan approval.</strong> All 12 SECURITY rules enforced on generated code.</p>
</div>
<div class="card">
<div class="rule-id" style="color:var(--accent-red);">Stage 6 — Security Tests</div>
<h3>Build and Test</h3>
<p>Generates build instructions, unit/integration/performance tests, and <strong>security test plan.</strong> Security testing is a required category alongside functional tests.</p>
</div>
</div>
<div class="callout callout-orange" style="margin-top:1rem;">
<div class="callout-title">Key Outputs</div>
<p>All source code · IaC templates · Test suites · <code class="font-mono">build-test-summary.md</code> · Updated <code class="font-mono">audit.md</code></p>
</div>
</div>
<!-- Phase 3 -->
<div>
<div style="display:flex;align-items:center;gap:1rem;margin-bottom:1.5rem;padding-bottom:1rem;border-bottom:1px solid var(--border);">
<div style="background:rgba(16,185,129,0.12);border:1px solid rgba(16,185,129,0.3);border-radius:var(--radius-sm);padding:0.5rem 1rem;font-size:0.75rem;font-weight:700;color:var(--accent-green);text-transform:uppercase;letter-spacing:0.1em;">Phase 3</div>
<h3 style="font-size:1.5rem;font-weight:800;">Operations — <span style="color:var(--text-secondary)">Deploy and Monitor</span></h3>
<span class="badge badge-orange">In Progress</span>
</div>
<p style="color:var(--text-secondary);line-height:1.7;margin-bottom:1.5rem;max-width:800px;">Deployment automation, monitoring/observability, production readiness validation, and continuous security monitoring. Phase 3 is currently planned in aidlc-workflows — the ops.md file is a 612-byte placeholder. Industry implementation uses SRE agents (Azure) and GuardDuty/Security Hub (AWS).</p>
<div class="grid-3">
<div class="card">
<div class="card-icon green">🚀</div>
<h3>Deployment Gates</h3>
<p>IaC scanning, container scanning, SBOM attachment, artifact signing before any deployment. Human approval gate required for production environments.</p>
</div>
<div class="card">
<div class="card-icon green">👁️</div>
<h3>SRE Agent Monitoring</h3>
<p>Continuous telemetry monitoring (logs, metrics, traces). Incident detection and investigation. Automated runbook-guided fixes. GitHub sub-agent creates issues after every resolution — completing the feedback loop.</p>
</div>
<div class="card">
<div class="card-icon green">🔄</div>
<h3>Autonomous Feedback Loop</h3>
<p>SRE issues auto-assigned to coding agent for simple fixes (incorrect ports, min-scale adjustments). Human review required before merge. Closes the loop back to Phase 1.</p>
</div>
</div>
</div>
</div>
</section>
<div class="divider"></div>
<!-- 12 SECURITY RULES -->
<section class="section section-alt" id="security-rules">
<div class="container">
<div class="section-header">
<div class="section-tag red">Security Extension</div>
<h2 class="section-title">The 12 Blocking Security Rules</h2>
<p class="section-desc">From <code class="font-mono" style="font-size:0.9rem;">extensions/security/baseline/security-baseline.md</code> (18.2 KB). These rules are hard constraints — when any is violated, the AI refuses to advance to the next stage.</p>
</div>
<div class="callout callout-red" style="margin-bottom:2rem;">
<div class="callout-title">How Blocking Works</div>
<p>When a SECURITY rule is violated: (1) the finding is listed under "Security Findings" with the rule ID, (2) the "Continue to Next Stage" option is REMOVED, (3) only "Request Changes" is presented, (4) the finding is logged to <code class="font-mono">aidlc-docs/audit.md</code>.</p>
</div>
<div class="rule-grid">
<div class="rule-card">
<div class="rule-id">SECURITY-01</div>
<h4>Encryption at Rest and in Transit</h4>
<p>Every data store must have encryption configured. TLS 1.2+ required for all data in transit. No unencrypted storage allowed in any IaC template.</p>
</div>
<div class="rule-card">
<div class="rule-id">SECURITY-02</div>
<h4>Access Logging on Network Intermediaries</h4>
<p>Load balancers, API gateways, and CDNs must have access logging enabled. Logs must be captured to a centralized, tamper-resistant destination.</p>
</div>
<div class="rule-card">
<div class="rule-id">SECURITY-03</div>
<h4>Application-Level Logging</h4>
<p>Structured logging to centralized service. <strong>No PII, secrets, or tokens in logs.</strong> Log format must enable correlation and forensic analysis.</p>
</div>
<div class="rule-card">
<div class="rule-id">SECURITY-04</div>
<h4>HTTP Security Headers</h4>
<p>All web applications must include: Content-Security-Policy, HSTS, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy. Each header must be properly configured (no wildcard CSP).</p>
</div>
<div class="rule-card">
<div class="rule-id">SECURITY-05</div>
<h4>Input Validation on All API Parameters</h4>
<p>All endpoints must implement: type-checking, length bounds, format validation, and injection prevention. Server-side validation required — client-side alone is insufficient.</p>
</div>
<div class="rule-card">
<div class="rule-id">SECURITY-06</div>
<h4>Least-Privilege Access Policies</h4>
<p>No wildcard IAM actions or resources. Read/write separation enforced. Service accounts get only the minimum permissions required for their specific function.</p>
</div>
<div class="rule-card">
<div class="rule-id">SECURITY-07</div>
<h4>Restrictive Network Configuration</h4>
<p>Deny-by-default ingress rules. No <code class="font-mono" style="font-size:0.8rem;">0.0.0.0/0</code> inbound except port 80/443 on load balancers. Private subnets for all compute and data resources.</p>
</div>
<div class="rule-card">
<div class="rule-id">SECURITY-08</div>
<h4>Application-Level Access Control</h4>
<p>Deny-by-default authentication. IDOR prevention (resource ownership verified server-side). CORS restricted to known origins. Server-side JWT validation — never trust client claims.</p>
</div>
<div class="rule-card">
<div class="rule-id">SECURITY-09</div>
<h4>Security Hardening & Misconfiguration Prevention</h4>
<p>No default credentials. No stack traces in production responses. No public storage buckets. Patched runtime versions (no EOL dependencies). Debug mode disabled in production.</p>
</div>
<div class="rule-card">
<div class="rule-id">SECURITY-10</div>
<h4>Software Supply Chain Security</h4>
<p>Exact dependency versions with lock files committed. Vulnerability scanning before install. SBOM required for production. No <code class="font-mono" style="font-size:0.8rem;">latest</code> tags. Only official registries.</p>
</div>
<div class="rule-card">
<div class="rule-id">SECURITY-11</div>
<h4>Secure Design Principles</h4>
<p>Security-critical logic (authentication, authorization, cryptography) isolated in dedicated modules. No scattered auth/authz across multiple components. Defense in depth enforced structurally.</p>
</div>
<div class="rule-card">
<div class="rule-id">SECURITY-12</div>
<h4>Additional Domain-Specific Rules</h4>
<p>Organizations can author custom extension rules using the same opt-in pattern: COMPLIANCE rules for SOC2, HIPAA rules for healthcare, PCI-DSS rules for payment processing. All follow the same blocking enforcement model.</p>
</div>
</div>
</div>
</section>
<div class="divider"></div>
<!-- REPO STRUCTURE -->
<section class="section" id="repo">
<div class="container">
<div class="section-header">
<div class="section-tag">Repository</div>
<h2 class="section-title">awslabs/aidlc-workflows Repository Structure</h2>
<p class="section-desc">Complete directory structure from the open-source AWS Labs repository (Apache 2.0, v0.1.8).</p>
</div>
<div class="repo-tree">
<div><span class="folder">awslabs/aidlc-workflows/</span></div>
<div>├── <span class="folder">aidlc-rules/</span></div>
<div>│ ├── <span class="folder">aws-aidlc-rules/</span></div>
<div>│ │ └── <span class="highlight">core-workflow.md</span> <span class="comment"># PRIMARY ENTRY POINT (25 KB) — master workflow rules</span></div>
<div>│ └── <span class="folder">aws-aidlc-rule-details/</span></div>
<div>│ ├── <span class="folder">common/</span> <span class="comment"># Cross-cutting rules</span></div>
<div>│ │ ├── <span class="file">ascii-diagram-standards.md</span></div>
<div>│ │ ├── <span class="file">content-validation.md</span></div>
<div>│ │ ├── <span class="file">depth-levels.md</span></div>
<div>│ │ ├── <span class="highlight">error-handling.md</span> <span class="comment"># (13.5 KB)</span></div>
<div>│ │ ├── <span class="file">overconfidence-prevention.md</span></div>
<div>│ │ ├── <span class="file">process-overview.md</span></div>
<div>│ │ ├── <span class="highlight">question-format-guide.md</span> <span class="comment"># (9.2 KB)</span></div>
<div>│ │ ├── <span class="file">session-continuity.md</span></div>
<div>│ │ ├── <span class="file">terminology.md</span></div>
<div>│ │ ├── <span class="file">welcome-message.md</span></div>
<div>│ │ └── <span class="highlight">workflow-changes.md</span> <span class="comment"># (10.7 KB)</span></div>
<div>│ ├── <span class="folder">inception/</span> <span class="comment"># Phase 1 rules</span></div>
<div>│ │ ├── <span class="file">workspace-detection.md</span></div>
<div>│ │ ├── <span class="file">requirements-analysis.md</span> <span class="comment"># (8.3 KB)</span></div>
<div>│ │ ├── <span class="file">reverse-engineering.md</span> <span class="comment"># (8.4 KB) — brownfield</span></div>
<div>│ │ ├── <span class="highlight">user-stories.md</span> <span class="comment"># (15.6 KB)</span></div>
<div>│ │ ├── <span class="file">application-design.md</span> <span class="comment"># (7.3 KB)</span></div>
<div>│ │ ├── <span class="highlight">workflow-planning.md</span> <span class="comment"># (15.3 KB)</span></div>
<div>│ │ └── <span class="file">units-generation.md</span> <span class="comment"># (9.4 KB)</span></div>
<div>│ ├── <span class="folder">construction/</span> <span class="comment"># Phase 2 rules</span></div>
<div>│ │ ├── <span class="file">functional-design.md</span> <span class="comment"># (5.9 KB)</span></div>
<div>│ │ ├── <span class="file">nfr-requirements.md</span> <span class="comment"># (5.0 KB)</span></div>
<div>│ │ ├── <span class="file">nfr-design.md</span> <span class="comment"># (4.5 KB)</span></div>
<div>│ │ ├── <span class="file">infrastructure-design.md</span> <span class="comment"># (5.1 KB)</span></div>
<div>│ │ ├── <span class="highlight">code-generation.md</span> <span class="comment"># (9.3 KB)</span></div>
<div>│ │ └── <span class="highlight">build-and-test.md</span> <span class="comment"># (9.3 KB) — security tests required</span></div>
<div>│ ├── <span class="folder">operations/</span></div>
<div>│ │ └── <span class="file">operations.md</span> <span class="comment"># (612 bytes — future placeholder)</span></div>
<div>│ └── <span class="folder">extensions/</span></div>
<div>│ ├── <span class="folder security">security/</span></div>
<div>│ │ └── <span class="folder security">baseline/</span></div>
<div>│ │ ├── <span class="security">security-baseline.md</span> <span class="comment"># (18.2 KB) — THE SECURITY EXTENSION</span></div>
<div>│ │ └── <span class="file">security-baseline.opt-in.md</span> <span class="comment"># (595 bytes) — user opt-in gate</span></div>
<div>│ └── <span class="folder">testing/</span></div>
<div>│ └── <span class="folder">property-based/</span></div>
<div>│ ├── <span class="highlight">property-based-testing.md</span> <span class="comment"># (18.1 KB)</span></div>
<div>│ └── <span class="file">property-based-testing.opt-in.md</span></div>
<div>├── <span class="folder">docs/</span></div>
<div>│ ├── <span class="highlight">ADMINISTRATIVE_GUIDE.md</span> <span class="comment"># (55 KB) — largest doc</span></div>
<div>│ ├── <span class="file">DEVELOPERS_GUIDE.md</span> <span class="comment"># (14.7 KB)</span></div>
<div>│ ├── <span class="highlight">WORKING-WITH-AIDLC.md</span> <span class="comment"># (29.2 KB) — practitioner guide</span></div>
<div>│ └── <span class="file">GENERATED_DOCS_REFERENCE.md</span> <span class="comment"># (10.8 KB)</span></div>
<div>├── <span class="folder">scripts/</span></div>
<div>│ ├── <span class="highlight">aidlc-evaluator/</span> <span class="comment"># Automated test/validation framework</span></div>
<div>│ └── <span class="highlight">aidlc-designreview/</span> <span class="comment"># EXPERIMENTAL: AI multi-agent design reviewer</span></div>
<div>├── <span class="folder security">.github/workflows/</span></div>
<div>│ ├── <span class="security">security-scanners.yml</span> <span class="comment"># 5 security tools (12.8 KB) — Gitleaks, Semgrep, Grype, Bandit, Checkov, ClamAV</span></div>
<div>│ ├── <span class="security">codeql.yml</span> <span class="comment"># CodeQL semantic analysis (4.9 KB)</span></div>
<div>│ ├── <span class="file">codebuild.yml</span> <span class="comment"># AWS CodeBuild integration (22.6 KB)</span></div>
<div>│ ├── <span class="file">pull-request-lint.yml</span> <span class="comment"># PR quality gates (7.0 KB)</span></div>
<div>│ └── <span class="file">release.yml</span> <span class="comment"># Release automation</span></div>
<div>├── <span class="security">.bandit</span> <span class="comment"># Python SAST config</span></div>
<div>├── <span class="security">.checkov.yaml</span> <span class="comment"># IaC scanning config</span></div>
<div>├── <span class="security">.gitleaks.toml</span> <span class="comment"># Secret scanning config</span></div>
<div>├── <span class="security">.gitleaks-baseline.json</span> <span class="comment"># Known-good baseline (45.5 KB)</span></div>
<div>├── <span class="security">.grype.yaml</span> <span class="comment"># SCA/dependency scanning config</span></div>
<div>├── <span class="security">.semgrepignore</span> <span class="comment"># SAST ignore rules</span></div>
<div>├── <span class="highlight">AGENTS.md</span> <span class="comment"># (8.7 KB) — agent-native platforms format</span></div>
<div>└── <span class="file">README.md</span> <span class="comment"># (38 KB) — comprehensive setup guide</span></div>
</div>
</div>
</section>
<div class="divider"></div>
<!-- CI PIPELINE -->
<section class="section section-alt" id="ci-pipeline">
<div class="container">
<div class="section-header">
<div class="section-tag green">CI/CD Security</div>
<h2 class="section-title">The Security CI/CD Pipeline</h2>
<p class="section-desc">The <code class="font-mono" style="font-size:0.9rem;">security-scanners.yml</code> workflow demonstrates the security toolchain all AI-DLC projects should implement — 6 independent scanning jobs with supply chain hardening.</p>
</div>
<div class="table-wrap mb-4">
<table>
<thead>
<tr>
<th>Tool</th>
<th>Type</th>
<th>Version (Pinned)</th>
<th>What It Catches</th>
<th>Fail Condition</th>
</tr>
</thead>
<tbody>
<tr>
<td><strong>Gitleaks</strong></td>
<td><span class="badge badge-red">Secret Scan</span></td>
<td><code class="font-mono">v8.30.1</code></td>
<td>Secrets, API keys, credentials in full git history</td>
<td>Any detection</td>
</tr>
<tr>
<td><strong>Semgrep</strong></td>
<td><span class="badge badge-orange">SAST</span></td>
<td><code class="font-mono">v1.157.0</code></td>
<td>OWASP Top 10 patterns, injection flaws, auth issues (<code class="font-mono">r/all</code> ruleset)</td>
<td>ERROR severity findings</td>
</tr>
<tr>
<td><strong>Grype</strong></td>
<td><span class="badge badge-purple">SCA</span></td>
<td><code class="font-mono">v0.110.0</code></td>
<td>Known CVEs in all dependencies (via <code class="font-mono">.grype.yaml</code>)</td>
<td>Configurable severity threshold</td>
</tr>
<tr>
<td><strong>Bandit</strong></td>
<td><span class="badge badge-orange">Python SAST</span></td>
<td><code class="font-mono">v1.9.4</code></td>
<td>Python-specific security issues (SQL injection, shell injection, hardcoded passwords)</td>
<td>HIGH severity findings</td>
</tr>
<tr>
<td><strong>Checkov</strong></td>
<td><span class="badge badge-blue">IaC Security</span></td>
<td><code class="font-mono">v3.2.513</code></td>
<td>IaC misconfigurations (public buckets, open security groups, missing encryption)</td>
<td>Configurable check list</td>
</tr>
<tr>
<td><strong>ClamAV</strong></td>
<td><span class="badge badge-red">Malware Scan</span></td>
<td>Pinned SHA digest</td>
<td>Malware in all repository files — critical for detecting backdoored AI artifacts</td>
<td>Any detection</td>
</tr>
<tr>
<td><strong>CodeQL</strong></td>
<td><span class="badge badge-orange">Deep SAST</span></td>
<td>Separate workflow</td>
<td>Semantic analysis, dataflow vulnerabilities, logic flaws</td>
<td>Any finding above threshold</td>
</tr>
</tbody>
</table>
</div>
<div class="callout callout-green">
<div class="callout-title">Supply Chain Hardening in the Pipeline</div>
<p>All <code class="font-mono">actions/checkout</code> steps use pinned commit SHAs (not version tags) to prevent supply chain attacks via tag mutation. All container images use SHA digests. Permissions locked to <code class="font-mono">permissions: {}</code> at workflow level, then selectively opened per job. SARIF output from all tools flows to GitHub Security dashboard.</p>
</div>
</div>
</section>
<div class="divider"></div>
<!-- GENERATED ARTIFACTS -->
<section class="section" id="artifacts">
<div class="container">
<div class="section-header">
<div class="section-tag">Artifacts</div>
<h2 class="section-title">Generated Documentation Structure</h2>
<p class="section-desc">Every AIDLC-Sec session generates a structured <code class="font-mono" style="font-size:0.9rem;">aidlc-docs/</code> folder — the immutable audit trail and design source of truth.</p>
</div>
<div class="two-col-3" style="align-items:start;">
<div class="repo-tree">
<div><span class="folder">aidlc-docs/</span></div>
<div>├── <span class="highlight">aidlc-state.md</span> <span class="comment"># Immutable progress tracker + audit history</span></div>
<div>├── <span class="security">audit.md</span> <span class="comment"># Security findings log (rule IDs, stage, context)</span></div>
<div>├── <span class="folder">inception/</span></div>
<div>│ ├── <span class="file">requirements.md</span></div>
<div>│ ├── <span class="file">user-stories.md</span></div>
<div>│ ├── <span class="file">application-design.md</span></div>
<div>│ ├── <span class="file">execution-plan.md</span></div>
<div>│ └── <span class="folder">units/</span></div>
<div>│ ├── <span class="file">unit-001.md</span></div>
<div>│ └── <span class="file">unit-00N.md</span></div>
<div>└── <span class="folder">construction/</span></div>
<div> ├── <span class="folder">functional-design/</span></div>
<div> ├── <span class="folder">nfr-design/</span></div>
<div> ├── <span class="folder">infrastructure-design/</span></div>
<div> ├── <span class="folder">code-generation/</span></div>
<div> └── <span class="folder">build-and-test/</span></div>
<div> ├── <span class="file">build-instructions.md</span></div>
<div> ├── <span class="file">unit-test-instructions.md</span></div>
<div> ├── <span class="file">integration-test-instructions.md</span></div>
<div> └── <span class="highlight">build-test-summary.md</span></div>
</div>
<div>
<div class="card mb-2">
<div class="rule-id" style="color:var(--accent-cyan);">aidlc-state.md</div>
<h4>Immutable Progress Tracker</h4>
<p>Tracks all completed/pending workflow items as an immutable log. If a session ends mid-workflow, the next session loads state and resumes — preventing context decay. Supports NIST AI RMF traceability requirements.</p>
</div>
<div class="card mb-2">
<div class="rule-id" style="color:var(--accent-red);">audit.md — Security Findings Log</div>
<h4>Security Compliance Evidence</h4>
<p>Every security rule violation is logged with: rule ID, violation description, stage where it occurred, and resolution. Combined with CI pipeline SARIF outputs, this becomes the AIBOM (AI Bill of Materials) for compliance purposes.</p>
</div>
<div class="card">
<div class="rule-id" style="color:var(--accent-green);">build-test-summary.md</div>
<h4>Security Test Evidence</h4>
<p>Documents all test categories including <strong>security tests</strong> as a required category alongside unit, integration, performance, and e2e. Required for SOC2 Type II evidence collection.</p>
</div>
</div>
</div>
</div>
</section>
<div class="divider"></div>
<!-- CTA -->
<section class="section section-alt">
<div class="container">
<div style="display:flex;align-items:center;justify-content:space-between;flex-wrap:wrap;gap:2rem;">
<div>
<h3 style="font-size:1.4rem;font-weight:800;margin-bottom:0.5rem;">Ready to implement AIDLC-Sec?</h3>
<p style="color:var(--text-secondary);">Follow the phase-by-phase security guide for detailed implementation instructions.</p>
</div>
<div style="display:flex;gap:1rem;flex-wrap:wrap;">
<a href="phases.html" class="btn btn-primary">Phase Security Guide →</a>
<a href="tools.html" class="btn btn-secondary">Browse Tools</a>
</div>
</div>
</div>
</section>
</div>
<footer>
<div class="container">
<div class="footer-grid">
<div>
<div class="footer-brand-logo">
<span class="footer-brand-icon">$</span>
<span class="footer-brand-name">aidlc<span>-sec</span></span>
</div>
<p class="footer-desc">Security-first AI-led Software Development Lifecycle. Built on awslabs/aidlc-workflows (Apache 2.0).</p>
</div>
<div>
<h4>Framework</h4>
<ul class="footer-links">
<li><a href="framework.html#overview">Overview</a></li>
<li><a href="framework.html#phases">Three Phases</a></li>
<li><a href="framework.html#security-rules">12 Security Rules</a></li>
<li><a href="framework.html#repo">Repo Structure</a></li>
<li><a href="framework.html#ci-pipeline">CI Pipeline</a></li>
</ul>
</div>
<div>
<h4>Security</h4>
<ul class="footer-links">
<li><a href="phases.html">Phase Guide</a></li>
<li><a href="threats.html">Threat Categories</a></li>
<li><a href="tools.html">Tools</a></li>
<li><a href="resources.html">Resources</a></li>
</ul>
</div>
<div>
<h4>Pages</h4>
<ul class="footer-links">
<li><a href="index.html">Home</a></li>
<li><a href="framework.html">Framework</a></li>
<li><a href="phases.html">Phases</a></li>
<li><a href="tools.html">Tools</a></li>
<li><a href="threats.html">Threats</a></li>
<li><a href="resources.html">Resources</a></li>
</ul>
</div>
</div>
<div class="footer-bottom">
<span>aidlc-sec.<a href="https://techanv.com" style="color:var(--tx-4);">techanv.com</a> · awslabs/aidlc-workflows (apache 2.0) · 2026</span>
</div>
</div>
</footer>
<script src="nav.js"></script>
</body>
</html>