Bakalar Software
SDLC Execution Platform

A governed pipeline for every AI-assisted code change.

The input is a ticket. The output is a verified, committed change with a full audit trail. Two human approval gates sit between the ticket and the codebase — no step is skippable.

The Pipeline

  1. Ticket — read from Jira or provided via --title flag.
  2. Clarify — open questions resolved with the developer before any work begins.
  3. Scan — codebase indexed with vector embeddings for RAG retrieval.
  4. Plan — LLM generates a structured execution plan: intents and affected files.
  5. Validate — hard validation gate. No silent failures, no degraded modes.
  6. Approve Plan — Checkpoint 1. Developer reviews before any code is written.
  7. Generate Code — LLM reads actual file contents and writes complete implementations.
  8. Approve Code — Checkpoint 2. Developer reviews the exact diff before anything is applied.
  9. Apply → Verify → Audit — changes written, build run, timestamped audit record written.

See It In Action

A regulated fintech team adds rate limiting to their transaction API. Four steps. Three minutes. Full audit trail.

1

Input

The Jira ticket

ACME-142  ·  Priority: High  ·  Reporter: Product

Add rate limiting to POST /api/transactions

Limit each authenticated client to 100 requests per minute.
Return HTTP 429 with a Retry-After header when exceeded.
All rate-limit events must be written to the audit log.
2

Checkpoint 1 — Plan review

AI generates a structured plan. You approve it before any code is written.

Indexing codebase... 847 methods across 94 files.
Generating execution plan for ACME-142...

Plan  ·  Confidence: 0.96  ·  3 operations

Op 1  Add RateLimitingFilter with token-bucket per client IP
      → src/main/java/com/acme/filter/RateLimitingFilter.java (new)

Op 2  Register filter in SecurityConfig before /api/transactions
      → src/main/java/com/acme/config/SecurityConfig.java

Op 3  Write rate-limit events to AuditService
      → src/main/java/com/acme/service/AuditService.java

Approve this plan? [yes/no]: yes
3

Checkpoint 2 — Code review

AI reads the actual files and writes complete implementations. You approve the diff.

+ src/main/java/com/acme/filter/RateLimitingFilter.java

+ @Component @Order(1)
+ public class RateLimitingFilter implements Filter {
+     private static final int LIMIT = 100;
+     private final Map<String, RateLimiter> limiters =
+         new ConcurrentHashMap<>();
+
+     @Override
+     public void doFilter(ServletRequest req, ...) {
+         String clientId = getClientId(req);
+         RateLimiter limiter = limiters.computeIfAbsent(
+             clientId, k -> RateLimiter.create(LIMIT / 60.0));
+         if (!limiter.tryAcquire()) {
+             HttpServletResponse r = (HttpServletResponse) res;
+             r.setStatus(429);
+             r.setHeader("Retry-After", "60");
+             auditService.logRateLimit(clientId);
+             return;
+         }
+         chain.doFilter(req, res);
+     }
+ }

Approve this diff? [yes/no]: yes
4

Result

Build verified, committed, PR opened, audit record written.

✓ Applied 3 file changes
✓ mvn test — BUILD SUCCESS  (coverage: 84%  ·  312 tests passed)
✓ Branch: ACME-142
✓ Commit: a7f3c91  [ACME-142] Add rate limiting to POST /api/transactions
✓ PR:     github.com/acme/core-api/pull/847

Audit record written
  Plan approved by:  Alice Chen  14:22:07
  Code approved by:  Alice Chen  14:24:31
  Duration:          3m 12s  ·  Est. cost: $0.031 USD
  Report:            ACME-142-report.pdf  (SOC2 evidence ready)

Multi-Developer Coordinator

A companion JAR (sdlc-coordinator.jar) for teams running the orchestrator across multiple developers. Decomposes a goal into a dependency-ordered task graph, detects file conflicts before they happen, and tracks the state of every task in an event-sourced audit trail.

1

Goal decomposition

Describe the goal — the coordinator breaks it into tasks with dependencies.

$ java -jar sdlc-coordinator.jar decompose \
    --goal "Add OAuth2 authentication to the API"

  Decomposing goal into tasks (calling LLM)...

  TASK ID      STATE      COMPLEXITY  TITLE
  ────────────────────────────────────────────────────────
  TASK-01      PENDING    MEDIUM      Add OAuth2 provider configuration
  TASK-02      PENDING    LARGE       Implement token validation filter
  TASK-03      PENDING    SMALL       Update SecurityConfig registrations
  TASK-04      PENDING    SMALL       Add /oauth2/callback endpoint

  TASK-02 prerequisite: TASK-01
  TASK-03 prerequisite: TASK-01
2

Assignment and execution

Assign tasks to developers. Prerequisites are enforced — a task cannot start until its dependencies are verified.

$ java -jar sdlc-coordinator.jar assign --task TASK-01 --developer gordan
  Assigned TASK-01 to gordan

$ java -jar sdlc-coordinator.jar assign --task TASK-02 --developer nadan
  Assigned TASK-02 to nadan

# gordan runs sdlc-orchestrator.jar for TASK-01, completes it
$ java -jar sdlc-coordinator.jar done --task TASK-01 --developer gordan
✓ Task TASK-01 marked VERIFIED
  → TASK-02 prerequisite satisfied — nadan unblocked
3

Conflict detection and resolution

When two in-progress tasks touch the same files, the coordinator surfaces the conflict and offers three resolution strategies.

Conflict detected: TASK-02 ∩ TASK-03
  Overlapping files: src/SecurityConfig.java

$ java -jar sdlc-coordinator.jar resolve \
    --task-a TASK-02 --task-b TASK-03 \
    --strategy SEQUENCE

  Conflict resolved (SEQUENCE) between TASK-02 and TASK-03
  → TASK-03 paused until TASK-02 is verified
  → TASK-03 will resume automatically on completion
4

Dashboard and event log

A read-only web dashboard shows the full task graph, per-task event history, and team state at a glance.

$ java -jar sdlc-coordinator.jar serve

  Coordinator dashboard running at http://localhost:7071

  Tasks: 4  ·  In Progress: 1  ·  Verified: 2  ·  Blocked: 1

  TASK-01  VERIFIED    gordan   MEDIUM  OAuth2 provider config
  TASK-02  VERIFIED    nadan    LARGE   Token validation filter
  TASK-03  BLOCKED     nadan    SMALL   SecurityConfig update
  TASK-04  IN_PROGRESS  gordan  SMALL   /oauth2/callback endpoint

Resolution strategies

  • SEQUENCE — pause one task until the other is verified, then auto-resume. Survives restart via event replay.
  • MERGE — both developers coordinate their changes manually; both tasks stay in progress.
  • CANCEL_ONE — cancel the lower-priority task and continue with the other.

How It Compares

Cursor, Claude Code, and Copilot make individual developers faster. This platform governs what AI-generated code reaches production — a different category entirely.

GitHub Copilot Cursor / Claude Code SDLC Execution Platform
Input Inline prompt or comment Free-form chat prompt Structured ticket (Jira, Linear, GitHub Issues)
Code generation Inline suggestion Inline suggestion or file edit LLM reads actual files, writes complete implementations
Human approval gate Accept or reject lines Accept or reject edits Two structured checkpoints — plan then diff
Pre-execution validation None None Hard validation gate — pipeline stops on failure
Build verification None None Compile + test suite runs before commit
Audit trail None None Full timestamped record — plan, approvals, diff, coverage
Compliance output None None SOC2 Type II and HIPAA PDF reports per run
Team consistency Depends on the developer Depends on the developer Same governed process for every change, every developer
Regulated environments Not designed for this Not designed for this Built for this from the start

Supported Stacks

  • Java / Spring Boot — Maven build and test.
  • TypeScript / Node.js — Express and NestJS route and service understanding, npm build and test.
  • Python — pytest verification.
  • Gradle — ./gradlew compileJava test verification.
  • Project type auto-detected from pom.xml, build.gradle, or package.json.
  • --build-system flag for manual override.

Enterprise Features

  • Web dashboard — --serve flag launches a browser audit log at localhost:7070: filterable table, full diff and plan viewer, git and PR links.
  • CI/CD integration — --non-interactive mode for pipeline-triggered execution, standardized exit codes for gating, GitHub Actions workflow included.
  • Compliance reports — SOC2 Type II and HIPAA change management records in text and PDF format. Per-ticket: --export-pdf-report and --export-hipaa-pdf-report. Batch: --export-all-pdf and --export-all-hipaa-pdf. All batch commands accept --since YYYY-MM-DD.
  • Coverage gate — configurable line coverage threshold (sdlc.coverage.minimum=0.80) enforced at build verification. Fails the pipeline if tests pass but coverage drops below the limit. JaCoCo (Maven/Gradle), Jest, and pytest supported.
  • Named approvals — approver identity recorded at each checkpoint, read from git config or sdlc.approver config key.

Observability & Distribution

  • Metrics — per-run LLM token counts, cost estimates, and wall-clock time per stage written to the audit JSON. --metrics shows aggregate stats across all runs.
  • Notifications — Slack webhook and SMTP email on pipeline success, failure, or validation rejection.
  • Local embeddings — Ollama support for offline or air-gapped environments.
  • Docker — ghcr.io/gbakalar/sdlc-platform:latest.
  • Fat JAR — no Maven required to run. Download from GitHub Releases.
  • Install script — curl -fsSL … | bash or run the JAR directly.

Coordinator CLI Reference

  • decompose --goal "…" — LLM decomposes a goal into a dependency-ordered task graph.
  • assign --task T-01 --developer gordan — assign a task; prerequisites must be satisfied first.
  • done --task T-01 — mark verified; downstream tasks auto-unblock.
  • block --task T-01 --reason "…" — report a blocker without losing task state.
  • resolve --task-a T-01 --task-b T-02 --strategy SEQUENCE — resolve a detected file conflict.
  • replan --reason "…" — mark affected in-progress tasks for replanning.
  • serve — read-only web dashboard at localhost:7071.
  • history — full event log in chronological order.
Download

Get started in one command

Requires Java 17+. No Maven or build tools needed — the platform ships as a self-contained JAR.

Linux / macOS
curl -fsSL https://bakalarsoftware.com/dl/install.sh | bash

Installs to ~/.sdlc/bin/ and adds sdlc to your PATH.

Windows
irm https://bakalarsoftware.com/dl/install.ps1 | iex

Run in PowerShell. Installs to %USERPROFILE%\.sdlc\bin\ and adds sdlc to your user PATH.

Installation Guide

Questions? Reach out directly.

Stack compatibility, compliance mapping, team onboarding — I read every email and reply personally. If you're not sure the platform fits, that's exactly the right time to ask.

info@bakalarsoftware.com
View services