Chapter 12 — The ADLC Model

SDLC's feedback loop returns to requirements. ADLC's feedback loop returns to the harness.

12.1 What a model has to earn

Process diagrams are cheap. Every consultancy has one, most are unfalsifiable, and the reason is that they consist entirely of things a reasonable person would do anyway, arranged in a circle.

So before drawing anything, the standard this chapter has to meet. A lifecycle model is worth its page only if it makes claims that could be wrong:

1. Forced ordering. Not conventional ordering — ordering where doing B before A demonstrably fails. If the phases could be permuted without consequence, they are a list.
2. An artefact per phase. Something you can point at afterwards and say this happened. A phase with no artefact is unauditable and therefore optional in practice, whatever the diagram says.
3. A stated place where each loop closes, so you can distinguish a system that is learning from one that is thrashing.
4. Prohibitions. A model that forbids nothing predicts nothing.

The fourth is the one that matters most, and it is the reason this chapter is organised the way it is. Taleb's methodological stance throughout his work is that negative knowledge is more robust than positive knowledge — we are far more certain about what fails than about what succeeds, so a discipline's real content is its list of things not to do. Via negativa applied to process design means the model's teeth are in §12.9, and everything before it is scaffolding for those seven sentences.

12.2 Nine principles

Compactly, because these are a summary of Parts I and II rather than new material. Each is the residue of an argument already made.

Nine principles is eight too many to remember, which is why §12.9 exists. Principles describe a posture. Prohibitions change behaviour.

12.3 Why two loops

The double loop is borrowed, and the borrowing should be explicit. Argyris and Schön distinguished single-loop learning — detecting an error and correcting action within existing assumptions — from double-loop learning, which questions the governing assumptions themselves. That distinction is theirs, and it is exactly the right shape here.

But the interesting question is not whether double loops are good in general. It is why software engineering managed for fifty years with essentially one.

SDLC has a feedback loop and it returns to requirements. Agile shortened it. DevOps automated the path from decision to production. Every variant closes the loop on the product: build, learn, adjust what you build.

None of them needed a loop for the control system, and Chapter 5 explains why. The controls were not artefacts. Scrutiny arrived free with the cost of producing a change. Intent was carried by a person who could be asked. Pacing was free because change was slow. Structural correction happened because somebody eventually found the duplication unpleasant. You do not need a maintenance lifecycle for something you are not maintaining.

That is the whole justification for the second loop, and it is worth stating as plainly as possible:

The outer loop exists because the harness became an artefact. Once scrutiny, intent, pacing, and structural correction have to be built, they acquire the properties of everything else that is built: they drift, they rot, they contradict each other, they need owners, and they need a loop.

12.4 The inner loop: the delegation cycle

Six phases. For each: what the human does, what the agent does, and the artefact — because §12.1 requires that a phase you cannot audit is a phase that will not happen.

Four phases deserve comment because each pays a specific debt.

Intent is a phase, not a precondition. Chapter 5 established that intent can no longer be recovered after the fact by interrogating an author — review became inspection rather than dialogue. Every lifecycle before this one assumed intent existed somewhere; ADLC makes stating it a step with an artefact, because the artefact is the only place intent now lives. And per Chapter 8, part of that artefact is a held-out acceptance set: authored by a human, before generation, never shown to the agent, run only at the merge gate. Without the partition, Chapter 8's Figure 8.5 applies and the tests prove consistency rather than correctness.

Ground is where Part II's pillars enter operationally. This is the phase in which Chapter 6's payload is assembled, Chapter 9's graph is traversed, and — per Chapter 11 — provenance should be tagged. The retrieval trace matters more than it looks: it is the artefact that lets you diagnose Chapter 6's starvation-versus-dilution question after a failure, rather than guessing.

Decompose is not project management. Two chapters converge here. Chapter 6 verified the survey's finding that models "demonstrate remarkable proficiency in understanding complex contexts" while showing "pronounced limitations in generating equally sophisticated, long-form outputs" [B] — so decomposition is compensation for a measured asymmetry, not administrative tidiness. And Chapter 10 showed it is information hiding applied to tasks: a task scoped inside one bounded context is a task where local inference can be sound; a task spanning two is not. MASAI's result — that modular sub-agents avoid "unnecessarily long trajectories which inflate costs and add extraneous context" [B] — is the same principle measured.

Verify runs computational before inferential, per Chapter 8's ordering rule, and reviews by exception: the human attends to what the sensors cannot express, which is the judgment residue. Chapter 16 costs this properly. Note what Verify does not include — it does not include a human reading every line, because Chapter 3 established that capacity does not exist.

12.5 The inner loop is a variety funnel

Now the structural reading, which is where the model stops being a list.

Chapter 8 established the Ashby constraint: a regulator can only regulate variety it has a model of, an unconstrained generator has unbounded variety, so variety reduction is forced. That was theory. The inner loop is where it happens operationally.

Three things fall out of Figure 12.2, and the first is the most immediately useful thing in the chapter.

Surprise at the output is a diagnostic about phases 1–3, never about the model. If an agent produced something you did not expect, the space it was permitted to explore was wider than you believed. That is a failure of Intent (you did not say), Ground (it could not see the constraint), or Decompose (the task was too broad). Blaming the model is a category error — the model sampled from the space you left open.

I would put that on a wall. It converts the most common reaction in agentic development — look what it did — into a three-way diagnostic with a fix at each branch.

The pre-Generate phases are cheap and the post-Generate phases are expensive. Narrowing the space costs a sentence. Rejecting bad output costs sensor runs, retries, and eventually human attention — the constraint from Chapter 3. So the economics push effort leftward, which is Chapter 8's keep quality left arriving from a different direction: not just early detection, but early restriction.

And Chapter 1's claim now has a location. The randomness comes to rest at Integrate. Everything before it is stochastic; the merged artefact is not. This is why Meaning B gets deterministic gates and Meaning A does not, and it is visible in the funnel's bottom.

12.6 The outer loop: the steering cycle

Four phases, subject: the harness.

Observe pays two debts. It is where Chapter 4's replacement homeostat lives — the standing-mandate drift sensor that senses accumulation without being asked, because complexity is monotone under additive change and the feeling-driven correction that used to bound it is gone. And it is where Chapter 8's drills run: deliberately produce the failure a control exists to prevent, and verify the control fires. Both share one property that makes them organisationally awkward: nothing triggers them. No ticket arrives. That is precisely why they belong to a loop with a mandate rather than to anyone's task list.

Steer is Böckeler's loop, with the retirement arm Chapter 8 added. Both directions, or the harness terminates in theatre: when an issue recurs, install a control and when a drill shows the failure can no longer be produced unguarded, remove one.

Govern is where Chapter 11's accountability argument becomes procedure. Accountability follows the autonomy decision and the harness ownership, not the individual approval — because approval is the gate Chapter 5 showed collapsed. Chapter 13 supplies the instrument.

Evolve is Chapter 8 §8.10's harness templates: variety reduction made reusable, and DORA's quality internal platforms capability in its agentic form [C].

12.7 The flaw in this model

Here is the problem with what I have just drawn, and I would rather raise it than let a reviewer find it.

Chapter 5 §5.5 established a control-systems fact and used it against shift-left: a regulator slower than its plant does not regulate it. It produces outputs appropriate to a state that has already passed.

Now count clock speeds. The inner loop runs at minutes to hours — call it dozens of traversals per team per day once agents are doing the work. The outer loop, as every organisation currently implements it, runs at the tempo of retrospectives and platform planning: fortnightly at best, quarterly in practice.

This is not a minor calibration issue. It is the same objection Chapter 5 raised against human review, applied to my own model, and it has the same answer: if the plant runs at machine speed, the regulator must too.

Which means the outer loop cannot be ceremonial. Specifically:

• Observe must be mechanised. Drift detection and drills are scheduled jobs, not agenda items. A human noticing that complexity is climbing is a sampling rate of roughly once per quarter, and Chapter 4 showed the accumulation is monotone and quiet.
• Recurrence detection must be automatic. Chapter 8's loop triggers on "an issue happens multiple times" — which requires counting failure modes across sessions. No human tracks this reliably at machine speed; it is exactly the kind of bookkeeping that must be instrumented. Chapter 14 makes it a metric.
• Steer can be substantially agent-driven. Böckeler's own observation is that the loop can be accelerated by agents — writing the tests, drafting the rules, scaffolding the linters. Chapter 8's rule stands: point the agent at the harness, not only at the product.
• Govern and Evolve stay human and stay slow, and that is correct. Authority assignment and platform strategy are judgment, they are not machine-paced, and Chapter 5's relocation of human judgment upward is exactly this: humans belong at the outer loop's slow end, where a decision governs a class of work rather than an instance.

So the honest version of Figure 12.1 has an internal split: the outer loop's sensing half runs at machine speed, and its deciding half runs at human speed. A retrospective is a fine place to decide what to do about a recurrence count. It is a hopeless place to detect one.

12.8 Artefacts are the only connection

The two loops in Figure 12.1 touch at exactly one place, and it is easy to miss.

The outer loop's input is the inner loop's artefacts. Retrieval traces, execution traces, sensor reports, escalations, recurrence counts. That is the entirety of what the steering cycle has to work with.

State it as a consequence:

A lifecycle without artefacts has no outer loop. Not a weak one — none. The steering cycle's only inputs are the inner cycle's records, so a team that does not capture them cannot detect recurrence, cannot tell a working control from a silent one, and cannot know whether a failure was starvation or dilution. It will therefore fix instances forever, correctly, one at a time, while the generator remains exactly as likely to produce the next one.

This is Taleb's silent evidence in a process diagram. The team sees the defects it fixed. It does not see the pattern across them, because nothing recorded the pattern. And the absence is invisible: an organisation with no traces does not experience a shortage of data. It experiences a series of individually reasonable debugging sessions.

Which makes trace capture the cheapest high-value investment in Part III. It buys nothing on its own — no defect is prevented by a log — and it is the precondition for every measurement in Chapter 14 and every control in Chapter 8.

12.9 What ADLC forbids

The teeth. Seven prohibitions, each traceable to an argument rather than a preference, and each stated so that a violation is observable.

1. Do not generate before intent exists in a checkable form. Because intent cannot be recovered afterwards by interrogating the author (Ch 5 §5.4), and a harness cannot verify correctness against a requirement never articulated (Ch 0). Violation looks like: the specification was written after the diff, or by the agent, or not at all.

2. Do not merge on a test the generator authored alone. Because code and tests descended from one model of intent prove consistency, not correctness (Ch 8 §8.7). Generated tests are a regression harness and are valuable as one. Violation looks like: no held-out acceptance criteria, or acceptance criteria the agent could see.

3. Do not fix a recurring defect at the instance. Because the generator will produce the next one at the same rate, and fixing instances consumes the constraint while returning nothing to the system (Ch 3, Ch 8 §8.1). Violation looks like: the same failure mode appearing in three retrospectives with three separate fixes.

4. Do not add a control without a date, a named failure mode, and a retirement criterion. Because guides age while sensors persist (Ch 2), the context budget is finite and its marginal token can be negative (Ch 6), and a loop that only adds terminates in Harness Theatre (Ch 8 §8.2). Violation looks like: nobody can say why a rule is in the context file.

5. Do not raise an autonomy level without evidence of harnessability and blast radius. Because autonomy is a function of those two things and never of enthusiasm (Ch 13), and because accountability attaches to the autonomy decision rather than to the approval (Ch 11 §11.9). Violation looks like: scope expanding by convenience, which Ch 21 calls Autonomy Creep.

6. Do not treat any artefact an agent reads as data. Because agents cannot reliably distinguish instructions from data, and OWASP ranks goal hijack first for that reason (Ch 11). Violation looks like: an instruction used to prevent a security outcome — "do not read .env" instead of no access to .env.

7. Do not mandate generation throughput. Because generation is the elastic side and review the inelastic one, so a throughput mandate raises arrival rate against fixed capacity and relocates the bottleneck out of sight (Ch 3). Violation looks like: merged pull requests per engineer as a target — which is exactly what the best-documented enterprise case did, hitting the metric while batch size grew by roughly a third [B].

Seven sentences. Each one falsifiable, each one violated routinely, and each one traceable to a chapter rather than to taste. If a reader takes nothing else from Part III, this list does more work than the diagram.

12.10 ADLC in context

The comparison, dimension by dimension. Chapter 5 §5.8 argued that ADLC contains DevOps rather than replacing it; this table shows what it adds.

The last row is the defining structural claim of this book, and Figure 12.1 is a picture of it. Everything above the last row is a difference of emphasis; the last row is a difference of kind, and it is the reason a second loop had to be drawn at all.

12.11 Two ladders, not one

One clarification before Chapter 13, because there is a competing framework that deserves engagement rather than dismissal.

Farrag's specification-driven governance proposes an escalating ladder: post-hoc review → natural-language specification → executable contract → constitutional governance, grounded in transaction cost economics [B]. It is a good ladder and it is measuring something real.

It is also not the same axis as Chapter 13's autonomy ladder, and conflating them causes trouble. One is about how strongly the work is specified; the other is about how much authority the agent holds. They are orthogonal, and the two-dimensional space they define is more useful than either alone.

The upper-left quadrant — high authority, weak specification — is precisely what Chapter 22 will call mode confusion: vibe coding's operating point applied to production stakes. The lower-right is the failure nobody warns about, because it looks responsible: heavy specification apparatus around work the team will not actually delegate.

Chapter 13 develops the vertical axis and gives it a scoring instrument. The horizontal axis is Farrag's, credited, and the pairing is this chapter's contribution: autonomy is only safe to the extent that specification strength has kept pace with it. Prohibition 5 is that sentence in imperative form.