Agents run the SDLC. People govern it.

QDF takes a government service from one sentence to a live API on Hukoomi. Lyzr agents do the work in six stages on Superflow. A person signs off at the points the process names, and nowhere else.

Replay the run Open the finished run

Run 364508a96c0f · 23 Sep 2026 · mudit-lyzr/qdf-sandbox“Let a business owner upload their CR document for a licence renewal and get back a reference number.”

0 Onboard repo1 min

1 Requirements3 min

2 Architecture10 min

3 Build7 min

4 Deploy16 min

5 Expose API15 min

Agent
Coding agent
GitHub call, code or check
Scan, deploy or gateway step
A person decides

nodes ran across six stage flows: 78
agent steps: 28
decisions made by a person: 9
pull requests opened by agents and merged: 2
mandatory policy controls passed before production: 4/4

Qatar's catalog has 4,000 government services. About 1,500 still have no digital version.

More than 60 entities have to build them on the stacks they already run, from Java to VB6, under three national mandates. A low-code attempt stalled on lock-in. This one keeps the entity's code, its Git host and its models, and asks for one or two engineers.

~1,500

services left to digitize, out of 4,000

~30/60+

entities digitized today

mandates on every output: information security, payments, authentication

1–2

engineers per entity, not thirty

Agents do the work. People own the outcome.

Each stage is its own Superflow: agents in sequence, then a gate where a named person approves, rejects or sends it back. What one stage produces is the next stage's input, so nobody re-briefs anybody.

Hand-offs become contracts

Every stage emits typed JSON that the next one reads. The backlog, the design and the evidence travel with the work, not in someone's inbox.

Review by exception

A person sees a pull request when policy blocks it, it touches payments or identity, quality is low, the reviewer escalates, or a fix fails three times.

Compliance moves into the flow

The policy engine runs inside every stage. A blocking finding stops the flow where it happens, not at an audit weeks later.

Brownfield first

The flow extends what an entity runs. It writes characterization tests before touching legacy code, and wraps VB6 and Sitecore rather than rewriting them.

StageAgentsA person decidesLeaves behind

0 · Onboard repo2 agent steps in the run

Read the repo tree, detect the stack, index the codebase, extract conventions

Confirm the entity profileEntity tech lead

Entity profile: stack, service map, conventions

1 · Requirements6 agent steps in the run

Intake, summarize, map national mandates, validate each requirement, write and prioritize stories

Approve strategic priorities and scopeEntity product lead

Prioritized backlog and MVP slice

2 · Architecture7 agent steps in the run

Choose a pattern, trace impact, model data, draw diagrams, draft the API, design security, validate

Govern architecture standards and constraintsEntity tech lead

Solution approach, impact, data, API and security design

3 · Build4 agent steps in the run

Plan, write code, open a PR, test, fix, merge, write integration tests, run regression

Intervene: exception, policy or riskTech lead, on exceptionRegression check after mergeTech lead

A qdf/<story> branch, commits and a merged PR

4 · Deploy4 agent steps in the run

Scan, triage vulnerabilities, check compliance, write the release checklist, deploy, validate

Run release checklistQA / SREMonitor outcomes and system behaviour, own accountability and governanceQA / SRE and product lead

Release record with its evidence

5 · Expose API5 agent steps in the run

Trace the legacy code, design the contract, build it, test the contract, register, validate, document

Confirm the legacy code path before anything is built on itEntity tech leadHukoomi integration approvalHukoomi integration team

OpenAPI spec, gateway registration, bilingual docs

One sentence in. A live API out.

On 23 Sep 2026 we gave QDF the sentence above and the repo mudit-lyzr/qdf-sandbox. This is what every stage ran and what it left behind, straight from the run's record.

Read 21 files and wrote the entity profile.

The Codebase Indexer mapped the modules and entrypoints. The Convention Extractor wrote CONVENTIONS.md, which the coding agent follows in Stage 3.

What ran, in order (7 nodes)

Read Repo Tree
Detect Stack
Adapter Gate
Codebase Indexer
Convention Extractor
Assemble Entity Profile
Approve Profile

Agent
Coding agent
A person decides
Scan, deploy or gateway
GitHub, code or check

What it left behind

Adapter: node-react
Files read: 21
Tests / CI: present / present
Languages: 11 js

The decision

Confirm the entity profile. Entity tech lead.

Read every output in the workbench

Agents propose. The policy engine decides.

Compliance is a versioned policy pack that the flow calls at eight fixed points, not an instruction in a prompt. A blocking result stops the flow, and only a compliance officer can change the pack.

Stopped at Stage 2 · run 4f9e8217eb78

A design reached the gate with an unauthenticated write endpoint. The pipeline stopped before any code was written.

The new endpoint must have National ID authentication and business-owner authorization middleware, but the implementation explicitly defers authentication and passes only (method, url, body) to route(), with no authenticated-principal context or authorization control.
The operation creates a licensing-related record and returns a confidential reference number.

The Pattern Validator raised 4 blocking findings. Read them in the workbench.

0.9
Baseline scanThe repo's starting posture, recorded in the entity profile
1.11
Scope pre-checkThe MVP slice covers every mandatory control
2.10
Design gateAuth tier per endpoint, PII classification, payment flag
3.9
Code gateSecrets, crypto, auth middleware, payment SDK, log masking
4.5
Artifact gateTLS, residency, audit logging, SBOM, bilingual errors. No human override
5.9
API gateNo unauthenticated writes, idempotency, rate limits
5.12
Gateway registrationThe registration matches the spec and its auth policy
4.16
Release recordThe policy pack version is stamped on every release

QA-SEC-01 No secrets in source
QA-SEC-02 No personal data in logs
QA-ENG-01 One module system
QA-ENG-02 Automated tests pass

The 4 mandatory controls the demo's policy pack checked in run 364508a96c0f, all passing. The full pack, with the national security, payment and authentication rules, comes from MCIT and NCSA.

Built for the estate an entity already runs.

Stage 0 reads a repo once and writes down what it is. Every later stage branches on that profile: which adapter writes the code, how it is tested, and whether an API goes inside the app or in a facade beside it.

Read the tree
One call to the Git host lists every path. In the run: 21 files in mudit-lyzr/qdf-sandbox.
Detect the stack
Marker files pick an adapter, in a fixed order, and extensions count the languages: Java, C#, VB, PHP, Python, JavaScript, TypeScript, SQL.
Index the codebase
The Codebase Indexer maps modules, public functions, endpoints, tables and external calls into a service map.
Write the conventions down
The Convention Extractor infers naming, layering, errors and logging, and writes CONVENTIONS.md for the coding agent to follow.
A person confirms it
The tech lead checks the stack, conventions and environments before any stage runs against the repo.

Detect Stack, first match wins. Highlighted: what the run found.

composer.json or core/lib/Drupal.phpphp-drupal
Sitecore*.config or App_Config/Include/dotnet-sitecore
.vbproj, .vbp or .aspdotnet-vb
pom.xml or build.gradlejava-spring
requirements.txt or pyproject.tomlpython-web
package.jsonnode-react
none of the abovea person maps it

“There is no evidence of VB6, classic ASP, Sitecore, COM, stored procedures, or an unmodifiable legacy application that would justify FACADE.”

Solution Architect, Stage 2 of run 364508a96c0f, choosing to extend the service in place

Adapter	Covers	Tests and builds with	API goes	Day-one confidence
java-spring	Java, Spring Boot, Jakarta EE	Maven or Gradle, JUnit	Native endpoints	High
node-react	React front ends, Node or Next APIs	npm or pnpm, Jest, Playwright	Native endpoints	High
python-web	Django, Flask, FastAPI	pytest, tox	Native endpoints	High
php-drupal	Drupal 7 to 10 sites and forms	PHPUnit, drush	Drupal REST, or a facade for D7	Medium
dotnet-sitecore	Sitecore XP/XM, .NET Framework and Core	MSBuild, NUnit or xUnit	Facade sidecar (.NET minimal API)	Medium
dotnet-vb	VB.NET, VB6 with COM, classic ASP	MSBuild, or characterization tests over HTTP	Facade sidecar over COM or the database	Low to medium

Tests before changes

Where a repo has no tests, the Test Author pins the current behaviour of every function a story touches before the coding agent changes it.

Wrap, don't rewrite

For VB6, classic ASP and Sitecore, the API is a small sidecar that calls the legacy logic. Nobody refactors a 2009 form in the first sprint.

Risky paths go to people

The Impact Analyst escalates anything that touches payment or identity code to the tech lead, even when every pattern check passes.

Any model, per node

Each agent's model is set on its node. The coding agent can run Claude, a sovereign-hosted open model or a Scale-tuned one without a change to the flow.

Run all six stages, or just the one you need.

Every stage has its own trigger and a versioned input contract. The full chain and a standalone run use the same flow definitions, so there is one thing to maintain.

Stage 1 aloneAn entity that wants a compliant backlog for its own team sends an entity id and a sentence.
Start at Stage 2An entity with stories uploads them in the Stage 1 shape and gets a design and an OpenAPI draft.
Start at Stage 4An entity that built its own artifact gets compliant scanning and promotion.
Stage 5 aloneAn entity with a live service points at the repo, names the transaction, and gets it on Hukoomi. With 2,500 services already digital, this is the fastest win.

Next: the ticket starts the run.

Today a person types the idea into the workbench. In the next edition, the entity's own tracker starts the flow, and every gate and result goes back to where the team already works. Planned, not in this demo.

1 · The ticketA story moves to "Ready for build"

A tracker webhook calls the Stage 1 trigger with the ticket's title, description and attachments as the intake.

JiraAzure BoardsGitLab issuesServiceNowLinear

2 · The backlogStories are written back as issues

Stage 1 already ends by creating tracker issues (PRD 1.13). Each story links back to the ticket that started it.

3 · The gatesDecisions happen where people are

Each gate posts to the ticket and to Teams or Slack. Approve there, and the flow resumes from the same node.

4 · The codePull requests on the entity's Git host

GitHub today; GitLab and Azure DevOps next, with the entity's CI runners doing the builds and tests.

5 · The closeThe ticket closes with its evidence

The PR, the release record, the API on Hukoomi and the docs link land on the ticket, which moves to Done.

Today

The workbench and six stage flows

An idea and a GitHub repo start the run
Lyzr agents on Superflow, gitagent for code, in a container
Local stand-ins for the scanner, policy pack, deploys, gateway and portal
Nine human gates, with required fields enforced

Next edition

Tracker-triggered, entity-hosted

Jira, Azure Boards, GitLab issues and ServiceNow start and close runs
Approvals in Teams, Slack and email
GitLab and Azure DevOps, the entity's own CI runners
The national policy pack as OPA/Rego and Semgrep rules

After that

National scale

The real Hukoomi gateway and national identity provider, with MCIT
Arabic-first intake and generated code
Scale AI evaluation sets and tuned models in the model gateway
Agentic refactoring for VB6 estates

Sovereign at every layer.

The last attempt failed on lock-in. So every layer QDF depends on can be swapped, exported or run inside Qatar.

Orchestration

Flows are JSON in Git

Each stage's Superflow exports as JSON and is versioned next to the code. The six in this demo are built by scripts in the repo.

Models

Chosen per node

Every agent names its model. Route them to sovereign-hosted models, or plug in the Scale AI investment, without touching the flow.

Deployment

Inside the boundary

Studio, the flow runtime, agents and policy engine run on one cluster in a Qatar VPC or on-prem. The coding agent runs in the entity's network.

Click through the run yourself.

The real workbench UI, replaying the recorded run. You make the nine decisions; nothing is deployed.