QA-DC — Quality Assurance & Design Control

Enforcement Pipeline

The Gate Between Code and Production

QA-DC sits inside the 8-step AEGIS pipeline. It is the mandatory quality gate — no code bypasses it.

Plan → Architect → Build → ┌──────────────────────────────────────┐
                           │           QA-DC GATE                  │
                           │                                      │
                           │  1. Code Quality    ─── Standards    │
                           │  2. Complexity      ─── Cyclomatic   │
                           │  3. Complexity      ─── Cognitive    │
                           │  4. Tests           ─── Coverage     │
                           │  5. Security        ─── SAST/SCA     │
                           │  6. Documentation   ─── Completeness │
                           │                                      │
                           │  Output: Quality Score + Verdict     │
                           └──────────────────────────────────────┘
                                        │
                           ┌────────────┼────────────┐
                           │            │            │
                      [PASS]       [WARNING]     [FAIL]
                      Continue     Review         Block
                                       │            │
                                  ┌─────┴─────┐  Stop
                                  │           │
                              Reviewed   Rejected
                              Continue   Return

→ Validate → Secure → Approve → Deploy

All Checks

Six Categories. One Verdict.

Each check produces a score. Scores roll up into an overall Quality Score that determines deployment eligibility.

Code Quality Validation

Standards & Best Practices

Evaluates every code change against organizational coding standards, language-specific best practices, and regulatory requirements. Checks naming conventions, code organization, separation of concerns, and maintainability indicators.

NamingOrganizationSoCReadability

QualitativeScore: 0-100

Cyclomatic Complexity

Path Branching Measurement

Counts independent execution paths through code. Higher = more branching, harder to test, more bugs. Thresholds enforced automatically with tiered responses.

Control FlowBranchingTestability

ThresholdWarning 10 / Error 20 / Block 30

Cognitive Complexity

Human Readability Measurement

Measures difficulty for a human to understand the code. Penalizes deep nesting, control flow disruptions, and interleaved logic. Maps directly to maintenance cost and technical debt.

NestingReadabilityTech Debt

ScoringLower = better

Test Coverage

Automated Quality Evidence

Statement, branch, and path coverage metrics. Minimum thresholds enforced per project. Identifies untested logic, tracks coverage trends over time, and flags regression risks.

StatementBranchPathRegression

CoverageMin threshold: per project

Security Scanning

SAST / SCA / Secrets

Static Application Security Testing, Software Composition Analysis, and secret detection. Critical and high-severity vulnerabilities automatically block production deployment. Integrates with ZEROT zero-trust layer.

SASTSCASecret DetectionAuto-Block

BlockerCritical = Deploy Block

Documentation Check

Completeness Validation

Validates API documentation, Architecture Decision Records (ADRs), change logs, and release notes. Ensures required documentation exists per engineering standard before deployment.

API DocsADRsChangelogsRelease Notes

CompletenessRequired: Yes/No

Standards Mapping

QA-DC Maps to International Standards

Every QA-DC check category maps to one or more international compliance standards. This is how compliance becomes a byproduct of engineering.

QA-DC Category	ISO 27001	SOC 2	NIST	EU AI Act
Code Quality	A.8.28 Secure Coding	CC6.1 Logical Access	SSDF PW.1	Art. 9 Risk Mgmt
Cyclomatic Complexity	A.8.25 SDLC	PI1.1 Processing Integrity	SSDF PW.2	Art. 9(3) Design Controls
Cognitive Complexity	A.8.25 SDLC	PI1.1 Processing Integrity	SSDF PW.2	Art. 13 Transparency
Test Coverage	A.8.29 Security Testing	PI1.3 Processing Integrity	SSDF PV.1	Art. 15 Accuracy
Security Scanning	A.8.29 Security Testing	CC6.1 Security	SSDF PW.5 + PW.8	Art. 9 Risk Mgmt
Documentation	A.8.18 Use of Priv Utilities	CC2.1 Communication	SSDF PO.3	Art. 11 Technical Docs

Outcome Tiers

Three Possible Outcomes

QA-DC produces a verdict for every engineering operation. The verdict determines whether code proceeds to the next pipeline stage.

PASS

APPROVED

All checks passed. Quality score meets or exceeds thresholds. Code is cleared for next pipeline stage: Validate.

Auto-ContinueScore LoggedEvidence Generated

PASSNext: Validate

WARNING

REVIEW

Some checks produced warnings. Non-blocking issues flagged. Requires human review before proceeding. May still deploy if reviewer approves.

Human ReviewIssue ListExpedited Path

REVIEWNext: Review

FAIL

BLOCKED

Blocking issues found. Critical security vulnerabilities, quality threshold violations, or missing required documentation. Code is returned to developer.

Deploy BlockedIssues ListedMandatory Fix

BLOCKNext: Return

How QA-DC Differs

Not a Linter. Not a Scanner. A Governance Gate.

Tool Type	Scope	Enforcement	Audit Trail	Compliance Mapping
Linters / Formatters	Code style	Advisory	None	None
SAST / DAST Scanners	Security only	Partial	Report	Partial
CI/CD Pipelines	Build + Deploy	Configurable	Logs	None
Manual QA	Functional	Ad-hoc	Notes	None
QA-DC	Full stack + compliance	Mandatory gate	LKWWV hash-chain	ISO/SOC/NIST mapped

Nothing Ships Without
QA-DC Verification

The Gate Between Code and Production

Six Categories. One Verdict.

QA-DC Maps to International Standards

Three Possible Outcomes

Not a Linter. Not a Scanner. A Governance Gate.

Ready to See QA-DC in Action?

Nothing Ships WithoutQA-DC Verification

The Gate Between Code and Production

Six Categories. One Verdict.

QA-DC Maps to International Standards

Three Possible Outcomes

Not a Linter. Not a Scanner. A Governance Gate.

Ready to See QA-DC in Action?

Nothing Ships Without
QA-DC Verification