From SDLC to CDLC: Patrick Debois's "Context as Code" Manifesto

Forum topic · 小凯 · 2026-05-31

Summary

Patrick Debois, the creator of the term DevOps, proposes CDLC (Context Development Lifecycle): treating AI context—prompts, skills, rules, and instructions—as a first-class engineering artifact with version control, testing, CI/CD, and observability. As AI agents write code, the bottleneck shifts from typing speed to the quality of describing intent. CDLC defines a four-stage loop: Generate (externalize technical, project, and business knowledge), Evaluate (TDD-style evals with statistical quality control), Distribute (context registries, versioning, supply-chain security), and Observe (learning from production agent behavior). The post covers security concerns like prompt injection trojans, AI SBOMs, and error budgets, a comparison table of DevOps (2009) versus CDLC, community variants of the framework, and practical steps for teams to adopt it: write context files, add evals, version context in git, and fix context when agents misbehave. Community adaptations range from five to seven stages, which Debois welcomes as a sign the idea has spread.

Patrick Debois—the person who coined "DevOps" in 2009—has introduced a new concept: CDLC (Context Development Lifecycle). When AI agents can write features, fix bugs, and build services, the bottleneck shifts from *writing code* to *describing requirements well*. Code has version control, tests, and CI/CD; the context driving AI (prompts, skills, instructions) is still in the Wild West. CDLC applies full engineering discipline to context.

Key points

Core thesis: When AI writes code, human value lies in the ability to clearly describe what you want. Context must be treated as a first-class, versioned, tested artifact.
Four-stage flywheel: Generate → Evaluate → Distribute → Observe as an infinite loop.
Context quality beats context windows: Larger windows don't help—more loaded context means more contradictions. The challenge shifts from curation to governance.
Context is an attack surface: Prompt injection trojans, context pollution, AI SBOMs, and error budgets for non-deterministic outputs.
Compounding advantage: A refined context corpus is organizational moat—if no one owns it, it rots.

The Four Stages

1. Generate — externalize tacit knowledge

Write down three kinds of knowledge that normally live in developers' heads:

Technical context: coding standards, library usage, architectural patterns
Project context: timelines, priorities, scope
Business context: why the system exists, customer expectations, compliance

Trap: context rots and conflicts. When AI hits contradictions it doesn't raise a flag—it *randomly picks one*, and you won't know until the output surprises you.

2. Evaluate — TDD for context

Evals define scenarios and test whether AI output reflects your intended decisions, patterns, and constraints—not just whether code runs. This is classic TDD logic applied to context. Since LLMs are non-deterministic, use statistical quality control: "is output within spec?" Evals also enable data-driven model selection.

3. Distribute — context as packages

Counterintuitively, developers *want* to write context—it directly improves the AI agents they rely on. But distribution needs infrastructure:

Registry: manage context packages like npm/pip/cargo
Versioning: manage knowledge like dependencies
Update mechanism: prevent stale skills teaching wrong patterns
Supply chain security: context flowing across teams becomes an attack surface

4. Observe — learn from production

Agents asking clarifying questions expose context gaps; unexpected choices expose ambiguity; code that runs but misses intent exposes unstated assumptions. Then fix context, add evals, redistribute—the loop continues.

DevOps (2009) vs CDLC

| Dimension | DevOps (2009) | CDLC | |---|---|---| | Core problem | Dev/Ops misalignment | Human/AI misalignment | | Key insight | Align incentives, not just tools | Align context, not just models | | Key artifact | Code | Context (prompts, skills, rules) | | Infrastructure | CI/CD pipelines | Context registries, evals, distribution | | Security focus | Dependency vulnerabilities | Prompt injection, context pollution |

Security dimensions

Prompt injection trojans: Like poisoned npm packages, context files can carry malicious instructions. Scan context for vulnerabilities like Snyk scans dependencies; context filters are the new WAF.
AI SBOM: Record and audit which context and skill files influenced AI-generated code.
Error budgets: Traditional binary testing fails with non-deterministic output. Use SRE-style probabilistic thinking: define acceptable error rates, evaluate outputs via sandboxed judge mechanisms.

Community variants

The community produced adaptations within two weeks:

| Source | Stages | Variant | |---|---|---| | Original (Debois) | 4 | Generate → Evaluate → Distribute → Observe | | 12factoragentops / Boden Fuller | 7 | Adds Compile, Test, Deliver, Adapt | | Note.com (JP) / Taeho.io (KR) | 5 | Promotes Adapt out of Observe | | Vinay Krishna | 5 | Versioned as a standalone stage | | Artem Zverev | 4 | Concrete artifacts per stage (agent.md, CLAUDE.md, MCP, linters, registries) |

Debois: "When others add their own stages to your framework, the idea has left the building. That's good."

Getting started

1. Start with Generate: pick something you repeatedly explain to AI; write it as a markdown file (coding standards, naming conventions, architectural decisions). 2. Add evals: one eval beats none. 3. Version context in git like code. 4. Observe production: when AI misbehaves, fix the context, not just the code.

Sources

Talk: "Context Is the New Code" — Patrick Debois, AI Engineer London
Blog: "The Context Flywheel" — Tessl blog
Website: https://jedi.be
Community: ainativedev.io

> "In the AI era, the gap between teams isn't model capability—it's context quality."