Blaze 3.0
NexGen
The agentic product development lifecycle platform powered by knowledge. Complete infrastructure for building, deploying, operating, and continuously improving AI-powered solutions at enterprise scale.
Vision & Strategy
Blaze is the agentic product development lifecycle platform powered by knowledge. It provides the complete infrastructure — cloud operations, knowledge management, process orchestration, AI governance, and developer tooling — that enables organizations to build, deploy, operate, and continuously improve AI-powered solutions at enterprise scale.
Every solution built on Blaze inherits the full platform: a 4-store knowledge base, Camunda BPMN process execution, compliance-driven development, governance-as-code controls, contextual micro-learning, and continuous feedback loops. Developers don't build these capabilities — they consume them. The platform gets smarter with every solution built on it.
Blaze solutions serve highly regulated industries — financial services, healthcare, government, insurance — where compliance is not optional. The platform's evidence-first architecture collects machine-verifiable evidence at every step for the full spectrum of regulatory obligations: SOC 2, SOX, PCI-DSS, HIPAA, GDPR, DORA, SR 11-7, and AI-specific frameworks (ISO 42001, EU AI Act, NIST AI RMF). AI governance is one critical dimension of a comprehensive governance-as-code capability that applies to every regulation each customer is required to operate by.
Strategic Differentiators
Knowledge-First
The KB is not a feature — it is the foundation. Every solution starts with knowledge ingestion, and every interaction enriches the KB.
Governance-as-Code
Regulatory compliance is enforced by executable BPMN processes and DMN decision tables, not documentation. Every control — from AI governance to industry-specific regulations — produces machine-verifiable evidence.
Agentic Development
78 specialized AI agents perform every specialist role — from requirements through deployment. See SDLC vs PDLC below for what makes this fundamentally different.
Platform Inheritance
Build once in Blaze, inherit everywhere. A capability added to the platform is immediately available to all solutions.
Full Lifecycle
From solution conception through production operation through retirement, every phase is governed, instrumented, and knowledge-captured.
Evidence-First Compliance
Compliance evidence is a first-class output of every workflow. Blaze solutions serve highly regulated industries — financial services, healthcare, government, insurance — where SOC 2, SOX, PCI-DSS, HIPAA, GDPR, DORA, SR 11-7, and AI-specific regulations (ISO 42001, EU AI Act, NIST AI RMF) all require auditable, machine-verifiable evidence at every step. The platform collects it automatically.
A System That Improves Itself
Every development platform on the market automates the Software Development Lifecycle — the cycle of writing requirements, coding, testing, reviewing, and deploying. AI code assistants make developers faster inside this loop. CI/CD pipelines make deployments more reliable. These are valuable — but they are static. The pipeline that shipped your code today is identical to the one that shipped it six months ago.
Blaze introduces something fundamentally different: the Product Development Lifecycle — a second, outer loop that continuously measures, analyzes, tunes, and improves the development process itself. 78 agents execute your SDLC. The PDLC watches how they perform, identifies where they're weak, and improves them. Agent effectiveness is tracked. Context is refined by the Context Engineer. Domain IP is encoded into prompts and rules. Feedback from users corrects the knowledge base. The micro-learning system adapts to developer growth.
The result: the system that builds your software today is measurably better than the one that built it last month. That's not a tool. That's a platform that learns.
SDLC vs PDLC — The Two Loops
What the agents do on every feature
execute
How the system improves itself
& improves
prd-generator writes requirements from PRDs• Developer writes code assisted by Claude
•
test-coverage-analyzer enforces TDD•
pr-orchestrator runs 9+ review agents•
pipeline-orchestrator deploys•
cdd-methodology collects evidence• Every interaction produces OTel traces
• Analyze — Which agents produce findings that lead to changes? Which don't?
• Tune — Context Engineer refines prompts, rules, ontologies, domain IP
• Deploy — Improved context ships to all agents across all solutions
• Feedback from users corrects KB and promotes knowledge
• Micro-learning adapts to developer skill growth
• The platform that built today's feature is better than yesterday's
Traditional CI/CD
Static YAML pipelines. Run the same checks every time. Never learn. Never improve. A tool, not a system.
AI Code Assistants
Copilot, Cursor, etc. Help one developer write code faster. No governance. No evidence. No lifecycle beyond the editor.
Blaze PDLC
78 agents execute the full SDLC with governance and evidence. The PDLC continuously measures and improves the agents, the context, and the methodology.
7-Layer Enforcement Architecture
Blaze enforcement is not advisory — it is non-bypassable, multi-layered, and evidence-producing. Seven layers ensure that governance is structural, not aspirational.
7 industry rule sets: HIPAA, SOC 2, PCI-DSS, SOX, GDPR, DORA, SR 11-7 — auto-selected by customer industry at onboarding
trust-enforcer agent enforces trust boundaries across the pipeline — prevents unauthorized cross-service operations6 blocking patterns: no stubs, no TODO/FIXME, no mocks outside tests, no hardcoded test data, no empty bodies, no commented-out code
4-category response: Auto-Fix (minor, in-scope) → Ask First (scope expansion) → Stop & Report (security/data) → Never Do (delete data, skip tests, force-push)
pre-commit (branch protection, canonical sync, AWS ID detection), commit-msg (conventional commits), pre-push (main branch protection)Always-active behavioral constraints: workflow (14), security (3), reasoning (3), BPMN (2), presentations (6), infrastructure (2), memory (2), frontend (2), agents (2), identity (1), testing (1)
compliance-monitor.py (4-framework evaluator), workflow-validator.py (phase gates), evidence-generator.py (Merkle hash), industry_rule_engine.py6 Testing Gates
Every PR must pass all 6 gates. These are blocking — not advisory, not warnings.
Gate 1: File Coverage
Every new source file has a corresponding test file. No exceptions.
Gate 2: Threshold
Overall coverage ≥50% floor. New modules ≥80%. Both must pass.
Gate 3: Integration
External dependencies (APIs, databases, queues) have integration tests or documented contract tests.
Gate 4: No Skips
Skipped tests require: (1) documented reason, (2) linked work item, (3) re-enable condition.
Gate 5: Real Assertions
Tests must assert observable outcomes. Tests that only verify "runs without exception" are rejected.
Gate 6: Edge Cases
Every function with conditional logic must test happy path AND at least one error/edge case.
Phase Gate Enforcement Thresholds
| Transition | Gate Condition | Enforcement |
|---|---|---|
| Phase 1 → 2 | BDD Gherkin scenarios exist in PRD; scenarios block transition | BLOCKING |
| Phase 2 → 3 | All tests pass; coverage ≥80% on new code; TDD commit order verified via git history | BLOCKING |
| Phase 3 → 4 | Pipeline green; trust boundaries verified; deployment evidence collected | BLOCKING |
| Phase 4 → Merge | Compliance score ≥90% AND 0 critical findings; 100% BDD scenario coverage; final CDD attestation | BLOCKING |
Multi-AI Consensus Pipeline
PR review is not single-model. Four stages using different AI models eliminate single-model blind spots through independent validation and cross-model debate.
Fast Triage
Security basics
Code style
Deep Analysis
Edge cases
Subtle logic bugs
External Validation
from external providers
Run in parallel
Discourse Synthesis
Resolve contradictions
Elevate consensus
Competitive Landscape
Detailed capability comparison against the primary market alternatives.
| Capability | EY + 8090 Partnership | 8090 Standalone | Blaze PDLC |
|---|---|---|---|
| AI Models | Single model | Single model | 4-model consensus (Sonnet + Opus + Gemini + GPT-4o) |
| Governance Model | Consulting overlay | ~20 built-in modules | 101 controls, 13 BPMN processes, 5 DMN tables — governance-as-code |
| Enforcement | Manual checkpoints | Recommended practices | 7-layer non-bypassable enforcement with evidence at every gate |
| Testing | Consulting-led | 4 modules | 6-gate blocking protocol, TDD commit-order verified |
| Compliance Evidence | Consulting deliverable | Basic reports | SHA-256 hash chain, WORM storage, automated CDD collection |
| Process Execution | None | None | Camunda BPMN engine (C7 + C8), DMN decision tables |
| Knowledge Base | None | None | 4-store KB (pgvector + Neo4j + Redis + MinIO) |
| Self-Improvement | None | None | PDLC outer loop — continuous measurement + Context Engineer |
| Hypothesis-Driven ADRs | None | None | L0/L1/L2 evidence classification, WLNK assessment, bounded validity |
| Deployment | Cloud SaaS only | Cloud SaaS only | Self-hosted EKS + Cloudflare edge, air-gapped/on-prem capable |
| Pricing | $200/seat + Big 4 rates | $200/seat/month | Platform-native — no consulting dependency |
Core Architecture
Blaze 3.0 is organized into five layers, each building on the one below. Applications sit at the top and consume everything beneath them.
Platform vs. Application Separation
Clear ownership boundaries ensure platform capabilities are not duplicated across solutions. Every column below describes where the capability lives and what the application contributes.
| Concern | PLATFORM | APPLICATION |
|---|---|---|
| Knowledge Base | 4-store stack + KB service + embedding + RAG | Domain ontology, domain parsers, domain seed data |
| Process Execution | Camunda BPMN engine, deployment, task management | Domain BPMN processes, domain DMN tables |
| Auth & Tenancy | JWT, RBAC, RLS, OTP/SSO, multi-tenant isolation | Role definitions, persona configurations |
| Compliance & Governance | 101 AI controls + industry regulatory frameworks (SOC 2, SOX, PCI-DSS, HIPAA, GDPR, DORA, SR 11-7), 13 BPMN governance processes, 5 DMN decision tables, evidence infrastructure with SHA-256 hash chain | Customer-specific regulatory requirements, industry-specific controls, domain risk scenarios |
| Ingestion | Pipeline framework, generic parsers (PDF, Excel, CSV, images) | Domain parsers (COBOL, ARIS, BPMN, contracts) |
| Feedback | Feedback service, correction promotion, KB growth | Domain-specific feedback categories |
| UI | Design system, layout shell, chart library, LMS engine | Domain pages, domain dashboards, domain components |
| Observability | OTel, Prometheus, Grafana, Phoenix AI | Domain-specific KRIs, domain dashboards |
| Connectors | Connector framework, WAL, sync checkpointing | Domain field mappings, domain-specific API calls |
| Development | Agentic SDLC, code generation framework, PR review | Domain fixtures, domain test scenarios |
Personas & Journeys
Six personas interact with the platform across its full lifecycle. Each persona has distinct touchpoints, needs, and journeys.
- One-click tenant provisioning
- Real-time infrastructure visibility
- Cost attribution by solution/tenant
- Automated alerting with runbooks
- Guided wizard experience
- Deterministic code generation
- Visual process design
- Architecture review feedback
- Seamless workspace access
- Agentic assistance at every step
- Transparent agent activity
- Fast feedback loops
- Intuitive domain-specific UI
- AI-powered assistance
- Contextual help and learning
- Ability to improve the system via feedback
- Single-pane compliance visibility
- Evidence integrity verification
- Regulatory mapping drill-down
- Automated board reporting
- Self-service onboarding
- SSO configuration
- Integration setup
- Usage and cost visibility
SDLC Personas — Agent-Embodied Roles
In the traditional SDLC, a team of 12-15 specialists collaborate across phases. In the Blaze PDLC, three human roles remain essential — stakeholders who set direction, a developer who drives the lifecycle, and a context engineer who ensures every agent carries battle-tested, differentiated domain IP. The remaining specialist roles are performed by 63 specialized agents that execute with enterprise-grade rigor, measured effectiveness, and continuous improvement.
PDLC
Product owner · Business stakeholders · Subject matter experts
Set direction · Define requirements · Validate outcomes
Drives the lifecycle · Writes code · Makes implementation decisions
Perform every specialist role · Measured · Continuously improving
Ensures every agent carries the right knowledge at the right time
This is where differentiation lives
Persona → Agent Mapping
Each traditional SDLC role maps to one or more Blaze agents. The agent analytics dashboard (E14) tracks effectiveness by role, not just by agent name.
| Traditional Role | What They Do | Blaze Agent(s) | Phase |
|---|---|---|---|
| Stakeholder / Product Owner ★ | Sets direction, defines requirements, validates outcomes, domain authority | Human — assisted by prd-generator · critical-thinking |
All |
| Context Engineer ★★ | Curates agent context, encodes domain IP into prompts/rules/ontologies, battle-tests reliability | Human — the role that creates differentiated competitive advantage | All |
| Business Analyst | User stories, BDD scenarios, process models | prd-generator · bpmn-specialist · dmn-decision-architect |
Phase 1 |
| UX/UI Designer | Interface design, user flows, accessibility | design-review · frontend-design skill · check-accessibility skill |
Phase 1-2 |
| Software Architect | System design, API contracts, technology selection | architecture-reviewer · codebase-mapper · plan-checker |
Phase 1-2 |
| Developer ★ | Drives the lifecycle, writes code, makes implementation decisions — may also embody the product owner role | Human + Claude Code — orchestrates all agents below | Phase 2 |
| QA Engineer | Test strategy, execution, coverage analysis | test-coverage-analyzer · playwright-e2e-tester · acceptance-criteria-tester · test-validator |
Phase 2-3 |
| Security Engineer | Vulnerability assessment, security architecture | security-reviewer · dependency-checker · trust-enforcer · red-team skill |
Phase 2-4 |
| DevOps / SRE | CI/CD, deployment, monitoring, incident response | pipeline-orchestrator · cloud-ops-engineer · platform-installer · service-detector |
Phase 3 |
| Technical Writer | Documentation, API docs, user guides | documentation-reviewer · presentation-reviewer |
Phase 2-4 |
| Compliance Officer | Regulatory compliance, evidence, controls | compliance-manager · cdd-methodology · regulatory-analysis · ai-governance-advisor |
All |
| Code Reviewer | Code quality, standards, best practices | code-quality-reviewer · pr-orchestrator (coordinates 9+ agents) |
Phase 4 |
| Release Manager | Release planning, versioning, deployment approval | sdlc-orchestrator · pipeline-orchestrator · goal-verifier |
Phase 3-4 |
| Performance Engineer | Load testing, optimization, benchmarking | performance-analyzer · bundle-analyzer |
Phase 2-3 |
| Data Engineer | Data pipelines, schema management, ETL | data-pipeline-orchestrator |
Phase 2-3 |
| Risk Analyst | Risk identification, assessment, mitigation | risk-assessment · critical-thinking · root-cause-analyzer |
Phase 1, 4 |
The Context Engineer — Where Differentiation Lives
The Context Engineer is the most strategically important new role in the agentic SDLC. They curate every agent's context — prompts, rules, ontologies, domain knowledge — ensuring it represents battle-tested, reliable, trustworthy intellectual property. This is where market differentiation is created: domain-specific expertise, encoded at the right place, at the right time, for the right solutions. The quality of the agents is only as good as the context they carry. The Context Engineer makes it exceptional.
Stakeholders Still Drive Direction
Agents don't set strategy. Stakeholders, product owners, and domain experts define requirements, validate outcomes, and make business decisions. The developer may embody the product owner in smaller teams, but the role exists. Agents amplify human judgment — they don't replace it.
Agent Analytics by SDLC Role (E14)
The dashboard tracks effectiveness by SDLC role, not just by agent name. "How effective is our QA function?" aggregates across test-coverage-analyzer, playwright-e2e-tester, acceptance-criteria-tester, and test-validator. The Context Engineer uses these metrics to improve agent context.
Value Proposition
Enterprise-grade SDLC rigor without enterprise-grade team size. Every role is performed, every check is executed, every piece of evidence is collected. One developer drives the lifecycle. 63 agents perform the specialist work. The Context Engineer ensures the agents carry differentiated domain IP. Stakeholders validate the outcomes.
Knowledge Base — 4-Store Architecture
Every solution inherits the full 4-store knowledge base. The KB FastAPI service provides unified access to graph queries, semantic search, caching, and object storage.
Unified Access Layer — /health, /graph, /search, /objects
PostgreSQL 17
768-dim embeddings
Semantic search
Relational data
Alembic migrations
Community + APOC
Knowledge graph
Entity relationships
Ontology schema
Evidence nodes
Alpine
Query caching
Pub/Sub events
Task queue
Rate limiting
S3-compatible
Raw source files
Evidence artifacts
Generated reports
Document storage
Platform Service Dependencies
15+ platform services interconnect to deliver the full Blaze experience. Every service is observable via OpenTelemetry.
JWT · RBAC · RLS · OTP/SSO
CSRF · Rate Limit · Headers · Request ID
Fernet · AES-256 · Key Rotation
Pub/Sub · Tenant-Scoped Broadcast
SMTP · Slack · In-App
pgvector · Neo4j · Redis · MinIO
25+ Parsers · Chunk · Embed · Store
Hybrid Retrieval · LLM · Streaming
Multi-Provider · Local-First · Data Residency
Corrections → KB · Growth Metrics
BPMN · DMN · External Tasks
WAL · Retry · Schema Drift · Sync
Redis Streams · Progress Tracking
Catalog · Policies · Lineage · GDPR
AI Agent Integration Protocol
Solution Lifecycle Flow
Every Blaze solution follows a BPMN-orchestrated lifecycle through four phases. Evidence is collected at every transition.
Steps 1–4
• Environment & tenancy
• Personas & roles
• Triggers & capabilities
Steps 5–9
• BPMN/DMN design
• KB-integrated development
• TDD/BDD/CDD enforcement
Steps 10–12
• Infrastructure provisioning
• Helm deploy + KB seed
• DNS + auth + alerting
Continuous
• KB growth tracking
• AI governance monitoring
• Continuous improvement
Platform Extraction — Before & After
35 platform capabilities currently maintained independently across 3 repos. Blaze 3.0 extracts them into one platform layer.
Auth middleware · KB · 25 parsers · RAG · Feedback · RLS · GDPR · Connectors · WebSocket · Task queue · Monitoring
Auth module · KB · LMS · Chat · OPA · GraphRAG ML · Notifications · Prometheus · Voice agent · shadcn/ui
5x Auth workers · BPMN validators · BDD testing · Connectors (5x) · WAL · Graph ingest · AI governance · Camunda tooling
Unify
Unified auth · KB (4-store) · Camunda (C7+C8) · LMS engine · RAG copilot · Feedback · Connectors · OPA governance · BPMN toolkit · BDD testing · Evidence infrastructure · OTel · Prometheus · Notifications · GDPR · Design system
Domain only
Domain only
Domain only
AI Governance Control Flow
Every AI interaction is classified by risk, routed to proportional governance, and produces machine-verifiable evidence.
Developer builds an AI-powered feature
5 dimensions × 1-10 scale → Risk Tier + EU AI Act Category
13 governance phases
Full committee review
Independent validation
9 governance phases
Working group review
Standard validation
5 governance phases
Automated checks
Self-attestation
SHA-256 hash chain
S3 WORM storage
Performance · Drift · PSI
Bias · SLA compliance
Quarterly SR 11-7
KRI trend analysis
Multi-Tenant Isolation Model
Four layers of isolation ensure complete data separation across the Org → Tenant → Project hierarchy.
Isolation Mechanisms
app.current_engagement_id enforced per transaction.Complete Agent, Skill & Rule Inventory
The Blaze platform operates through 62 agents, 27 skills, and 40 rules across 11 categories. Every capability is visible, instrumented, and mapped to personas — even when orchestrated behind larger workflows.
Agents by SDLC Role
PRIMARY = directly invocable. HIDDEN = behind orchestrators but fully instrumented and tracked in Agent Analytics.
| SDLC Role | Agent | Vis | Description |
|---|---|---|---|
| Product Owner | prd-generator | PRI | PRD generation with CDD + BDD Gherkin |
critical-thinking | PRI | 7-phase rigorous decision analysis | |
hypothesis-reasoning | PRI | ADI hypothesis testing cycle | |
| Business Analyst | bpmn-specialist | PRI | BPMN 2.0 creation, validation, optimization |
dmn-decision-architect | HID | DMN 1.3 decision tables, FEEL expressions | |
| UX/UI Designer | design-review | HID | Live browser testing via Playwright |
presentation-qa | HID | Viewport testing, CSS fixes | |
| Architect | architecture-reviewer | HID | Architecture, patterns, structural integrity |
codebase-mapper | PRI | Brownfield project analysis | |
plan-checker | HID | Validates plans against goals | |
| QA Engineer | test-coverage-analyzer | PRI | Coverage, quality, completeness |
playwright-e2e-tester | PRI | Full UI path coverage, MCP browser | |
acceptance-criteria-tester | HID | BDD test generation from work items | |
test-validator | HID | Results validation + evidence | |
| Security Eng | security-reviewer | HID | Vulnerability analysis, risk assessment |
dependency-checker | HID | Supply chain security | |
trust-enforcer | HID | Trust boundary enforcement | |
| DevOps / SRE | cloud-ops-engineer | PRI | Autonomous monitoring, cost, ops |
pipeline-orchestrator | HID | CI/CD, multi-service deployment | |
platform-installer | HID | Declarative platform install | |
service-detector | HID | Auto-detect affected services | |
| Compliance | compliance-manager | PRI | Multi-framework compliance |
cdd-methodology | PRI | CDD implementation + evidence | |
regulatory-analysis | HID | Regulatory gap identification | |
ai-governance-advisor | HID | ISO 42001, EU AI Act guidance | |
| Code Reviewer | pr-orchestrator | PRI | 9+ agent consensus review |
code-quality-reviewer | HID | Standards, patterns, practices | |
| Release Mgr | sdlc-orchestrator | PRI | Master 4-phase SDLC workflow |
goal-verifier | HID | Trust-nothing verification | |
| Work Items | ado-manager | HID | ADO: PRD-driven epics/stories/BDD |
jira-manager | PRI | Jira: PRD-driven work items | |
github-issues-manager | PRI | GitHub Issues: stories + tasks |
Skills (27) & Rules (40)
Skills — User-Invocable Commands
Dev: sdlc · full-sdlc · specify · simplify · coding-standards
Governance: review · gate · red-team · security-scan · governance-bridge · risk-assessment
Ops: platform-ops · cloud-ops-check · onboard-solution · deploy-production · deploy-preview · rollback · pipeline-status
Analysis: critical · hypothesize · rigorous · code-audit · check-drift
Context: context-full · context-infrastructure · context-services · context-budget · memory · review-presentation
Rules — Always-Active Behavioral Constraints
Security (3): dependencies · deployment-security · security-hooks
Reasoning (3): hypothesis-evaluation · prompt-anti-patterns (28 catalogued)
BPMN (2): modeling-standards · visual-clarity
Presentations (6): accessibility · brand · color-contrast · deployment · language · responsive
Infra (2) · Memory (2) · Frontend (2) · Agents (2) · Identity (1) · Testing (1)
Transparency Principle
Every agent invocation — whether triggered by a developer or orchestrated behind a workflow — produces an OpenTelemetry trace. The Agent Analytics Dashboard (E14) surfaces all 62 agents grouped by SDLC role. Nothing is invisible. Nothing runs unmeasured. The Context Engineer curates the context that makes each agent effective.
Epic E1: Multi-Tenant Cloud Platform
Epic E2: Knowledge Base Foundation
Epic E3: BPMN Process Engine
Epic E4: Evidence Ingestion Pipeline
Epic E5: RAG Copilot
Epic E6: Feedback & Continuous Learning
Epic E7: Connector Framework
Epic E8: Data Governance
Epic E9: Auth & Security
Epic E10: Solution Creation Wizard
Epic E11: Agentic SDLC Orchestration
Epic E12: Code Generation Pipeline
Epic E13: PR Orchestration
Epic E14: Agent Analytics Dashboard
Epic E15: Micro-Learning & Education
Epic E16: AI Management System (ISO 42001)
Blaze solutions serve highly regulated industries — financial services (SOC 2, SOX, PCI-DSS, SR 11-7, DORA), healthcare (HIPAA), government, and insurance. AI governance is one critical dimension, but the platform's evidence-first compliance and governance-as-code capabilities extend to every regulation each customer in each industry is required to operate by. The BPMN-orchestrated control framework, DMN-driven routing, and SHA-256 evidence chain apply uniformly — whether the regulation is EU AI Act Article 14 or SOX Section 404.
Epic E17: EU AI Act & NIST Compliance
Epic E18: AI Observability
Epic E19: AI Risk Register
Epic E20: AI Governance Dashboard
Epic E21: Parser Extension Interface
Epic E22: Ontology Extension Interface
Epic E23: UI Component SDK
Reference Applications
Four applications demonstrate the platform's capabilities. Each is Tier 1 (Full Knowledge Solution) consuming all 5 platform layers.
KMFlow
8-step PoV consensus algorithm (BRIGHT/DIM/DARK), TOM analysis, shelf data requests, client portal, assessment matrix, pattern library, survey bot, simulation & financial modeling
Change / ACMOS
SCML 7-phase methodology, stakeholder analysis, sentiment sensing, capacity modeling, content generation with governance, conversational assessments, adoption drift, wisdom harvesting
SLA
8-phase governance lifecycle, contract analysis NLP, vendor management, 5 ITSM connectors, 21 DMN decision tables, committee voting, regulatory ingest (17 frameworks in Neo4j)
COBOL Migration
COBOL parser, BMS screen map transformer, CICS stub generator, JCL-to-BPMN generator, DB2-to-PostgreSQL migration, CardDemo knowledge graph (11 programs, 4 stores, 5 rules)
Platform Extraction Priority
35 capabilities currently duplicated across repos, prioritized for extraction into the Blaze platform.
Immediate — P0
| Priority | Capability | Current State | Action |
|---|---|---|---|
| P0 | Auth framework | 3 implementations (middleware + NestJS + 5x CF Workers) | Single platform auth library |
| P0 | 4-store KB standardization | 3 independent configurations | Standardize via Helm data-layer subchart |
| P0 | Security middleware stack | 3 implementations (CSRF, rate limit, headers, audit) | Unified middleware package |
| P0 | Camunda BPMN engine support | cib7 in 2 repos + C8 in 1 | Platform supports C7 + C8 via adapters |
| P0 | BPMN validator + security scanner | SLA only (7-file suite) | Extract as platform BPMN toolkit |
| P0 | BDD BPMN testing framework | SLA only (Cucumber + BpmnParser) | Extract as platform test toolkit |
Near-Term — P1
| Priority | Capability | Source |
|---|---|---|
| P1 | LMS engine | Change worktree (full backend + 26 frontend components) |
| P1 | Notification service (SMTP) | Change (only app with email sending) |
| P1 | Hallucination detector + reranker | Change graphrag-ml (gRPC) |
| P1 | Connector framework merger | KMFlow BaseConnector + SLA task-sync-base + WAL |
| P1 | AI governance OPA policies | Change (6-domain framework) |
| P1 | Regulatory ingest pipeline | SLA (17 frameworks → Neo4j) |
| P1 | Evidence infrastructure | SLA (SHA-256 hash chain, S3 WORM, retention tiers) |
Medium-Term — P2
| Priority | Capability | Source |
|---|---|---|
| P2 | PEP/PDP field-level access control | KMFlow |
| P2 | Voice agent framework | Change (LiveKit) |
| P2 | Camunda Modeler sync + Optimize export | SLA |
| P2 | Schema library unification | KMFlow + SLA (YAML templates) |
| P2 | Demo persona system | SLA (persona → candidateGroup mapping) |