Essay by **Bill Staples**, CEO of **GitLab**, published on **August 24, 2026** on the about.gitlab.com blog: an announced **31-minute** read, roughly **39,000 characters**, presented as the sequel to a memo written to the board of directors in January 2026 and partially published in May under the title *GitLab Act 2*. The text presents itself as a response to **Anthropic**'s AI-native SDLC playbook, published three days earlier, from which it borrows the opening line — "Code is no longer the bottleneck" — to pose the question that drives it: what becomes scarce when code becomes abundant. (A) The economic diagnosis: the useful unit is not cost per line but **cost per accepted change**, which aggregates generation, environment, context, verification, review, remediation, and governance; AI collapses the generation term alone, which makes the others proportionally heavier — an organization ten times faster at generating "will simply move the queue." (B) The architectural response: four capabilities — agent platform, machine-scale execution, durable context, governance — forming an enterprise layer that outlives the model, "The model should be replaceable. The agent should belong to the customer." (1) Three modes coexist durably, from human-driven legacy to autonomous development, against the idea of a single maturity curve. (2) The CI/CD pipeline becomes the place where the inner loop runs, instead of being an end-of-line gate. The figures cited are Stripe's, Spotify's, and Amplitude's; GitLab produces only one, about its own source control. The corpus already holds [[claxton-anthropic-ai-native-sdlc-playbook-2026-08-21]], the source this text responds to, and [[sfeir-sdlc-pdlc-articulation-2026-07-22]] on the SDLC/PDLC articulation that Staples adopts as his own.
#code abundance#cost per accepted change#theory of constraints
Bill Staples · directeur général de GitLab (fonction non affichée par la page) · sur le blog about.gitlab.com.
SFEIR's decryption (firm voice) of Jason Clinton's (Deputy CISO, Anthropic) debrief published five days earlier — already documented in [[clinton-anthropic-secure-ai-native-sdlc-2026-07-21]]. **The added value lies not in the facts but in the thesis that rereads them**: if Anthropic's controls hold, it is because **a cycle with named stages exists to hang them on** — "the SDLC is the foundation, not a formality." The demonstration proceeds by rereading the mapping (**PSR at Plan, CLAUDE.md + egress allowlist at Code, review agents at Test, continuous DAST at Deploy, triage + SIEM routing at Monitor**), then through a **four-part anaphora**: (1) *without an SDLC, productivity gains do not materialize* — Clinton cites **Amdahl's law**: multiplying code volume by 8 multiplies nothing if review stays sequential and human, and Anthropic gained not by distributing agents but by **identifying the blocking stage (Test) and rebuilding it** — "you don't optimize a bottleneck you haven't mapped" (echoing DORA 2025's **mirror effect**); (2) *without an SDLC, security has no anchor point* — a **gate is by definition a control placed between two stages**, and Clinton's three threats are addressed at distinct moments; (3) *without an SDLC, no **token FinOps** policy can be formulated* — agentic scanning is billed on consumption and grows with code throughput, so **risk-based tiering IS the FinOps policy** (it decides where three agent passes get paid for and where a SAST suffices), otherwise "token spend is not steered, it is discovered at month's end"; (4) *without an SDLC, there is nothing to measure* — the indicators (16% → 54% of PRs commented, one third of past incidents intercepted) exist only because there are stages where a counter can be placed; absent that, one produces only **usage figures** (licenses, tokens) that say nothing about quality or risk. Two strong points beyond the thesis: the reading of the **incident agent-à-agent** ("a security perimeter that rests on an instruction in a prompt is not a perimeter"; **an agent's access to other agents is part of its attack surface**) and an **explicit methodological caveat** — Anthropic's figures about Anthropic, unaudited, published by the vendor of the model described, in the context of a young codebase with no mainframe: **what transposes is the method, not the figures**.
#SDLC#AI-native SDLC#development cycle
SFEIR (voix éditoriale du cabinet, article non signé individuellement) — commentaire de Jason Clinton (Deputy CISO, Anthropic)
SFEIR analysis (consulting-firm voice, "an engineer's reading") articulating two frameworks too often conflated: the **SDLC** (Software Development Life Cycle — *building the software correctly and reliably*) and the **PDLC** (Product Development Life Cycle — *building the right product and succeeding in the market*). Central thesis: the two cycles are not competitors but **nested** — the SDLC is the subset of the PDLC **housed under its development phase**; when a product team reaches the "build" stage, a full SDLC cycle (design → build → test → review → deployment) runs inside it. The SDLC is standardized (**ISO/IEC/IEEE 12207**, 2017 and 2026 editions), with its lineage of models (Waterfall 1970, V-model, iterative/spiral, **Agile 2001**, **DevOps/DevSecOps 2009+**) and its **DORA** metrics (throughput, stability, MTTR, change failure rate). The PDLC, being the umbrella cycle, runs from **ideation/discovery** to **market withdrawal** (not to be confused with the marketing **PLC** of Theodore Levitt, 1965, which describes a *commercial curve*, not *organized work*: "the PLC observes a curve; the PDLC organizes work"). **Tipping point**: the SDLC natively addresses **only one risk in four** — via **Marty Cagan's "Four Big Risks"** framework (Value → PM, Usability → Designer, Feasibility → Lead Engineer, Business viability → PM) — an organization excellent at SDLC but blind to PDLC produces "software nobody wants" — John Cutler's **"feature factory"** (success measured by output, not outcome). **Why AI changes everything**: generative AI **compresses the SDLC** (Google/JetBrains data, May 2026: **~85% of developers** regularly use coding agents, **~41% of new code** is AI-generated; implementation goes from weeks to hours), so the **bottleneck shifts upstream** — deciding *what* to build (Marty Cagan, April 2026: "when the cost of delivery collapses, the bottleneck shifts to discovery"). Consequences: DORA 2025 (~5,000 professionals, 90% AI adoption) shows a **positive correlation with throughput but a negative one with stability** (more unvalidated features means instability and rework); Andrew Ng (AI Startup School, July 2025) reports teams **reversing the "1 PM for 4 engineers" ratio to "2 PMs for 1 engineer"**; and with **spec-driven development**, the PDLC/SDLC boundary becomes **porous** (the product spec becomes directly executable by agents). **What a CIO should take away**: an augmented SDLC becomes a **market standard, not a differentiator** — the junction with the product must be instrumented, **executable specifications** demanded as input, technical metrics cross-referenced with outcome metrics, and the role of "feature supplier" **refused**. For a CPO: the shift of the bottleneck toward discovery is both a **promotion** (product judgment becomes scarce again) and a **notice to act** (industrialize discovery to reach parity with the SDLC). SFEIR's in-house framework ("Designing and building in the agentic era" — **11-phase cycle** + **Software Factory 10x**) is positioned as the answer on the engineering side, with the **articulation of the two cycles** as the next lever. Conclusion: "as code becomes a commodity, margin shifts toward product judgment and governance."
LinkedIn post by Fred Plais (CEO of Archie, ex-Platform.sh): AI made engineers so fast that the **bottleneck moved upstream**, to a place nobody is watching. With execution no longer the slow part, the thinking time that used to exist "while the code was being built" has vanished — the right vision now has to be formed and the right decisions made in a fraction of the time. Two rare profiles are emerging: the one who can **articulate a vision precise enough** for an agent to execute without derailing, and the one who knows how to **orchestrate agents** (anticipating their failures, chaining them, catching an error before it propagates). Hiring for "code output" is becoming obsolete: that is precisely what has stopped being rare. Final thesis: "thinking clearly was always the job — speed just made it impossible to fake".