feat: SSDLC full lifecycle support with LangGraph orchestration (v4.0)

[arthurpanhku]

Summary

Major upgrade to v4.0 introducing DocSentinel as an AI-powered SSDLC (Secure Software Development Lifecycle) platform. The project now spans all six phases of the development lifecycle with dedicated AI agents orchestrated by LangGraph and powered by LangChain.

Key Changes

Documentation & Specifications

• SPEC.md (v3.0): Complete rewrite with:

  • Full SSDLC phase definitions (Requirements, Design, Development, Testing, Deployment, Operations)
  • Phase-specific user stories and features
  • LangChain + LangGraph technology stack
  • NIST SSDF and OWASP SAMM alignment

• ARCHITECTURE.md (v4.0): Redesigned architecture with:

  • LangGraph StateGraph for stateful phase orchestration
  • Six dedicated phase agents with conditional routing
  • Cross-phase state management via LangGraph checkpointing
  • Phase-specific Knowledge Base collections

• README.md: New product positioning emphasizing:

  • Full SSDLC lifecycle coverage vs. pre-release-only approach
  • Intelligent agent orchestration (LangGraph)
  • Phase-specific capabilities table
  • Updated quick start and MCP integration guide

• README_zh.md: Chinese version with same content

Technical Documentation

• docs/01-architecture-and-tech-stack.md (v1.0): LangGraph orchestration, LangChain framework, phase-specific KB collections
• docs/03-assessment-report-and-skill-contract.md (v2.0):
  • Assessment report schema with ThreatModel, Vulnerability, CrossPhaseRef
  • Phase-tagged reports with cross-phase traceability
  • 12 built-in phase-specific skills (Threat Modeler, Secure Code Reviewer, Pentest Analyst, etc.)

Changelog & Guidelines

• CHANGELOG.md: v4.0.0 entry with complete feature list
• CONTRIBUTING.md: Updated for LangGraph/LangChain stack, SSDLC skill contributions
• SECURITY.md: References to LangGraph state and checkpoint security
• docs/README.md: Updated index for v4.0 documentation

Architecture Highlights

• LangGraph: Stateful, graph-based agent orchestration with conditional routing and human-in-the-loop
• Phase Agents: Requirements, Design, Development, Testing, Deployment, Operations — each with specialized prompts and tools
• Cross-Phase State: LangGraph checkpointing enables findings from one phase to inform later phases (e.g., Design threats → Testing test cases)
• Phase-Specific KB: Separate knowledge base collections ensure agents retrieve the most relevant context
• Threat Modeling: Design Agent performs automated STRIDE/DREAD analysis
• SAST/DAST Integration: Testing Agent can parse SARIF, SonarQube, Checkmarx, Burp, ZAP reports

Migration Notes

This is a major version upgrade (v4.0). Existing assessments and skills should be reviewed for compatibility with the new phase-based model.

Test Plan

• Updated all markdown documentation (SPEC, ARCHITECTURE, README, docs/)
• Verified cross-references between documents
• Confirmed SSDLC phase alignment with NIST/OWASP standards
• Checked LangGraph/LangChain terminology accuracy
• Manual review of PRD completeness
• Review of architectural decisions

---

🤖 Generated with Claude Code | SSDLC-first approach for enterprise security automation