Not promised.Proven.

How we assess, implement and prove modern software delivery. Every change is measured at a gate, so you know what improved, by how much, and what it cost.

  • 6phases, Profile to Nurture
  • 13gates, G0 to G12
  • 40+capabilities across three tiers
  • 10disciplines, team to AI

An operating model for software delivery.

PROVEN is the method we built after twenty years of watching companies buy tools to fix problems that were never about tools.

It is more than a maturity scorecard. It is a method that engineers, auditors and regulators can read from the same page: six phases, ten disciplines, thirteen gates in your pipeline, and one set of numbers that says whether any of it worked.

Most transformation programs fail the same way. A consultancy arrives, runs workshops, produces a target operating model and leaves. 18 months later nobody can say what changed, because nobody measured the starting point and nobody measured the gates in between. PROVEN is built to make that impossible.

  • You know what hurts.

    Releases take weeks, the platform is a liability, quality is slipping, or security was never built in. We run a focused Profile of two weeks on one or two disciplines and go straight into the work. Verdict is connected on day one, so the improvement is measured against a real baseline, not a memory.

  • Something hurts, and nobody can say what.

    Missed deadlines, people leaving, outages, a board that has lost confidence. We run a full Profile across all ten disciplines over four to six weeks. The causes usually sit in three or four places at once, which is why the roadmap matters as much as the findings.

Three rules

Every phase, every gate and every report follows them.

  • Measure at the gate, not in retrospect.

    Every gate produces its number as part of running. A practice that has no gate and no metric is an opinion, and opinions do not survive a change of management.

  • Outcomes over outputs, never individuals.

    Metrics describe teams and systems. The moment a number is used in a performance review it stops being true. Verdict does not store per-person metrics and does not render them.

  • Platform over policy.

    Practices are enforced through tooling defaults, paved roads and required checks. A policy document that no pipeline reads is not a control.

Six phases

Each one ends with something you can check in Verdict.

Profile

Where you are. Capabilities, bottlenecks and the numbers as they stand today. A focused Profile takes two weeks on one or two disciplines. A full Profile takes four to six weeks across all ten.

What happens

Verdict connects read-only to your tools before the first workshop, so we judge against data and not against memory. Workshops run one discipline at a time with the people who do the work. Their managers stay out of the room, because what actually happens changes when they are in it.

We ask to be shown, not told: the last release, the last incident, the oldest branch. One real piece of work is followed from request to production with every queue timed. Flow efficiency, active time divided by elapsed time, is usually below 15% when we first measure it. Anything only an interview supports is labelled a hypothesis until the data confirms it.

Seven kinds of bottleneck

  • Unrefined work
  • Review latency
  • Build and test friction
  • Environment contention
  • Manual change control
  • Rework
  • Dependency waits

Every bottleneck in the report carries one of these types, its measured cost and the capability that fixes it, so reports compare across teams, customers and engagements.

What you get

  • An assessment report that leads with the five biggest bottlenecks and what they cost, in your units
  • A gap matrix: every capability marked absent, informal or enforced
  • A tier per discipline, a risk register and your end-of-life exposure

How it ends

The Assessment Report and the Gap Matrix. Every number in them can be reproduced from Verdict after we leave.

Reveal

What it costs. Every bottleneck translated into hours, incidents and money, ranked.

What happens

Reveal starts on day one of Profile, when Verdict connects, and its four-week baseline runs underneath the workshops. Within a day the Four Keys and the flow metrics begin to fill from your own history, and you watch the scorecard build in real time.

Your sponsor sees the scorecard first. No leader should learn their tier in a room full of their engineers. Anything Verdict cannot connect to is a finding too. A team that cannot produce a deployment timestamp has a release problem before it has a metrics problem.

What you get

  • A baseline scorecard per team, built from your own tools over four weeks
  • The bottlenecks ranked by cost: releases missed, hours queued, incidents repeated

How it ends

With the complete four-week baseline, never partial data. Early numbers are wrong numbers.

Orchestrate

The roadmap, signed. Which capabilities, in which order, with a target tier per discipline and a done-when number for each wave. A ninety-day plan and a twelve-month target.

What happens

We sequence the work by its effect on the bottlenecks against the effort, with prerequisites drawn. Progressive delivery does not come before infrastructure as code. Mutation testing does not come before there is a test suite worth mutating.

The work runs in waves: one discipline, one team, four to eight weeks. Wave one always holds a quick win that shows in Verdict within a month, such as batch-size limits, review turnaround or quarantining flaky tests. What is deliberately out of scope is written down, with the trigger that would bring it in.

What you get

  • A roadmap of waves, each with its done-when written as Verdict thresholds
  • A target tier per discipline, loaded into Verdict so everyone sees the distance to it
  • An out-of-scope list, each item with its trigger

How it ends

Signed in a meeting by your sponsor and our lead. A roadmap agreed by email is a roadmap nobody agreed.

Velocity

The work. Pipelines, platform and process, done with your team so it survives us leaving.

What happens

In an existing product, most teams already do most of the right things, informally. The first move is to turn them into gates: the review that already happens becomes required, the build that already runs becomes a required check. That costs days and changes no tool.

Then every wave pairs our engineer with one of yours who will own the capability. Gates go in enforcing from day one, never advisory, because an advisory gate teaches everyone that gates are advisory. Old paths are deleted, not disabled.

What you get

  • Gates enforced in your pipeline, not described in a document
  • A named engineer on your side who owns each capability
  • A written warning at the two-week mark if a wave is failing, with the numbers and the options

How it ends

Each wave ends with a before-and-after from Verdict, presented by your engineer, not by us.

Evidence

The proof. Verdict shows the before and after from the same instrument, in your own data.

What happens

Every quarter the report is generated from Verdict. We do not write it. If a number needs explaining, we explain it in the meeting and leave it as it is in the document. Customers keep old reports and check.

Where time is converted into money, the assumption sits next to the number. An honest smaller number beats an impressive one your CFO takes apart.

What you get

  • A quarterly report generated from Verdict, per team and per discipline
  • The return on the work, with every assumption stated
  • Next quarter's roadmap changes, agreed and initialed

How it ends

Handover is a checklist: Verdict's infrastructure code, the runbook, on-call assigned, and alerts routed to your channels.

Nurture

Keeping it. Verdict keeps measuring after we leave, so the gain does not quietly leak away.

What happens

At handover we switch Verdict to steady state together and watch the first drift alert reach your team. From then on your team owns it.

Every metric has a rolling baseline, usually the trailing 90-day median, and drift rules, such as cycle time up more than 25% over two sprints, or change failure rate above the tier ceiling for two weeks. When a rule fires, the alert names the discipline, the likely gate and the playbook. A tier drop is an event, not a footnote.

We read the portfolio view with you for thirty minutes a month. An alert open for more than thirty days comes up in that read. Twice a year we run a one-hour guild session.

What you get

  • Drift alerts in your channels, before the headline numbers move
  • A monthly read of your portfolio by us, and a note to your sponsor when something moved
  • The quarterly report with our short read, and a meeting only when a tier moved
  • An annual Check-up, booked at handover with a date

How it ends

It does not. Delivery decays by default, so the measurement stays on.

Ten disciplines

Every Delivery capability belongs to one of them, and under each one is what we usually find. The Profile decides which ones matter for you. Nobody gets every capability in one engagement.

  • Team, skills and ways of working

    Nobody owns anything, and one person holds the system together.

  • Product management and process

    No SDLC at all, ad-hoc planning, no definition of done, work arriving by chat.

  • Architecture and technology

    A stack past end of life, a monolith that blocks every release, decisions nobody wrote down.

  • Development and engineering

    Long-lived branches, no code review, a CI pipeline nobody trusts.

  • Quality assurance

    Manual testing only, defects found by customers, releases held up by regression rounds.

  • Release management

    None exists. Releases are events with a war room, not a routine.

  • DevOps and platform engineering

    No infrastructure as code, servers configured by hand, environments that differ.

  • Security

    No scanning, secrets in code, no clear picture of what runs in production.

  • Operations, reliability and improvement

    Monitoring that only says whether it is up, no on-call, incidents that repeat.

  • AI-assisted engineering

    Tools bought with no policy and no measurement, or no adoption at all.

Thirteen gates

G0 to G12 sit in your pipeline, and each one emits a metric. With PROVEN Secure the same gate also emits the evidence an auditor asks for. One pipeline, one set of checkpoints.

  1. G0Delivery readinessTeam, platformPlatform adoption, cognitive load
  2. G1Requirements baselineProduct and processItems with acceptance criteria
  3. G2Design approvedArchitectureDecision record coverage, fitness-function pass rate
  4. G3Flow entryProduct and processWork in progress, cycle time, flow efficiency
  5. G4CommitEngineering, AIBatch size, branch age, AI-assisted share
  6. G5MergeEngineering, AIPull request lead time, rework rate
  7. G6Build integrityEngineeringBuild duration, flaky-test rate
  8. G7Test and acceptanceQualityCoverage, mutation score, escaped defects
  9. G8Release approvalReleaseDeployment frequency, lead time for changes
  10. G9Production deployPlatformChange failure rate, rollback rate
  11. G10Operational readinessOperationsFailed-deployment recovery time, SLO attainment
  12. G11Incident closureOperationsTime to detect, postmortem action closure
  13. G12Evolution reviewArchitecture, operationsDebt ratio, dependency freshness

Three tiers

Every discipline is scored on three tiers. Your overall tier is the lowest tier of any discipline you depend on, because a chain is as fast as its slowest gate.

  • Baseline

    The practice exists, is documented and is measured. It is not yet enforced on every change.

    Deploys
    Weekly to monthly
    Lead time
    One week to one month
    Change failure rate
    15 to 30%
    Recovery
    Within a week
  • Performing

    A gate enforces the practice on every change. The metric is stable and improving quarter on quarter.

    Deploys
    Daily to weekly
    Lead time
    One day to one week
    Change failure rate
    Under 15%
    Recovery
    Within a day
  • Elite

    The practice has become invisible. It is how the platform works, and the metric sits at benchmark.

    Deploys
    On demand, several times a day
    Lead time
    Under a day
    Change failure rate
    Under 5%
    Recovery
    Within an hour

Delivery thresholds follow the Four Keys benchmarks from the annual State of DevOps research. The rest come from the teams we have measured.

Every capability is marked one of three ways

  • AbsentNot practised.
  • InformalPractised by some people some of the time, without a gate and without a metric.
  • EnforcedA gate blocks changes that do not meet it, and Verdict shows the number.

The family

One method, five ways to use it.

  • PROVEN Delivery

    The core. Ten disciplines, six phases and thirteen gates, measured on Verdict.

  • PROVEN Secure

    The security baseline every customer gets, in every market. Same thirteen gates: Delivery reads each one for a metric, Secure reads it for a control. A control without a blocking gate does not count as implemented.

  • PROVEN Comply

    Regulatory overlays on the Secure baseline: SOC 2, ISO 27001, NIS2, EU DORA, the EU AI Act, PCI DSS, HIPAA and GDPR. The pipeline does not change, only what is retained, reported and contracted. One merge record is ISO 27001, SOC 2 and DORA evidence at once. Compliance follows the market, so we select only what a buyer or regulator will ask for.

  • PROVEN Organise

    For companies whose bottleneck is the structure, not the code. It compares the organization as it behaves with the organization as drawn. Ten capabilities and one decision gate, measured on Verdict.

  • PROVEN Check-up

    The annual re-assessment. One week, once a year, at a fixed price, against a year of Verdict data, with a refreshed roadmap. A persistent tier drop brings it forward.

Verdict

The instrument behind the method. During the engagement it is what we and you both read. After it, it is your early warning.

Verdict's Executive view: five delivery metrics, each with its stability pair and tier, the maturity scorecard per discipline, lead time and change failure on one chart, open drift alerts and early-warning signals.

The Executive view, with sample data for a fictional company. Every speed number sits next to its stability pair, and every alert names the gate and the playbook.

Verdict reads, it does not write. Every connection to your systems is read-only, and it holds no credential that could change anything.

Every metric is defined in a versioned specification: the formula, the sources, the tier thresholds, the drift rule, and a note on how it could be gamed and which paired metric would show it. Dashboards, alerts, the scorecard and the quarterly report are generated from it. Your instance pins a version, so a change in our definitions never silently moves your history.

  • Every metric defined as codeOpen to you, so you argue with the definition, not the result. Ratings are computed, never overridden.
  • Read-only, in your cloudIt reads your tools. It changes nothing in them.
  • Speed always shown with stabilityDeployment frequency with change failure rate. Batch size with rework. Never one alone.
  • Never a personThere is no person-level table, and no metric is aggregated below team level. Our test suite checks this.

Start with a Profile.

Two weeks of workshops on the one or two disciplines that hurt, with Verdict connected on day one. The report follows when the four-week baseline is complete.

Book a 30-minute call
contact@cendryon.com