Secure TDD Agent Framework

A TDD and QA framework with integrated security for AI coding agents and developers. Combines functional test-first engineering, living STRIDE threat modeling, local code quality checks, and continuous skill self-evolution to mitigate recurring issues.

[!CAUTION] Use at Your Own Risk: This repository is a demonstration of an approach, not an officially supported framework. AI coding agents generate and execute code that may be unstable or perform unexpected actions. While this approach works to mitigate these very problems through test-first boundaries and local scanning, no testing framework offers a complete solution to model error. Run agentic workflows only in isolated development environments and never on systems with access to production credentials, sensitive customer data, or internal networks.

---

1. Security as Part of Quality

Test-Driven Development (TDD) writes tests first to encode the requirements early on and target development against discrete goals. It documents expected behavior, catches regressions early, and keeps the agent zeroed in on implementing verifiable logic instead of guessing. This reduces some of the common issues with AI generated code, for example hallucinated features, hallucinations on test coverage, and going off on sidequests to recreate entire helper libraries, which is a nightmare to even run agentic reviews against.

Historically, software engineering has often treated functional QA and security testing as completely separate disciplines:

• QA runs during development and CI to verify business logic, user journeys, and regressions.
• Security is siloed into delayed post-merge scans or third-party audits (leading to an average 20-day remediation cycle, deliterious impacts to throughput, and high context-switching costs). With AI agents, this old approach may lead to more growth risk than the security risk it mitigates, and it certainly costs more to fix later than the moment the code is written.

The Flaw with Reviewing ONLY in CI/CD

When security and QA reviews happen only downstream in CI/CD or post-merge pipelines:

• Delayed Discovery: Developers receive feedback hours, days, or weeks after authoring code, when the architectural context is no longer fresh.
• Context-Switching Tax: Fixing a failure detected in CI requires rolling back branches, reopening pull requests, and context switching away from current feature work.
• Compounding Technical Debt: AI coding agents without local QA guardrails generate unchecked assumptions and subtle logic bypasses that escape into the codebase.

Security as Part of Software Quality (and the Stability Risk of Isolation)

Security is an intrinsic part of software quality. Treating security separately from functional development introduces direct risks to system stability: