All Guides
CTO · Operational Guide

CTO Playbook

Architecture health reporting, AI governance risk, and knowing when to escalate.

The 10-minute Monday check

Three signals to review at the start of each week. If all three are green, no architectural governance action is required. If any are in the red threshold, block time before the week's planning begins.

01Navigate to /changecontrols/dashboard — check DHS trend

Is DHS up or down from last sprint? A single data point is less important than the direction. Three consecutive declining sprints is the signal that requires action.

02Check ADRIFT — is AI-generated code producing ungoverned drift?

ADRIFT measures the percentage of AI-authored PRs that introduced architectural drift without governance coverage. A rising ADRIFT is not a reason to slow AI adoption — it is a reason to deploy the MCP integration.

03Check UDR — what % of structural changes happened outside the CHI process?

UDR is the fraction of structural PRs that had no approved Change Intention at all. Above 20% means one in five structural changes is happening outside governance.

Decision rule
If any of these are in the red threshold: block 20 minutes for a conversation with the lead architect before the week's planning begins.
If all three are green: no architectural governance action required this week.

Reading DHS for board reporting

DHS is the number you can take to a board. But the number without context is a liability, not an asset. Here is how to present it honestly.

01

Always present DHS alongside GD (Governance Depth). DHS without GD context is misleading. A DHS of 94 with GD=2 means only two rules are being checked. The score reflects the governance surface you have actually instrumented, not your full architecture.

02

Present as a trend, not a point-in-time number. A DHS of 78 rising for four consecutive sprints is a better board story than a DHS of 84 that dropped 12 points last quarter. The direction tells you whether governance is strengthening or eroding.

03

What to say when DHS is red:

“We have identified a governance gap in our automated design audit coverage. We are addressing it by expanding our Lens coverage and deploying rkito's MCP integration for our AI coding tools.”

04

Navigate to the org dashboard at /changecontrols/dashboard to export the DHS trend chart for the reporting period. The export includes sprint-over-sprint values suitable for presentation or inclusion in a board pack.


AI adoption governance — what ADRIFT tells you

ADRIFT is the AI coding risk signal that no other tool provides. It is not a reason to restrict AI tools. It is a reason to govern them.

01

ADRIFT measures the percentage of AI-generated PRs that introduced ungoverned architectural drift — structural changes that violated Lens directives or crossed service boundaries without an approved Change Intention.

02

A rising ADRIFT is not a reason to restrict AI tools — it is a reason to deploy rkito's MCP module. The agents are generating ungoverned changes because they have no architecture context before they generate code. The fix is context, not restriction.

03

The conversation with engineering leadership:

“Our agents are generating X ungoverned structural changes per week. The fix is connecting them to our architecture governance context before they generate code, not slowing down AI adoption.”

To see the specific changes ADRIFT is measuring

Navigate to /changecontrols/designaudits, filter by agent-authored PRs, then filter by BLOCKED status. This shows each ungoverned structural change ADRIFT has flagged — with the specific Lens violation that triggered the block.


When to escalate

Three signals that require a conversation with the lead architect — not just monitoring. These are not thresholds that trigger a report. They are thresholds that require a human conversation before the next sprint begins.

DHSDHS declining for 3+ consecutive sprints

The absolute value does not matter here. A DHS of 72 that has risen for four sprints is healthy signal. A DHS of 85 that has dropped for three consecutive sprints is an early warning that requires diagnosis.

ADRIFTADRIFT above 15% for 2+ sprints

AI tools are producing systemic ungoverned drift. At this rate, agents are the leading source of architectural risk in the org. The MCP integration should be deployed immediately.

UDRUDR above 20%

One in five structural changes is happening outside governance. This is a process breakdown, not a one-off miss. The CHI workflow is either too slow, too unfamiliar, or being actively bypassed.

What to say

“Here is the data. Help me understand root cause and what it will take to fix it.”


Architecture health as audit evidence

What rkito produces for regulatory or investor due diligence. Each of these is a structured, exportable record — not a manually assembled document.

Per-PR audit trail

Every PR evaluated by the CDA gate produces a record: which Lenses ran, what findings were raised, whether the PR was blocked or passed, who approved any exceptions, and the timestamp of each event.

DHS trend over time

Sprint-over-sprint DHS data is retained and exportable. This is demonstrable evidence that architecture quality is actively tracked, not just asserted. The trend shows direction, not just a point-in-time claim.

CHI approval records

Every approved Change Intention is a formal, timestamped record that a structural change was reviewed before implementation. This is the governance paper trail that regulators and acquirers look for.

To export audit history

Navigate to /changecontrols/designaudits and use the date range filter to scope the export to your required reporting period. The export includes per-PR findings, approval records, and exception justifications in a format suitable for submission to an auditor or inclusion in due diligence documentation.


Your role in Steering

Steering is the governed record of architectural intent. As CTO, you own the organisation's architectural vision and manifesto — the artefacts that everything else derives from.

/steerings/visions
Define or review the architectural Vision — the one-sentence statement of where the system is heading. This anchors all Pillars and Manifesto content. If it is absent or stale, SCS will flag it. Review it once per half.
/steerings/manifestos
The architectural Manifesto documents the non-negotiable principles the org codes by. Review for staleness quarterly. An outdated Manifesto is worse than no Manifesto — teams actively cite it to justify bad decisions.
/steerings/pillars
Pillars are the architectural domains (Security, Data, API, Infra, etc.). You do not author Lenses, but you should confirm a Pillar exists for every domain that carries material business or compliance risk. Missing Pillar = no governance coverage for that domain.
/steerings/dashboard
The Steering dashboard shows Steering Completeness Score (SCS) and Steering Freshness (SF). These are the signals that tell you whether governance infrastructure is intact or quietly rotting.

Your primary Steering task is not authoring — it is reviewing. Confirm that a Vision exists, the Manifesto reflects current architectural direction, and every risk domain has a Pillar. Delegate authoring to the Chief Architect.

Get started

Put a number on architecture health.

Connect your repository, configure your first Lenses, and start tracking DHS, ADRIFT, and UDR from your next sprint.