The 2025 Google Cloud DORA report said the quiet part out loud.

PR review time is up 441 percent. Thirty-one percent more changes are merging with no review at all. Incidents per change have more than tripled. Throughput went up. Something underneath it did not.

The DORA team calls this the acceleration whiplash. I think it points at something DORA itself cannot measure.

DORA tells you whether a team ships well. It is the best instrument we have for that, and nothing here replaces it. But it does not tell you whether a control demonstrably changes what an agent does. A team can sit in DORA’s top profile and still be running governance theatre. Policies that exist on paper. Reviews that approve without reading. Constraints that never fire at the point of action.

That is the gap the Cognitive Delivery Index measures.

This matters most where the agents actually write code. Adoption is near total and the review layer underneath has not kept pace. DORA’s own numbers are the evidence.

Every CDI dimension scores on five levels, Absent to Substantive. The jump that matters is Level 4 to Level 5. Level 4 is a control that is fully documented and consistently followed. Level 5 is a control that demonstrably changes behaviour where the agent acts. Most governance programmes stall at 4 and call it done. A documented control no one can show changed an outcome is not governance. It is documentation.

So CDF is not an alternative to DORA. It is the layer underneath it.

The regulators are arriving at the same point from the other direction. The EU AI Act and the Digital Operational Resilience Act both ask for evidence that a control works, not evidence that it exists. Level 4 will not answer that question. Level 5 is written to.

Keep your DORA review. Then for every green metric, ask the substance question next to it. A healthy change fail rate is the prompt to check whether your constraints actually fired, not the proof that they did.

I have put the full mapping on a one-page cheat sheet, each DORA signal against the CDI dimension that grades what sits beneath it.

Where is your governance actually living, at the point of action, or on a policy page?