The CDF DORA supplement

What the cheat sheet covers

This two-page supplement starts where DORA stops. A team can sit in DORA’s top profile and still be running governance theatre, so the sheet maps each DORA 2025 signal to the Cognitive Delivery Index dimension that grades the substance underneath it. A green metric becomes the prompt for a harder question, not the proof of an answer.

Every CDI dimension is scored on five levels: Absent, Informal, Documented, Complete and Substantive. The jump that matters is Level 4 to Level 5, from a control that is fully documented and followed to one that demonstrably changes behaviour at the point of action. The sheet cites DORA’s 2025 data as showing the cost of missing it: PR review time up 441 percent, and 31 percent more changes merging with no review at all. Throughput rose. Substance did not.

Key points

• Deployment frequency and change lead time map to Capability Calibration. How fast agents ship is not whether the team can tell where an agent should and should not be trusted. Speed is visible. Calibration is not.
• Change fail rate and rework rate map to Constraint Fidelity. A low fail rate tells you outcomes held, not whether the constraint actually fired at the point of action, or whether you were simply lucky.
• Failed deployment recovery time maps to Supervisory Clarity. Recovery speed measures the fix, not whether a human was ever genuinely in the loop or whether oversight was nominal.
• DORA’s AI Capabilities practices map to Provenance Integrity (version control and transparency), Scope Definition (working in small batches) and Review Substance (quality internal platform and review). DORA counts whether review happens; CDI grades whether review changed the outcome or the approval was a rubber stamp.
• Most governance programmes stall at Level 3 or 4: the policy exists, the box is ticked. A documented control that no one can show changed an outcome is theatre.
• Four steps for practitioners: run your DORA review as normal and keep the metrics; for every green metric, ask the CDI question next to it; score each dimension and be honest about Level 4; fix the point of action, the endpoint, the MCP call, the invocation, not the policy page.