ai-sdlc-harness

Name: ai-sdlc-harness
Author: MostAshraf

11stars4forks

How to install ai-sdlc-harness?

mostashraf/ai-sdlc-harness

$git clone https://github.com/MostAshraf/ai-sdlc-harness

Installs into the current project.

Summary

AI-driven SDLC harness for Claude Code — multi-agent TDD workflow (plan → tests → code → review → PR) with Azure DevOps, Jira, GitHub, GitLab, Zoho, and local-markdown providers. Language-agnostic, discovery-driven.

Files · 1

View on GitHub

README.md

1	# ai-sdlc-harness · v3.0
2
3	A governed multi-agent SDLC pipeline for Claude Code — a ground-up rewrite of [ai-sdlc-harness](https://github.com/MostAshraf/ai-sdlc-harness). Drives a real engineering workflow — fetch → scope-confirmed plan → independent plan review → proven-red TDD → review → security → PR → comment rounds → reconcile → metrics — across one or many repos. No application code lives here: only the pipeline manifest, the Python core that enforces it, and the agents, skills, and hooks that run it.
4
5	\| Command \| Purpose \|
6	\|---\|---\|
7	\| `/init-workspace` \| One-time setup interview: provider, repos, discovered toolchain, verification gate \|
8	\| `/dev-workflow <work-item-id>` \| Take a work item from requirements to merged PR end-to-end \|
9	\| `/story-workflow <command> <work-item-id>` \| Shape a story's quality before it's built: `analyze` · `refine` · `improve` · `groom` \|
10	\| `/workflow-status` \| Read-only dashboard: cursor, tasks, gates, flagged events, run-health verdict per run \|
11	\| `/workspace-config` \| Change one config section without re-running the interview \|
12	\| `/add-repo` \| Register one new repo into an already-bootstrapped workspace \|
13	\| `/migrate-workspace` \| Adopt a v2.x workspace: config carries over, run history stays archived in place \|
14	\| `/repo-map-refresh` \| Regenerate the auto-generated codebase map the planner grounds its plans in \|
15
16	## The rewrite, in one table
17
18	The original harness works, but almost all of its accumulated complexity compensates for one root cause: orchestration logic lived in markdown prose an LLM had to faithfully execute, with hooks bolted on to catch the cases where it didn't. The rewrite moves every mechanical rule into code that just runs, and reserves the model for judgment.
19
20	\| Concern \| ai-sdlc-harness (v2.x) \| ai-sdlc-harness (v3.0) \|
21	\|---\|---\|---\|
22	\| Pipeline definition \| Prose phase files the orchestrator re-derives every run; a separate hardcoded copy in guard scripts \| One declared manifest ([pipeline/manifest.yaml](pipeline/manifest.yaml)) read by both the orchestrator and the enforcement layer — no second copy to drift \|
23	\| Git operations \| Raw `git` calls reverse-engineered after the fact by `shlex`-parsing hooks \| Owned entry points (`harness commit` / `merge-task` / `sync-branch` / `push` …); the raw verbs are blocked outright \|
24	\| Workflow state \| `tracker.md`, honor-system updates \| HMAC-chain-sealed `state.yaml` + append-only ndjson evidence ledgers — tamper-evident, `exit 3` on out-of-band edits \|
25	\| Human gates \| The model reads your reply and acts on it \| A hook captures your reply verbatim; deterministic code parses the decision — the model cannot approve on your behalf \|
26	\| TDD enforcement \| Separate Tester and Developer subagents per task (token/latency tax) \| One developer writes test + implementation; `harness verify-red` proves the failure and blob-SHA-locks the test set until completion \|
27	\| Providers \| Markdown capability docs an agent must correctly read \| Code modules behind one interface, each held to a shared contract test \|
28	\| Agents \| 7 role files fusing permissions with procedure \| 3 fixed tool-grant shapes (planner / developer / reviewer); procedure lives in shared step files \|
29	\| File-size budgets \| Retrofitted after files passed 400 lines \| ~100/200-line budget enforced from day one (`tools/budget_check.py`) \|
30
31	## Install
32
33	This repo is a Claude Code plugin marketplace. Inside Claude Code:
34
35	```
36	/plugin marketplace add MostAshraf/ai-sdlc-harness
37	/plugin install ai-sdlc-harness@ai-sdlc-harness
38	```
39
40	The repeated name isn't a typo — it's `plugin-name@marketplace-name`, and here they match. Restart Claude Code (or `/reload-plugins`) so the skills and hooks load. There's a non-interactive equivalent too, if you'd rather script it:
41
42	```sh
43	claude plugin marketplace add MostAshraf/ai-sdlc-harness
44	claude plugin install ai-sdlc-harness@ai-sdlc-harness # --scope user\|project\|local
45	```
46
47	Then, inside Claude Code:
48
49	```
50	/init-workspace
51	```
52
53	The interview asks only what it must (provider, repos), discovers your toolchain (proposing the test command it found), and offers default for everything else. It bootstraps a plugin-owned Python venv (PEP 668-safe — no system-python changes), ends with a verification gate — every check passes or you don't proceed — and writes per-section config under `.claude/context/`, a permission allowlist into `.claude/settings.json` (no manual `settings.json` editing needed), and the bootstrap marker.
54
55	## Prerequisites
56
57	\| Dependency \| Why \|
58	\|---\|---\|
59	\| Claude Code \| The CLI that runs this harness. Install from [claude.ai/code](https://claude.ai/code). \|
60	\| Git \| Branch management, per-task worktree isolation, owned commits. \|
61	\| Python 3.10+ \| The entire core is Python. `/init-workspace` creates the plugin's own venv with PyYAML as its first step; until then the guards print a one-line notice and stand down. \|
62	\| Provider CLI, authed (optional) \| `gh auth login` / `glab auth login` / `az login`,

People who liked this also viewed

6 picks

Type

ai-sdlc-harness

11stars4forks

View on GitHub

How to install ai-sdlc-harness?

mostashraf/ai-sdlc-harness

$git clone https://github.com/MostAshraf/ai-sdlc-harness

Installs into the current project.

Summary

Files · 1

View on GitHub

README.md

1	# ai-sdlc-harness · v3.0
2
3	A governed multi-agent SDLC pipeline for Claude Code — a ground-up rewrite of [ai-sdlc-harness](https://github.com/MostAshraf/ai-sdlc-harness). Drives a real engineering workflow — fetch → scope-confirmed plan → independent plan review → proven-red TDD → review → security → PR → comment rounds → reconcile → metrics — across one or many repos. No application code lives here: only the pipeline manifest, the Python core that enforces it, and the agents, skills, and hooks that run it.
4
5	\| Command \| Purpose \|
6	\|---\|---\|
7	\| `/init-workspace` \| One-time setup interview: provider, repos, discovered toolchain, verification gate \|
8	\| `/dev-workflow <work-item-id>` \| Take a work item from requirements to merged PR end-to-end \|
9	\| `/story-workflow <command> <work-item-id>` \| Shape a story's quality before it's built: `analyze` · `refine` · `improve` · `groom` \|
10	\| `/workflow-status` \| Read-only dashboard: cursor, tasks, gates, flagged events, run-health verdict per run \|
11	\| `/workspace-config` \| Change one config section without re-running the interview \|
12	\| `/add-repo` \| Register one new repo into an already-bootstrapped workspace \|
13	\| `/migrate-workspace` \| Adopt a v2.x workspace: config carries over, run history stays archived in place \|
14	\| `/repo-map-refresh` \| Regenerate the auto-generated codebase map the planner grounds its plans in \|
15
16	## The rewrite, in one table
17
18	The original harness works, but almost all of its accumulated complexity compensates for one root cause: orchestration logic lived in markdown prose an LLM had to faithfully execute, with hooks bolted on to catch the cases where it didn't. The rewrite moves every mechanical rule into code that just runs, and reserves the model for judgment.
19
20	\| Concern \| ai-sdlc-harness (v2.x) \| ai-sdlc-harness (v3.0) \|
21	\|---\|---\|---\|
22	\| Pipeline definition \| Prose phase files the orchestrator re-derives every run; a separate hardcoded copy in guard scripts \| One declared manifest ([pipeline/manifest.yaml](pipeline/manifest.yaml)) read by both the orchestrator and the enforcement layer — no second copy to drift \|
23	\| Git operations \| Raw `git` calls reverse-engineered after the fact by `shlex`-parsing hooks \| Owned entry points (`harness commit` / `merge-task` / `sync-branch` / `push` …); the raw verbs are blocked outright \|
24	\| Workflow state \| `tracker.md`, honor-system updates \| HMAC-chain-sealed `state.yaml` + append-only ndjson evidence ledgers — tamper-evident, `exit 3` on out-of-band edits \|
25	\| Human gates \| The model reads your reply and acts on it \| A hook captures your reply verbatim; deterministic code parses the decision — the model cannot approve on your behalf \|
26	\| TDD enforcement \| Separate Tester and Developer subagents per task (token/latency tax) \| One developer writes test + implementation; `harness verify-red` proves the failure and blob-SHA-locks the test set until completion \|
27	\| Providers \| Markdown capability docs an agent must correctly read \| Code modules behind one interface, each held to a shared contract test \|
28	\| Agents \| 7 role files fusing permissions with procedure \| 3 fixed tool-grant shapes (planner / developer / reviewer); procedure lives in shared step files \|
29	\| File-size budgets \| Retrofitted after files passed 400 lines \| ~100/200-line budget enforced from day one (`tools/budget_check.py`) \|
30
31	## Install
32
33	This repo is a Claude Code plugin marketplace. Inside Claude Code:
34
35	```
36	/plugin marketplace add MostAshraf/ai-sdlc-harness
37	/plugin install ai-sdlc-harness@ai-sdlc-harness
38	```
39
40	The repeated name isn't a typo — it's `plugin-name@marketplace-name`, and here they match. Restart Claude Code (or `/reload-plugins`) so the skills and hooks load. There's a non-interactive equivalent too, if you'd rather script it:
41
42	```sh
43	claude plugin marketplace add MostAshraf/ai-sdlc-harness
44	claude plugin install ai-sdlc-harness@ai-sdlc-harness # --scope user\|project\|local
45	```
46
47	Then, inside Claude Code:
48
49	```
50	/init-workspace
51	```
52
53	The interview asks only what it must (provider, repos), discovers your toolchain (proposing the test command it found), and offers default for everything else. It bootstraps a plugin-owned Python venv (PEP 668-safe — no system-python changes), ends with a verification gate — every check passes or you don't proceed — and writes per-section config under `.claude/context/`, a permission allowlist into `.claude/settings.json` (no manual `settings.json` editing needed), and the bootstrap marker.
54
55	## Prerequisites
56
57	\| Dependency \| Why \|
58	\|---\|---\|
59	\| Claude Code \| The CLI that runs this harness. Install from [claude.ai/code](https://claude.ai/code). \|
60	\| Git \| Branch management, per-task worktree isolation, owned commits. \|
61	\| Python 3.10+ \| The entire core is Python. `/init-workspace` creates the plugin's own venv with PyYAML as its first step; until then the guards print a one-line notice and stand down. \|
62	\| Provider CLI, authed (optional) \| `gh auth login` / `glab auth login` / `az login`,

People who liked this also viewed

6 picks

Type