Plugin

ai-sdlc-harness

Name: ai-sdlc-harness
Author: mostashraf

Orchestrates AI-driven multi-agent development workflow across multi-repo projects, from story refinement and requirements analysis to code implementation, review, testing, and PR creation, with automated guardrails and human approval gates.

What's Inside

Agents3

ai-sdlc-developer

/developer

[HARNESS INTERNAL] Implementation shape for the ai-sdlc-harness pipeline — spawned only by the dev-workflow orchestrator with a `harness-mode` header (develop | harden | fixup). Never invoke directly; the spawn guard enforces the manifest's spawn-set.

ai-sdlc-planner

/planner

[HARNESS INTERNAL] Planning shape for the ai-sdlc-harness pipeline — spawned only by the dev-workflow orchestrator (modes: intake | plan | repo-map). Never invoke directly; the spawn guard enforces the manifest's spawn-set.

Skills8

Register one new repo into an already-bootstrapped workspace, without disturbing repos already registered or re-running the full interview. USER-ENTRY — invoke only when the user explicitly runs /add-repo; never autonomously, never from a subagent (guard-enforced).

dev-workflow

/dev-workflow

Run the governed SDLC pipeline for a work item. USER-ENTRY — invoke only when the user explicitly runs /dev-workflow <work-item-id>; never trigger autonomously from conversation, and never from a subagent (guard-enforced).

init-workspace

/init-workspace

One-time workspace setup for the ai-sdlc-harness pipeline. USER-ENTRY and HUMAN-ONLY — invoke only when the user explicitly runs /init-workspace; never autonomously, never from a subagent (guard-enforced).

migrate-workspace

/migrate-workspace

Adopt a v2.x ai-sdlc-harness workspace into v3.0 — config carries over, run history stays archived in place. USER-ENTRY and HUMAN-ONLY — invoke only when the user explicitly runs /migrate-workspace; never autonomously, never from a subagent (guard-enforced).

repo-map-refresh

/repo-map-refresh

Regenerate the auto-generated repo map the planner grounds its plans in. USER-ENTRY — invoke only when the user explicitly runs /repo-map-refresh; never autonomously, never from a subagent (guard-enforced).

Hooks1

Event Hooks

Bash

File writes

8 hooks across 4 events

Stats

Version3.2.1

ReleasedJul 21, 2026

LanguagePython

Stars11

Forks4

MaintenanceExcellent

LicenseMIT

Last CommitJul 21, 2026

AddedApr 27, 2026

Actions

View on GitHub View README Plugin Marketplace JSON

Available In

ai-sdlc-harness11

Safety Signals

Caution

Executes bash commands

Hook triggers when Bash tool is used

Modifies files

Hook triggers on file write and edit operations

Tags

ai-sdlc-harness · v3.0

A governed multi-agent SDLC pipeline for Claude Code — a ground-up rewrite of ai-sdlc-harness. Drives a real engineering workflow — fetch → scope-confirmed plan → independent plan review → proven-red TDD → review → security → PR → comment rounds → reconcile → metrics — across one or many repos. No application code lives here: only the pipeline manifest, the Python core that enforces it, and the agents, skills, and hooks that run it.

Command

Purpose

/init-workspace

One-time setup interview: provider, repos, discovered toolchain, verification gate

/dev-workflow <work-item-id>

Take a work item from requirements to merged PR end-to-end

/story-workflow <command> <work-item-id>

Shape a story's quality before it's built: analyze · refine · improve · groom

/workflow-status

Read-only dashboard: cursor, tasks, gates, flagged events, run-health verdict per run

/workspace-config

Change one config section without re-running the interview

/add-repo

/migrate-workspace

Adopt a v2.x workspace: config carries over, run history stays archived in place

/repo-map-refresh

Regenerate the auto-generated codebase map the planner grounds its plans in

The rewrite, in one table

The original harness works, but almost all of its accumulated complexity compensates for one root cause: orchestration logic lived in markdown prose an LLM had to faithfully execute, with hooks bolted on to catch the cases where it didn't. The rewrite moves every mechanical rule into code that just runs, and reserves the model for judgment.

Concern

ai-sdlc-harness (v2.x)

ai-sdlc-harness (v3.0)

Pipeline definition

Prose phase files the orchestrator re-derives every run; a separate hardcoded copy in guard scripts

One declared manifest (pipeline/manifest.yaml) read by both the orchestrator and the enforcement layer — no second copy to drift

Git operations

Raw git calls reverse-engineered after the fact by shlex-parsing hooks

Owned entry points (harness commit / merge-task / sync-branch / push …); the raw verbs are blocked outright

Workflow state

tracker.md, honor-system updates

HMAC-chain-sealed state.yaml + append-only ndjson evidence ledgers — tamper-evident, exit 3 on out-of-band edits

Human gates

The model reads your reply and acts on it

A hook captures your reply verbatim; deterministic code parses the decision — the model cannot approve on your behalf

TDD enforcement

Separate Tester and Developer subagents per task (token/latency tax)

One developer writes test + implementation; harness verify-red proves the failure and blob-SHA-locks the test set until completion

Providers

Markdown capability docs an agent must correctly read

Code modules behind one interface, each held to a shared contract test

Agents

7 role files fusing permissions with procedure

3 fixed tool-grant shapes (planner / developer / reviewer); procedure lives in shared step files

File-size budgets

Retrofitted after files passed 400 lines

~100/200-line budget enforced from day one (tools/budget_check.py)

Install

This repo is a Claude Code plugin marketplace. Inside Claude Code:

/plugin marketplace add MostAshraf/ai-sdlc-harness /plugin install ai-sdlc-harness@ai-sdlc-harness

The repeated name isn't a typo — it's plugin-name@marketplace-name, and here they match. Restart Claude Code (or /reload-plugins) so the skills and hooks load. There's a non-interactive equivalent too, if you'd rather script it:

claude plugin marketplace add MostAshraf/ai-sdlc-harness claude plugin install ai-sdlc-harness@ai-sdlc-harness # --scope user|project|local

Then, inside Claude Code:

/init-workspace

The interview asks only what it must (provider, repos), discovers your toolchain (proposing the test command it found), and offers default for everything else. It bootstraps a plugin-owned Python venv (PEP 668-safe — no system-python changes), ends with a verification gate — every check passes or you don't proceed — and writes per-section config under .claude/context/, a permission allowlist into .claude/settings.json (no manual settings.json editing needed), and the bootstrap marker.

Prerequisites

ai-sdlc-harness · v3.0

Command	Purpose
`/init-workspace`	One-time setup interview: provider, repos, discovered toolchain, verification gate
`/dev-workflow <work-item-id>`	Take a work item from requirements to merged PR end-to-end
`/story-workflow <command> <work-item-id>`	Shape a story's quality before it's built: `analyze` · `refine` · `improve` · `groom`
`/workflow-status`	Read-only dashboard: cursor, tasks, gates, flagged events, run-health verdict per run
`/workspace-config`	Change one config section without re-running the interview
`/add-repo`	Register one new repo into an already-bootstrapped workspace
`/migrate-workspace`	Adopt a v2.x workspace: config carries over, run history stays archived in place
`/repo-map-refresh`	Regenerate the auto-generated codebase map the planner grounds its plans in

The rewrite, in one table

Concern	ai-sdlc-harness (v2.x)	ai-sdlc-harness (v3.0)
Pipeline definition	Prose phase files the orchestrator re-derives every run; a separate hardcoded copy in guard scripts	One declared manifest (pipeline/manifest.yaml) read by both the orchestrator and the enforcement layer — no second copy to drift
Git operations	Raw `git` calls reverse-engineered after the fact by `shlex`-parsing hooks	Owned entry points (`harness commit` / `merge-task` / `sync-branch` / `push` …); the raw verbs are blocked outright
Workflow state	`tracker.md`, honor-system updates	HMAC-chain-sealed `state.yaml` + append-only ndjson evidence ledgers — tamper-evident, `exit 3` on out-of-band edits
Human gates	The model reads your reply and acts on it	A hook captures your reply verbatim; deterministic code parses the decision — the model cannot approve on your behalf
TDD enforcement	Separate Tester and Developer subagents per task (token/latency tax)	One developer writes test + implementation; `harness verify-red` proves the failure and blob-SHA-locks the test set until completion
Providers	Markdown capability docs an agent must correctly read	Code modules behind one interface, each held to a shared contract test
Agents	7 role files fusing permissions with procedure	3 fixed tool-grant shapes (planner / developer / reviewer); procedure lives in shared step files
File-size budgets	Retrofitted after files passed 400 lines	~100/200-line budget enforced from day one (`tools/budget_check.py`)

Install

This repo is a Claude Code plugin marketplace. Inside Claude Code:

/plugin marketplace add MostAshraf/ai-sdlc-harness
/plugin install ai-sdlc-harness@ai-sdlc-harness

claude plugin marketplace add MostAshraf/ai-sdlc-harness
claude plugin install ai-sdlc-harness@ai-sdlc-harness   # --scope user|project|local

Then, inside Claude Code:

/init-workspace

ai-sdlc-harness

What's Inside

ai-sdlc-harness

Popularity

What's Inside

Confidence

README

ai-sdlc-harness · v3.0

The rewrite, in one table

Install

Prerequisites

Similar Plugins

development-planning

agentize

exarchos

claude-dev-kit

ai-sdlc-harness · v3.0

The rewrite, in one table

Install

Prerequisites

Popularity

Health & Quality

Similar Plugins

development-planning

agentize

exarchos

claude-dev-kit

agent-flow

sdlc-core