ai-sdlc-harness

A governed multi-agent SDLC pipeline for Claude Code and Qwen Code — a ground-up rewrite of ai-sdlc-harness. Drives a real engineering workflow — fetch → scope-confirmed plan → independent plan review → proven-red TDD → review → security → PR → comment rounds → reconcile → metrics — across one or many repos. No application code lives here: only the pipeline manifest, the Python core that enforces it, and the agents, skills, and hooks that run it.

Command	Purpose
/init-workspace	One-time setup interview: provider, repos, discovered toolchain, verification gate
/dev-workflow <work-item-id>	Take a work item from requirements to merged PR end-to-end
/story-workflow <command> <work-item-id>	Shape a story's quality before it's built: analyze · refine · improve · groom
/workflow-status	Read-only dashboard: cursor, tasks, gates, flagged events, run-health verdict per run
/workspace-config	Change one config section without re-running the interview
/add-repo	Register one new repo into an already-bootstrapped workspace
/migrate-workspace	Adopt a v2.x workspace: config carries over, run history stays archived in place
/repo-map-refresh	Regenerate the auto-generated codebase map the planner grounds its plans in

The rewrite, in one table

The original harness works, but almost all of its accumulated complexity compensates for one root cause: orchestration logic lived in markdown prose an LLM had to faithfully execute, with hooks bolted on to catch the cases where it didn't. The rewrite moves every mechanical rule into code that just runs, and reserves the model for judgment.

Concern	ai-sdlc-harness (v2.x)	ai-sdlc-harness (v3.0)
Pipeline definition	Prose phase files the orchestrator re-derives every run; a separate hardcoded copy in guard scripts	One declared manifest (pipeline/manifest.yaml) read by both the orchestrator and the enforcement layer — no second copy to drift
Git operations	Raw git calls reverse-engineered after the fact by shlex-parsing hooks	Owned entry points (harness commit / merge-task / sync-branch / push …); the raw verbs are blocked outright
Workflow state	tracker.md, honor-system updates	HMAC-chain-sealed state.yaml + append-only ndjson evidence ledgers — tamper-evident, exit 3 on out-of-band edits
Human gates	The model reads your reply and acts on it	A hook captures your reply verbatim; deterministic code parses the decision — the model cannot approve on your behalf
TDD enforcement	Separate Tester and Developer subagents per task (token/latency tax)	One developer writes test + implementation; harness verify-red proves the failure and blob-SHA-locks the test set until completion
Providers	Markdown capability docs an agent must correctly read	Code modules behind one interface, each held to a shared contract test
Agents	7 role files fusing permissions with procedure	3 fixed tool-grant shapes (planner / developer / reviewer); procedure lives in shared step files
File-size budgets	Retrofitted after files passed 400 lines	~100/200-line budget enforced from day one (tools/budget_check.py)

Install

This repo is dual-native: a native Claude Code plugin (.claude-plugin/) and a native Qwen Code extension (qwen-extension.json) in one repository. Install it under either CLI — no conversion step is needed.

Claude Code

/plugin marketplace add MostAshraf/ai-sdlc-harness
/plugin install ai-sdlc-harness@ai-sdlc-harness

The repeated name isn't a typo — it's plugin-name@marketplace-name, and here they match. Restart Claude Code (or /reload-plugins) so the skills and hooks load. There's a non-interactive equivalent too, if you'd rather script it:

claude plugin marketplace add MostAshraf/ai-sdlc-harness
claude plugin install ai-sdlc-harness@ai-sdlc-harness   # --scope user|project|local

Qwen Code

qwen extensions install MostAshraf/ai-sdlc-harness

For development with a live link to your working copy:

qwen extensions link /path/to/ai-sdlc-harness

Restart Qwen Code so the skills, agents, and hooks load.

After install

Then, inside Claude Code or Qwen Code:

/init-workspace

The interview asks only what it must (provider, repos), discovers your toolchain (proposing the test command it found), and offers default for everything else. It bootstraps a plugin-owned Python venv (PEP 668-safe — no system-python changes), ends with a verification gate — every check passes or you don't proceed — and writes per-section config under .claude/context/, a permission allowlist into .claude/settings.json (no manual settings.json editing needed), and the bootstrap marker.

This is the beginning of the README. Read the rest at the original. Read the full README ↗