cc_sdlc

sdlc

A Claude Code plugin that runs the AI-native SDLC playbook as six slash commands:

See the six-command workflow diagram for how the stages connect (source: diagrams/sdlc-commands.html).

Project Memory

Refactor Your Codebase via the Archify Diagrams

Install

claude plugin marketplace add linus-McM/cc_sdlc
claude plugin install sdlc@sdlc

Set up a project

Run the first command in any git repository:

/sdlc:plan "Add rate limiting to the public API"

The six commands

1. /sdlc:plan — capture the intent

/sdlc:plan "<title>"          # creates sdlc/<slug>/intent.md and interview you
/sdlc:plan check              # validate the artifact
/sdlc:plan accept             # product owner accepts; commits the intent
/sdlc:plan status             # which artifacts are accepted, present or missing

Claude interviews you (what cannot be done today, who is affected, what better looks like, what is out of scope) and writes the answers into intent.md. Changes touching auth, PII, payments, migrations or infrastructure are marked Risk: high. accept is refused until the artifact validates and its stage diagram is fresh; only a human accepts.

2. /sdlc:design — turn the intent into a spec

/sdlc:design                  # blocked until intent.md is accepted; writes spec.md
/sdlc:design check
/sdlc:design accept           # product owner accepts; commits the spec

spec.md holds numbered testable requirements traced to the intent, the design (components, data flow, interfaces), a Concerns section listing every policy conflict with its owner, and the proof (test files and checks). Concerns are walked through with the product owner before engineering sees the spec.

3. /sdlc:build — plan, then implement red→green

/sdlc:build                   # blocked until spec.md is accepted; writes plan.md in plan mode
/sdlc:build check
/sdlc:build accept            # engineer (tech lead for Risk: high) accepts the plan
/sdlc:build red <step>        # proves the step's test fails before code is written
/sdlc:build green <step>      # proves it passes after the smallest change
/sdlc:build sync              # every edited file must be listed in plan.md, or reverted
/sdlc:build fix on | off      # bug-fix mode: test files are locked while on

plan.md lists the files that change, the order of work (each step names the failing test written first), the risks and the proof. After acceptance every step is a red→green cycle recorded in tdd.jsonl; test run later refuses without at least one. fix on reproduces a bug as a failing test, then denies edits to test files until the fix passes, so a fix cannot rewrite the test that caught it.

4. /sdlc:test — feedback loop, review and evals

/sdlc:test run                # test, lint and build commands from .sdlc.toml; writes test-report.json
/sdlc:test review             # three-pass review (Bugs, Security, Compliance) against REVIEW.md; writes review.md
/sdlc:test evals              # runs evals/*.json through `claude -p` and gates on the pass rate

run refuses when no red→green cycle was recorded and spawns a fresh-context verifier agent that checks the change matches plan.md. review spawns the reviewer agent; every Important: finding is fixed with another red→green cycle before the review is committed. Add one eval per production incident.

5. /sdlc:deploy — PR, tiers, rollback rehearsal, production gate

/sdlc:deploy pr               # writes pr-body.md from the artifacts and opens the PR with gh
/sdlc:deploy check <env>      # allow | ask | blocked, with reasons
/sdlc:deploy rehearse         # runs [deploy] rollback in a throwaway worktree; required before production
/sdlc:deploy record <env>     # appends env, sha and approver to deploy.json

Environments are tiered in .sdlc.toml: free (Claude deploys), ask (Claude asks first) and gate (needs a passing report, a review, a rehearsed rollback and RELEASE_APPROVAL=<name> in the environment). A hook also denies the release command for a gated environment while RELEASE_APPROVAL is unset. Claude never pushes to main; branch protection and a code-owner approval close the PR.

6. /sdlc:maintain — watch production, close the loop

/sdlc:maintain watch [metric]           # tier and action per metric
/sdlc:maintain ingest <metric> --value <v>   # feed a reading from CI or a webhook
/sdlc:maintain propose <metric>         # writes the next intent.md from the evidence
/sdlc:maintain lesson "<text>"          # appends to sdlc/lessons.md

Readings land in sdlc/metrics.jsonl; bands in sdlc/bands.toml. Detection is Western Electric rules on a rolling baseline, pure Python: 1σ logs, 2σ triggers a read-only diagnosis and a three-line SITREP, 3σ writes a Risk: high intent and returns you to /sdlc:plan. Claude never acts beyond a PR or the rehearsed rollback; the on-call engineer triages.

Guardrails

Hooks run on every session, edit and shell command:

Each stage boundary commits what it produced: plan(<slug>): accept — intent.md, test(<slug>): review — review.md, deploy(<slug>): record <env> — deploy.json, maintain(<slug>): propose — intent.md, knowledge: refresh — sdlc/knowledge (+N files). Only the plugin’s own output moves (the sdlc/ directory plus [checkpoint] paths); source code, tests and staged work are left alone, and intermediate output rides along with the next boundary as (+N files).

Off switches: SDLC_KNOWLEDGE=off, SDLC_DOCS=off, SDLC_CHECKPOINT=off, SDLC_PACKS=off, [knowledge] enabled = false, [docs] enabled = false, [checkpoint] enabled = false.

Develop

uv sync && uv run pytest            # TDD: red test first, then code
uv run ruff check plugin/scripts scripts tests
claude plugin validate --strict plugin && claude plugin validate --strict .

Acknowledgements

Runtime tools and skills the plugin installs or drives:

Development tooling: pytest, pytest-cov, ruff, bandit, pre-commit with pre-commit-hooks, and just.

This site is open source. Improve this page.