anivar/agentic-sdlc

Agent skills and non-negotiable checks for a software delivery process run with coding agents.
Created by **Anivar Aravind**
The problem
A coding agent follows the instructions it is given, most of the time. The parts of a delivery
process that matter most are the parts "most of the time" is not good enough for: a commit that
lands without a go-ahead, a git add -A that sweeps in a file nobody meant to ship, a force push
that moves a protected branch, a key-shaped literal in a test fixture, a tool's name signed into
the history as a co-author. Instructions in a prompt are requests. The rules a team relies on need
a mechanism that does not negotiate.
This solution
Eleven skills that encode the process as rules an agent follows, and four mechanisms that
enforce the rules an agent must not be able to talk its way past:
- a **Claude Code hook** on every Bash command that refuses tool attribution, bulk staging,
hook-bypass flags, force pushes to protected branches and staged secrets, and asks before every
commit, push and post; the same hook asks before a credential file is read or the guard's own
configuration is edited through the file tools, and checks the commit that just landed;
- **native git hooks** (commit-msg, pre-commit, pre-push) that hold the same attribution,
secret and protected-branch rules for every other agent and every person, installed with one
command or through the pre-commit framework;
- a **reusable GitHub workflow** that fails a pull request whose title, body or commits carry
attribution, and runs TruffleHog over the pull request's commits;
- a **ruleset** for the protected branch: merged pull requests only, signatures, linear history,
the checks required.
Every rule has a stable id in rules/registry.json; the skills cite the
ids, the hook names them in its reasons, and docs/coverage.md is generated
from the registry so the coverage claim is a table, not a sentence.
Install
**Claude Code** (skills plus the hook), from inside a session:
or in two steps: /plugin marketplace add anivar/agentic-sdlc, then
/plugin install agentic-sdlc@agentic-sdlc. Skills appear as agentic-sdlc: .
**Any other agent** (skills only; the hook is Claude Code specific, and hook manifests for
other agents are on the roadmap):
Do not install both ways into Claude Code; the plugin already carries the skills. The skill files
carry Claude Code's argument-hint field, which the skills CLI tolerates; the claude.ai skill
upload is not a supported path.
**Every agent and every person**, the git hooks, from inside a repository:
This copies the package under .git/ and writes commit-msg (ATTR-1, ATTR-2), pre-commit
(SECRET-1) and pre-push (PUSH-1) into the hooks directory; hooks status and hooks uninstall
manage them, and an existing hook this tool did not write is left alone unless --force is
passed. Teams on the pre-commit framework add the repository to .pre-commit-config.yaml
instead; .pre-commit-hooks.yaml lists the three hook ids.
**The upstream skills.** This set descends from the skills below (see NOTICE). Keeping
both installed gives a prompt about tests or reviews two answers; to keep one set:
Baseline
| Component | Needs |
|---|---|
| The hook | python3 3.9 or newer on PATH (the stock macOS interpreter qualifies); git; trufflehog optional, used when present, with verification and the update check off. The hook fails closed: on a machine where python3 does not resolve, every Bash tool call is refused until it does or the plugin is disabled. The hook has a 30 s budget; its own git and TruffleHog calls stay under it |
| The plugin | Claude Code 2.1.211 or newer for the forced prompt in auto mode; 2.1.295 or newer for onFailure: block |
| The CI check | GitHub Actions; gh is preinstalled on the runners |
| The skills | any agent that reads SKILL.md |
A constraint, stated plainly rather than as a footnote: on Windows the hook works only where
python3 resolves to a real executable rather than the Store shim, and the CI matrix does
not run Windows, so Windows behaviour is not verified on every change.
What is inside
Skills
| Skill | What it does | Rules |
|---|---|---|
| evidence | Calibrate every claim: Verified, Measured, Inferred, Planned; verify at the production sha; agent output is a lead; read sources in full; compute a headline number twice; sweep after one defect | EVID-1 to EVID-10 |