A complete, evidence-driven software lifecycle for Claude Code — run by one command, checked at every step, and signed off by you.
These sheets explain how it works, from first principles to the internals. No prior experience with agentic tooling required.
Claude Code is an AI agent that works in your terminal: it reads your codebase, writes code, and runs commands.
A plugin is a package you install into it — new commands, specialist AI workers, and safety hooks that teach Claude a whole way of working.
This plugin teaches it the discipline of a full engineering team.
AI agents are fast — but left alone they skip everything around the code: requirements, design, verification, release discipline.
Worse, they sometimes claim success without proving it: “all tests pass!” — when zero tests actually ran.
Real engineering teams solved this long ago with process. This plugin makes that process executable.
You type /sdlc. A wizard detects where your project stands and drives it through the seven phases a mature engineering organization uses — each anchored in a published standard.
A subagent is a small AI worker spun up for one job, in its own clean workspace. It does its task and reports back one final message — like a specialist filing a report.
Instead of one AI doing everything (and grading its own homework), the work is split across a roster of 35.
| Phase | Qty | Specialists include |
|---|---|---|
| Prepare | 2 | codebase explorer · CLAUDE.md author |
| Define | 7 | requirement authors + analysts · requirement reviewer |
| Design | 6 | architecture authors + explorers · design reviewer |
| Develop | 7 | planner · code author · test author · code reviewer |
| Verify | 5 | coverage · regression · static analysis · validation reviewer |
| Release | 3 | planner · author · release reviewer |
| Operate | 5 | triage · dependency + telemetry monitors · feedback loop |
Every gate reviewer must end its report with one machine-readable line:
## Regression Test Report
…full findings…
VERDICT: PASS — both runs
green, no flakesThe wizard keys the decision off that exact VERDICT: token — never off hopeful-sounding prose.
Phase 5 exists because “looks done” and “is done” are different things. Its agents are written to catch the specific ways a build fools you:
| The trap | The rule that catches it |
|---|---|
| Test command exits 0 — but collected zero tests | 0 suites collected = FAIL, never a pass |
| Unit tests green, but the production build is broken | The real deployable build must run and exit 0 — the test toolchain is not the shipping toolchain |
| A test that passes… sometimes | The full suite runs twice; any run-1/run-2 difference is flagged as flaky |
| An agent reporting numbers it never saw | Reports must quote the command, exit code, and the runner's own summary lines verbatim |
| A reviewer trusting another agent's counts | The final validation reviewer independently re-runs the suite itself and cross-checks the totals |
Your project's whole lifecycle position lives in one YAML file: which phases are done, which agent is next, how many times a gate has failed.
AIs are brilliant at prose and sloppy at hand-editing structured files. So here, no AI ever edits that file. Every change goes through one small, boring, fully tested script.
That's why you can close your laptop mid-review and resume next week — even mid-failure-loop, nothing is forgotten.
Instructions can be ignored; hooks cannot — a real program runs before the AI acts. This guard makes two promises mechanical:
Publishing asks you first. git commit · git push · npm publish → a permission prompt. Your approval is the gate.
The state file is untouchable. Any direct edit — sneaky shell redirects included — is flatly denied.
Real teams separate duties: the person who inspects the work is never the person who did it.
Here that separation is physical: reviewer agents are simply not given writing tools. A reviewer that wanted to quietly “fix” the code and pass its own gate… can't. The tools aren't there.
A structure test pins this — give a reviewer a write tool and the plugin's own test suite fails.
| Agent | Tool grant |
|---|---|
| Code author | Read Grep Glob Bash Write Edit |
| Test author | Read Grep Glob Bash Write Edit |
| Code reviewer | Read Grep Glob Bash |
| Validation reviewer | Read Grep Glob Bash |
Read-only inspectors, by construction — not by promise.
Agents propose; you dispose. The lifecycle pauses for a human signature at three altitudes — no more (ceremony stays proportionate), no fewer (these three are never skipped, even when every gate is green).
After Define — you approve what will be built before anything is designed.
After Design — you decide each architecture trade-off; your approval turns proposed decisions into accepted ones.
In Operate — a new work cycle starts only on your explicit go. Never on an agent's say-so.
Every retry loop has a hard bound. Three gate failures in a row, or a fixed issue that comes back? The wizard stops dispatching and hands you a structured decision instead of burning tokens.
You choose: guidance (your decision unblocks the loop), waive (recorded as WAIVED, never dressed up as a PASS), or abort (state saved; resume whenever).
HUMAN_REVIEW_REQUIRED
Phase / gate: verify — validation-reviewer
Trigger: gate FAILed 3× (strike bound)
Open blockers: release build exits 1 —
missing prod dependency
Artifacts: docs/verify/report-cycle3.md
Options: 1) guidance 2) waive 3) abortRepresentative output. Strike counts are stored in the state file — an interruption never resets a failure loop.
35 agents could get expensive. So each agent belongs to a tier, and a profile decides how much model each tier gets.
The invariant: no profile ever downgrades a gate. Reviewers, planners, and code authors always run on the strongest model — the savings come only from mechanical work.
| Tier | quality | balanced ·default | economy |
|---|---|---|---|
| Full — gates, planners, code authors | best | best | best |
| Standard — analysis, doc authoring | best | mid | small |
| Fast — mechanical tool-running | best | small | small |
Judgment never gets the cheap model. Log-reading does.
161 structure tests (free, run on every change) pin the machinery: the agent roster, the read-only reviewer rule, the state script's every transition, the guard's decisions.
Agent evals (opt-in, billed) go further: they run the real review agents against trap projects and check the verdict. Testing your AI agents — not just your code — is still rare.
| Trap fixture | Required verdict |
|---|---|
| Clean, working project | PASS |
| Tests green — but the production build is broken | FAIL |
| No build step exists at all | PASS — honestly reported |
| A hardcoded API key in the incoming change | FAIL — security blocker |
| Test command exits 0, collects zero tests | FAIL |
The plugin carries the process. Your repository receives the evidence — requirements, design decisions, verification reports.
Uninstall the plugin tomorrow and the record stays: a complete, human-readable engineering history of your project, in plain files, in your git.
| Your situation | What /sdlc does |
|---|---|
| Empty folder — an idea, no code | Interviews you for a short brief, scaffolds a minimal skeleton in your stack, then starts Phase 1 on it |
| Existing codebase — no lifecycle yet | Sets up the metadata, maps your code, and back-fills requirements and design docs from what exists |
| Already running — metadata present | Prints the status board and resumes at the exact phase and agent where you stopped |
$ /sdlc
✓ Prepare ✓ Define ✓ Design
→ Develop · Verify · Release · Operate
⚙ Model profile: balanced
You're on Develop, at the test_author agent.
1) Develop a feature 2) Continue 3) Pick a phaseRepresentative output — your board shows your own project's state.
Yes, if you want AI speed with an auditable trail — solo builders shipping seriously, teams that need requirements and sign-offs, anyone burned by “all tests pass” that wasn't.
Not yet, if you're sketching throwaway prototypes — a full lifecycle is deliberate ceremony, and ceremony should be proportionate.
Even then: the plugin tiers every change as trivial, standard, or complex — depth scales down for small changes, while security, tests, and review never drop below the floor.
License: AGPL-3.0 — free to use and modify, including at work; if you distribute a modified version, you share your changes the same way.
# inside Claude Code:
/plugin marketplace add orchestratedbyalex/agentic-sdlc-plugin
/plugin install agentic-sdlc@agentic-sdlc-marketplace
/sdlcSource, docs, and the full agent roster:
github.com/orchestratedbyalex/agentic-sdlc-plugin
If it saves you from one false “all tests pass”, a star on the repo says thanks.