sdlc: gates and human approvals for AI coding agents, with GigaCode support
sdlc
The agent writes code, people decide, and gates are held by hooks in Claude Code, Codex, Cursor, OpenCode, Qwen Code and GigaCode
- 3 ★ on the repository
- Last commit
Extended access
Why this level
- sdlc writes hooks and deny rules into project agent settings, including settings.json, and blocks agent actions
- The PolyForm Noncommercial license restricts commercial use without a separate agreement
Install
- Works in
- Services
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/sdlcDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- sdlc writes hooks and deny rules into project agent settings, including settings.json, and blocks agent actions
- The PolyForm Noncommercial license restricts commercial use without a separate agreement
This is third-party code. Review the repository files before installing.
What it does
sdlc moves a project through a cycle from backlog to archive: explore, intent, spec, plan, build, verify, review. Approvals are bound to the digest of the approved document, so an edit makes the approval stale. An agent cannot approve its own work: the CLI refuses inside an agent session and hooks block the attempts. Specifications are handled by OpenSpec as a pinned dependency. For GigaCode, setup creates files under .gigacode/ (skills, commands, subagents, hooks in settings.json), and one adapter serves both GigaCode and Qwen Code. GigaCode support is marked experimental.
Who it is for. Teams that write code with agents and want to record who approved what, including users of Sber GigaCode.
Good fit when
- The agent jumps to code without an approved plan and a hook should stop it
- GigaCode and Claude Code both work on the project and the process has to be the same
- The code reviewer and its author must be different people, and it is written down in openspec/roles.yaml
- Before a release you want evidence that tests passed on this tree state, not on an older one
Not a fit when
- You want a quick prototype with no approvals: the gates will slow things down
- Commercial use: the repository carries PolyForm Noncommercial and a separate commercial license
- The project is not in git: sdlc expects a repository and keeps the backlog and log in it
Example request
Initialize sdlc for Claude Code and GigaCode in this repository and show the next process step and who has to take itLimitations
GigaCode support is experimental: the adapter follows the GigaCode documentation and Qwen Code behavior but has not been checked against a live GigaCode installation, as docs/en/17-qwen-gigacode.md says outright. Node.js, git and the package from the GitHub release are required; npm install -g sdlc installs an unrelated package with the same name. The license is dual: the repository holds PolyForm Noncommercial 1.0.0, MIT for OpenSpec code and a COMMERCIAL-LICENSE.md file. The documentation is mostly in English and there are three stars.
How to disable. Run sdlc uninstall in the project: it removes the files recorded in the manifest, while your hooks, deny rules and MCP servers in settings.json stay. The global package is removed with npm uninstall -g.
FAQ
Which agents are supported?
Claude Code, OpenCode, Cursor, Codex CLI, Qwen Code and GigaCode; support for the last two is experimental.
How is sdlc different from OpenSpec?
OpenSpec handles specifications and stays inside sdlc as a pinned dependency, while sdlc adds gates, human approvals, verification evidence and audit.
Is a server or cloud needed?
No: Node.js, git and your agent are enough, with no database, containers or cloud account.
What if the agent tries to approve on its own?
The CLI refuses inside the agent session and hooks block the attempt: decisions are made by a person from their own terminal.
Where are approvals stored?
In the git repository itself: the backlog, approvals, verification evidence and log are plain files, so no separate server or database is needed.
Discussion
No questions or reviews yet.
Related
All GigaChat toolsGigaCode project flows with hooks, gates and OpenSpec
gigacodeAgents
A monorepo of flows for the GigaCode CLI: development with stages and hard gates, a work progress observer and reverse analysis of code into a spec
QA Agent for the GigaCode CLI: 14 roles and 6 skills for testing
QaAgentGigacodeCli
Requirements-based testing in GigaCode: from analysis and autotest review to a conclusion, with duplicate search before a bug is filed in Jira
SDD on OpenSpec for GigaCode
sdd-gigacode
Spec-driven development on OpenSpec for a multi-repository product: a shared spec store, BA and SA roles and skills for GigaCode
A Python runner executes tasks from tasks.md one GigaCode iteration at a time, then five reviewers and a finalize pass, with a separate commit per task
GigaCode Bridge MCP
Gigacode-bridge-mcp
MCP server that delegates isolated code edits to GigaCode CLI in temporary Git worktrees and returns a patch for independent review
Eight skills for coding against the GigaChat API: choosing a layer, access setup, SDK, LangChain, gpt2giga and Deep Agents
README in short
The README explains the cycle from backlog to archive, digest-bound gates, the ban on agent self-approval, six supported tools (GigaCode and Qwen Code experimentally), a quick start through the release tgz and installation as a Claude Code plugin.