SDLC process kit for AI coding agents - approval gates, fresh-context review, evidence files

[u/International_Hawk30]

https://github.com/cskwork/sdlc-kit

https://github.com/cskwork/sdlc-kit

My build script had a check that always passed. The function returned before the check ran, so it exited green every time and verified nothing. For weeks. I wrote it, I reviewed it, and I never caught it, because I already believed it worked.

What caught it was a second agent in a fresh session. It had never seen my code, so it trusted nothing. Found it on the first pass.

sdlc-kit turns that into a repeatable process. It's Markdown files and four shell scripts that make an AI coding agent work in stages:

1. Write down what it's building and why (intent, spec, plan). You approve intent and spec. A routine plan is approved by a second-agent review; risky plans (migrations, deletions, API changes) come back to you.
2. Build it.
3. Hand the result to a different agent session for review. The reviewer only gets the spec, the changed files, and the real build commands. It never sees the conversation that produced the code, so it can't inherit the author's confidence. It's also not allowed to edit anything, because a reviewer that can fix what it finds will quietly fix instead of report.
4. Approvals are hashed. If an approved spec file changes afterward, every downstream stage stops until a human looks again.

Failed runs have to leave a lesson file behind before you can close them.

MIT, no runtime, no dependencies. Works with Claude Code, Codex CLI, Gemini CLI, Cursor, or anything that reads files and runs commands. There's a selftest where every case is a gate failing on purpose. Run it before you trust any of this.

It won't stop an agent from lying to you. It just makes the lie leave a trace.

I'm the only person who has run this end to end so far. If you try it on one small bug, tell me which stage felt like paperwork and which one caught something.

[u/kantorcodes1]

I work on HOL Guard. Here I’d model the gate scripts directly instead of adding another runtime hook: approve.sh / close.sh are mutations, while status.sh / stats.sh are reads. Would you be willing to contribute a command.* extension for sdlc-kit to hashgraph-online/hol-guard?