Claude SDLC Kit

A drop-in system for running your project's full software lifecycle with Claude Code: specialized agents for every role, skills encoding your processes, slash commands to invoke them, and continuity systems (checkpoints, handover, onboarding) so knowledge never dies when a session ends or a developer leaves.

How to use this kit

There is one way to install it: IMPLEMENT_PROMPT.md.

1. Open a Claude Code session at the root of the project you want the kit in (a new project, an existing one, or one of the mini-apps in this repo).
2. Copy the entire contents of IMPLEMENT_PROMPT.md and paste it as your first message.
3. Claude reads every real file in this kit (not a summary), audits your project's actual stack, and installs .claude/, docs/, tooling/, and a CLAUDE.md with every placeholder filled from what it found — plus a first docs/AUDIT.md, an ADR, and a checkpoint, so the install is provably live, not inert scaffolding.
4. Commit the result. The kit only works if it lives in the repo. Restart Claude Code (agents load at session start).

That's the whole process — there's no separate manual copy-and-fill-in-placeholders path to choose between; the prompt does exactly what those manual steps would, just without the risk of a stale placeholder or a skipped file. If you genuinely want to see each file before it lands (e.g. reviewing a diff before committing), that's a normal part of any Claude Code session — ask Claude to show you the changes before you approve them; you don't need a different install method for it.

What's inside

Agents (.claude/agents/) — one per lifecycle role

Agent	Role	Access
architect	Designs features, writes ADRs before code is written	read + write docs
code-reviewer	Reviews diffs: correctness, security, tests, style	read-only
security-auditor	Deep security analysis + dependency audit	read-only
test-engineer	Writes/fixes/runs tests; never touches prod code	tests only
debugger	Reproduce → isolate → root cause → fix → regression test	read + edit
git-workflow	Branches, atomic Conventional Commits, PRs, conflicts	git ops
release-manager	Release gate, SemVer, changelog, tags, rollback plans	release ops
doc-writer	README/architecture/CLAUDE.md kept true to the code	docs
codebase-auditor	Full-repo audit → docs/AUDIT.md with remediation plan	read + report
version-manager	SemVer derivation, annotated tags, CHANGELOG.md, hotfix tags	git + docs
handover-manager	Checkpoints + handover documents	docs
changelog-manager	Live CHANGELOG.md upkeep + auto-splitting archives	docs
onboarding-guide	Interactive new-developer tours	read-only

Skills (.claude/skills/) — the detailed processes

code-audit (7-phase audit methodology) · git-workflow (branching/PR/conflict/recovery rules) · conventional-commits (full commit standard + enforcement) · semantic-versioning (bump derivation, tag management, pre-releases, hotfixes, changelog) · checkpoint (session-state snapshots + restore) · handover (evidence pass + interview + full template) · onboarding (7-stage tour to first merged PR).

Commands (.claude/commands/)

/audit /review /security /test /commit /pr /version /tag /changelog /release /checkpoint /resume /handover /onboard

Docs (docs/ + root) — every file's purpose in one place

File / folder	What it is	Written by
CLAUDE.md	Project memory: stack, commands, conventions, gotchas — the one place agents look for stack-specific facts	filled from the audit on install; kept current by doc-writer
CHANGELOG.md	Live, user-facing change log (Keep a Changelog format)	changelog-manager, continuously
docs/ARCHITECTURE.md	System overview, component map, primary flows, key invariants — under 2 pages by design, depth lives in ADRs	doc-writer, updated when an ADR lands
docs/AUDIT.md	Evidence-based state-of-the-project report + prioritized remediation plan; the release gate checks it for open Criticals	codebase-auditor via /audit
docs/ONBOARDING.md	Static day-1/week-1 checklist, improved after every real onboarding run	onboarding-guide, after each tour
docs/CHECKPOINTS/*.md	Session-state snapshots (YYYY-MM-DD-HHMM.md) — the unit of continuity between sessions	handover-manager via /checkpoint
docs/HANDOVER/*.md	Full ownership-transfer documents when a person leaves	handover-manager via /handover
docs/DECISIONS/*.md	ADRs — one file per significant decision, numbered, using the 0000-template.md shape	architect, when a design choice is ADR-worthy
docs/changelog/*.md	Archived older CHANGELOG.md sections, moved out once the live file passes the size threshold	changelog-manager, automatically

Continuity system (the part most teams skip)

• Checkpoints (docs/CHECKPOINTS/): every session ends with /checkpoint; every session starts with /resume. The 10-minute-stranger rule: anyone must be able to pick up work cold in 10 minutes.
• Handover (docs/HANDOVER/): when a person leaves, /handover interviews them and captures tribal knowledge, access inventory, people map, and a 30/60/90 successor plan.
• Onboarding (docs/ONBOARDING.md + /onboard): new developers get an interactive, personalized tour ending in a merged first contribution — and every confusion they hit improves the docs for the next person.
• ADRs (docs/DECISIONS/): every significant decision recorded with its reasoning.

The daily loop

/resume                       # morning: pick up from the last checkpoint
  ...build with Claude; the reviewer/tester/debugger agents trigger as needed...
/review  →  /test  →  /commit  →  /pr  →  /changelog   # keep the changelog LIVE
/checkpoint                   # evening: save state for tomorrow (or the next dev)

Milestones: /audit quarterly · /version → /release to ship (tag + changelog handled by the version-manager) · /handover when people change · /onboard when people arrive.

Enforcement tooling (tooling/, see tooling/README.md)

Three interchangeable tiers so enforcement isn't Node-only: commitlint + husky (Node projects), a dependency-free POSIX commit-msg hook (any other stack), and a GitHub Action (any stack, CI-side — brings its own Node runtime). CHANGELOG.md seed included in Keep-a-Changelog format.

Works with any language or framework

Nothing in this kit hardcodes a stack. The single point of stack-specific knowledge is the Commands table in CLAUDE.md — every agent reads the install/dev/test/lint/typecheck/ build commands from there rather than assuming npm test or any other convention. Where a process genuinely differs by ecosystem (dependency audit tools, version-manifest files), the relevant skill/agent lists the common ones per ecosystem and a generic fallback — see semantic-versioning's version-bump checklist and security-auditor's dependency-audit step. If you hit a gap for your stack, it's a bug in the kit — the fix is almost always "add one more bullet to that list," not a redesign.

Pairs with official Claude Code plugins

This kit is deliberately complementary to Anthropic's official plugins, not a replacement:

• security-guidance (/plugin install security-guidance@claude-plugins-official) — real-time pattern warnings and diff review as code is written. Run it alongside the security-auditor agent / /security, which does deep, evidence-based, point-in-time audits. See tooling/README.md for how they divide the work.
• code-review (official /code-review) — reviews a GitHub PR via gh, with parallel-agent triage and a confidence-scored filter before it ever comments. This kit's code-reviewer agent / /review reviews local diffs against CLAUDE.md conventions before you even open a PR. Use both: /review pre-PR, the official one post-PR.
• commit-commands (official /commit, /commit-push-pr) — fast, minimal, no gate. This kit's /commit and /pr run the full pre-commit gate (lint/typecheck/tests/secret scan) and enforce Conventional Commits first. If both are installed, prefer this kit's versions for anything you intend to actually merge; the official ones are fine for throwaway/experimental branches.

After install, on an existing project

The launch prompt already produces docs/AUDIT.md, a filled CLAUDE.md, and a state-zero checkpoint (steps 3–4 above) — this is what to do with them next: work the audit's remediation plan, one item per branch, through /review → /commit → /pr. Re-run /audit quarterly to keep it honest as the codebase moves.