🔁 Critical Fix: Plan → Implement Infinite Loop
sdp.developer used to handle both planning and implementation behind a self-referencing handoff, which in auto mode could repeatedly re-trigger implementation instead of moving to review. It's now split into two single-purpose agents:
• sdp.planner (Gate 4) — plans only, never writes code, never self-invokes.
• sdp.developer (Gate 5) — implements only, hands off exactly once to sdp.reviewer .
Moving from a plan to code now always requires an explicit approval + /implement — no more silent auto-chaining.
🔐 Configurable Security Review
Epics now declare a security_review policy: per-story (default), epic-level (batched, audited once per epic), or waived (with a required reason). Agents respect this without complaining — but still block if the policy is missing on security-sensitive stories (auth, secrets, external input, data boundaries).
⏱️ Plan Scope Budgets
Every PLAN.md now requires a Scope Budget (max 8 files, ~300 changed lines, complexity tier) to keep implementation time and token usage predictable. Oversized stories are split and sent back to Gate 2 instead of being executed as-is.
📄 Complete Artifact Templates
Added the previously missing PRD.md , BACKLOG.md , EPIC.md , DESIGN.md , PLAN.md , and HISTORY.md templates, all carrying a status: draft | approved | rejected header so gate approval is explicit and checkable rather than inferred.
🛑 Hardening Loop Breaker & ⚖️ Unified Severity
• After 2 failed hardening cycles on the same story, agents stop retrying and escalate to you instead of looping indefinitely.
• Reviewer, Security, and QA now share one Critical/High/Medium/Low severity scale (previously inconsistent).
🧭 Resumability & Effort Feedback
• ACTIVE.md now tracks current_gate , current_story , and status for resuming interrupted sessions.
• Architect rates story complexity (S/M/L); Analyst applies INVEST sizing — catching oversized stories before they reach planning.
🧹 Deduplication
coding-standards.instructions.md no longer duplicates orchestration content from sdlc-process.instructions.md ; the generated root AGENTS.md is now duplication-free (regenerated via apm compile ).
Also in this release
• Expanded default targets in apm.yml : claude , cursor , codex , gemini , alongside copilot .
• README.md fully updated (Quick Start, gate diagram, reference tables, file trees) to match the new agent/template structure.
Full Changelog: spec-development-protocol-v0.4.0...spec-development-protocol-v0.5.0