Agentic SDLC v0.6.1

Highlights

Fix: approved-gate validator always rejected every approved gate (#9, #10)

validate's approved-gate check for an independent verifier's reviewer role was structurally broken: required_reviewers was a hardcoded empty set left over from the v0.3 kernel refactor that moved domain-specific review_agents out of the kernel's lifecycle-gates.json contract, so verifier_role not in required_reviewers was unconditionally True and every approved gate failed with "lacks required reviewer role []", regardless of who verified it.

• Removed the dead check; the existing agent-catalog reviewer lookup is now gated to kind: "agent" verifiers only. A naive fix (just keep the old elif) would have silently started rejecting every legitimate human/service verifier instead, since an identity's kind (human/agent/service) and the agent catalog's own per-role kind (author/reviewer/specialist) are different axes — caught in review before merge.
• Independent review also caught that removing the dead branch made a previously-unreachable line live for the first time: a schema-invalid, non-string role (e.g. a hand-edited record) would have raised an uncaught TypeError instead of degrading to a validation error like every neighboring check. Fixed with an explicit string guard.
• 5 new regression tests: agent-kind reviewer verifier, agent-kind non-reviewer verifier, human-kind verifier, service-kind verifier, and non-string-role.

Compatibility

The kernel's VERSION constant remains 0.3.0 -- no G1-G10 contract or schema changes in this release; the fix only corrects validator logic. Existing providers pinned to kernel_compatibility ranges covering 0.3.0 remain compatible.

Full changelog: v0.6.0...v0.6.1

Agentic SDLC v0.6.0

Highlights

GitLab issue linkage for G1 Intent / G2 Requirements Baseline (#6)

intent_record_id/requirements_baseline_id are run-record fields that have existed in the schema since the beginning, but nothing anywhere ever set them until now. A G1/G2 authority can link the gate's contribution to a real, fetched-and-validated GitLab issue, in both the kernel and the LangGraph engine.

• Kernel: link-intent-from-gitlab-issue / link-requirements-from-gitlab-issue fetch the issue via glab api, attach it as gate-level evidence, and set the run-record field. Deliberately not approval evidence — linking a source never marks a gate approved, and gate approval is unaffected either way.
• Engine: gitlab_issue.py (a close port of the kernel's fetch/parse functions) is wired into plan --intent-gitlab-issue/--requirements-gitlab-issue and the FastAPI service's CreateTaskRequest, seeding the same fields as plan-time state carried through to export — no changes to the dispatch/model-call graph nodes.
• Review caught and fixed two real correctness bugs before merge: reenter() wasn't clearing the linked-source field alongside the evidence it re-baselines (leaving it pointing at deleted evidence), and relinking a different issue to the same gate left the old evidence entry orphaned instead of being replaced. Both are covered by regression tests that fail without the fix.

Kernel is now pip/pipx-installable (#5)

plugins/agentic-sdlc/ is a real Python distribution (pyproject.toml, hatchling, console script agentic-sdlc):

pipx install ./plugins/agentic-sdlc
agentic-sdlc --help

contracts/ stays at its existing location (still read directly by agentic_sdlc_langgraph's runtime.py) and is bundled into the built wheel via force-include at build time rather than duplicated in the source tree. bin/agentic-sdlc now runs the checkout via a dedicated dev_entrypoint.py rather than python -m agentic_sdlc, specifically to avoid the caller's own working directory ever shadowing the real package on sys.path. CI now builds and installs the packaged distribution and runs it from outside the checkout on every change.

Compatibility

The kernel's VERSION constant remains 0.3.0 — no G1–G10 contract or schema changes in this release; both new features are additive CLI/engine surface only. Existing providers pinned to kernel_compatibility: {"minimum": "0.3.0", "maximum_exclusive": "0.4.0"} remain compatible.

Full changelog: v0.5.0...v0.6.0

Agentic SDLC v0.5.0

Highlights

Kernel is now pip/pipx-installable (#5)

plugins/agentic-sdlc/ is a real Python distribution: a new pyproject.toml
(hatchling, package name agentic-sdlc, console script agentic-sdlc) makes

pipx install ./plugins/agentic-sdlc
agentic-sdlc --help

work with no repository checkout needed at runtime. The kernel script moved
from scripts/agentic_sdlc.py to the importable agentic_sdlc/ package.
contracts/ deliberately stays at its existing location
(plugins/agentic-sdlc/contracts/, still read directly by
agentic_sdlc_langgraph's runtime.py) rather than moving under the new
package — the build bundles a copy into the installed wheel via hatchling
force-include instead, and the CLI resolves whichever copy is actually
present (bundled, editable-install, or checkout) at runtime. bin/agentic-sdlc
now runs the checkout via a dedicated dev_entrypoint.py rather than
python -m agentic_sdlc, specifically to avoid the caller's own working
directory ever shadowing the real package on sys.path. CI now builds and
installs the packaged distribution and runs it from outside the checkout on
every change, so this keeps working rather than silently regressing.

init --dry-run, a GitLab approval adapter, and a docs fix (#4)

• init --dry-run: preview what init would create/change without writing
  anything.
• approve-from-gitlab / approve-from-gitlab-mr: a GitLab MR
  approval-evidence adapter analogous to the existing GitHub PR adapter, opt
  in via human_gate_default: "gitlab-mr". Speculative — not the approval
  source this kernel's own default provider uses; see
  plugins/agentic-sdlc/README.md for its documented trust-level caveats
  (MR-level rather than per-approver timestamps/commit values, gitlab.com/
  convention for self-hosted instances requiring an explicit
  gitlab_username field).
• Corrected --force documentation: init, with or without --force, is
  non-destructive and idempotent with respect to already-written wrapper and
  overlay files — the prior docs implied otherwise.

A2A (Agent2Agent) protocol support (#3)

agentic_sdlc_langgraph/a2a/ mounts a JSON-RPC surface into the FastAPI
service so external agents (e.g. Codex CLI) can participate as dispatch
targets through the same runtime helpers as REST/CLI, seeing identical
behavior for a given task_id across all three surfaces. a2a/client.py is
the reverse direction, used by agents.A2AModelClient to dispatch a graph
node to an external A2A agent instead of an in-process model call.

Compatibility

The kernel's VERSION constant remains 0.3.0 — no G1–G10 contract or
schema changes in this release. Existing providers pinned to
kernel_compatibility: {"minimum": "0.3.0", "maximum_exclusive": "0.4.0"}
remain compatible.

Note on v0.4.0 / v0.4.1

Those tags were pushed without corresponding GitHub Releases; their changes
(A2A support, and a CLAUDE.md addition) are folded into this release's
notes and changelog rather than backfilled separately.

Full changelog: v0.3.0...v0.5.0

Agentic SDLC v0.3.0

Highlights

LangGraph orchestration engine (new)

The prompt-orchestrated engine — six SKILL.md files a Claude Code/Codex
CLI host had to interpret step by step, calling a deterministic
bookkeeping CLI underneath — is retired in favor of a LangGraph
StateGraph built declaratively from the existing G1-G10 contracts.
Gate sequencing, author/reviewer dispatch, separation-of-duties
enforcement, and human/mutation-gate stops are now graph control flow,
checked in code and covered by tests, not prose an LLM has to get right
every time.

New: agentic_sdlc_langgraph/, a standalone package with:

• A declarative graph builder covering the full G1-G10 lifecycle,
  including a real interrupt()-based mutation-gate hard stop and
  invalidate/reenter operations where reentry genuinely re-dispatches
  a gate's agents (not just a status-field flip).
• Pure-function provider/profile loading (no legacy global mutable
  state, so the engine is reentrant across processes) and a
  GitHub-review-as-resume approval adapter.
• A standalone runtime: the agentic-sdlc-lg CLI and a minimal FastAPI
  service, both able to plan/resume/inspect a task across genuinely
  separate process invocations with zero chat CLI involved.

See agentic_sdlc_langgraph/README.md for setup and a module map.

Kernel / provider boundary (carried over from the unreleased 0.3.0 kernel work)

• Separated the portable lifecycle kernel from domain-specific agents,
  profiles, and extensions, which now load through a versioned provider
  manifest (schema/semver-checked, path-confined, load-time
  separation-of-duties enforcement).
• providers/agentic-sdlc-defaults/ ships as the reference provider.

Removed

• The six legacy SKILL.md files, their Codex openai.yaml sidecars,
  both plugin manifests, and runner-adapters.md — superseded by the
  LangGraph engine.
• Both marketplace manifests (.claude-plugin/marketplace.json,
  .agents/plugins/marketplace.json), which existed solely to
  distribute the now-retired plugin.

Compatibility

The kernel's VERSION constant remains 0.3.0 — the G1-G10 contracts,
schemas, and deterministic CLI (plugins/agentic-sdlc/scripts/agentic_sdlc.py)
are unchanged by the LangGraph work in this release. Existing providers
pinned to kernel_compatibility: {"minimum": "0.3.0", "maximum_exclusive": "0.4.0"}
remain compatible.

Full changelog: v0.2.0...v0.3.0

Agentic SDLC v0.2.0

Full Changelog: https://github.com/deagy/agentic-sdlc/commits/v0.2.0