{"id":51670900,"url":"https://github.com/scottconverse/dev-rigor-stack","last_synced_at":"2026-07-15T00:03:42.369Z","repository":{"id":369984234,"uuid":"1292638274","full_name":"scottconverse/dev-rigor-stack","owner":"scottconverse","description":"A six-gate delivery discipline for AI coding agents, plus the skills it runs. Model-agnostic, MIT.","archived":false,"fork":false,"pushed_at":"2026-07-07T19:59:57.000Z","size":118,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-07T20:04:58.807Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/scottconverse.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-07T17:47:45.000Z","updated_at":"2026-07-07T20:00:03.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/scottconverse/dev-rigor-stack","commit_stats":null,"previous_names":["scottconverse/dev-rigor-stack"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/scottconverse/dev-rigor-stack","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scottconverse%2Fdev-rigor-stack","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scottconverse%2Fdev-rigor-stack/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scottconverse%2Fdev-rigor-stack/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scottconverse%2Fdev-rigor-stack/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/scottconverse","download_url":"https://codeload.github.com/scottconverse/dev-rigor-stack/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scottconverse%2Fdev-rigor-stack/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35483860,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-14T02:00:06.603Z","response_time":114,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-15T00:03:41.540Z","updated_at":"2026-07-15T00:03:42.356Z","avatar_url":"https://github.com/scottconverse.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# dev-rigor-stack\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)\n\nA six-gate delivery discipline for AI coding agents — the skills it runs, and three\nalways-on hooks that keep the discipline present by default: a **reflex** that primes every\nsession, a **rigor router** that injects the matching task protocol per prompt, and a\n**grounding check** that mechanically blocks \"done\" claims on code nothing ever ran. It\nturns \"the agent said it's done\" into \"the change was *proven*, at the layer of the claim,\nbefore it shipped.\" For anyone directing a coding agent through work where being\nconfidently wrong is expensive.\n\n## What it is\n\nThe **dev-rigor-stack** skill routes every unit of work — a fix, a feature, a refactor —\nthrough five gates, then stands a release gate before any version tag. It is\nmodel-agnostic and tool-agnostic: install it as a set of Claude Code skills, or paste the\nderived bundle into any other agent.\n\nTwo ways it reaches the agent: the **skills are pull-based** (invoked when a task needs\nthem), and the **hooks are push-based** — the [reflex](plugin/dev-rigor-reflex.md) is a\none-page distillation injected into every session and subagent, the router injects the\ntask-matching protocol the moment a prompt arrives, and the grounding check runs whether\nor not the model remembered the discipline. The discipline is on by default instead of\nwaiting to be summoned — and its floor is enforced, not requested.\n\n## The loop\n\nTwo altitudes:\n\n- **Per-unit loop** (every change): **PLAN** (classify blast radius) → **BUILD**\n  (test-first) → **VERIFY** (adversarially break the claim) → **REVIEW** (proportionate\n  audit) → **MERGE** (green-path only).\n- **Release gate** (before a tag): the full gauntlet driven to **zero findings** +\n  claim-refutation on the docs + real deliverable docs + a rollback plan → the **owner's\n  go/no-go on the tag**.\n\nAbove both sits a **session/machine continuity** bookend, so a multi-day, multi-machine\neffort doesn't lose its locked decisions. Full text: [the dev-rigor-stack\nskill](skills/dev-rigor-stack/SKILL.md).\n\n## What's in the box\n\n| Component | Role in the stack |\n|---|---|\n| [`dev-rigor-stack`](skills/dev-rigor-stack/SKILL.md) | the stack — orchestrates the loop + release gate |\n| [`coder-tdd-qa`](skills/coder-tdd-qa/SKILL.md) | **BUILD** — test-first engineering + QA standards |\n| [`proof-gate`](skills/proof-gate/SKILL.md) | **VERIFY** — adversarial build-and-verify, anti-theater |\n| [`audit-lite`](skills/audit-lite/SKILL.md) | **REVIEW** — fast single-pass audit of a small change |\n| [`audit-team`](skills/audit-team/SKILL.md) | **REVIEW** — multi-role deep audit for high-blast units |\n| [`gauntletgate`](skills/gauntletgate/SKILL.md) | **REVIEW + release** — adversarial stage-gate (lite / walkthrough / full) |\n| [`dev-rigor reflex`](plugin/dev-rigor-reflex.md) | **always-on hook** — primes every session with the proof ladder + never-shrink rules; delegates to the six skills above |\n| [`rigor router`](plugin/hooks/dev-rigor-router.js) | **always-on hook** — classifies each prompt, injects only the [matching task protocol](plugin/disciplines/) (bug → investigation, UI → grounding, multi-part → decomposition, tag → release); silence otherwise |\n| [`grounding check`](plugin/hooks/dev-rigor-ground.js) | **always-on hook** — mechanically blocks ending a session that edited runnable code without ever executing anything |\n\nThe six skills and the three hooks are MIT-licensed and authored by the repo owner. The\nhooks are the always-on layer (see [The always-on layer](#the-always-on-layer)); the\nskills are invoked per gate. The installer installs **all** of them.\n\n`audit-lite`/`audit-team` and `gauntletgate` overlap by design — the same review discipline\nin two packagings: the standalone audits are the per-unit **review reports**, while\n`gauntletgate` is the release-altitude **advancement gate** (its `lite`/`full` lanes re-run\nthat discipline self-contained, plus a pass/fail verdict, first-run attestation, and the\n`walkthrough` lane). A report vs. a gate.\n\n## Quick start\n\n**Requirements:** Git, and **Node.js** — the three hooks are small Node scripts (see [The\nalways-on layer](#the-always-on-layer)). The six skills install without Node; only the\nhooks need it, and anyone running a coding agent almost certainly has it already.\n\n**As Claude Code skills:**\n\n```sh\ngit clone https://github.com/scottconverse/dev-rigor-stack\ncd dev-rigor-stack\n./install.sh                                             # macOS / Linux / Git Bash\npowershell -ExecutionPolicy Bypass -File .\\install.ps1   # Windows\n```\n\nOn Windows the `-ExecutionPolicy Bypass` prefix avoids the default *\"running scripts is\ndisabled on this system\"* block — a bare `.\\install.ps1` may be refused on a locked-down box.\n\nInstalls the six skills into `~/.claude/skills` (or `$CLAUDE_CONFIG_DIR/skills` if set)\n**and** wires the three always-on hooks (below). If Node is missing, the skills still install\nand the installer says the hooks were skipped. Restart your agent to pick them up. Re-running\nupdates in place — no path assumptions, safe to repeat (a v1.4 install upgrades cleanly; the\nnew hooks are added, nothing is duplicated).\n\nOne flag on both installers:\n\n```sh\n./install.sh --target ~/.codex/skills       # install the skills somewhere else, e.g. Codex\n./install.ps1 -Target ~/.codex/skills       # (PowerShell equivalent)\n```\n\n`--target` sends the skills to any directory — use it for Codex (`~/.codex/skills`) or any\nnon-default host. With `--target`, only the skills are installed; the always-on hooks are\nClaude-specific and are not wired.\n\n**Installing from inside a Cowork or Codex session** (the common case — no terminal): just\ntell the agent *\"install the dev-rigor-stack from github.com/scottconverse/dev-rigor-stack\"*.\nIt clones the repo, copies `skills/*` into the host's skills directory (`~/.claude/skills`\nfor Claude, `~/.codex/skills` for Codex), and for a Claude install wires the hooks.\n`manifest.json` lists everything that installs.\n\n### The always-on layer\n\nThe six skills are pull-based — the agent invokes them when it judges a task calls for\nthem. The three hooks are push-based, each covering a different failure mode:\n\n- **The reflex** (`SessionStart` + `SubagentStart`) is injected into every session and\n  every subagent — a single page: the **proof ladder** (spend rigor sized to blast radius,\n  not by habit), the never-shrink rules, and a one-line evidence receipt. It delegates the\n  heavy mechanics to the skills.\n- **The rigor router** (`UserPromptSubmit`) classifies each prompt and injects **only the\n  matching task protocol** from [`plugin/disciplines/`](plugin/disciplines/): bug work gets\n  the investigation protocol (reproduce → hypothesize → trace → fix at the root), UI and\n  artifact work gets render/run grounding, multi-part work gets decomposition with a\n  per-story evidence gate, and release wording gets the release discipline. Each protocol\n  injects at most once per session; a prompt that matches nothing gets silence. Routing\n  keeps every session's context lean while still delivering the right discipline at the\n  right moment — always-on-everything is the failure mode it replaces.\n- **The grounding check** (`PostToolUse` + `Stop`) is the only *enforced* layer: it keeps a\n  per-session ledger of edits to runnable/viewable files and of execution-tool calls, and\n  if a session edited runnable code but never executed or rendered **anything**, it blocks\n  the stop — once — with instructions to run the narrowest real check first. It is a\n  deliberate floor: it catches provable theater (zero executions ever), and leaves\n  \"re-run after the last tweak\" judgment to the model and the router's protocol.\n\nAll three are convenience layers, not dependencies: the full discipline lives in the\n`dev-rigor-stack` skill. The installer copies them to `~/.claude/dev-rigor-plugin/` and\nadds the hook entries to your `settings.json` (idempotently, preserving your existing\nhooks). They **need Node.js** — without node the skills still install and the installer\nsays the hooks were skipped. Edit the markdown under `~/.claude/dev-rigor-plugin/` (the\nreflex page, or any file in `disciplines/`) to tune the wording; the hooks re-read them,\nno code change needed.\n\n### Manual hook wiring\n\nOnly needed if the installer said the hooks were skipped (no Node.js) or refused\n(unreadable `settings.json`). After installing Node, just re-run the installer — it\nwires everything. To wire by hand instead, add these entries to `~/.claude/settings.json`\n(merge into your existing `hooks` object; replace `HOME` with your home directory):\n\n```json\n{\n  \"hooks\": {\n    \"SessionStart\": [{ \"matcher\": \"startup|resume|clear|compact\", \"hooks\": [{ \"type\": \"command\", \"command\": \"node \\\"HOME/.claude/dev-rigor-plugin/hooks/dev-rigor-activate.js\\\"; exit 0\", \"timeout\": 5 }] }],\n    \"SubagentStart\": [{ \"hooks\": [{ \"type\": \"command\", \"command\": \"node \\\"HOME/.claude/dev-rigor-plugin/hooks/dev-rigor-activate.js\\\" subagent; exit 0\", \"timeout\": 5 }] }],\n    \"UserPromptSubmit\": [{ \"hooks\": [{ \"type\": \"command\", \"command\": \"node \\\"HOME/.claude/dev-rigor-plugin/hooks/dev-rigor-router.js\\\"; exit 0\", \"timeout\": 5 }] }],\n    \"PostToolUse\": [{ \"matcher\": \"Edit|Write|MultiEdit|NotebookEdit|Bash|PowerShell|.*(preview|chrome|browser|computer|screenshot|navigate|snapshot|exec|run|test|shell|terminal|jupyter|notebook|ide|eval).*\", \"hooks\": [{ \"type\": \"command\", \"command\": \"node \\\"HOME/.claude/dev-rigor-plugin/hooks/dev-rigor-ground.js\\\" record; exit 0\", \"timeout\": 5 }] }],\n    \"Stop\": [{ \"hooks\": [{ \"type\": \"command\", \"command\": \"node \\\"HOME/.claude/dev-rigor-plugin/hooks/dev-rigor-ground.js\\\" check; exit 0\", \"timeout\": 5 }] }]\n  }\n}\n```\n\n**For any other agent (ChatGPT, Gemini, Codex, …):**\n\n```sh\n./export/export-portable.sh      # or export/export-portable.ps1\n```\n\nProduces `portable-bundle.md` — paste it into the agent's system prompt / custom\ninstructions / `AGENTS.md`. Claude-specific mechanics (the Workflow tool, `/slash`\nskills, model routing) stay in and read as plain guidance; nothing is stripped from the\nClaude side to serve the export.\n\nOptional: fold [`config/CLAUDE.md`](config/CLAUDE.md) into your own `CLAUDE.md` to apply\nthe stack automatically. It is a generic template — no machine paths, accounts, or\npermissions — but review before adopting.\n\n## When to use it — and when not\n\nUse it for work where a wrong \"done\" is costly: releases, migrations, security or\ncompliance changes, anything a real user or consumer hits. **Skip it** for trivial\none-line edits, throwaway prototypes, and cosmetic changes — the overhead only pays for\nitself when being wrong is expensive. The stack says so itself, in every gate.\n\n## Docs\n\n- [**User manual**](docs/MANUAL.md) — plain-English and technical, start to finish.\n- [**Architecture**](docs/ARCHITECTURE.md) — how the gates and skills compose, with diagrams.\n\n## License\n\nMIT — see [LICENSE](LICENSE). The skills and the hooks are authored by Scott Converse.\nTwo pieces of prior art, gratefully credited: the reflex's always-on *form* is from\n[ponytail](https://github.com/DietrichGebert/ponytail) (DietrichGebert, MIT), and the\nper-task-routing + verification-grounding *concepts* were proven transferable to smaller\nmodels by [fablize](https://github.com/fivetaku/fablize)'s Fable-vs-Opus comparison\n(fivetaku, MIT). The router and grounding check are clean-room implementations; no code\nfrom either project is used, bundled, or required.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fscottconverse%2Fdev-rigor-stack","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fscottconverse%2Fdev-rigor-stack","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fscottconverse%2Fdev-rigor-stack/lists"}