Skip to content

aratkruglik/codex-sdlc

v1.0.0

Universal stack-aware SDLC orchestration for Codex.

GitHub

Changelog

1.0.0 — first tagged release

Declares codex-sdlc version 1.0.0 as the first tagged release of this repository. No previous version of this port was ever tagged in git (only v0.1.0 existed); this release consolidates the prior 2.0.0-labeled work under 1.0.0.

2.0.0 — upstream 2.0 parity and native Codex marketplace

Ported from AratKruglik/claude-sdlc release 2.0.0, commit 4c09bc9658e2672683691ac476368c4a1c696b27.

Provider architecture

  • Restored the upstream provider graph with 24 logical providers, 19 stack profiles, foundation dependencies, protected configuration and post-checks.
  • Added deterministic per-aspect stack selection, tie detection, dependency closure and content-addressed caching in scripts/detect-stack.py.
  • Refreshed 48 generated roles and 61 framework convention skills while keeping the three hand-ported core skills protected from migration overwrites.

Pipeline behavior

  • Ported parallel workflow groups, per-dispatch retries, resumable state, conditional members, backend-to-frontend contracts and disjoint-path checks.
  • Kept two-pass development with a user approval gate and added post-check repair.
  • Made security report-only; critical and high fixes return to development and QA verifies them.
  • Added native bundled-role dispatch so stack-selected roles work without global custom-agent registration. The compatibility installer still registers named roles.

Codex integration

  • Added portable and compatibility plugin manifests plus a repository marketplace manifest validated with the Codex plugin CLI.
  • Added lifecycle hooks for stack caching, provider configuration protection, commit guarding, formatter dispatch, model mismatch correction and telemetry.
  • Records token usage only from recognized Codex usage events; unavailable data remains unavailable and compact-summary estimates stay separate.
  • Resolves optional capabilities from codex plugin list --json, verifies their skills and versions, and keeps stack detection operational without PyYAML.
  • Added scripts/sync-upstream.py and expanded the port verifier for marketplace, detector and hook contracts.

0.1.0 — initial Codex port

Ported from AratKruglik/claude-sdlc (Claude Code marketplace, v1.4.1).

Behaviour preserved

  • 5-phase pipeline with per-aspect stack resolution across 19 profiles
  • Two-pass development phase with human approval gate
  • Git-flow detection, task typing, PR base selection (61 tests still green)
  • Skip-rules, workflow recipes, run marker, off-roster agent denial
  • Compact handoff contract — full artifacts on disk, summaries in context

Behaviour changed

  • 24 plugins collapsed into one flat repository (ADR-02)
  • Entry points are skills, not slash commands (ADR-08)
  • Stack discovery reads stacks/, not a plugin cache glob (ADR-07)
  • Skills carry an sdlc- prefix; there is no plugin:skill namespacing (ADR-09)
  • Accounting is in output tokens, not USD (ADR-11)
  • Batch isolation is a git-worktree script, not a tool parameter (ADR-13)
  • Batch branches now follow the project's naming convention (was a documented limitation upstream)
  • 16 per-plugin formatter hooks became one dispatcher + a table (ADR-10)
  • Every skill carries the sdlc- prefix, including sdlc-architect-conventions
  • security-init output is consumed by our own security phase; there is no external security-guidance plugin on Codex

Behaviour gained

  • SubagentStop telemetry records the model the runtime actually ran, and Step 5-reconcile prints a loud warning when it disagrees with the declared tier
  • JSON Schema validation of phase output under codex exec (ADR-12)
  • Exact token counts from turn.completed.usage instead of chars / 4 estimates

Tooling

  • scripts/convert-agents.py — 29 upstream agents to 48 Codex roles
  • scripts/convert-stack-profiles.py — 19 profiles, agent-name normalisation
  • scripts/migrate-skills.py — 61 skills, refuses to overwrite hand-ported ones
  • scripts/install.sh — INSTALL_MODE=link|copy, managed config block, discovery probe
  • scripts/verify-port.sh — 7 checks, including install-boundary reachability
  • scripts/batch-run.sh — worktree-per-task batch runner

Known gaps

  • The spawn tool's payload shape is not documented by OpenAI. The model-pinning hook matches on five candidate keys and fails open. Observe the real payload once and narrow it — docs/port-notes/PLAN.md task 1.3 steps 5-7.
  • No live verification has been run: codex was not installed on the porting machine. Everything here is structurally verified, not behaviourally.