SDLC Harness

imageLicense: MIT imagecopilot plugin install imageVS Code imageGitHub Copilot CLI

From first commit to final release, Harness orchestrates your entire software development lifecycle — so you can focus on building what matters.

SDLC Harness is a multi-agent orchestration system for GitHub Copilot that drives software projects through 9 SDLC phases using 19 specialized AI agents. It combines adversarial QA evaluation, live MCP-powered context, and iterative feedback loops to deliver production-quality code with enforced development standards.

Distributed as an Agent Plugin for VS Code and GitHub Copilot CLI. Install once — get all 19 agents, 16 skills, and the full SDLC workflow instantly.

Table of Contents

• Quick Start
• Architecture
• How It Works
• Cloud Packs
• Canary Testing
• What's Included
• Prerequisites
• Adopting in Your Repo
• Contributing

Quick Start

Install the plugin

VS Code

GitHub Copilot CLI

First use

Caution

Two VS Code settings are required:

Setting	Value	Why
chat.agent.defaultApproval	autopilot	Without this, every tool call requires manual approval.
github.copilot.chat.virtualTools.threshold	0	Harness uses 7 MCP servers (~150+ tools). The default limit hides tools.

Open your project and bootstrap:

/agent harness
initialize workspace

Harness deploys MCP config, quality instructions, and prompt files, then asks for your project details (name, domain, stack) to generate copilot-instructions.md.

After Harness deploys .vscode/mcp.json, start the MCP servers and open a new chat session (Ctrl+L) — VS Code registers MCP tools at session start.

The repository includes the agent profiles in both supported locations:

• .github/agents/ — Copilot CLI, GitHub Copilot App, and repository-level discovery.
• com.github.copilot/agents/ — Agent Plugins-compatible package layout.

The two directories must remain identical. In Copilot CLI, use /agent and select harness; @ is reserved for file references.

Architecture

Agent system (19 agents)

A single user-facing agent — Harness — orchestrates specialized workers, each scoped to a specific SDLC phase with least-privilege tool access.

flowchart TD
    Request["Engineer Request"] --> H["Harness"]

    H --> A["Analyst<br/>Phase 1-2"]
    H --> S["Scaffolder<br/>Phase 3"]
    H --> Dep["Deployer<br/>Phase 3+8"]
    H --> I["Implementer<br/>Phase 4"]
    H --> Doc["Documenter<br/>Phase 5"]
    H --> QA["QA Coordinator<br/>Phase 6"]
    H --> RAI["RAI Reviewer<br/>Phase 7"]
    H --> R["Release Manager<br/>Phase 8-9"]

    QA -->|parallel| R1["Architecture"]
    QA -->|parallel| R2["Azure Compliance"]
    QA -->|parallel| R3["Code Quality"]
    QA -->|parallel| R4["Security"]
    QA -->|parallel| R5["Test Coverage"]
    QA -->|parallel| R6["Req. Completeness"]
    QA -->|parallel| R7["UX & A11y"]
    QA -->|parallel| R8["LLM Behavior"]
    QA -->|parallel| R9["Deploy Readiness"]

    style H fill:#4A90D9,color:#fff
    style QA fill:#E67E22,color:#fff

9-phase SDLC workflow

QA evaluation engine

Inspired by Anthropic's harness design research:

• Generator-evaluator separation — 9 independent reviewers run in parallel, each in its own context window with no anchoring bias.
• Adversarial posture — every reviewer has explicit anti-leniency instructions.
• Numeric scoring — each reviewer scores 1-10. Security requires ≥8, others ≥7. Any Critical finding = automatic fail.
• Iterative loops — QA → fix → targeted re-QA, up to 3 rounds.
• Weighted composite — (security × 1.5 + sum(others)) / 8.5. Composite < 7 = fail.

See docs/harness-design.md for the full research-to-implementation mapping.

MCP integration (7 servers)

Agents fetch live context from external tools — no stale training data:

How It Works

/agent harness
Implement the order history API from ADR-012.

1. Harness identifies this as Phase 4, verifies the ADR exists, delegates to Implementer.
2. Implementer fetches live SDK patterns (GitHub MCP), loads framework docs (Context7), writes code + tests.
3. QA Coordinator spawns 9 reviewers in parallel — each scores 1-10 with adversarial posture.
4. If any domain fails its threshold, Harness runs an iterative fix loop (up to 3 rounds).
5. Documenter updates the ADR. Release Manager creates the PR.

Engineers stay in control — agents propose, engineers decide. Every subagent call is visible in Chat as a collapsible tool call.

See docs/workflow-guide.md for the full step-by-step walkthrough with sequence diagrams.

Cloud Packs

Cloud Packs are modular skill sets for specific cloud platforms. Each pack adds deployment, data access, and storage skills tailored to that provider.

The Azure Pack metadata is bundled at packs/azure/pack.json; its three skills are also published in the root skills/ directory so current Agent Plugins clients discover them. To create a new cloud pack, use the packs/_template/ skeleton.

Canary Testing

SDLC Harness includes an E2E test framework for validating the harness itself. Canary specs define expected agent behavior for each SDLC phase.

• 11 canary specs across bench/canaries/ (one per phase + catalog-specific tests)
• 2 JSON schemas in schemas/ for validation (canary specs, cloud packs)
• CI integration — canary-test.yml validates spec schema on PRs touching agents/skills
• Results stored as structured JSON in bench/results/

# Validate canary specs locally
python tools/validate_canaries.py

What's Included

Agents (19)

Skills (16)

Quality instructions (14 files, auto-applied by file type)

Prompt files (6)

Prerequisites

Conditional: Node.js 20+ / pnpm for TypeScript/React projects.

Adopting in Your Repo

Option A: Plugin install (recommended)

# Register the marketplace once
copilot plugin marketplace add Dongbumlee/sdlc-harness

# Install or update the plugin from the marketplace
copilot plugin install sdlc-harness@sdlc-harness

Then open any project and run:

/agent harness
initialize workspace

Harness generates copilot-instructions.md, deploys quality instructions and prompt files.

To update the plugin later:

copilot plugin marketplace update sdlc-harness
copilot plugin install sdlc-harness@sdlc-harness

copilot plugin install Dongbumlee/sdlc-harness still works today, but Copilot CLI marks direct repository installs as deprecated. Use the marketplace form to remain compatible with future CLI releases.

Option B: Manual copy

1. Copy .github/agents/, skills/, .github/prompts/, .github/instructions/, .design/, .vscode/mcp.json
2. Set <PROJECT_NAME> in .github/copilot-instructions.md
3. Select quality instruction files matching your stack

Adoption checklist

• Install plugin or copy files
• Run /agent harness or /sdlc-workspace-init to generate workspace files
• Review .github/copilot-instructions.md
• Start MCP servers, open new chat session
• Enable branch protection on main

Contributing

SDLC Harness development happens on the evo branch.

Repository structure

com.github.copilot/   ← Copilot-specific agents
skills/               ← Portable Agent Plugins skills
plugin.json           ← Root plugin manifest
bench/canaries/       ← E2E canary test specs
schemas/              ← JSON schemas for validation
tools/                ← Validation scripts
docs/                 ← Architecture docs, specs, guides

CI checks

To publish a plugin update, open Actions → Bump Plugin Version → Run workflow, choose patch, minor, or major, and run it from the branch to update. The workflow updates plugin.json, .claude-plugin/marketplace.json, creates a matching vX.Y.Z tag, and pushes the commit to that branch.

Key rules

• VSIX distribution is retired — do not recreate vscode-extension/, sync-check.yml, or build-vsix.yml. The repo ships as a root Agent Plugins package via plugin.json, skills/, and com.github.copilot/, with .claude-plugin/marketplace.json providing marketplace metadata.
• Agent/skill changes require corresponding canary spec updates
• All QA reviewers emit structured YAML output (see sdlc-reviewer-output-format skill)

License

MIT