chore(rename): wizard → harness for the repo slug and brand, identifiers held - #503
Merged
Conversation
Groundwork for renaming this repo to claude-sdlc-harness, landed ahead of the rename so the rename itself cannot break anything. `pr-review.yml` skips the paid Claude review on this repo's own PRs with `github.repository != 'BaseInfinity/claude-sdlc-wizard'`, because this repo uses Codex for cross-model review instead. Both reviewers independently flagged the same failure: a GitHub rename does not rewrite that string. The redirect covers web and git operations, not a literal comparison inside a workflow. The moment the repo is renamed the condition silently flips true and the review this skip exists to prevent starts running on every self-PR — burning quota with nothing to indicate anything changed. Listing both slugs makes the rename a no-op for this gate, in either direction, so it can be flipped without a flag day and rolled back without a second one. The test previously pinned the old slug exactly; it now requires a negative comparison for every slug this repo answers to. Its inverted-operator negative control still fires, verified by mutation. Not addressed here, and NOT covered by GitHub's redirect: npm Trusted Publishing binds to the exact repository name, so the publisher config on npmjs.com must be updated at rename time or the next tagged release fails at publish. That is a manual step in the npm console, not a code change. Suite 65/65.
…iers held The GitHub repo is now BaseInfinity/claude-sdlc-harness. This updates what points at it and what calls it by name, and deliberately changes nothing that a consumer's install depends on. Renamed: - repo slug in 23 files (marketplace sources, plugin manifests, package.json repository.url, shipped skills, workflows, docs) - brand phrase "SDLC Wizard" -> "SDLC Harness" across 38 files - package.json description, now leading with self-evolving — the word the README has used all along and the GitHub description now matches Deliberately NOT renamed, per both reviewers consulted blind: - npm package `agentic-sdlc-wizard` (1,654 downloads/month; npm cannot rename in place, and a new package starts at zero) - plugin IDs `sdlc-wizard`, `sdlc-wizard-cowork`, and the marketplace name (installs key on these; renaming forces everyone to reinstall and changes their skill namespace) - CLI bin `sdlc-wizard`, the /claude-*-wizard commands, CLAUDE_CODE_SDLC_WIZARD.md, SDLC_WIZARD_CACHE_DIR There is precedent: this repo was already renamed once (agentic-ai-sdlc-wizard -> claude-sdlc-wizard) while npm stayed put, with no fallout. Consumers touch exactly one identifier per surface and never have to reconcile them. Kept on the old slug on purpose: pr-review.yml's dual-slug list and the test that pins both, so the rename stays a no-op for that gate in either direction; and CHANGELOG plus the archived Codex findings, which were true when written. One test needed a real fix, not a cosmetic one. `test_wizard_url_live` fetched `main` and asserted the title. Pinning the new title made this change unmergeable by its own gate: the check reads published state from inside the unpublished diff, `main` still serves the old title, ci.yml runs the suite, and merge-pr.sh treats CI-green as NOT waivable. It now accepts either brand for the transition window. The property worth asserting is that the URL serves the wizard document, not that the title is one exact string. TDD deliberately skipped, on the maintainer's explicit instruction: a one-time mechanical rename that will not recur, verified after the fact rather than driven by a regression test nobody will ever need again. Recorded here rather than skipped silently. Verified: suite 65/65; npm package, bin and plugin IDs unchanged; skills/sdlc/SKILL.md still 19,993 bytes and byte-identical to its cowork twin; repository.url points at the new slug so provenance still matches.
Owner
Author
|
USER-APPROVED MERGE OVERRIDE Reason: Maintainer directed the wizard->harness rename this session and approved shipping v1.95.0 ('yup'). Fable, used as decider per the maintainer's Fable-is-the-brain instruction, ranked shipping v1.95 as the single highest-leverage next action: the work is finished and unbanked, and every branch cut after the rename rebases painfully until it lands. CI validate green. Rename scope (repo+prose, identifiers held) was decided by Fable and Codex consulted blind, and npm Trusted Publishing has already been re-pointed at the new slug and verified. HARD tier applies because the diff touches .github/workflows/ and skills/. Waived (would otherwise have blocked):
Still verified, not waivable: CI Head: Posted by |
BaseInfinity
added a commit
that referenced
this pull request
Aug 8, 2026
…ption, and Fable decides (#505) * fix(cowork): the prompt gate must tell a bypass from a justified exception Live incident, 2026-08-07. The maintainer wrote: "do the prose rename now, dont TDD something like this, it will most likely only ever happen once so just verify after" The gate denied it and ended the turn outright, with no retry. That is not a bypass. It states a reason (a one-time mechanical rename that will not recur) and an alternative (verify afterwards). The safeguard was being substituted, not removed — which is a reasoned engineering call, and exactly the kind of judgement the SDLC is supposed to support. The gate could not tell the difference because it only ever asked "does this ask to skip planning, testing, or review". Any sentence containing a skip was a bypass, regardless of what was offered in its place. Confirmed to be ours, not a third party: the blocking prompt was read out of the installed plugin cache (~/.claude/plugins/cache/.../sdlc-wizard-cowork/1.93.0) and is byte-identical to cowork/hooks/hooks.json in this repo. The prompt now draws the distinction explicitly, keeps denying bare skips that offer nothing in their place, and adds a tie-break the old one lacked: when a prompt is ambiguous, allow it. This gate ends the turn with no retry, so a wrong denial costs the user their entire turn while a wrong allow costs nothing — the TDD and review gates downstream still apply. Asymmetric consequences deserve an asymmetric default. This is the third gate this session that was right in general and had no sanctioned path for the case where it wasn't. The merge gate got --user-approved for the same reason. A rule with no exception path is a rule people learn to route around, and that is worse than a rule with a recorded one. Two of my own assertions were vacuous and got caught while writing them: grepping for "reason" matched the JSON response field `"reason"` the prompt already contained, and `alternative|verify` matched the word "alternative" elsewhere in the text. Both tightened to the exact clauses, then mutation-tested — deleting any of "stated reason", "stated alternative" or "substituted" now turns the test red. The denial path is asserted too, so a future edit cannot quietly gut the gate while keeping the test green. Suite 65/65. * docs(sdlc): Fable decides, and ROADMAP stops asserting things that were false Two corrections, both about a stated fact with nothing checking it. **Fable is the primary thinker, not a rung you escalate to.** The shipped guidance framed it as somewhere to go when uncertain, and as a cadence slot ("Fable during design"). Both read as advisory. The intended contract is stronger: Fable decides design, priority and sequencing; the driver implements that call. The loop is now stated in order — Fable decides, Opus implements, Fable reviews the implementation, and only then Codex runs as the final cross-model check. Fable appears twice on purpose. Codex is last and singular: an adversarial gate, not a second opinion to average with the first. Also recorded as explicitly unsettled: this topology runs Opus as driver calling out to Fable. The inverse — Fable driving and delegating to Opus subagents — has not been tested and may be better. The doc now says that rather than implying the current arrangement was chosen on evidence. This rule was written to per-user memory first, which was the wrong place and breaks the skill's own Memory Audit Protocol: "a process rule saved only to memory is a /sdlc gap — memory changes one agent, docs change everyone." Worth naming why it happened — skills/sdlc/SKILL.md is at 19,993 of 20,000 bytes, so the byte ceiling is actively pushing process rules out of the shipped doc and into private memory. That is GH #489 doing damage beyond "edits are annoying". **ROADMAP.md stated two things that were false.** Under "Start here next" — the first thing a cold session reads — it claimed row #485 was implemented and awaiting review on `fix/485-single-tier-merge-gate`, with `HARD_DENY` deleted. Verified today: that branch is 0 commits ahead of main and carries nothing, and `HARD_DENY` is alive in merge-pr.sh with 5 occurrences. It had been sending cold sessions to work that does not exist, on a branch that is empty. Corrected in place rather than quietly deleted. It also said "Open PRs — none" while #503 was open. The integrity test could not catch that: it enforces the *form* of bullets in that block, so a claim of "none" has no bullets to inspect. The fix is not a better checker — whether a PR is open is the tracker's fact and no offline test can verify it, so ROADMAP now links the PR list instead of restating it. A new assertion fails if that claim ever comes back. Both new tests were RED first. The Fable assertion initially failed against correct prose because the doc says "Fable **decides**" and the pattern wanted a literal space — the same markdown-weld class as the #491 splitter bug, caught here by the test rather than by a reviewer. Suite 65/65.
BaseInfinity
added a commit
that referenced
this pull request
Aug 8, 2026
…hipping (#506) The repo is now BaseInfinity/claude-sdlc-harness. The npm package stays agentic-sdlc-wizard and the plugin IDs, CLI bin and slash commands are unchanged — those are what an install depends on, and renaming them would force every consumer to reinstall for no functional gain. The old repo URL still redirects, and npm Trusted Publishing has been re-pointed at the new slug, which GitHub's redirect does not cover. Carries #495 (--user-approved), #497 (three shipped defects, and five review rounds fixing the tests meant to catch them), #500 (dual-slug CI tolerance, landed before the rename so the rename could not break it), #503 (the rename) and #505 (the Cowork gate fix and the Fable-decides contract). Version markers: eleven had to move together, and the suite caught three I missed — the cowork marketplace entry, the update skill's example, and the SDLC.md table. That is GH #493's defect class caught by tests rather than by review, which has not happened before. Historical v1.94.0 references in ROADMAP and in two test comments are left alone deliberately: they describe what was true then. Suite 65/65.
BaseInfinity
added a commit
that referenced
this pull request
Aug 12, 2026
…hipping The repo is now BaseInfinity/claude-sdlc-harness. The npm package stays agentic-sdlc-wizard and the plugin IDs, CLI bin and slash commands are unchanged — those are what an install depends on, and renaming them would force every consumer to reinstall for no functional gain. The old repo URL still redirects, and npm Trusted Publishing has been re-pointed at the new slug, which GitHub's redirect does not cover. Carries #495 (--user-approved), #497 (three shipped defects, and five review rounds fixing the tests meant to catch them), #500 (dual-slug CI tolerance, landed before the rename so the rename could not break it), #503 (the rename) and #505 (the Cowork gate fix and the Fable-decides contract). Version markers: eleven had to move together, and the suite caught three I missed — the cowork marketplace entry, the update skill's example, and the SDLC.md table. That is GH #493's defect class caught by tests rather than by review, which has not happened before. Historical v1.94.0 references in ROADMAP and in two test comments are left alone deliberately: they describe what was true then. Suite 65/65.
BaseInfinity
added a commit
that referenced
this pull request
Aug 12, 2026
…re false
Two corrections, both about a stated fact with nothing checking it.
**Fable is the primary thinker, not a rung you escalate to.** The shipped
guidance framed it as somewhere to go when uncertain, and as a cadence
slot ("Fable during design"). Both read as advisory. The intended
contract is stronger: Fable decides design, priority and sequencing; the
driver implements that call.
The loop is now stated in order — Fable decides, Opus implements, Fable
reviews the implementation, and only then Codex runs as the final
cross-model check. Fable appears twice on purpose. Codex is last and
singular: an adversarial gate, not a second opinion to average with the
first.
Also recorded as explicitly unsettled: this topology runs Opus as driver
calling out to Fable. The inverse — Fable driving and delegating to Opus
subagents — has not been tested and may be better. The doc now says that
rather than implying the current arrangement was chosen on evidence.
This rule was written to per-user memory first, which was the wrong place
and breaks the skill's own Memory Audit Protocol: "a process rule saved
only to memory is a /sdlc gap — memory changes one agent, docs change
everyone." Worth naming why it happened — skills/sdlc/SKILL.md is at
19,993 of 20,000 bytes, so the byte ceiling is actively pushing process
rules out of the shipped doc and into private memory. That is GH #489
doing damage beyond "edits are annoying".
**ROADMAP.md stated two things that were false.** Under "Start here next"
— the first thing a cold session reads — it claimed row #485 was
implemented and awaiting review on `fix/485-single-tier-merge-gate`, with
`HARD_DENY` deleted. Verified today: that branch is 0 commits ahead of
main and carries nothing, and `HARD_DENY` is alive in merge-pr.sh with 5
occurrences. It had been sending cold sessions to work that does not
exist, on a branch that is empty. Corrected in place rather than quietly
deleted.
It also said "Open PRs — none" while #503 was open. The integrity test
could not catch that: it enforces the *form* of bullets in that block, so
a claim of "none" has no bullets to inspect. The fix is not a better
checker — whether a PR is open is the tracker's fact and no offline test
can verify it, so ROADMAP now links the PR list instead of restating it.
A new assertion fails if that claim ever comes back.
Both new tests were RED first. The Fable assertion initially failed
against correct prose because the doc says "Fable **decides**" and the
pattern wanted a literal space — the same markdown-weld class as the #491
splitter bug, caught here by the test rather than by a reviewer.
Suite 65/65.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The GitHub repo is now
BaseInfinity/claude-sdlc-harness. This updates what pointsat it and what calls it by name, and deliberately changes nothing a consumer's
install depends on.
Renamed
package.jsonrepository.url, shipped skills, workflows, docs"SDLC Wizard"→"SDLC Harness"across 38 filespackage.jsondescription, now leading with self-evolving — the word the READMEhas used all along, and which the GitHub description now matches
Deliberately NOT renamed
Scope decided by Fable and Codex, consulted blind; both independently recommended
repo + prose only.
agentic-sdlc-wizardsdlc-wizard,sdlc-wizard-cowork, marketplace namesdlc-wizard,/claude-*-wizardcommands,CLAUDE_CODE_SDLC_WIZARD.md,SDLC_WIZARD_CACHE_DIRThere is precedent: this repo was already renamed once
(
agentic-ai-sdlc-wizard→claude-sdlc-wizard) while npm stayed put, with nofallout. Consumers touch exactly one identifier per surface.
Kept on the old slug on purpose:
pr-review.yml's dual-slug list and the testthat pins both (so the rename stays a no-op for that gate in either direction), plus
CHANGELOG and the archived Codex findings — those were true when written.
One test needed a real fix, not a cosmetic one
test_wizard_url_livefetchedmainand asserted the title. Pinning the new titlemade this change unmergeable by its own gate: the check reads published state from
inside the unpublished diff,
mainstill serves the old title,ci.ymlruns thesuite, and
merge-pr.shtreats CI-green as not waivable. It now accepts eitherbrand for the transition window. The property worth asserting is that the URL serves
the wizard document — not that the title is one exact string.
Out-of-band, already done
npm Trusted Publishing was re-pointed at
BaseInfinity/claude-sdlc-harness(
release.yml,npm publishonly). GitHub's redirect does not cover npm's OIDCidentity, so without this the next tagged release would have failed at publish.
Verified on npmjs.com. The
npm trust githubCLI returns a bodyless 400 on a payloadthat passes its own validation — the web form is the supported path.
TDD deliberately skipped
On the maintainer's explicit instruction: a one-time mechanical rename that will not
recur, verified after the fact rather than driven by a regression test nobody will
ever need again. Recorded here rather than skipped silently.
Verified
bin, and plugin IDs unchanged after the sweepskills/sdlc/SKILL.mdstill 19,993 bytes, byte-identical to its cowork twin(it had zero brand-phrase hits, so the 20,000 ceiling never came into play)
repository.urlpoints at the new slug, which npm validates against the trustedpublisher at publish time