Commission the repository
Generate repository-specific controls, a project adapter, coding-agent entry points, commands, authority boundaries, and proof obligations.
Public mechanism reference / v0.9 release candidate
Valdris SDLC Harness
repository-level SDLC assurance harness for AI coding agents
Valdris installs repository controls, routes work, records external coding-agent activity as evidence, checks required proof, and blocks unsupported completion.
Controlled technical English is an authoring target. Formal ASD-STE100 conformance is not verified. The published source is a release candidate, not a tagged stable release.
- Foundation
- Layer 0
- Production assurance
- 13 domains
- Lifecycle
- 7 skills
- Work types
- 8 skills
- Complete catalog
- 15 skills
- Source revision
- 69bab1c945a989cc821f4807d9ab02b62773698a
01
What the harness actually does
The harness surrounds external coding agents with repository controls, durable state, typed evidence, and completion gates.
Capture and classify the request
Bind the authorized request, operator, environment, scope, exclusions, workload class, risk, and assurance requirement.
Freeze the route and durable goal
Select one primary work type, required supporting work, checkpoints, stop rules, and the source revision. Later evidence cannot weaken the route.
Resolve Layer 0
Check the foundation: intended workload, required capabilities, selected profile, acceptance rules, ownership, and proof contract.
Connect external coding work
Claude Code, Codex, or Hermes performs implementation. Runtime adapters normalize allowed events and watched artifacts into evidence.
Evaluate applicable assurance
Resolve the 13 production domains, active cross-cutting packs, gates, explicit skips, technical proof, and human-only Red Zone decisions.
Review, packet, and hand off
Freeze evidence for separated review, validate the run packet, state the supported assurance level, and preserve unresolved work instead of claiming unsupported completion.
02
Source setup
Valdris is source-installed. No npm package, marketplace listing, or stable tagged release is claimed.
Verify the source
git clone https://github.com/nickcarmonadigital/valdris-sdlc-harness.git
cd valdris-sdlc-harness
git checkout --detach 69bab1c945a989cc821f4807d9ab02b62773698a
test "$(git rev-parse HEAD)" = "69bab1c945a989cc821f4807d9ab02b62773698a"
node -e 'const p=require("./package.json"); if (p.version !== "0.9.0-rc.1") throw new Error("Unexpected package version: " + p.version)'
npm ci
npm run typecheck
npm run build
npm run verify:harnessThis verifies a development checkout. It is not authoritative release proof.
Commission a target repository
npm run commission -- \
--repo /path/to/repo \
--project-name "Example" \
--out /path/to/repo/.valdris-harness \
--yesReview and commit the generated pack before routing work.
03
Seven lifecycle skills
Lifecycle skills select the harness system that owns the current operation. Their order is deterministic.
Lifecycle 01
valdris-commissionCommission
Install repository-specific controls, adapters, and coding-agent entry points.
Open referenceLifecycle 02
valdris-route-goalRoute and Control the Goal
Create the durable goal, classify the request, and freeze the authorized route.
Open referenceLifecycle 03
valdris-assureAssure
Evaluate Layer 0 and the applicable production-domain obligations.
Open referenceLifecycle 04
valdris-connect-runtimeConnect the Runtime
Normalize runtime events and artifacts from an external coding agent.
Open referenceLifecycle 05
valdris-execute-workflowExecute the Work
Run the selected work-type skill against the immutable route.
Open referenceLifecycle 06
valdris-prove-governProve and Govern
Validate evidence, approvals, review separation, and the run packet.
Open referenceLifecycle 07
valdris-trust-improveTrust and Improve
Preserve trusted learning and approve controlled improvements.
Open reference04
Eight work-type skills
Work-type skills select the engineering procedure after classification and routing. They are not lifecycle stages.
Work type
valdris-intake-routeIntake and Route
Classify an authorized request and select the smallest valid route.
Open referenceWork type
valdris-bug-rcaBug Root Cause Analysis
Reproduce a defect, establish its root cause, fix it, and prove non-regression.
Open referenceWork type
valdris-feature-deliveryFeature Delivery
Deliver a feature or integration through implementation and proof.
Open referenceWork type
valdris-architecture-refactorArchitecture and Refactor
Change architecture or module boundaries while preserving required behavior.
Open referenceWork type
valdris-security-auditSecurity Audit
Test security, privacy, authorization, and tenant-isolation claims.
Open referenceWork type
valdris-platform-releaseCloud Infrastructure and Release
Govern cloud infrastructure, deployment, rollback, recovery, and release work.
Open referenceWork type
valdris-genai-assuranceGenerative AI Assurance
Evaluate models, prompts, retrieval, agents, tools, memory, and AI telemetry.
Open referenceWork type
valdris-proof-handoffProof and Handoff
Validate required evidence and hand off a supported result.
Open reference05
Layer 0 and 13 production domains
Layer 0 commissions the foundation. The production domains then evaluate applicable operational obligations.
Layer 0
7 capabilities / 14 controlsFoundation / Good Looks Like
Layer 0 binds the authorized request, workload classification, required capabilities, assurance tier, selected profiles, and proof contract before non-documentation delivery begins.
01Frontend Experience02Backend, API & Business Logic03Data & Storage04Identity, Authorization & Tenant Isolation05Hosting & Deployment06Cloud Infrastructure & Compute07CI/CD, Version Control & Quality08Security & Data Protection09Rate Limiting & Usage Control10Caching & Content Delivery11Scaling & Traffic Management12Observability13Availability, Recovery & Operations
Inspect every capability, control, profile, and proof level →06
Three assurance levels
The level names the strength of the supported claim. It does not describe visual polish or agent confidence.
Structural
Required artifacts, schemas, bindings, and coverage are valid.
Semantic
Commissioned adapters and thresholds prove the intended behavior.
Authoritative
An independent trusted runner, provider, signer, or authority attests the result with rollback-resistant state.
07
External runtime boundary
Claude Code, Codex, Hermes, and other coding agents perform implementation. Valdris records allowed activity and checks proof.
Blueprint
Explains topology and expected flow with static descriptive data.
It does not claim that execution occurred.Live Run
Shows events from an application programming interface, command-line tool, Model Context Protocol server, connector, or watched artifact.
It can support runtime claims only when the source identity and artifacts verify.Replay
Reconstructs a recorded run from stored events and artifacts.
It must identify the original run and cannot present replay data as live data.08
Operating rules
These boundaries prevent route weakening, self-approval, fake runtime claims, and unsupported completion.
- Artifacts support claims; an assertion alone is not proof.
- Every applicable domain resolves to evidence, a failure, or an explicit reason for non-applicability.
- A stronger finding can add controls but cannot silently weaken the frozen route.
- External coding agents implement work; the harness commissions, routes, records, checks, and blocks.
- Human approval permits a decision but does not replace missing technical proof.
- Authoritative assurance requires trust outside the delivery agent and repository-local evidence.
09
Search the complete reference
Search all 15 skills, 13 production domains, and every approved Markdown source document in the pinned public snapshot.
Showing 18 of 81 matching entries
Lifecycle skillCommission
Install repository-specific controls, adapters, and coding-agent entry points.
valdris-commissionLifecycle skillRoute and Control the GoalCreate the durable goal, classify the request, and freeze the authorized route.
valdris-route-goalLifecycle skillAssureEvaluate Layer 0 and the applicable production-domain obligations.
valdris-assureLifecycle skillConnect the RuntimeNormalize runtime events and artifacts from an external coding agent.
valdris-connect-runtimeLifecycle skillExecute the WorkRun the selected work-type skill against the immutable route.
valdris-execute-workflowLifecycle skillProve and GovernValidate evidence, approvals, review separation, and the run packet.
valdris-prove-governLifecycle skillTrust and ImprovePreserve trusted learning and approve controlled improvements.
valdris-trust-improveWork-type skillIntake and RouteClassify an authorized request and select the smallest valid route.
valdris-intake-routeWork-type skillBug Root Cause AnalysisReproduce a defect, establish its root cause, fix it, and prove non-regression.
valdris-bug-rcaWork-type skillFeature DeliveryDeliver a feature or integration through implementation and proof.
valdris-feature-deliveryWork-type skillArchitecture and RefactorChange architecture or module boundaries while preserving required behavior.
valdris-architecture-refactorWork-type skillSecurity AuditTest security, privacy, authorization, and tenant-isolation claims.
valdris-security-auditWork-type skillCloud Infrastructure and ReleaseGovern cloud infrastructure, deployment, rollback, recovery, and release work.
valdris-platform-releaseWork-type skillGenerative AI AssuranceEvaluate models, prompts, retrieval, agents, tools, memory, and AI telemetry.
valdris-genai-assuranceWork-type skillProof and HandoffValidate required evidence and hand off a supported result.
valdris-proof-handoffProduction domainFrontend Experience2 capabilities and 3 controls.
frontendProduction domainBackend, API & Business Logic3 capabilities and 3 controls.
backend-api-logicProduction domainData & Storage3 capabilities and 3 controls.
database-storage