{"id":"ea322f02-8b18-4776-8f12-c126996e8b1e","slug":"devcrew","kind":"skill","name":"devcrew","summary":"Turn one AI coding agent into a full engineering team: 15 department subagents, a gated 15-stage SDLC pipeline, and deterministic security, compliance, and token controls. Works in Claude Code, Cursor","owner":"sarveshtalele","repoUrl":"https://github.com/sarveshtalele/devcrew","license":"MIT","licenseTier":"permissive","trust":"community","stars":1,"match":null,"fewStars":true,"format":"skill","createdAt":"2026-08-09T14:12:41.000Z","addedAt":"2026-10-21T14:32:01.019Z","logoUrl":"https://avatars.githubusercontent.com/u/93718731?u=e713c01c57b2d36a6bbdc647a2dfd400c174ad8f&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools","browser-web","cloud-infra"],"tags":["agile","ai-agents","antigravity","claude-code","compliance","cursor","developer-tools","devops"],"runtime":"node","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-26T04:31:17.478Z","sample":false,"url":"https://conduits.dev/tools/devcrew","language":"Shell","transports":["stdio"],"install":{"npm":"devcrew"},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"<div align=\"center\">\n\n# devcrew\n\n### Your AI agent writes code. **devcrew makes it ship like a team.**\n\n15 department subagents, a gated 15-stage SDLC pipeline, agile trackers, and security, compliance, and token controls that are shell hooks — not polite suggestions. One command into any project. No paid tools, ever.\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-black.svg)](LICENSE)\n[![Runtime](https://img.shields.io/badge/runtime-bash%20%2B%20python3-black.svg)](#requirements)\n[![Agents](https://img.shields.io/badge/agents-15-black.svg)](#the-agents)\n[![Modes](https://img.shields.io/badge/modes-5-black.svg)](#delivery-modes)\n[![Editors](https://img.shields.io/badge/works%20in-Claude%20Code%20%C2%B7%20Cursor%20%C2%B7%20Antigravity-black.svg)](#works-in-your-editor)\n[![Cost](https://img.shields.io/badge/paid%20tools-none-black.svg)](#zero-paid-software)\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/sarveshtalele/devcrew/main/install.sh | bash\ndevcrew init my-app --mode core\n```\n\n[**Quickstart &rarr;**](QUICKSTART.md) · [See it work](Example.md) · [Guide](Guide.md) · [Modes](#delivery-modes) · [Agents](#the-agents) · [Gates](#gates-that-are-code-not-advice)\n\n</div>\n\n---\n\n## The problem\n\nAI coding agents write code quickly and skip everything around it.\n\nNo requirements you can test against. No architecture decision record, so nobody remembers why. No threat model before the auth code. Secrets in a commit. Tests written after the fact that pass whether or not the feature works. A merge with no reviewer that isn't the author. And a context window that fills with files nobody needed, until the agent forgets the instruction you gave it twenty turns ago.\n\nTeams solve this with Jira, Linear, Snyk, SonarQube, Vanta, Datadog — a stack that costs thousands a month and still doesn't tell the agent what to do.\n\n**devcrew puts the process in the repository, where the agent reads it.**\n\n## What it is\n\nA folder you install into any project. It contains:\n\n- **15 department agents** — product, UX, architecture, tech lead, backend, frontend, code review, QA, E2E, DevOps, security, compliance, SRE, release — coordinated by an orchestrator. Each has its own persona, tool allowlist, token budget, and Kanban board.\n- **A 15-stage pipeline** from requirement to production to feedback, with named owners and literal exit criteria. Stages cannot be skipped silently.\n- **Deterministic gates** as shell hooks, not polite instructions: blocked secrets, blocked unverified pushes, blocked context-blowout reads, blocked AI authorship trailers.\n- **Standards baked in** — OWASP ASVS L2, OWASP LLM Top 10, SOC 2, GDPR, HIPAA, PCI DSS, IEEE 29148 requirements, IEEE 29119 testing, ISO/IEC 25010 quality, C4 + ADRs, WCAG 2.2 AA, DORA metrics.\n- **Five delivery modes** so a weekend project runs 4 agents and a regulated product runs all 15.\n- **Two runtime profiles** — `normal` runs anywhere with zero installs; `optimized` adds caveman, rtk, and a blocking design-token lint, installed for you by one script.\n- **A CLI** to install into a new or existing project, switch modes, verify before push, and report token spend.\n\n## Why it's different\n\n| | Typical AI agent setup | Enterprise SaaS stack | **devcrew** |\n|---|---|---|---|\n| Process | none, or one long prompt | in Jira/Linear, invisible to the agent | in the repo, read by the agent |\n| Roles | one generalist agent | human teams | 15 specialists with isolated context |\n| Security | \"please be secure\" | Snyk + Vanta + a consultant | STRIDE + OWASP LLM + blocking hooks |\n| Compliance | absent | Vanta / Drata subscription | SOC 2 / GDPR / HIPAA / PCI control maps + evidence log |\n| Tests | written when remembered | mandated in a doc nobody reads | required by stage 7 exit criteria |\n| Push safety | hope | branch protection you pay for | local gate that blocks unverified pushes |\n| Context cost | grows until it breaks | not addressed | per-agent budgets, enforced by hooks |\n| Authorship | AI credited as co-author | n/a | blocked at commit-msg |\n| Price | — | \\$2k–\\$10k+/month | **\\$0** |\n\n### devcrew vs. Spec Kit vs. OpenSpec\n\nAll three exist because prompting an agent straight into code produces the wrong thing. They solve different slices of that.\n\n| | [Spec Kit](https://github.com/github/spec-kit) | [OpenSpec](https://github.com/Fission-AI/OpenSpec) | **devcrew** |\n|---|---|---|---|\n| **Owner** | GitHub | Fission AI | community |\n| **Core idea** | Specifications become executable — spec first, then code | A lightweight planning layer before code, fluid not rigid | The whole lifecycle, with the rules enforced by hooks |\n| **Covers** | constitution → specify → plan → tasks → implement → converge | explore → propose → apply → archive | requirement → PRD → architecture → design → code → review → tests → CI → security → staging → UAT → prod → monitoring → metrics |\n| **Stops at** | implementation | implementation | production, then feedback into the next iteration |\n| **Roles** | one agent, phase by phase | one agent, phase by phase | **15 specialists**, each with isolated context and its own budget |\n| **Enforcement** | phase gates in the workflow | convention | **shell hooks with exit codes** — secrets, unverified pushes, AI authorship, and context blowouts are blocked, not discouraged |\n| **Review** | — | — | fresh-context `code-reviewer` that never saw the code being written |\n| **Security** | — | — | STRIDE threat models, OWASP ASVS L2 + LLM Top 10, SAST/SCA/secrets in CI |\n| **Compliance** | — | — | SOC 2 / GDPR / HIPAA / PCI control maps + append-only evidence log |\n| **Testing** | tasks may include tests | tasks may include tests | story → acceptance criteria → assigned test level, traceability matrix, axe + keyboard + 3 viewports |\n| **Ops** | — | — | SLOs, runbooks, canary + rollback, DORA metrics |\n| **Design system** | — | — | DESIGN.md tokens, contrast-linted in CI |\n| **Token control** | — | — | per-agent budgets, `token-guard`, `/scout`, `/compact-docs`, measured spend |\n| **Brownfield** | supported | a stated design goal | `add` is non-destructive; the repo is scanned into `project-facts.json` |\n| **Artifacts** | specs, plans, tasks, checklists | proposals, specs, design, tasks | all of that **plus** ADRs, threat models, test plans, trackers, runbooks, change records, evidence log |\n| **Scales down** | phases are fixed | yes, by design | 5 modes, 4→15 agents |\n| **Runtime** | Python CLI (`uv`) | Node CLI | bash + python3, no install into your project |\n\n**Honest summary.** Spec Kit and OpenSpec are *specification* tools: they make sure the agent builds the right thing. devcrew is a *delivery* system: it also decides who reviews it, what must be true before it merges, what cannot be pushed, and what has to exist before it reaches users.\n\nIf you only want a better plan before coding, those are lighter and you should use them. If your problem is what happens *after* the plan — review, tests, security, compliance, release, on-call — that's the gap devcrew fills. They compose: keep OpenSpec's `openspec/` proposals as your stage-2 artifact and let devcrew run stages 3–15 around them; nothing in the pipeline requires the PRD to come from `product-manager`.\n\n### Zero paid software\n\nEvery capability maps to something free and self-hosted:\n\n| Need | Usually | Here |\n|---|---|---|\n| Issue tracking, sprints | Jira, Linear | Markdown Kanban in `trackers/` |\n| Requirements management | Jama, DOORS | IEEE 29148 PRDs + traceability matrix |\n| Design system handoff | Figma paid seats | `Design.md` tokens generating Tailwind config |\n| SAST / SCA / secrets | Snyk, Checkmarx | semgrep, bandit, pip-audit, gitleaks |\n| Compliance automation | Vanta, Drata | control maps + append-only evidence log |\n| Test management | TestRail | IEEE 29119 plans + traceable test IDs |\n| APM / SLOs | Datadog, New Relic | OpenTelemetry + runbook + SLO templates |\n| Architecture governance | LeanIX | C4 diagrams + ADRs in `docs/adr/` |\n| Code review | paid review bots | `code-reviewer` agent in a fresh context |\n\nNothing phones home. Everything is a file you can read, diff, and change.\n\n---\n\n## Requirements\n\n**Required:** `git`, `python3`, and a POSIX shell.\n\n| Platform | Shell | Notes |\n|---|---|---|\n| macOS, Linux | system `bash` | nothing extra |\n| **Windows** | **Git Bash** (ships with Git for Windows) or **WSL** | `install.ps1` detects either and creates a `devcrew`-style shim on your PATH |\n\nWindows needs a POSIX shell because the gates are shell hooks — the same shell git hooks, Claude Code, and Cursor already use there. `install.ps1` fails with the exact `winget` command if neither is present.\n\nPer-stack tooling (`uv`, `pnpm`, `ruff`, `pytest`, `gitleaks`, …) is optional — `devcrew verify` skips what isn't installed and tells you.\n\n### Third-party tools\n\nNothing here needs installing by hand. `--profile optimized` runs the installer for you; `--profile normal` uses none of it.\n\n| Tool | Repo | Layer | Installed by |\n|---|---|---|---|\n| **caveman** | [JuliusBrussee/caveman](https://github.com/JuliusBrussee/caveman) | compresses what the agent writes | profile installer |\n| **rtk** | [rtk-ai/rtk](https://github.com/rtk-ai/rtk) | compresses what tool calls return | profile installer |\n| **DESIGN.md** | [google-labs-code/design.md](https://github.com/google-labs-code/design.md) | design tokens, contrast + reference linting | `npx`, no install |\n\nCommands and levels for each are in [TOKEN-OPTIMIZATION.md](template/TOKEN-OPTIMIZATION.md), which lands in your project when the profile is active. Per-platform behaviour: [below](#how-the-installer-behaves-per-platform).\n\n## Quick start\n\n### Install the kit\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/sarveshtalele/devcrew/main/install.sh | bash\n```\n\n```powershell\n# Windows PowerShell\nirm https://raw.githubusercontent.com/sarveshtalele/devcrew/main/install.ps1 | iex\n```\n\n<details>\n<summary>Other install methods</summary>\n\n```bash\n# npx — no global install\nnpx devcrew init my-app\n\n# git clone\ngit clone https://github.com/sarveshtalele/devcrew ~/.devcrew\nln -s ~/.devcrew/bin/devcrew ~/.local/bin/devcrew\n\n# Claude Code plugin (agents, skills, and hooks, no CLI)\n/plugin marketplace add sarveshtalele/devcrew\n/plugin install devcrew\n```\n</details>\n\n### New project\n\n```bash\ndevcrew init my-app --mode core\ncd my-app\n```\n\nCreates the folder, initializes git, installs the payload and both git hooks, prunes agents to the mode.\n\n### Existing project\n\n```bash\ncd my-existing-repo\ndevcrew add . --mode secure\n```\n\n**Non-destructive by construction.** Every file that already exists is skipped and printed; `add` only writes what is missing. Your `README.md`, `Makefile`, CI, and source are untouched. An existing `CLAUDE.md` or `AGENTS.md` is preserved — `/project-init` merges devcrew's rules into it rather than overwriting your conventions. `--force` replaces kit-owned files only, never your source.\n\nIt also scans the repo once into `.devcrew/project-facts.json` — stack, manifests, test directories, CI, IaC, repo age. Agents read those facts instead of spending 20k tokens rediscovering your stack on every session.\n\n`devcrew init` refuses to run in a non-empty directory and tells you to use `add`, so there is no path where it can clobber an existing project.\n\nStart brownfield projects in `lite` or `core`. Retrofitting `full` onto a live codebase produces findings nobody has time to act on.\n\n### Then\n\n```bash\ndevcrew doctor        # confirm prerequisites and health\n```\n\nOpen the project in your agent and run:\n\n```\n/project-init          # 16-question intake, fills placeholders, scopes compliance\n/feature checkout-flow # drives the feature through every stage of the pipeline\n```\n\nShip it:\n\n```bash\ndevcrew verify && git push\n```\n\n---\n\n## Two axes: mode and profile\n\nThey are independent, and the distinction matters.\n\n- **Delivery mode** decides **who works on the code** — which agents exist and which pipeline stages run. Scale it with the stakes.\n- **Runtime profile** decides **how the agent runs** — portability versus token cost. Scale it with your tooling.\n\n| | `normal` | `optimized` |\n|---|---|---|\n| **For** | Cursor, Antigravity, VS Code, Copilot, Codex, mixed teams | Claude Code, or any agent with skills and command hooks |\n| **Installs** | nothing | caveman + rtk, by script, after asking |\n| **Agent output** | plain prose | caveman-compressed (~65% fewer output tokens on prose) |\n| **Tool results** | full | filtered by rtk (up to 90% of bash output) |\n| **DESIGN.md lint** | advisory | **blocking** in `make ci` and `devcrew doctor` |\n| **Unbounded read ceiling** | 800 lines | 600 lines |\n| **Portable configs** | AGENTS.md, Cursor, Antigravity, Copilot | same — portability is never traded away |\n\nBoth profiles keep every hook-level control: per-agent budgets, delegated exploration, on-demand reads, fixed handoff blocks. `normal` is not \"unoptimized\" — it just doesn't require anyone to install anything.\n\n```bash\ndevcrew init my-app --profile normal        # default\ndevcrew init my-app --profile optimized     # runs the installer\ndevcrew profile                             # what's active\ndevcrew profile optimized                   # switch, any time\n```\n\nRun `devcrew init` interactively with no `--profile` and it asks. Non-interactive runs default to `normal` and never install software silently — including the installer itself, which skips every install when there's no terminal unless you pass `DEVCREW_YES=1`.\n\nSwitching profiles touches no code, trackers, agents, or documents. It changes how the agent runs, not what it produced.\n\n### What `--profile optimized` actually does\n\n`scripts/setup-optimized.sh` (and `setup-optimized.ps1` on Windows), copied into every project at `.devcrew/bin/`:\n\n1. installs **caveman** if missing — asks first, skips cleanly if node is absent;\n2. installs **rtk** via brew, scoop, cargo, or the upstream script, then offers `rtk init -g`;\n3. checks **`Design.md`** against Google's linter and reports findings;\n4. writes `.devcrew/active-profile.json`, drops the read ceiling to 600 lines, makes `make ci` block on `design-check`, adds `TOKEN-OPTIMIZATION.md`, and points `CLAUDE.md` and `AGENTS.md` at it;\n5. verifies all of the above and prints what is still missing.\n\nIdempotent. Re-run it after installing anything it had to skip.\n\n### How the installer behaves per platform\n\nIt detects the OS, architecture, and package manager, then picks the right path. Nothing is assumed.\n\n| Platform | devcrew itself | caveman | rtk | Notes |\n|---|---|---|---|---|\n| **macOS** (Intel / Apple silicon) | `install.sh` | `curl \\| bash`, needs node ≥18 | `brew install rtk`, falling back to the upstream script | `brew install node` if node is missing |\n| **Linux** (Debian/Fedora/Arch/SUSE/Alpine) | `install.sh` | `curl \\| bash`, needs node ≥18 | upstream script → prebuilt binary for your arch; `cargo install rtk` if that fails | node hint matches your package manager: `apt-get`, `dnf`, `pacman`, `zypper`, `apk` |\n| **WSL** | `install.sh` | same as Linux | same as Linux | detected via `/proc/version`; treated as Linux, not Windows |\n| **Windows PowerShell** | `install.ps1` | `irm … \\| iex` | `scoop install rtk`, else `cargo install rtk` | rtk has no MSI or winget package; node hint follows scoop/winget/choco |\n| **Windows Git Bash** | `install.sh` | works | **not here** — the script tells you to install rtk from PowerShell | the bash installer detects `MINGW*`/`MSYS*` and says so |\n\nCommon to every platform: `git` and `python3` are required, the linter runs through `npx` so it needs no install, and the script is idempotent — re-run it after installing whatever it had to skip. If a binary installs but isn't found afterward, it warns about `~/.local/bin` and `~/.cargo/bin` not being on `PATH`.\n\nWindows needs a POSIX shell for the gates themselves — `install.ps1` finds Git Bash or WSL and writes a shim, and `.gitattributes` pins every script to LF so CRLF never turns a hook into a syntax error.\n\n## Delivery modes\n\nRigor should match the stakes. Switch any time with `devcrew mode <name>` — agents are added or pruned and gate strictness changes.\n\n| Mode | Agents | Stages | Security | Compliance | E2E | For |\n|---|:---:|:---:|:---:|:---:|:---:|---|\n| `lite` | 4 | 5 | advisory | off | – | Prototypes, scripts, solo work |\n| **`core`** | **7** | **9** | **blocking** | advisory | – | **Default. Most products.** |\n| `secure` | 11 | 11 | blocking | advisory | ✓ | User data, money, or auth |\n| `ai` | 12 | 13 | blocking | advisory | ✓ | A model call in the critical path |\n| `full` | 15 | 15 | blocking | blocking | ✓ | Regulated or audited delivery |\n\n**Core 7:** orchestrator · product-manager · architect · backend-engineer · frontend-engineer · code-reviewer · qa-engineer.\n\n`ai` mode activates the full OWASP LLM Top 10 control set: prompt-injection framing, output schema validation, tool allowlists, scoped agent identities, token ceilings, and guardrail logging.\n\n---\n\n## The agents\n\nEach runs in its own context with its own tools and token budget, and reports back a fixed handoff block — so only a summary reaches the orchestrator, never the files the agent read.\n\n| Agent | Owns | Included in |\n|---|---|---|\n| `orchestrator` | Routes every stage, enforces gates, talks to you | all |\n| `product-manager` | Requirements (IEEE 29148), PRDs, stories, UAT | core+ |\n| `architect` | C4 diagrams, ADRs, boundaries | core+ |\n| `backend-engineer` | API, domain logic, data access, migrations | core+ |\n| `frontend-engineer` | UI from design tokens, a11y | core+ |\n| `code-reviewer` | Fresh-context diff review, blocking findings | all |\n| `qa-engineer` | Unit + integration tests, IEEE 29119 plans | all |\n| `tech-lead` | Interfaces, schemas, error contracts, task sizing | lite, secure+ |\n| `e2e-automation` | Playwright journeys, axe-core, keyboard, 3 viewports | secure+ |\n| `security-engineer` | STRIDE threat models, OWASP ASVS + LLM, scanner triage | secure+ |\n| `devops-engineer` | CI/CD, IaC, reproducible builds, SBOM | secure+ |\n| `ux-designer` | Flows, UI specs, design system | ai, full |\n| `sre-observability` | SLOs, dashboards, alerts, runbooks, DORA | ai, full |\n| `compliance-officer` | SOC 2 / GDPR / HIPAA / PCI controls and evidence | full |\n| `release-manager` | Change records, canary rollout, rollback | full |\n\nAgents never call each other. Everything routes through the orchestrator.\n\n---\n\n## The pipeline\n\n```\nProduct Requirement → PRD / User Stories → Architecture + ADR → Technical Design\n   → Development → Code Review → Automated Tests → CI Pipeline\n   → Security / Compliance → Staging → UAT → Production Deployment\n   → Monitoring → Feedback / Metrics → Next Iteration\n```\n\nEvery stage has an owner and exit criteria that are checked literally. A stage that genuinely does not apply is logged in `Changelog.md` as `SKIPPED: <stage> — <reason>`. Silence is never a skip.\n\nSmall changes take the fast path — stages 5→8 only — unless they touch auth, payments, health data, uploads, deserialization, or an LLM, which are never eligible.\n\n---\n\n## Gates that are code, not advice\n\nInstructions in a markdown file are advisory; an agent under context pressure will drift. These are shell scripts with exit codes.\n\n| Gate | Blocks |\n|---|---|\n| `secret-guard` | Writing `.env`, keys, or credential-shaped literals; edits to `migrations/`, `infra/prod/`, `.github/workflows/` |\n| `push-guard` | `git push` / `gh pr create` without a fresh verification stamp · `--no-verify` · force-push to shared branches · **AI attribution trailers** |\n| `token-guard` | Unbounded reads of files over 800 lines, tree-wide greps, `cat`, `find /` |\n| `quality-gate` | (warns) Formats and lints the changed file immediately, before CI sees it |\n| `session-meter` | Nothing — records per-tool token cost for `devcrew tokens` |\n| `commit-msg` | AI co-author trailers, non-conventional commit subjects |\n| `pre-push` | Any push whose verification stamp is older than the last source change |\n\n### Nothing ships unverified\n\n```bash\ndevcrew verify\n```\n\nRuns in order — **secrets scan → authorship check → lint and types → unit and integration tests → SAST/SCA → E2E and accessibility** (where the mode requires it). Secrets run first: a leaked credential makes every later result irrelevant.\n\nOn success it writes `.devcrew/verify-ok`. Both the git `pre-push` hook and the agent-level `push-guard` refuse to push without a stamp newer than your last change under `src/` or `tests/`. Editing code invalidates the stamp automatically.\n\n### Human authorship\n\nNo AI tool is ever credited as an author or co-author. No `Co-Authored-By: Claude`, no \"Generated with\" trailers, in commits or PR bodies. Enforced at three layers: the agent instructions, the `push-guard` hook, and the `commit-msg` git hook. The human who runs the change is accountable for it.\n\n---\n\n## Token economics\n\nThe context window is the binding constraint on agent quality, so the kit treats it as a budget.\n\n- **Per-agent budgets** in `Project-Management.md` §4, enforced by `token-guard` rather than good intentions.\n- **Deterministic-first.** If `rg`, `jq`, or a Makefile target can answer it, no agent may reason it out of file contents. A script costs ~0 tokens; reading costs thousands.\n- **Delegate, don't read.** Any search across more than 3 files goes to a subagent; only its handoff block returns.\n- **Read on demand.** The root documents are never loaded together — that alone is ~15k tokens.\n- **Fixed handoff blocks** keep the orchestrator's context flat no matter how many stages run.\n- **Measured, not assumed.** `devcrew tokens` reports actual spend by agent and by tool from the session meter.\n\nThree skills do the work directly:\n\n| Skill | Cuts |\n|---|---|\n| `/scout <question>` | Exploration — searches in a subagent, returns a 6-line answer instead of twelve files. The single biggest win. |\n| `/compact-docs` | Standing cost — shrinks `CLAUDE.md` and friends, converts repeated rules into hooks, so every future turn is cheaper |\n| `/token-report` | Diagnosis — names the dominant waste pattern and one concrete fix |\n\nPlus `.devcrew/project-facts.json`, written once at install: agents read the stack from there rather than rediscovering it every session.\n\nLayered with **caveman** (output) and **rtk** (tool results), each attacks a different part of the bill.\n\n---\n\n## Works in your editor\n\n| Tool | Support | Reads |\n|---|---|---|\n| **Claude Code** | full — agents, skills, hooks, plugin | `CLAUDE.md`, `.claude/` |\n| **Cursor** | full — rules, docs, CLI gates | `AGENTS.md`, `.cursor/rules/` |\n| **Antigravity** | full — docs, CLI gates | `AGENTS.md`, `.agent/` |\n| **GitHub Copilot** | instructions + CLI gates | `.github/copilot-instructions.md` |\n| **Codex / Aider / Cline / Windsurf** | instructions + CLI gates | `AGENTS.md` |\n| **Any other agent** | CLI + git hooks always apply | `AGENTS.md` |\n\n`AGENTS.md` and `CLAUDE.md` carry the same rules. Regenerate every target from one source:\n\n```bash\ndevcrew sync all\n```\n\nSubagent orchestration needs an agent runtime that supports it (Claude Code today). Everywhere else you get the standards, the pipeline, the trackers, and every gate — the CLI and git hooks are editor-independent by design.\n\n---\n\n## CLI reference\n\n```\nSETUP\n  devcrew init [dir]      Scaffold a new project\n  devcrew add  [dir]      Add to an existing project — never overwrites your files\n  devcrew doctor          Check prerequisites and installation health\n  devcrew uninstall       Remove kit files, leave your source alone\n\nOPERATE\n  devcrew mode [name]     Show or switch delivery mode\n  devcrew agents          List agents active in the current mode\n  devcrew verify          The full gate. Required before push.\n  devcrew tokens          Token consumption report\n  devcrew sync <target>   Regenerate config for claude | cursor | antigravity | all\n\nOPTIONS\n  --mode <name>   --stack <name>   --no-git   --force   -h   -v\n```\n\n---\n\n## What gets installed\n\n```\nyour-project/\n├── CLAUDE.md                  # agent instructions (Claude Code)\n├── AGENTS.md                  # same rules, portable\n├── Project-Context.md         # what this is + which standards bind it\n├── Project-Plan.md            # roadmap, OKRs, sprints, risks\n├── Project-Management.md      # agents, gates, hooks, budgets, live state\n├── Design.md                  # design tokens + UI rules → Tailwind config\n├── System-Design.md           # capacity, data, consistency, failure, scaling, cost\n├── User-Story-Testing.md      # story → acceptance criteria → tests\n├── Changelog.md               # append-only; doubles as SOC 2 change evidence\n├── trackers/                  # one Kanban board per department\n├── docs/{adr,prd,design,compliance}/\n├── templates/                 # PRD, ADR, tech design, threat model, DPIA, runbook…\n├── scripts/                   # token report and helpers\n├── .claude/{agents,skills,hooks,settings.json}\n├── .cursor/rules/             # Cursor\n├── .agent/                    # Antigravity\n├── .devcrew/                  # mode, verification stamp, project facts, local CLI\n├── Makefile                   # setup, lint, test, e2e, sec, ci\n├── .github/workflows/ci.yml   # fail-fast pipeline with SBOM\n└── .pre-commit-config.yaml    # gitleaks, ruff, large-file and private-key checks\n```\n\n<details>\n<summary>Layout of this repository (for contributors)</summary>\n\n```\n.claude/\n├── agents/        15 agent definitions — the canonical source\n├── skills/        slash commands\n├── hooks/         gate scripts + hooks.json for plugin installs\n└── settings.json  the repo runs its own gates on itself\n.claude-plugin/    plugin + marketplace manifests, pointing at .claude/\ntemplate/          the payload copied into target projects\nmodes/modes.json   mode definitions\nbin/devcrew       the CLI\ntests/cli.test.sh  137 assertions across the CLI, hooks, git hooks, plugin schema, and design tooling\n```\n\nAgents and skills live in `.claude/` so that opening this repository in Claude Code gives you the full team immediately — no setup step, and one source of truth for both the plugin and the CLI.\n</details>\n\n---\n\n## The design system\n\n`Design.md` follows the [DESIGN.md format from Google Labs](https://github.com/google-labs-code/design.md): YAML front matter holds machine-readable tokens, the prose below holds the rationale. Agents read both — the tokens so they produce exact values, the prose so they know when a value applies.\n\ndevcrew ships a filled-in system rather than an empty schema: a modern-SaaS palette in **light and dark as equal first-class themes**, an 8-step type scale, 4px spacing grid, 5 elevation levels, and component specs for buttons, inputs, cards, dialogs, toasts, badges, and tables — all at WCAG 2.2 AA.\n\nThe important part is that it is **verified, not asserted**:\n\n```bash\nmake design          # lint, then export tokens.css + tailwind.tokens.json\nmake design-check    # lint only — runs in CI on every push\n```\n\nUnder the hood that is Google's linter, no install needed:\n\n```bash\nnpx -y @google/design.md lint Design.md\nnpx -y @google/design.md export --format css-tailwind Design.md\nnpx -y @google/design.md diff Design.md Design-v2.md\n```\n\nIt checks broken token references, **contrast ratios**, orphaned tokens, unknown keys, missing typography, and canonical section order. A contrast failure fails the build, so \"we'll fix accessibility later\" never becomes a decision anyone gets to make.\n\nThe shipped `Design.md` passes: **0 errors, 0 contrast findings.** Six `orphaned-tokens` warnings remain and are explained in the file — `border`, `borderStrong`, and `focus` (plus dark variants) exist as values but the spec's component sub-tokens (`backgroundColor`, `textColor`, `typography`, `rounded`, `padding`, `size`, `height`, `width`) have no border or outline slot, so nothing can reference them. Running the linter is what found that, and an earlier draft that *looked* conformant but wasn't.\n\nThe Tailwind theme is generated from the front matter. `frontend-engineer` is forbidden from transcribing a token value into a component or hand-editing generated files — need a value that doesn't exist, add the token and regenerate. That one rule is why a devcrew UI stays consistent after twenty features.\n\nTo use your own brand: edit the `colors` block, run `make design`, fix whatever the contrast rule flags. Nothing else needs to change.\n\n## Documentation\n\n| Document | Read it for |\n|---|---|\n| **[Guide.md](Guide.md)** | The complete manual — every command, agent, gate, mode, customization, CI integration, and troubleshooting |\n| **[Example.md](Example.md)** | One user story walked through all 15 stages, with the real artifacts and the six defects the process caught |\n| **[User-Story-Testing.md](template/User-Story-Testing.md)** | How a story becomes executable tests: Given/When/Then criteria, level assignment, traceability, anti-patterns |\n| **[QUICKSTART.md](QUICKSTART.md)** | Ten minutes from nothing to a shipped feature |\n| **[template/System-Design.md](template/System-Design.md)** | System design end to end — capacity, data, consistency, failure, scaling, cost, and a complete **zero-cost stack** |\n| [CONTRIBUTING.md](CONTRIBUTING.md) · [SECURITY.md](SECURITY.md) | Working on the kit itself |\n\nNew here? Start with [QUICKSTART.md](QUICKSTART.md), then read [Example.md](Example.md) — it is faster than the Guide and shows what the process is actually for.\n\n---\n\n## FAQ\n\n<details>\n<summary><b>Is this only for Claude Code?</b></summary>\n\nNo. Subagent orchestration currently needs Claude Code, but the standards, pipeline, trackers, CLI, and git hooks work with any agent or none at all. Cursor and Antigravity read `AGENTS.md` and get everything except automatic agent handoffs.\n</details>\n\n<details>\n<summary><b>Will 15 agents burn my budget?</b></summary>\n\nThat's what modes are for. `core` (7 agents) is the default; `lite` runs 4. Budgets are enforced by hooks, handoff blocks keep the orchestrator's context flat, and `devcrew tokens` shows exactly where spend went. With caveman and rtk installed, a `core` feature typically costs less than an unstructured session that re-reads the same files.\n</details>\n\n<details>\n<summary><b>Do I have to use all four compliance regimes?</b></summary>\n\nNo. `/project-init` asks which data classes you handle and activates only what applies — PII activates GDPR, PHI activates HIPAA, cardholder data activates PCI DSS, SOC 2 is always on. The scope-down is recorded as ADR-001. Carrying regimes you don't need costs tokens every session.\n</details>\n\n<details>\n<summary><b>Can I add it to a large existing codebase?</b></summary>\n\nYes — `devcrew add .` is non-destructive and skips every file you already have. Start in `lite` or `core` and scale up when the project earns it.\n</details>\n\n<details>\n<summary><b>Why block AI attribution?</b></summary>\n\nAccountability. A commit author is who you ask when something breaks in production. Attribution trailers also leak tooling choices into public history and confuse `git blame`. If you want the opposite, delete the check in `template/githooks/commit-msg` — but decide it deliberately.\n</details>\n\n<details>\n<summary><b>How do I customize the standards?</b></summary>\n\nThey're markdown. Edit `Project-Context.md` for standards, `Design.md` for tokens, agent files in `.claude/agents/`, gates in `.claude/hooks/`. Nothing is compiled or hidden.\n</details>\n\n---\n\n## Contributing\n\nIssues and pull requests welcome. See [CONTRIBUTING.md](CONTRIBUTING.md). The kit follows its own rules: `devcrew verify` before every push, no AI attribution, conventional commits.\n\n## Security\n\nReport vulnerabilities per [SECURITY.md](SECURITY.md). Do not open a public issue for an unpatched vulnerability.\n\n## License\n\n[MIT](LICENSE). Use it commercially, fork it, ship it.\n\n## Credits\n\nBuilt to compose with [caveman](https://github.com/JuliusBrussee/caveman) by Julius Brussee and [rtk](https://github.com/rtk-ai/rtk) by the rtk-ai team. Standards from OWASP, NIST, IEEE, ISO, and the C4 model.\n"}