Agentic delivery · Claude Code · zero dependencies
DevFlow plans your request into tickets, builds them with parallel specialist agents, runs QA, security, design and code review, debugs until clean — and hands you a branch. 14 agents, 24 skills, installed in one line.
❯ git clone https://github.com/ljojua1998/skills.git; cd skills; powershell -ExecutionPolicy Bypass -File .\install.ps1 -Global
Windows one-liner · macOS / Linux version below · MIT licensed
▲ what one /ship run does — the terminal and the board are the same state
The flow
The pipeline is state-on-disk: markdown tickets with statuses, an append-only run ledger, one git commit per finished ticket. Kill the session anytime — /ship resume continues exactly where it stopped.
Vague idea? A short interview turns it into a mini-PRD before a single ticket exists.
The planner reads your codebase and writes Jira-like tickets with acceptance criteria and file ownership.
Specialist agents build tickets in parallel. A stop-gate hook re-runs typecheck, lint and tests — red means the agent can't finish.
QA executes the criteria; security, code and screenshot-based design review run alongside; a test-engineer grows the regression net.
A skeptic agent refutes false positives first; the debugger root-causes what's real and re-verifies until clean.
Docs updated, retro lessons saved, branch ready — it offers a PR and never pushes without your yes.
The crew
Builders write, reviewers judge, the skeptic filters, the debugger fixes. Every agent is preloaded with craft standards you can edit — encode your team's rules once, every agent follows them.
Plans
Builds
Verifies
Guards
Stacks it knows
Each stack has a dedicated craft skill — authoritative, framework-specific rules the developer agents load automatically from the ticket's stack (React ≠ Angular ≠ FastAPI). Existing projects are auto-detected; greenfield picks and you confirm.
Don't see yours? The agents still build it from backend-craft/frontend-craft plus the framework's own idioms — and adding a new stack is one *-craft/SKILL.md file. Burp Suite isn't listed because it can't be driven headlessly; ZAP + nuclei cover the same DAST ground.
Commands
One orchestrator command with modes, plus standalone passes when you need just one thing.
❯ /ship "build X"The full pipeline — asks at launch: capped run or loop-until-done❯ /ship --review "…"The plan waits for your approval before any code is written❯ /ship --loop "…"Cycles until the Definition of Done is met — progress guards, no fake "done"❯ /ship --quick / --full / --budgetScale the pipeline and the cost to the task❯ /ship resumeA new session continues exactly where the board says it stopped❯ /boardLive Jira-style status: epics, tickets, findings, blockers❯ /qa · /security-audit · /testsStandalone passes: functional review, OWASP audit, coverage & flaky hunting❯ /debug-findingsRoot-cause and fix whatever the reviews found❯ /patrolReport-only health sweep — safe to run on a schedule❯ /retro · /devflow-updateDistill lessons into steering docs · pull the latest DevFlowHard guarantees
The difference between "the AI usually tests things" and a system where skipping the test is structurally impossible.
A hook re-runs typecheck, lint and tests every time a builder tries to finish. Red checks bounce the agent back with the failure — "done with failing tests" cannot happen.
Every CRITICAL/HIGH finding faces a skeptic agent that tries to refute it against the real code. Only confirmed issues cost a debug cycle.
Destructive migrations, auth/payment code, mass deletions and major upgrades pause even loop mode and ask you first — with the decision logged in the run ledger.
Every run leaves an append-only trace. /ship resume reconciles tickets against git history before continuing — a died agent can't leave a ghost ticket.
Agents keep project memory and steering docs; /retro distills every epic's lessons. The fifth run knows things the first one had to discover.
Each epic on its own branch, one ticket = one conventional commit, every stage revertable. Merging and pushing stay in your hands.
Proof
A real end-to-end run: build a small Express notes API from one line. Fifteen tests passed. QA passed clean. Then the adversarial layers went to work — and found what green tests hid.
Fifteen passing tests and a clean QA pass would have shipped that info-disclosure bug. The adversarial security → verify → debug layers are the difference — they catch what a single pass, however good, doesn't.
Get started
git clone https://github.com/ljojua1998/skills.git; cd skills; powershell -ExecutionPolicy Bypass -File .\install.ps1 -Globalgit clone https://github.com/ljojua1998/skills.git && cd skills && ./install.sh --globalGlobal install covers every project on the machine. Per-project: .\install.ps1 -Target "path" — commit .claude/ and your whole team has the same pipeline.
cd your-project && claudeWorks on an existing codebase (it studies your conventions first) or an empty folder (it scaffolds the whole project).
/ship --review "Build a task manager with auth and a kanban board"Watch the board fill, answer the escalations that matter, merge the branch when it's verified. That's the job now.