DIA — Elite SDLC Pipeline
A multi-agent software development lifecycle pipeline for Claude Code, packaged as a VS Code
extension. It installs 15 role agents and a 225-skill store into any workspace, backed by
enforcement hooks that block rather than warn.
It also exports entry files for GitHub Copilot, OpenAI Codex, Cursor and Windsurf, so the same
pipeline works outside Claude Code from a single source of truth.
Why this exists
Most SDLC guidance is advisory: a document says "parameterize your queries" and nothing stops you
shipping a concatenated one. This pipeline makes the discipline mechanical. Five hooks refuse the
work when a gate is unmet, and the reviewer agent cannot approve a feature without live evidence
that its endpoints actually respond.
Install
Download the .vsix from Releases and install it:
code --install-extension dia-<version>.vsix
Works identically in Cursor and Windsurf, or use Extensions → ... → Install from VSIX….
No account, token, or network access is required to install.
Then open a project and run DIA: Install pipeline into workspace from the command palette.
What gets installed
.claude/
agents/ 15 role agents
skills/ 225 specialized skills
hooks/ 5 enforcement hooks (these block)
scripts/ sonar-scan, derive-memory, export-assistants
checks/ contract-check
settings.json
.sdlc/ project state and templates
The agents
| Stage |
Agents |
| Lifecycle |
00-product · 01-analyst · 02-architect · 03-designer |
| Build |
10-backend · 11-frontend · 12-mobile · 13-database · 14-integration |
| Quality & release |
20-tester · 21-security · 22-reviewer · 23-sre · 24-devops · 25-ai-engineer |
Each carries deep inline technical judgment — 10-backend covers .NET, NestJS and Python across six
slice types; 11-frontend covers Angular 22 and React 19; 12-mobile covers iOS, Android, Flutter
and React Native. Depth lives in the agents and the store, not in a wiki nobody opens.
The enforcement hooks
| Hook |
Blocks |
quality-gate.mjs |
hardcoded secrets, unparameterized SQL, lint errors, failing quality gate |
impact-manifest.mjs / impact-gate.mjs |
changes with no recorded blast-radius analysis |
postmortem-gate.mjs |
closing an incident without owned follow-ups |
triage-reminder.mjs |
defects left unfiled |
checks/contract-check.mjs |
a dispatch with no handler; contract drift between layers |
Commands
All commands are namespaced DIA: in the palette.
| Command |
Does |
| Install pipeline into workspace |
copies agents, skills, hooks; merges settings.json without clobbering yours |
| Verify installation |
checks every component is present and runs the SonarQube stack plan |
| Update all pipeline files |
refreshes pipeline files to the extension's version |
| Export for other AI assistants |
generates Copilot / Codex / Cursor / Windsurf entry files |
| Start local SonarQube container |
brings up a local Sonar instance |
| Open Terminal |
branded terminal with the workspace hint |
Use it from the terminal
The repository also ships a CLI that does the same work without VS Code:
node cli/bin/dia-sdlc.mjs install # into the current project
node cli/bin/dia-sdlc.mjs verify
node cli/bin/dia-sdlc.mjs store # browse or search all 225 skills
node cli/bin/dia-sdlc.mjs suggest "add login with refresh tokens"
Develop
node gen-catalog.mjs # regenerate catalog.json after changing agents or skills
node test.mjs # 13 tests covering install, merge safety, verify, catalog integrity
node preflight.mjs # release gate: tests, manifest, secret scan, lockfile/feed guard
./release.sh --patch # bump, verify, package a .vsix
preflight.mjs refuses to release if a lockfile, registry config, or private-feed URL would be
packaged, so an install can never be made to authenticate against a private registry.
Documentation
A note on currency
Every research-derived section in the agents is dated. Framework versions, platform requirements,
and regulatory deadlines move; a confidently stated stale fact is worse than none. Re-verify before
relying on a version claim.
License
MIT — see LICENSE.
