Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add MostAshraf/ai-sdlc-harness/plugin install ai-sdlc-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/mostashraf/ai-sdlc-harness/groom)<a href="https://agentmods.dev/commands/mostashraf/ai-sdlc-harness/groom"><img src="https://agentmods.dev/badge/commands/mostashraf/ai-sdlc-harness/groom.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00954 |
| Opus 5 | $0.00000 | $0.00477 |
| Sonnet 5 | $0.00000 | $0.00191 |
| Haiku 4.5 | $0.00000 | $0.00095 |
Grade A, and why
groom scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 63 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/story-workflow groom
Technical enrichment pass. Analyzes the relevant repos to identify affected components, migration concerns, testing strategy, and risks, and produces per-repo technical notes. This is where Claude Code's native codebase awareness is the main tool.
Steps
- Fetch the work item per
shared/provider-io.md. If it has no clear ACs yet, offer to runimprovefirst — grooming is more effective on a refined story — but proceed if the user wants to. - Identify relevant repos. Read the repo landscape per
shared/context.md(repos.yaml+ eachrepo-map/<name>/). From the story, propose which repos are affected, each with a one-line reason, and wait for the user to confirm before scanning anything. Don't scan repos they didn't approve. - Refresh remote knowledge, then check position (never mutate the tree).
For each confirmed repo, using its path from
repos.yaml:git -C "<path>" fetch origin— allowed, and updates remote refs without touching the working tree. If it fails (no network/remote), report and skip that repo — don't scan a repo you couldn't refresh.git -C "<path>" rev-list HEAD..origin/<default-branch> --count— a read; how far behind the checkout is.- The harness blocks raw
git pull/mergeinside any workspace that has completed/init-workspace(owned-entry-point rule; this skill only ever runs inside one), so this command never updates the working tree on its own. If a repo is behind, say so and offer two choices: (a) analyze the current checkout as-is — and stamp the staleness into the notes so the reader knows the analysis reflects commit<short-sha>, N commits behindorigin/<default>; or (b) on the user's explicit say-so, run${CLAUDE_PLUGIN_ROOT}/bin/harness update-base --repo "<path>"— the owned fetch + fast-forward-only verb — and re-scan. It moves the base ref without switching the checkout, and refuses rather than guessing when the base has diverged, is checked out and dirty, or the remote won't answer; surface any refusal and let the user resolve it. Never switch branches or discard changes to "help".
- Analyze each confirmed, fetched repo against the story. Use
Grepfor content,Globfor file patterns,Readfor inspection — notBashfor searches. Look for: affected files/classes/methods; database & migration impact; API surface (controllers, routes, DTOs); configuration & DI; existing test coverage for the touched areas; and cross-service dependencies. Align with the team's real patterns from the repo-map (repository pattern, MediatR, etc.). Be concrete — name the file and method, e.g. "AuthService.csValidateToken(~line 45) is what this story changes; tests live inAuthServiceTests.cs", not "the auth module might be affected." - Produce technical notes in
templates/technical-notes.md— a section per repo, plus Cross-Repo Considerations when more than one repo is involved. - Present the notes and ask whether to post them as a comment. Iterate on
the user's input (they know planned refactors and constraints the code
doesn't show), then post per
shared/provider-io.md. Forlocal-markdown, notes are a comment by default; do not overwrite the story — if the user wants them persisted separately, offer a sibling<id>-technical-notes.md.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 63 lines · 0 tokens per session scan A 5ad813628fad
groom is a command published in the GitHub repository MostAshraf/ai-sdlc-harness (18 stars, last pushed 11d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 954 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
insert-phase
Insert urgent work as decimal phase (e.g., 72.1) between existing phases.
remove-phase
Remove a future phase from roadmap and renumber subsequent phases.
add-todo
Capture idea or task as todo from current conversation context.
audit-milestone
Audit milestone completion against original intent before archiving.
new-milestone
Start a new milestone cycle — update PROJECT.md and route to requirements.
backlog
Manage backlog items — ideas not ready for active planning. Add, review, promote, or remove.