dev-cycle

A full implementation workflow that takes the highest-priority action from a project queue through testing, coding, verification, and pull-request creation. A pull request is a proposed code change prepared for review before merging.

In plain words
What is it for?
Selecting the highest-priority queued implementation task, working on a dedicated branch, running tests and verification, and creating a draft pull request.
Why use it?
It gives implementation work a repeatable path and keeps human review in the merge process, while adding checks for safety, tests, and project complexity.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/mataeil/ooda-loop/dev-cycle
Any agent
npx skills add mataeil/OODA-loop --skill dev-cycle
Clone the repo
git clone --depth 1 https://github.com/mataeil/OODA-loop

Made for: Claude Code, Codex.

Per session 46 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 5,300 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00046 $0.05300
Opus 5 $0.00023 $0.02650
Sonnet 5 $0.00009 $0.01060
Haiku 4.5 $0.00005 $0.00530

Measured 2d ago against content hash 1f3db346616f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

dev-cycle scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

2. **Fetch the concrete block.** WebFetch / curl the *specific* reference snippet
skills/dev-cycle/SKILL.md · 527 lines

How it starts

The opening of the file, as written. The whole thing — 527 lines — stays where its author put it; the contents beside it link to each section on GitHub.

dev-cycle: Full Implementation Cycle Pipeline

The "builder" of the harness. Takes the highest-priority action from the action queue, implements it in a dedicated branch, verifies it passes tests, and creates a Draft PR for human review.

dev-cycle is the primary skill for the implementation domain. When evolve's Orient step selects implementation as the winning domain, it calls dev-cycle. All changes go through branch + PR — dev-cycle never commits directly to main.

  • Creates Draft PRs by default — human review is mandatory for implementation
  • Creates a ready (non-draft) PR ONLY when the change is auto-merge-eligible (see "Auto-merge eligibility" below) AND the operator has opted in via config.safety.enable_auto_merge. Default behavior is Draft / human merge.
  • NEVER uses git add -A — only explicit file staging to prevent secret leaks
  • evolve (4-C) is the final merge authority — it re-checks every gate before any auto-merge; dev-cycle only chooses draft vs ready.

Safety Rules

  1. HALT file — Mandatory first check. If present, print reason and stop.
  2. Level gate — Requires progressive_complexity >= 3 or direct user invocation. Below Level 3, exit cleanly.
  3. PR size limits — Respect config.safety.max_files_per_pr and config.safety.max_lines_per_pr. Exceeding either triggers a partial PR.
  4. Protected paths — Any change touching config.safety.protected_paths forces Risk Tier 3 (already enforced — Draft only).
  5. Explicit staginggit add {file} per file. git add -A is forbidden.
  6. Test retry cap — Maximum 3 fix attempts after a test failure. Beyond that, mark action as "blocked" and exit.

Step 0: Safety

0-A: HALT Check

if file exists at config.safety.halt_file:
  Print "[HALT] dev-cycle stopped. Reason: {file_content}"
  Print "Remove to resume: rm {config.safety.halt_file}"
  EXIT immediately.

0-B: Level Gate

Read config.json → progressive_complexity.current_level  (authoritative source)
Also check config.json → implementation.enabled
if implementation.enabled == false AND not manually invoked by user:
  Print "Implementation domain is disabled. Enable it: set implementation.enabled=true in config.json (done automatically by /ooda-config level 3)"
  EXIT cleanly (not an error).
if progressive_complexity.current_level < 3 AND not manually invoked by user:
  Print "Implementation requires Level 3. Current: {current_level}"
  EXIT cleanly (not an error).

Read the full file on GitHub · 527 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 527 lines · 46 tokens per session scan A 1f3db346616f

Subscribe to this mod's changes

dev-cycle is a skill published in the GitHub repository mataeil/OODA-loop (5 stars, last pushed 2mo ago), licensed MIT. It adds 46 tokens to every session and 5,300 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

security-ownership-map

Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for…

HKUDS/DeepCode · 99 tokens

integrity-forensics

Run the Anti-Autoresearch integrity-forensics sweep (span-anchored evidence ledger → GPT auditors propose findings → a rules-only reporter that lists every proposal with what the auditor said about it) against a paper via a SHA-pinned thin launcher — then convert the verdict into a typed policy gate…

wanshuiyin/Auto-claude-code-research-in-sleep · 162 tokens

patent-novelty-check

Assess patent novelty and non-obviousness against prior art. Use when user says "专利查新", "patent novelty", "可专利性评估", "patentability check", or wants to evaluate if an invention is patentable.

wanshuiyin/Auto-claude-code-research-in-sleep · 59 tokens

flow-next-tracker-sync

Project a flow-next spec to a tracker issue (Linear, GitHub, GitLab, Jira) and reconcile two-way. Use when asked to sync to a tracker. NOT plan-sync.

gmickel/flow-next · 44 tokens

flow-next-export-context

Export RepoPrompt context to a markdown file for review with an external LLM (ChatGPT, Claude web, etc.). Use when you want Carmack-level review but prefer an external model. Triggers on "export context", "export for external review", "export plan for ChatGPT", "export impl review context", "review with an external…

gmickel/flow-next · 81 tokens

moai-ref-ui-polish

UI polish and interface-completion reference: the small visual details — concentric border radius, optical alignment, shadow-vs-border, motion easing, typography smoothing, tabular numbers, icon stroke weight, hit areas — that separate polished interfaces from generic ones. Agent-extending skill that amplifies…

modu-ai/moai-adk · 98 tokens