docs-framework

Devflow

A meta-harness for Claude Code. Claude Code gives you one brilliant engineer. Devflow installs the engineering organization around it: an orchestrator that delegates, a roster of specialized agents, a review culture, institutional memory, and a delivery pipeline. Built for developers turning agentic development into a team that ships.

The problem with AI-assisted development

Claude Code is powerful. But a single agent is not a team. Every session starts from scratch, context evaporates between conversations, reviews are single-pass and shallow, and quality depends on what you remember to ask for. What's missing is exactly what makes an engineering team ship: memory, standards, review culture, and a delivery process.

Devflow fixes this. Install once, forget about it.

See it work

One feature, four commands, bird's-eye view — each command is an agent pipeline, not a prompt:

you: /plan add rate limiting to the /api/upload endpoint

  Skim · Explore         orient in the codebase — relevant modules, existing middleware patterns
  Design                 gap analysis: completeness, security, performance
  Plan · Synthesize      PR-ready plan document → .devflow/docs/design/
  Git                    traceable issue #42 opened

you: /implement (hand it the plan)

  Git                    branch feat/42-rate-limit-upload
  Code                   implements the plan — your learned decisions, pitfalls, and feature knowledge preloaded
  Validate               build ✓ typecheck ✓ lint ✓ tests ✓
  Simplify · Scrutinize  cleanup pass, then 9-pillar quality gate
  Evaluate               implementation matches the original request ✓
  Test                   5/5 QA scenarios pass → PR opened

you: /code-review

  Review ×12             security, architecture, performance, complexity, … (up to 20, in parallel)
  Synthesize             18 findings ranked by severity + confidence → review-summary.md

you: /resolve

  Triage                 every finding validated against a blast-radius matrix — 11 fix-now, 3 by design, 4 false positives
  Code ×11               each real issue fixed
  Validate · Git         verification gate ✓ → pushed to the PR

This is the orchestrated flow — you stay in the loop between every step. With ambient mode on you don't even need the commands: describe the task and the orchestrator routes it through the same pipelines.

What you get

Ambient orchestration. Your main session becomes the tech lead: a charter injected at session start turns it into a pure orchestrator that delegates work to specialized agents and keeps only judgment mainline. Plan-mode handoffs auto-run /implement. Init and forget.

A staffed agent roster. 17 specialized agents with explicit model assignments — Opus for analysis, Sonnet for execution, Haiku for I/O. Reassign any agent's model with devflow agents, including GPT models through external model routing (devflow proxy).

Up to 20 parallel Review agents. Security, architecture, performance, complexity, consistency, regression, testing, and more. Each produces findings with severity, confidence scoring, and concrete fixes. Conditional Review agents activate when relevant (TypeScript for .ts files, database for schema changes, compliance when regulated surface detected in the diff). Every finding gets validated and resolved automatically.

Memory that persists. Session context survives restarts, /clear, and context compaction. Your agent picks up exactly where it left off.

Self learning. A background agent detects architectural decisions and known pitfalls from your session dialogs and writes them to .devflow/learning/decisions.md and .devflow/learning/pitfalls.md — informing every future review and implementation session without any manual bookkeeping.

Feature knowledge bases. Curated KNOWLEDGE.md files per feature area — patterns, conventions, and gotchas — git-tracked and shared with your team. Planning, implementation, and review workflows load them automatically and refresh them after changes.

Always-on rules. 13 ultra-condensed engineering principles (~10 lines each) load on every prompt — security, quality, and language-specific guidance (TypeScript, React, Go, Python, Java, Rust), plus a compliance rule when compliance is enabled. Rules install from your selected plugins only, so a Go project won't get React rules. Override any rule via ~/.devflow/rules/{name}.md or devflow rules shadow <name>.

41 skills (40 plugin-owned + 1 feature-owned compliance skill, installed on every machine). Skills install for the plugins you selected plus whatever those plugins declare they use, so the default plugin set installs 32 of the 40 and a Go project never gets the React skill. Most are grounded in expert material — backed by peer-reviewed papers, canonical books, and industry standards: security (OWASP, Shostack), architecture (Parnas, Evans, Fowler), performance (Brendan Gregg), testing (Beck, Meszaros), design (Wlaschin, Hickey), compliance (GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, SOX, NIST SSDF, OWASP ASVS), 200+ sources total.

Skill shadowing. Override any built-in skill with your own version. Drop a file into ~/.devflow/skills/{name}/ and the installer uses yours instead of the default — same activation, your rules. A shadow for a skill outside your plugin selection stays where it is: not installed, never deleted, and live again the moment you select that plugin.

Compliance built in. Six regulatory frameworks — GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, SOX. Every install carries the review skill with all six framework references; devflow compliance --enable adds an always-on rule for exactly the frameworks you select. A repository can declare its own frameworks in .devflow/project.json ("compliance":["hipaa"]), and the compliance review then runs there on any machine — with your machine's frameworks plus the repository's, loading only those references — without ever touching your rule. Compliance reviews activate automatically when a diff touches regulated surface. Enabling it on your machine also makes required the floor of your team's evidence policy on your machine: tracker-linked PRs, checked test plans, traced releases and a non-author approval before a PR reads merge-ready.

Your issue tracker, not just GitHub. Pick the tracker your team actually uses — GitHub, Jira, or Linear — at devflow init, with devflow init --tracker <id>, or later with devflow tracker --set <id>; that sets your machine's default. A repository can select its own in .devflow/project.json, and devflow follows it there automatically — one machine can work on a Jira repository and a GitHub one side by side. Every install carries every provider's mechanics (47 generated reference files, the tool-call contract among them) and the background agent, because pull requests stay on GitHub whatever your tracker and any repository may pick any provider. On a non-GitHub tracker that agent learns your conventions once per provider (project key, issue types, required fields, workflow transitions, how a reference renders) and writes them to ~/.devflow/tracker/{provider}.md, so traceability speaks your tracker's vocabulary instead of assuming #123. Each provider's conventions are learned from the first repository that uses it. Those fi