The scenario can fail
Gherkin keywords are case-sensitive, so GIVEN is prose and
the scenario runs zero steps — and passes. The gate refuses a scenario
Cucumber would see as empty.
Zero runtime dependencies Any agent CLI MIT
Requirements, Gherkin scenarios and a traceability matrix that your CI enforces — plus a harness that drives any coding agent through them, one requirement at a time, in its own git worktree. It never merges.
npx create-spec-driven-app@latest init
Get started Read the docs Worked example →
Most teams already write requirements. They live in a wiki, drift from the code within a sprint, and nothing fails when they disagree. Point a coding agent at that and you have automated the drift.
This tool makes the specification a thing that can be wrong:
every requirement has a scenario, every scenario has a file, and
csda validate fails when the link is broken. Then — and only
then — an agent is worth pointing at it.
Four commands. The same four whether a person or an agent is driving.
csda initScaffold a project: spec, scenarios, traceability matrix, and the execution contract an agent reads before it writes a line.
csda planWhat still needs a test, an implementation or a status change — ordered by dependency, with a fix on every blocker.
csda harness runHand one requirement to an agent in its own worktree, gate the result, and stop if the gate says no.
csda validateThe gate itself: structure, traceability, Gherkin that Cucumber can actually run, and TDD order. This is what CI runs.
No agent runtime, no SDK dependency. The agent is any shell command
containing {prompt_file} — the harness writes the prompt,
substitutes the path, and reads the exit code plus the gate result.
csda harness run --agent "claude -p < {prompt_file}"
csda harness run --agent "aider --yes --message-file {prompt_file}"
csda harness run --agent "./my-wrapper.sh {prompt_file}" # anything else
Commit the commands your team uses in .harness/profiles.yaml
and pick one by name — or let a profile select itself per requirement, so
an infrastructure task and a domain task get different tools and different
allowances in the same run.
Wired from one definition:
claudecursorcopilotwindsurfaidergeminiclinecodexantigravity
Choosing your agent → How the harness works → Wiring agent tools →
Every item here exists because the loop was caught approving work it had not checked. They are not features; they are scars.
Gherkin keywords are case-sensitive, so GIVEN is prose and
the scenario runs zero steps — and passes. The gate refuses a scenario
Cucumber would see as empty.
A filter that matches nothing exits 0. When the runner is Cucumber, the gate reads its message protocol instead of its exit code.
An agent that cannot pass a scenario can relax the scenario. Touching
spec.md, features/** or the rules fails the
attempt, with the diff fed back.
The matrix names a test and a production artifact. A green diff that
never goes near them is reported, and fails under
--strict-artifacts.
No feature file, unmet dependencies, or a status of
Needs Clarification — checked before an agent is paid for,
not after.
--budget-seconds and --max-requirements. Running
out is not an error: the run stops cleanly and still reports what it
did.
No. Patterns are optional; principles are not (ADR-0022). Pick an architecture profile and you get only the vocabulary it declares — a static site is not handed six documents describing aggregates it does not have.
Yes — csda adopt installs the specification layer without
touching your code. Checks that a legacy repository cannot pass yet are
flags, and csda doctor reports them as advisories with a
fix, so adoption is a door rather than a wall.
None in particular, and none at all if you do not want one. Every command works by hand. The harness takes any shell command; there is no SDK and no vendor lock.
Never. It produces a branch per requirement and stops. Merging is a judgement, and a tool that merges its own work removes the only place a person was still reviewing it.
Whatever your agent costs — the harness measures wall-clock, because an agent is any shell command and only the agent knows its token spend. A profile may declare a cost hint, and the report multiplies it out and says it is declared rather than measured.
Mostly in what happens after the specification is written. See the comparison, which is honest about where the others are the better choice.
npx create-spec-driven-app@latest init
cd my-spec-driven-app
csda validate .