post-1.0: build and release copilot-sdlc-harness for GitHub Copilot

[BaseInfinity]

Goal

Build, prove, and release a GitHub Copilot-native sibling named
copilot-sdlc-harness, using the Codex SDLC Wizard as the known-good behavioral
baseline without blindly copying Codex-specific machinery.

This is the contingent implementation follow-up to #97. Complete the host
capability decision and a disposable proof before creating or publishing the
separate repository. If #97 shows that trustworthy parity is not viable, close
this issue with that evidence instead of shipping an advisory workflow as an
enforced harness.

Hard sequencing gate

Do not prototype, implement, create the product repository, import an adapter,
or run harness E2E until codex-sdlc-wizard 1.0.0 has been released and its
exact public artifact has passed the release verification gate.

Before that release, preparation is limited to account/tool readiness,
official-source research, a frozen known-good Codex behavior inventory,
conformance-test design, and synthetic fixture planning. An unmodified GitHub
Copilot account/product smoke is allowed, but it is not harness proof.

Consumption surfaces to preserve in the design

Preparation research found that the product should be layered rather than
treated as one copied skill:

• Canonical experience: Copilot CLI must expose the complete harness,
  including setup/update/check/uninstall, lifecycle workflow, enforcement,
  diagnostics, failure, and resume behavior. It is not a reduced compatibility
  surface.
• Primary package: a Copilot plugin bundling skills, custom agents, hooks,
  and optional MCP/LSP configuration.
• Required repository overlay: AGENTS.md, Copilot instructions, project
  skills, custom agents, repository hooks, Copilot settings, and ordinary
  git/test/CI enforcement.
• Primary hosts to prove independently: Copilot CLI, GitHub Copilot app, and
  Copilot cloud agent.
• Secondary hosts: VS Code, Visual Studio, JetBrains, and Copilot code
  review, with their preview or missing hook support stated honestly.
• Later automation/embedding: GitHub Agentic Workflows and the Copilot SDK.
• Non-foundations: Copilot Memory, Spaces, prompt files, mobile/remote
  control, experimental CLI extensions, and third-party/partner agents.

Official references:

• https://docs.github.com/en/copilot/reference/customization-cheat-sheet
• https://docs.github.com/en/copilot/concepts/agents/about-plugins
• https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-plugin-reference
• https://docs.github.com/en/copilot/how-tos/copilot-cli/set-up-copilot-cli/install-copilot-cli
• https://docs.github.com/en/copilot/concepts/agents/about-agent-skills
• https://docs.github.com/en/copilot/concepts/agents/hooks
• https://docs.github.com/en/copilot/how-tos/github-copilot-app/customize-github-copilot-app
• https://docs.github.com/en/copilot/concepts/agents/about-github-agentic-workflows
• https://github.blog/changelog/2026-06-02-copilot-sdk-is-now-generally-available/

Each surface must keep its own evidence. Local CLI, app worktree, app cloud
sandbox, cloud agent, IDEs, code review, and Actions do not inherit parity from
one another.

CLI-first distribution contract

Build the plugin, generated repository overlay, and any installer wrappers from
one source manifest. Every route must report the same semantic version and
content digest. Installing or enabling a plugin must not silently mutate the
repository; repository initialization/update is an explicit, ownership-aware
operation.

Certify every applicable official Copilot CLI runtime distribution:

• macOS: Homebrew, npm, and GitHub's install script;
• Linux: Homebrew, npm, and GitHub's install script;
• Windows: WinGet and npm, with PowerShell as required native proof and Git
  Bash/WSL reported separately.

Certify every native harness delivery route that is claimed as supported:

• local plugin path;
• GitHub repository root and repository subdirectory;
• arbitrary Git URL;
• registered private marketplace for pre-1.0 pilots;
• public marketplace only as part of the approved 1.0 release;
• user-level declarative enabledPlugins settings;
• repository-level declarative enabledPlugins settings for CLI/cloud agent;
• Copilot app settings and cloud-agent activation as separate host evidence.

An optional gh extension, npm/npx initializer, Homebrew tap, or standalone
release binary may be added only as a thin convenience wrapper around the same
verified artifact. No wrapper may fork lifecycle or enforcement logic.

For each supported lane, prove clean install, discovery, explicit repository
initialization, idempotent re-run, customization-preserving update, drift
diagnostics, rollback, ownership-aware uninstall, and honest auth/network/offline
failure. Bind receipts to the Copilot CLI version and installer, harness
version/digest, OS/shell, and fixture commit. Unsupported lanes must be named in
release notes rather than implied by another lane's success.

Product boundary

• Target GitHub Copilot CLI first, then prove the supported IDE, app, and cloud
  agent surfaces individually.
• Do not conflate GitHub Copilot with Microsoft 365 Copilot or Copilot Studio.
• Preserve local git hooks, tests, and hosted CI as enforcement authorities
  wherever Copilot instructions or skills are advisory.
• Reuse host-neutral lifecycle policy and proof contracts; keep Copilot-native
  instructions, skills, agents, hooks, plugins, permissions, and packaging in
  the adapter.
• Treat codex-sdlc-wizard as the behavioral baseline, not as a source tree to
  rename wholesale.

Proposed delivery sequence

1. Release and verify codex-sdlc-wizard 1.0.0. This is a hard dependency, not
   a scheduling preference.
2. Complete preparation-only work: Research a GitHub Copilot CLI adapter for the SDLC workflow #97's official-source capability matrix,
   account/tool readiness, frozen behavior inventory, conformance specification,
   and synthetic E2E plan. Do not write adapter code.
3. After the Codex 1.0.0 gate, select adopt, experiment, or reject from
   Research a GitHub Copilot CLI adapter for the SDLC workflow #97's evidence.
4. Freeze a small conformance suite from the released Codex behavior: setup,
   customization preservation, plan/TDD loop, proof freshness, commit/push
   gates, review, compaction/handoff, update, and honest failure.
5. Create BaseInfinity/copilot-sdlc-harness as a private repository and
   build the smallest Copilot-native adapter there. Do not implement it inside
   codex-sdlc-wizard.
6. Import/load that private adapter into GitHub Copilot and run full synthetic
   black-box E2E on macOS and Windows, including negative and recovery paths.
7. Retain private visibility throughout pre-1.0 development and consumer
   pilots, binding every candidate to exact evidence.
8. Adopt the released harness in consumer repositories one at a time. Track
   each consumer pilot, private evidence, and project-specific improvements only
   in that repository.
9. Promote reusable improvements back to the harness through sanitized,
   evidence-backed issues and regressions.

Required proof

• Skill/instruction/agent discovery works from a clean Copilot installation.
• Setup and update preserve pre-existing repository instructions and user-owned
  customization.
• A frozen fixture completes one RED -> GREEN change, focused/full tests, exact
  candidate freeze, and independent review.
• An uncertified commit/push is blocked by a real enforcement surface rather
  than prompt compliance alone.
• Stale proof, wrong candidate, forbidden mutation, auth failure, quota/budget
  exhaustion, provider failure, interruption, and resume all fail honestly.
• Windows PowerShell and macOS behavior are tested explicitly.
• CLI, IDE, app, and cloud-agent claims are kept separate; no surface inherits
  another surface's proof.
• Cost, latency, included-credit consumption, permissions, data handling, and
  rollback are recorded for the tested Copilot plan/model.

Deliverables

• Host-neutral conformance fixtures and expected outcomes.
• Copilot-specific adapter and deterministic installer/updater/check command.
• One canonical manifest/version/digest across plugin, overlay, and every shipped
  distribution wrapper.
• Exact asset/ownership map showing what is shared, generated, or host-specific.
• Sanitized E2E receipts for supported surfaces and operating systems.
• Private copilot-sdlc-harness repository for development, validation, and
  pre-1.0 consumer pilots.
• Public repository and supported install/update path only when the approved,
  exact 1.0.0 candidate passes its release gate.
• Consumer adoption runbook and privacy boundary for downstream project pilots.
• Final parity classification: enforced, mixed, advisory-only, or
  unsupported, per capability and host surface.

Acceptance criteria

• Research a GitHub Copilot CLI adapter for the SDLC workflow #97 reaches an evidence-backed adopt or experiment decision before
  production implementation begins.
• codex-sdlc-wizard 1.0.0 is publicly released and its exact artifact is
  verified before any Copilot harness prototype, repository, import, or E2E.
• Pre-gate activity remains preparation-only and produces no adapter code.
• The conformance suite captures the current known-good Codex behavior
  before adapter work.
• The implementation uses Copilot-native mechanisms where they exist and
  documents every fallback or missing primitive.
• Plugin, repository overlay, CLI, app, cloud agent, IDE, review, Actions,
  SDK, and third-party-agent boundaries are versioned and tested separately.
• Homebrew/npm/install-script lanes on macOS/Linux and WinGet/npm lanes on
  Windows are either independently proven or explicitly unsupported.
• Local path, repository root/subdirectory, Git URL, private marketplace,
  public 1.0 marketplace, user-declarative, and repository-declarative plugin
  routes have independent install/update/uninstall receipts.
• Every shipped convenience wrapper resolves to the same verified artifact;
  no wrapper contains divergent lifecycle or enforcement logic.
• Disposable black-box E2E passes for install, discovery, TDD, proof,
  enforcement, review, update, preservation, failure, and recovery.
• macOS and Windows evidence bind the exact release candidate.
• The product repository is created privately only after the Codex 1.0 gate
  and Research a GitHub Copilot CLI adapter for the SDLC workflow #97 decision, then remains private through all pre-1.0 work and pilots.
• Public visibility and package publication happen only as an explicit
  1.0.0 release action after exact-candidate proof, review, and approval.
• No private consumer repository name, code, issue, evidence, or business
  context is copied into the public harness.
• Downstream consumption happens through repository-local issues after the
  harness release, with reusable improvements promoted back in sanitized
  form.
• README and ecosystem docs distinguish this project from
  codex-sdlc-wizard, claude-sdlc-harness, opencode-sdlc-wizard, and
  gh-sdlc-wizard.
• Release notes state exactly which Copilot surfaces are proven and which
  remain experimental or unsupported.

Dependencies and related work

• Research a GitHub Copilot CLI adapter for the SDLC workflow #97 - GitHub Copilot CLI adapter research and host decision.
• SDLC enforcement as a portable sdlc-mcp server vs per-host skills - converge the forks? #58 - portable/shared SDLC core boundary.
• Audit AGENTS.md against current Codex guidance and generated SDLC behavior #95 - repository instruction ownership and precedence.
• research: identify and prove the Microsoft-enterprise agentic coding host #122 - Microsoft-enterprise coding-host proof and policy boundary.
• research: map the SDLC experience across every Copilot tier and host #125 - cross-Copilot tier/host map.

This is post-codex-sdlc-wizard-1.0.0 contingent implementation work. It must
not begin early or displace the current 1.0 release path.