Skip to main content

MedHarness

AI-assisted development with design control: your AI agent writes the code and the design record, and ordinary code checks that they agree before anything merges.

PyPI License: MIT Python 3.11+

AI development

flowchart LR
    A["<b>1 · Design</b><br/>AI drafts the design"] -->|"<b>you review</b>"| B["<b>2 · Code</b><br/>AI codes and tests"]
    B -->|"<b>you review</b>"| C(["Merge"])

For each change request, the agent designs first — it assesses the change's risk, then writes the requirements, design and test points it needs as items in your repository's Design History File (DHF), each traced to the next — and codes second, tagging each test with the requirement it verifies. You review the design, then the code. Between them, ordinary code — never a model — checks that the design traces, every requirement is verified, and the branch changed what the request said.

What MedHarness gives the agent:

  • The process, in its own instructions. init writes an AGENTS.md (and a CLAUDE.md that imports it) telling the agent when to open a change request and which commands to run; build plan --prompt prints the exact steps and this change's DHF context for whichever agent you use.
  • Commands instead of files. The agent reads and writes the DHF with medharness item, which checks the schema first: a bad edit is refused, not saved.
  • Feedback it can act on. The checks name the item and field that are wrong, so the agent fixes them and runs the check again.

How the agent and MedHarness fit together — what to call when, a skill, and two Claude Code hooks — is in Working with your coding agent.

Run it two ways:

  • At your desk, with the agent you already use: it does the work in your working tree and you commit.
  • Unattended, from an issue: CI opens the change request and a pull request with the design; ask for changes and it revises; the code stage runs the same way. The recipe is in the AI workflow page.

Unattended, build plan and build code run the claude CLI, or any provider:model you set (anthropic, openai, deepseek, or a local OpenAI-compatible endpoint such as ollama) — they run an agent with a shell, so use an ephemeral runner and read ai-security.md first.

Quick start

pip install medharness
mkdir my-device && cd my-device
medharness init            # writes DHF/ with sample items, and AGENTS.md for your agent

Then ask your coding agent: "open a CR for PDF export and implement it". Or use the checks alone, with no AI: medharness verify dhf checks that the design holds together.

What a project looks like

my-device/
├── DHF/
│   ├── config/global.yaml       # the project name — and only what you change
│   └── items/                   # one YAML file per item, one directory per type
│       ├── 01_crs/CRS-001.yaml
│       ├── 03_srs/SRS-001.yaml
│       └── …                    # one directory per configured type
├── AGENTS.md                    # product context and DHF steps, for any coding agent
└── CLAUDE.md                    # @AGENTS.md, so Claude Code reads it too

The item types (13 by default), their fields and lifecycles, the required links and the specification templates are defaults shipped in the package, so upgrading medharness upgrades them. A project overrides only what it changes, in DHF/config/: see Changing the defaults.

An item is a small YAML file. Links are written on the child and point up:

id: SRS-012
title: Password must be at least 12 characters
derives_from: [SYS-004]
verification_method: [Test]
testing: |
  T1: an 11-character password is rejected

Commands

One CLI, four groups:

medharness init
medharness item    list | get | create | update | transition
medharness verify  dhf | tests | soup | completion | impact | changes
medharness build   plan | code | soup | release

item reads and changes DHF items, verify checks and writes nothing, build produces items, code and release artifacts. Every command's options and what it returns are in interface.md; --help on any command prints the same.

Example project

ContourLab is an example project used to exercise MedHarness end to end: its DHF, its CI, and changes made through AI development.

Documentation

adopting.md starting fresh, bringing an existing DHF, what to adopt in what order
ci.md the CI recipe, cutting a release
ai-workflow.md a change request from design to code: your own agent, or unattended in CI
soup.md the SOUP register, SBOM, vulnerability scanning
configuration.md changing the defaults, your own types and relationships
interface.md the gate result, exit codes, what may change
validation.md the tool's intended use, the risk of each command, and its own requirements and tests
ai-security.md what the AI stages can do, and running without them
architecture.md how the code is organised
charter.md what MedHarness is for, and what it does not do
CHANGELOG.md version history

License

MIT. See LICENSE.

Metadata

Release files for medharness 0.71.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for medharness 0.71.0
File Size Uploaded Provenance Actions
medharness-0.71.0.tar.gz 208.6 kB With provenance Details for medharness-0.71.0.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for medharness 0.71.0
File Interpreter ABI Platform Actions
medharness-0.71.0-py3-none-any.whl Python 3 none any Details for medharness-0.71.0-py3-none-any.whl

Total release size: 469.1 kB

Release files / medharness-0.71.0.tar.gz

Download URL medharness-0.71.0.tar.gz
Size 208.6 kB
Tags Source
SHA-256 checksum
How to use checksums
a3e3089bd976766c9413729620cd4a005087ddbcb526f8161db81fec1a9813d0
BLAKE2b-256 checksum
How to use checksums
0e294be17c95f7a0acdac006668774aebd988cbf5b13528c61fed80b5f8a125c
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 28, 2026.

Transparency log

Release files / medharness-0.71.0-py3-none-any.whl

Download URL medharness-0.71.0-py3-none-any.whl
Size 260.5 kB
Tags Python 3
SHA-256 checksum
How to use checksums
94e145d741585580fd651471ae5881db7bdca7097f4e1589fa5fb5ce4c336f2f
BLAKE2b-256 checksum
How to use checksums
034018f27fde6e6457665c1c612093a31534cf31e627dd68554fff96b48f1d89
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 28, 2026.

Transparency log

Security for medharness 0.71.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for medharness-0.71.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 28, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

This release

0.71.0 This release

2 release files Full provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page