Quick Start: /plugin marketplace add galando/temper then /temper "add password reset" — one command for the full pipeline.

Headless / CI (claude -p): use the fully-qualified name, /temper:temper "..." — the bare /temper alias only resolves in an interactive session.

The Problem

AI writes code fast. But "fast" without "right" creates bugs, technical debt, and features that miss the point. AI-generated code has structural failure patterns:

Most AI tools check if code compiles. Temper checks if it solves the right problem, handles edge cases, and is safe to ship — and since v7, it checks mechanically, not by asking the model to grade its own work.

The Catch

The rate-limiting bug that vanilla AI always misses:

Scenario: Rate limiting on reset requests
  Given a user has requested 3 resets in 10 minutes
  When they request another reset
  Then the request is rejected with 429

AI built password reset. All tests pass. But Temper's scenario coverage gate caught the gap: no test for rate limiting. Build wrote the test. Test failed. Build implemented rate limiting. Test passed. Without the coverage gate, rate limiting would never have been implemented.

More: Evidence Gallery

How It Works

Three methodologies, one contract file (intent.md):

intent.md
|
+-- Intent (IDD)           WHY are we building this?
|   Problem, success criteria, constraints
|
+-- Scenarios (BDD)        WHAT should it do?
|   Gherkin Given/When/Then, derived BEFORE architecture
|
+-- /temper:build (TDD)    HOW do we build it?
    Tests from scenarios, RED → GREEN → REFACTOR

Key insight: Scenarios are derived before architecture. The file plan follows from what the system must do, not the other way around. This prevents over-engineering structurally.

Full methodology: docs/methodology.md

Deterministic Gates (v7)

Every gate verdict — Plan, Build, Review, Check, Eval, Commit — is computed by a small CLI (scripts/temper) from an evidence ledger, never asserted by a model:

> temper gate check
temper gate check -> PASS
  [v] tests pass — 24 green test run(s) recorded
  [v] coverage >= threshold — 87.0% >= 80% threshold

• Every claim carries proof. temper evidence add records a command, exit code, and artifact. PROVEN is mechanically re-checked — a missing artifact or a nonzero exit auto-downgrades it to HEURISTIC. Nothing is labeled verified on faith.
• git commit is physically blocked, not just discouraged, while any gate is FAIL and unoverridden — a native pre-commit hook and an in-agent hook both run temper gate commit. A human can always override (recorded, never silently erased), but a confused model can't talk past a red gate.
• The gate logic is ~20-30 lines of readable shell per stage — scripts/temper, unit tested in scripts/tests/test-temper.sh. If you want to know exactly what "Check passed" means, read the function; you don't have to trust 1,000 lines of prompt.
• Seeded-defect fixtures prove the pipeline catches real bugs — 3/3, verified live, at the strict bar. Three small projects, each with one known, planted defect (missing rate limiting, a hallucinated API call, a component never wired in). Run for real against both v6.0.1 and this branch: both catch all three. v7's catches require the harness's strongest tier — temper gate mechanically FAILing with the defect named — not a weaker "some evidence text roughly matches" signal; that distinction was itself a real bug the harness had until it was caught by asking "is this eval actually correct?" and fixing it. A fourth, differently-shaped fixture (no seeded defect) then confirmed the remaining gate stages — plan, build, eval — actually get called by the model too, not just the two the seeded-defect fixtures exercise. Full story, including the real bugs this found along the way (one in the pipeline, one in the eval harness itself): evals/README.md.

Full design rationale: docs/plans/v7-deterministic-spine.md

Autonomous Continuation (opt-in)

After you approve the plan, /temper can run the remaining stages (design → build → review → check → eval) unattended and leave a report. It never pushes or merges, never re-plans on its own, and parks before commit and on anything needing a human — enforced by the same temper gate mechanism as the interactive path, not a separate trust boundary.

First run: pre-allow your build/test commands in settings.json, or the run parks on the first unpermitted command. No config yet? /temper:init seeds one (and scaffolds .temper/ for the CLI).

Commands

Quality Packs

Rule sets enforced during code generation and review. Three-tier resolution: project-local → global → built-in.

Create custom packs with /temper:pack or add a rules.md to .claude/packs/your-pack/.

Security & Trust

Temper is Markdown and ~500 lines of auditable shell — every command, skill, pack, and gate is either a prompt file or a script you can read in this repository. The trust contract:

• No network calls, no telemetry. Temper never phones home. The only shell commands it runs are your project's own build/test/lint commands (plus its own gate script), and only under Claude Code's normal permission prompts.
• Writes are confined to your project. Temper writes .claude/temper.config (created by /temper:init, only with your approval) and its working files under .temper/ in your project. It never touches files outside the project directory.
• The commit gate is mechanical, not advisory. temper gate commit — enforced by a real git pre-commit hook — blocks a commit whenever an upstream gate is FAIL and unoverridden. See Deterministic Gates.
• Autonomous Continuation is opt-in and fenced. Armed per-run at the plan gate, never at invocation. It never commits, never pushes, never merges — it parks before commit and leaves a report.
• Optional MCP servers are optional. The recommended servers below only upgrade evidence quality; nothing breaks without them.

Installation

Claude Code

/plugin marketplace add galando/temper
/plugin install temper
bash "$CLAUDE_PLUGIN_ROOT/scripts/hooks/install.sh"   # installs the commit gate

Cursor IDE (archived)

Cursor support is archived at the v6.0.1 snapshot (frozen feature set — CHANGELOG v5.2.1 platform strategy) and is no longer regenerated per release; v7's CLI-backed gates and agents/ directory ship Claude Code-only. ./scripts/generate-cursor.sh still works if you want to hand-run it. Details: .cursor/README.md.

Recommended Setup

Temper works out of the box. Two optional MCP servers upgrade heuristic analysis to mechanically verified findings:

# Register with Claude Code (requires restart)
claude mcp add code-review-graph -- code-review-graph
claude mcp add semgrep -- semgrep --mcp

Every finding carries an evidence label — PROVEN (mechanically verified), HEURISTIC (grep-based), SEMANTIC (judgment), OCR (external engine) — recorded in .temper/evidence/ by temper evidence add.

Full setup: docs/recommended-setup.md

Supported Stacks

Documentation

• Getting Started — Step-by-step guide
• Commands Reference — Full command documentation
• Packs — Built-in and custom packs
• Methodology — IDD, BDD, TDD deep dive
• v7 Design — Why the CLI, the evidence ledger, the prompt diet
• Recommended Setup — MCP servers and live verification
• Enterprise Setup — Deploy across your organization
• Privacy Policy — No data collected, no servers, no telemetry

Contributing

See CONTRIBUTING.md for guidelines.

License

MIT (c) Gal Naor