zetetic-team-subagents

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

Every change lands on main through a pull request, so interim work is public before it is released. The eight commits between v2.34.0 and v2.35.0 are individually reviewable: https://github.com/cdeust/zetetic-team-subagents/commits/main

Repository on GitHub, which uses git. git is distributed.

Each release carries a unique semantic version in .claude-plugin/plugin.json and a matching git tag: https://github.com/cdeust/zetetic-team-subagents/releases

Semantic Versioning. Tags are of the form vMAJOR.MINOR.PATCH, currently v2.35.0.

Every release is an annotated git tag: https://github.com/cdeust/zetetic-team-subagents/tags

Non-trivial release notes file in repository: https://github.com/cdeust/zetetic-team-subagents/blob/main/CHANGELOG.md.

No vulnerability with a CVE assignment has been fixed in any release to date. Security-relevant fixes are named in the release notes when they occur: the v2.35.0 notes record all 33 CodeQL alerts cleared at source with no suppressions (issue #60) and the six Scorecard code-scanning findings closed (issue #59). https://github.com/cdeust/zetetic-team-subagents/blob/main/CHANGELOG.md

Non-trivial SECURITY[.md] file found file in repository: https://github.com/cdeust/zetetic-team-subagents/blob/main/SECURITY.md. [osps_do_02_01]

GitHub Issues: https://github.com/cdeust/zetetic-team-subagents/issues

Every bug report raised in the tracker has been acknowledged and closed by the maintainer, most within a day. Recent examples: #64 (redaction-checker scope), #59 (Scorecard findings), #56 (redaction backlog), #54 (advisor.md anchor), #53 (unattested session-executing artifacts). https://github.com/cdeust/zetetic-team-subagents/issues?q=is%3Aissue

Enhancement requests use the same tracker and the same pattern. Every one raised so far was answered and resolved in a release, for example #52 (version currency) shipping in v2.35.0. https://github.com/cdeust/zetetic-team-subagents/issues?q=is%3Aissue

Issues and pull requests are public and permanently archived: https://github.com/cdeust/zetetic-team-subagents/issues?q=is%3Aissue

SECURITY.md documents the process, what to include, and a per-severity response SLA: https://github.com/cdeust/zetetic-team-subagents/blob/main/SECURITY.md

Private GitHub Security Advisories are enabled and SECURITY.md links the private channel directly: https://github.com/cdeust/zetetic-team-subagents/security/advisories/new

No vulnerability report has been received through the disclosure channel in the last six months. The commitment is documented: 24 hours first response for critical, 3 days for high, 7 days otherwise. https://github.com/cdeust/zetetic-team-subagents/blob/main/SECURITY.md

Nothing is compiled. The software is Markdown agent and skill definitions plus bash and Python scripts that run directly from source; a modified file takes effect on the next session with no rebuild step. The release workflow does assemble a deterministic tarball for attestation (https://github.com/cdeust/zetetic-team-subagents/blob/main/tools/build-release-bundle.sh), but that artifact is for verification rather than for making the software usable.

There is no build step. See the build criterion.

There is no build step. See the build criterion.

Automated suites run on every push and pull request, and the workflow shows exactly how to run each one: https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/ci.yml. They are the eight memory and propagation suites under scripts/, the 16 regression suites under tools/tests/*/run-tests.sh, the agent definition auditor, the craftsmanship checker, the redaction sweep and the zetetic checker. Everything is MIT-licensed with the rest of the repository.

Each suite is invoked the standard way for its language: bash <script> for the shell suites (every one listed with its command in https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/ci.yml) and python3 -m pytest for the Python suites, configured through the standard [tool.pytest.ini_options] table in https://github.com/cdeust/zetetic-team-subagents/blob/main/pyproject.toml. The workflow is the accurate list; the commands quoted in CONTRIBUTING.md are stale and are being corrected under issue #73.

Every push to main and every pull request runs seven jobs, four of them hard gates that block the merge: https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/ci.yml, plus https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/shellcheck.yml and https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/codeql.yml

A written policy, not an informal one. rules/coding-standards.md section 13.1 requires that every code path introduced by a change maps to a test that asserts its observable effect, and section 13.2 requires the mapping to be embedded in the pull request as a Completion Ledger. https://github.com/cdeust/zetetic-team-subagents/blob/main/rules/coding-standards.md

Evidence from the most recent changes. v2.36.0 shipped tests/test_stop_zetetic_spine.py and tools/tests/agent-definition-auditor/run-tests.sh alongside the code they cover. v2.35.0 added tools/tests/plugin-version-check/ with 31 hermetic assertions covering every arm of the new checker, and tools/tests/release-verify/ with five tamper-rejection tests for the new bundle verifier. The fix for issue #64 shipped with the regression test that fails on the pre-fix code. https://github.com/cdeust/zetetic-team-subagents/blob/main/CHANGELOG.md

CONTRIBUTING.md states it for hooks ("Changes to that hook need a corresponding test in tests/") and rules/coding-standards.md section 13 states it generally, with the Completion Ledger as the mechanism that makes it checkable in review. https://github.com/cdeust/zetetic-team-subagents/blob/main/CONTRIBUTING.md and https://github.com/cdeust/zetetic-team-subagents/blob/main/rules/coding-standards.md

shellcheck covers the shell surface and CodeQL with the security-and-quality query pack covers the Python surface. Both run on every push, every pull request and on a weekly schedule: https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/shellcheck.yml and https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/codeql.yml

CodeQL is at zero open alerts on main: all 33 were cleared at the source with no suppressions (issue #60, recorded in https://github.com/cdeust/zetetic-team-subagents/blob/main/CHANGELOG.md). shellcheck at error severity is at zero across hooks/ and tools/ and is a hard gate, verified by running the workflow's own command locally on 2026-07-28. The residual is 27 warning-severity shellcheck findings (most of them SC2034 unused variable), which are measured, categorised and scheduled in issue #74 rather than left unread.

Maximally strict for the languages in use. shellcheck runs at error severity over every shell file in hooks/ and tools/ with no "|| true" escape, so a single finding fails the job: see the step "ShellCheck (error severity - hard gate)" in https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/shellcheck.yml. CodeQL runs the widest query pack, security-and-quality, rather than the default security-only pack. The redaction sweep runs under ZETETIC_PROFILE=strict, which promotes every finding to exit 1 (https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/ci.yml). Warning severity for shellcheck is currently informational, with the backlog measured and scheduled in issue #74.

The design principles are applied and written down rather than assumed. Fail-safe defaults: the memory ACL denies writes outside a scope's owner list, and tools/manifest_gate.py rejects an ungrounded source with exit 3 instead of passing it through. Least privilege: every workflow declares contents: read and the release job adds only id-token and attestations write. Open design: the whole enforcement surface is public and its limits are stated at https://github.com/cdeust/zetetic-team-subagents#what-this-system-does-not-do

The vulnerability classes that matter for this software are the supply-chain ones, and they are named and countered in https://github.com/cdeust/zetetic-team-subagents/blob/main/SECURITY.md: a modified hook is code execution with the user's permissions, countered by an executable manifest, a Sigstore attestation and a verifier that checks before unpacking. Injection and traversal classes are handled by fixing what CodeQL reports at the root cause rather than annotating it away (issue #60, 33 alerts cleared, no suppressions).

Only published and reviewed primitives are used, and none is implemented here: SHA-256 for the release checksums and executable manifest, and TLS through Python's ssl.create_default_context for outbound fetches.

No cryptographic function is reimplemented. Hashing goes through Python hashlib and coreutils shasum, TLS through the platform's OpenSSL by way of Python's ssl module, and release signing through Sigstore.

OpenSSL through Python's ssl module, Python hashlib, GNU coreutils and Sigstore are all FLOSS.

SHA-256 is the only digest used anywhere in the tree, verified by grep for md5 and sha1 across tools/ and hooks/ (no hits). TLS key sizes come from Python's default context, which rejects anything below current minimums.

No broken or known-weak algorithm is used. There is no MD5 or SHA-1 anywhere in tools/ or hooks/, and TLS is negotiated by the platform default context rather than pinned to an old suite.

The only digest in the tree is SHA-256 and the only transport is the platform default TLS context. No SHA-1, no MD5, and no hand-selected cipher mode.

Outbound TLS uses ssl.create_default_context (https://github.com/cdeust/zetetic-team-subagents/blob/main/tools/web_ingest.py), which negotiates ephemeral Diffie-Hellman suites by default. The software terminates no TLS of its own.

The software performs no inbound authentication and stores no user passwords. It is a local plugin with no server and no accounts.

No security-relevant random values are generated. Nothing in the tree issues tokens, nonces, salts or keys.

Distribution channels use HTTPS exclusively. [osps_br_03_02]

Checksums are never fetched over plain HTTP. Each release publishes a .sha256 companion over HTTPS alongside a Sigstore attestation, and https://github.com/cdeust/zetetic-team-subagents/blob/main/tools/verify-release-bundle.sh checks the tarball checksum before unpacking and every executable against the manifest before running it.

There are no publicly known unpatched vulnerabilities of medium or higher severity. CodeQL is at zero open alerts on main and the only external dependency surface, the pinned GitHub Actions, is watched by Dependabot.

No critical vulnerability has been reported. The two error-severity CodeQL findings that did exist (py/uninitialized-local-variable) were fixed structurally rather than annotated away, in issue #60.

No credential is committed. GitHub secret scanning and push protection are both enabled on the repository (verified through the repository API on 2026-07-27), and https://github.com/cdeust/zetetic-team-subagents/blob/main/hooks/pre-tool-secret-shield.py additionally blocks any agent from reading .env, .aws/credentials, *.pem, *.key or shell history files.

Two tools, split by language because no single tool covers both. CodeQL with the security-and-quality query pack analyses the Python hooks and tools (https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/codeql.yml) and shellcheck analyses the shell (https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/shellcheck.yml). Both run on every push to main, every pull request and on a weekly schedule, so every release is covered. The split is stated in the workflow headers rather than left as an unexplained gap.

CodeQL runs the security-and-quality suite, which is the security query pack plus the quality queries, rather than a generic lint. It found real vulnerability-class defects and they were fixed: 33 alerts cleared at source in issue #60. https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/codeql.yml

Zero open CodeQL alerts on main. The full set of 33 was cleared at the source with no suppressions and no dismissals, including the two error-severity py/uninitialized-local-variable findings, which needed the functions made total rather than an annotation. Recorded in https://github.com/cdeust/zetetic-team-subagents/blob/main/CHANGELOG.md under v2.35.0.

On every push to main, every pull request, and weekly on a schedule (CodeQL Mondays 05:00 UTC, shellcheck Wednesdays 06:00 UTC). The schedule exists because a new query pack lands out of band against code that has not changed.

The software is bash and Python. There is no C, C++ or other memory-unsafe code for a memory-safety dynamic analyser to target.

The suites run the software with its checks at their strictest rather than at defaults. The Python suites run under pytest with assertion rewriting active and without -O, so every assert is live. The shell suites run the gate scripts under set -euo pipefail and drive the checkers with ZETETIC_PROFILE=strict, which promotes every informational finding to a blocking exit, so a violation fails loudly during the test rather than being reported and ignored.

No dynamic analysis tool of the kind this criterion describes is applied (see dynamic_analysis), so no vulnerability has been discovered by one. This becomes answerable when issue #71 lands input-varying analysis.