zetetic-team-subagents

There is a documented upgrade path and the project keeps it working. https://github.com/cdeust/zetetic-team-subagents/blob/main/docs/MIGRATION.md gives a five-step adoption path for an existing non-compliant project, from permissive through standard to strict. Version currency is enforced rather than assumed: https://github.com/cdeust/zetetic-team-subagents/blob/main/tools/plugin-version-check.sh compares installed, pinned and released versions and names which of the two possible lags applies and who fixes it, and it runs at session start. Upgrade-relevant changes are called out per release in https://github.com/cdeust/zetetic-team-subagents/blob/main/CHANGELOG.md

GitHub Issues: https://github.com/cdeust/zetetic-team-subagents/issues

No vulnerability has been resolved in the last 12 months, so there is no reporter to credit. The commitment is documented: reporters are credited in the release notes for the patched version unless they request anonymity. https://github.com/cdeust/zetetic-team-subagents/blob/main/SECURITY.md

https://github.com/cdeust/zetetic-team-subagents/blob/main/SECURITY.md documents the whole response process: the private advisory channel, what a report must contain, a per-severity SLA table (24 hours first response and 7 days to patch for critical, 3 and 14 days for high), a five-step disclosure timeline with a 30-day default coordinated date, and what is out of scope.

The standard is a document in the tree, not a preference: https://github.com/cdeust/zetetic-team-subagents/blob/main/rules/coding-standards.md covers SOLID, the layer dependency rule, size limits, dependency injection, local reasoning, source discipline, mutation testing, the definition of done and the boy-scout rule, each with its primary source. CONTRIBUTING.md names it as binding and excerpts the load-bearing rules: https://github.com/cdeust/zetetic-team-subagents/blob/main/CONTRIBUTING.md

Enforced automatically at two points. At commit time https://github.com/cdeust/zetetic-team-subagents/blob/main/hooks/pre-commit-zetetic.sh runs tools/zetetic-checker.sh on the staged diff and returns exit 2 on a violation. In CI four hard gates block the merge (https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/ci.yml): the craftsmanship checker on newly added files, the redaction sweep on the full tree under ZETETIC_PROFILE=strict, the tools regression suite, and shellcheck at error severity. The ratchet shape (new files gated, legacy debt reported) is documented in the workflow itself.

No native binaries are generated. There is no compiler or linker invocation anywhere in the project, so CC, CFLAGS and LDFLAGS have nothing to apply to.

There is no build or installation system that strips anything. The software is Markdown and scripts, installed by copying, and the source on disk is what runs.

There is no build system, so there are no subdirectory builds to make recursive or otherwise.

Although nothing is compiled, the one thing that is generated is bit-for-bit reproducible by construction. https://github.com/cdeust/zetetic-team-subagents/blob/main/tools/build-release-bundle.sh creates the release tarball with --sort=name --mtime=@0 --owner=0 --group=0 --numeric-owner, so the archive does not depend on filesystem order, timestamps or the building user. The script says why: an attestation over a non-deterministic archive proves nothing a second builder can check.

Installed and uninstalled through the ecosystem's package manager: "claude plugin marketplace add cdeust/zetetic-team-subagents" then "claude plugin install zetetic-team-subagents" (https://github.com/cdeust/zetetic-team-subagents#install). The manual path is https://github.com/cdeust/zetetic-team-subagents/blob/main/scripts/setup.sh with install, update, uninstall and configure verbs, and the installer writes a manifest so that uninstall removes exactly what it added.

There is no installation system that writes built artifacts to a configurable prefix. Installation copies agents, skills, hooks and tools into the host's own plugin directory under ~/.claude, which is the convention the host defines, so DESTDIR and similar variables have nothing to select.

git clone and the software is complete: nothing is compiled and there are no dependencies to resolve. https://github.com/cdeust/zetetic-team-subagents/blob/main/CONTRIBUTING.md lists the prerequisites (bash 4+, GNU coreutils, ripgrep, python3) and https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/ci.yml gives the exact command for every suite, which is the same command a developer runs locally. The stale command list inside CONTRIBUTING is being corrected under issue #73.

Listed in two computer-processable forms. Every release publishes a CycloneDX SBOM (zetetic-team-subagents.cdx.json) inventorying every bundled file with its hash, including the vendored third-party skill material, alongside an EXECUTABLE-MANIFEST.sha256 that enumerates every hook and tool that will run on the user's machine (https://github.com/cdeust/zetetic-team-subagents/blob/main/SECURITY.md). The only external supply-chain surface, the GitHub Actions, is declared in https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/dependabot.yml and each action is pinned to a full commit SHA in the workflows.

https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/dependabot.yml runs weekly against the github-actions ecosystem, which is this project's only external dependency surface: there is no runtime package to install, so there is no pip or npm manifest to watch, and the config states that reasoning rather than declaring an empty ecosystem. Dependabot updates the pinned SHA and rewrites the version comment in place, so pinning discipline is preserved automatically. OpenSSF Scorecard runs on a schedule on top of it (https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/scorecard.yml), with each finding's disposition recorded in https://github.com/cdeust/zetetic-team-subagents/blob/main/docs/SCORECARD.md

Reused components are identifiable and updateable. The GitHub Actions are pinned by full commit SHA with a version comment and updated by Dependabot weekly. The Python code imports only the standard library, so there is no vendored runtime dependency to go stale. The one convenience copy, the vendored writing and redaction rule material, carries its provenance in the file and is inventoried in the per-release CycloneDX SBOM.

The technology stack is current and nothing deprecated is relied on. The Python is standard library only (argparse, hashlib, json, ssl, subprocess, urllib, xml.etree, tempfile) with no deprecated or removed module, and CI pins Python 3.12. The shell targets bash 4+ with POSIX coreutils, and shellcheck at error severity would flag obsolete constructs on every push.

Every push to main and every pull request runs the full gate set and reports pass or fail per job: seven jobs in https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/ci.yml (memory suites, agent auditor, worktree tests, zetetic checker, craftsmanship checker, redaction sweep, tools regression suite covering 16 suites), plus shellcheck and CodeQL in their own workflows. Four of them are hard gates that block the merge. The Python pytest suites are the one part not yet wired into CI, tracked in issue #71.

Well above 50 percent, because the standard makes it mandatory: rules/coding-standards.md section 13.1 G2 requires every bug fixed in a pull request to carry a regression test that fails on the pre-fix code. Recent fixes follow it: issue #64 (redaction-checker missing untracked files) shipped with the test that reproduces the false local pass, and issue #60's CodeQL fix was made structural so the checker itself is the regression guard. https://github.com/cdeust/zetetic-team-subagents/blob/main/rules/coding-standards.md

Measured on 2026-08-03 with coverage.py 7.15.2 and pytest 9.1.1 over the shipped Python surface declared in pyproject.toml (hooks/ plus tools/): 1607 statements, 50 missed, 97 percent, with 969 tests passing. The figure was 21 percent before issue #71, and the pytest suite did not run in CI at all, so a change that broke its tests landed green. Both are fixed. The suite now runs as a hard gate on push and pull_request (https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/ci.yml, job 'Python Suite + Coverage Gate'), and coverage.py runs in the same job with fail_under = 80, so the number is enforced rather than reported. Scope, the floor and the exclusions are declared in https://github.com/cdeust/zetetic-team-subagents/blob/main/pyproject.toml rather than passed as command-line flags, so a local run and CI cannot measure different things; the one exclusion, the one-shot scripts/patch_*.py migrations, is written down there with the reason. The current command exits 0 at 97 percent, proving the 80 percent floor remains satisfied after the HTTPS trust-boundary change.

A formal written policy exists. rules/coding-standards.md section 13.1 A1 to A3 requires happy paths, every enumerated edge case and every failure path (including the emission of the signal itself) to map to a test, and section 13.2 makes the mapping a required artifact of the pull request. Section 13.3 enumerates the refusals, including that classifying a coverage gap in new code as a follow-up is blocking. https://github.com/cdeust/zetetic-team-subagents/blob/main/rules/coding-standards.md

CONTRIBUTING.md states it for hooks ("Changes to that hook need a corresponding test in tests/") and rules/coding-standards.md section 13 states it generally, with the Completion Ledger as the mechanism that makes it checkable in review. https://github.com/cdeust/zetetic-team-subagents/blob/main/CONTRIBUTING.md and https://github.com/cdeust/zetetic-team-subagents/blob/main/rules/coding-standards.md

Maximally strict for the languages in use. shellcheck runs at error severity over every shell file in hooks/ and tools/ with no "|| true" escape, so a single finding fails the job: see the step "ShellCheck (error severity - hard gate)" in https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/shellcheck.yml. CodeQL runs the widest query pack, security-and-quality, rather than the default security-only pack. The redaction sweep runs under ZETETIC_PROFILE=strict, which promotes every finding to exit 1 (https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/ci.yml). Warning severity for shellcheck is currently informational, with the backlog measured and scheduled in issue #74.

The principles are implemented, with one stated exception. Fail-safe defaults: the memory ACL denies any write outside a scope's owner list and tools/manifest_gate.py rejects an ungrounded source with exit 3. Separation of privilege: the release job holds only id-token and attestations write, everything else is contents: read. Open design: the enforcement surface and its documented limits are public (https://github.com/cdeust/zetetic-team-subagents#what-this-system-does-not-do). Economy of mechanism: web_ingest, manifest_gate and semantic_layer import none of each other and are wired by a skill, so each is independently testable. The exception is complete mediation at one tool boundary, described under input_validation below.

The only digest in the tree is SHA-256 and the only transport is the platform default TLS context. No SHA-1, no MD5, and no hand-selected cipher mode.

The project selects no cryptographic algorithm of its own. Transport algorithms are negotiated by the platform TLS stack and release signing is delegated to Sigstore, so there is no project-level choice for a user to switch.

The software processes no authentication credentials and holds no private keys. Release signing is keyless through Sigstore, where the signing certificate is short-lived and issued against the workflow's OIDC identity, so there is no stored private key to separate out or rotate.

All outbound web-ingest traffic is HTTPS-only by construction. https://github.com/cdeust/zetetic-team-subagents/blob/main/tools/web_ingest.py applies one allowlist before constructing a request, inside the redirect handler before urllib follows a target, on the final response URL before reading its body, and before admitting discovered links to a crawl. Plain HTTP and every non-HTTPS scheme fail closed as FetchError. tests/test_web_ingest.py proves caller-supplied HTTP is rejected without reaching the transport, an HTTPS-to-HTTP redirect is rejected, and an insecure final response URL is rejected before its body is read. Certificate and hostname verification remain enabled through ssl.create_default_context.

Outbound TLS goes through ssl.create_default_context (https://github.com/cdeust/zetetic-team-subagents/blob/main/tools/web_ingest.py), whose minimum protocol version on the Python versions this project targets is TLS 1.2. The context is created once and reused for every fetch, including the robots.txt fetch, so no request escapes it.

Certificate verification is on by default and is never disabled. ssl.create_default_context sets verify_mode to CERT_REQUIRED and check_hostname to True, and there is no CERT_NONE, no check_hostname = False and no unverified context anywhere in the tree. The context is preferentially built against certifi's CA bundle when available, falling back to the system store. https://github.com/cdeust/zetetic-team-subagents/blob/main/tools/web_ingest.py

No private information is ever sent. The outbound client transmits only a User-Agent, Accept-Encoding and the conditional-GET validators (If-None-Match, If-Modified-Since); it sends no cookie, no authorization header and no credential. Certificate verification is performed by the default context before any request body or header leaves, and no fetch is made outside that context.

Every release is cryptographically signed through Sigstore and the verification path is documented. The release workflow attests the tarball, the executable manifest and the CycloneDX SBOM with actions/attest-build-provenance under a least-privilege OIDC identity, and self-verifies with the shipped verifier before publishing (https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/release.yml). Users verify with "gh attestation verify zetetic-team-subagents.tar.gz --repo cdeust/zetetic-team-subagents", documented at https://github.com/cdeust/zetetic-team-subagents/blob/main/SECURITY.md. Signing is keyless, so no private key exists to be stored on the distribution site: the certificate is short-lived, issued by Fulcio against the workflow's identity, and logged in the Rekor transparency log.

Untrusted input is validated at each trust boundary. The memory tool checks every scope write against an owner list, tools/manifest_gate.py rejects an ungrounded source with a non-zero exit, hooks bound their stdin reads, and the fetch path caps response size and redirect depth. The remaining URL gap is closed in https://github.com/cdeust/zetetic-team-subagents/blob/main/tools/web_ingest.py with an explicit allowlist: the value must be a non-empty string, parse as an absolute HTTPS URL, include a host and valid port, and contain no embedded username or password. The same check is re-applied to redirects, final response URLs and discovered links. tests/test_web_ingest.py covers HTTP, file and scheme-relative forms, missing hosts, embedded credentials, invalid ports, redirect downgrade and insecure final URLs, including negative proof that rejected caller input never reaches the transport.

https://github.com/cdeust/zetetic-team-subagents/blob/main/docs/ASSURANCE-CASE.md provides the assurance case with all four required parts, each individually identifiable as its own section, and it is linked from both SECURITY.md and the README. Part 1, threat model: installing the plugin grants session-execution rights with no sandbox, which is the ecosystem's shortest path from a compromised artifact to code execution because the payload does not need to be compiled; four adversaries are tabulated with the capability assumed and what each is trying to reach, and three classes are placed explicitly out of scope. Part 2, trust boundaries: five are enumerated concretely for this system, each with what crosses it, what checks it and what the check does not cover, namely the release bundle to install path, the marketplace install into ~/.claude, hook invocation from the Claude Code lifecycle, tool invocation with model-supplied arguments, and the memory scope ACL. Part 3, secure design: fail-closed where failure is recoverable (including gates that treat an empty match set as failure, so a path bug cannot turn a gate into a silent green no-op), least privilege on agent reads, defence in depth on the artifact path, bounded consumption of untrusted input with sourced constants, validation at boundaries per the project's own coding standard, and no long-lived signing key anywhere in the project because Sigstore issues short-lived certificates against the workflow OIDC identity. Part 4, common implementation weaknesses: a table of eleven weakness classes against the counter applied and that counter's limit, covering shellcheck at error and warning severity with the linter pinned and checksum-verified, CodeQL, the path denylist, the redaction sweep, artifact attestation, resource caps, silent-no-op gates, untested error paths, mutation testing, SHA-pinned actions and Scorecard. Every claim states its limit in the style SECURITY.md already uses, including the places where a control is weaker than it looks: the secret shield fails open on malformed input by design, the memory ACL is permissive with no registry present and is bypassable by environment so it separates cooperating agents rather than bounding a hostile one, and the HTTPS allowlist is not a network sandbox. The document closes by stating that it has never been tested by a real attack and has had no independent review, since its author also wrote the code.

CodeQL runs the security-and-quality suite, which is the security query pack plus the quality queries, rather than a generic lint. It found real vulnerability-class defects and they were fixed: 33 alerts cleared at source in issue #60. https://github.com/cdeust/zetetic-team-subagents/blob/main/.github/workflows/codeql.yml

The software is bash and Python. There is no C, C++ or other memory-unsafe code for a memory-safety dynamic analyser to target.