standards-index.md

# Standards index

Every standard the skill relies on, split into what was **verified by direct
fetch** for this release and what is **referenced by name** (not fetched — verify
the current version before citing a specific URL). This split enforces the skill's
own rule: cite only URLs you have verified.

**Last link-rot re-verification: 2026-09-18** — every cited URL was re-fetched and
confirmed live and content-accurate, except five fixed in that pass: 1 dead (the OWASP
ASVS project page → 404, repointed to the ASVS repo) and 4 moved (OWASP Top 10:2025,
its A03 detail, OWASP API Security 2023, and the GitHub Actions security page → their
new canonical hosts, cited content verbatim-intact). Original verification dates below
are unchanged (they record first verification); only the five fixed URLs were touched.

Verification date for all direct fetches below: **2026-08-13**.

---

## Verified by direct fetch (2026-08-13)

| Standard | URL | What was confirmed |
|---|---|---|
| OWASP Top 10:2025 | https://top10.owasp.org/2025 | Categories A01–A10:2025 verbatim (A01 Broken Access Control … A10 Mishandling of Exceptional Conditions). |
| OWASP Top 10 for LLM Applications 2025 | https://genai.owasp.org/llm-top-10/ | LLM01–LLM10:2025 names verbatim. A 2026 edition now exists (verified 2026-08-21; see the verification addendum below). |
| OWASP Top 10 for LLM Applications 2025 (resource) | https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/ | Edition landing page; document publication 2024-11-17. |
| OWASP Top 10 for Agentic Applications 2026 | https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ | Framework exists; published 2025-12-09; peer-reviewed by 100+ practitioners. (ASI01–ASI10 titles later confirmed verbatim from the official 2025-12-09 announcement — see the 2026-08-21 addendum below; the authoritative PDF was not re-fetched and wins on any conflict.) |
| OWASP API Security Top 10 (2023) | https://api-security.owasp.org/editions/2023/en/0x11-t10 | API1–API10:2023 names verbatim. |
| CWE-502 — Deserialization of Untrusted Data | https://cwe.mitre.org/data/definitions/502.html | Deserializing attacker- or otherwise-untrusted serialized data. Security face: can enable RCE (never auto-deserialize untrusted input — `security-appsec.md` A08). Data-integrity face: a parser weaker than its builder reintroduces a fabricated value across serialize→parse — re-derive computed fields + validate element shape, never trust the serialized form (`data-quality.md`). Stable identifier; by-name. |
| CWE Top 25 (2025) | https://cwe.mitre.org/top25/archive/2025/2025_cwe_top25.html | Official 2025 edition, last updated 2025-12-15; top entries (XSS, SQLi, CSRF, Missing Authorization, OOB Write, Path Traversal, Use-After-Free, OOB Read, OS Command Injection, Code Injection). |
| WCAG 2.2 | https://www.w3.org/TR/WCAG22/ | W3C Recommendation, dated 2024-12-12; conformance levels A/AA/AAA; WCAG 3.0 still in development. |
| EU Accessibility Act (EAA) — Directive (EU) 2019/882 | https://eur-lex.europa.eu/eli/dir/2019/882/oj | "Directive (EU) 2019/882 … on the accessibility requirements for products and services." Covers consumer digital surfaces on the EU market — e-commerce, consumer banking / payment terminals, passenger-transport ticketing & self-service, e-readers, computers / operating systems. (The directive mandates functional accessibility requirements to be met via future harmonised standards; it does **not** name EN 301 549 or WCAG on this page — those appear in the skill body as engineering leads *by name only*, not sourced here.) In-scope / micro-enterprise exemption / timelines routed to counsel (not encoded). Fetched 2026-09-19. |
| EU NIS2 Directive — Directive (EU) 2022/2555 | https://eur-lex.europa.eu/eli/dir/2022/2555/oj | "Directive (EU) 2022/2555 … on measures for a high common level of cybersecurity across the Union … repealing Directive (EU) 2016/1148" (NIS2). Applies to medium-sized+ **essential** and **important** entities across covered sectors (energy, transport, digital infrastructure, cloud / data centres / DNS, online marketplaces / search / social networks, health, drinking/waste water, public administration, space, postal, trust services; financial entities fall under DORA, Regulation (EU) 2022/2554). The preamble previews risk-management-measure categories — risk assessment, incident handling, access control, basic cyber hygiene (zero-trust, updates, segmentation, identity/access), training, and physical/environmental security; the full measure set (including business continuity and supply-chain security) and the staged incident-reporting windows were **not** pinned down in the fetch and are cited by name only (reporting is to "the CSIRT, the competent authority or the single point of contact"). In-scope / essential-vs-important / authority / timelines / management accountability routed to counsel (not encoded). Fetched 2026-09-19. |
| W3C Global Privacy Control (GPC) | https://w3c.github.io/gpc/ | "a mechanism for expressing a person's general universal preference for a do-not-sell-or-share interaction in HTTP requests" — the `Sec-GPC` request header (value `1`) + the `navigator.globalPrivacyControl` boolean; excludes deletion / same-context use; "at least four states have specifically identified GPC as a valid means to exercise legal opt-out rights" (legal force jurisdiction-specific → route to counsel). Fetched 2026-09-19. |
| W3C Internationalization — authoring techniques | https://www.w3.org/International/techniques/authoring-html | "Choose UTF-8 for all content" + always declare encoding in-document; declare `lang` and `dir="rtl"`, "tightly wrap every opposite-direction phrase in markup that sets its base direction"; NFC recommended for identifiers. Fetched 2026-09-19. |
| Unicode UAX #15 — Normalization Forms | https://www.unicode.org/reports/tr15/ | Unicode 18.0.0 (2026-08-12); NFC/NFD/NFKC/NFKD; "None of the Normalization Forms are closed under string concatenation … even if two strings X and Y are normalized, their string concatenation X+Y is not guaranteed to be normalized." Fetched 2026-09-19. |
| Unicode UAX #9 — Bidirectional Algorithm | https://www.unicode.org/reports/tr9/ | Unicode 18.0.0 (2026-09-01); explicit directional-formatting controls — overrides (RLO/LRO), isolates (RLI/LRI/FSI/PDI, the safer mechanism), terminators (PDF/PDI); the overrides "are to be avoided wherever possible, because of security concerns" (see UTR #36 — the Trojan-Source class). Fetched 2026-09-19. |
| Unicode UTS #39 — Security Mechanisms | https://www.unicode.org/reports/tr39/ | Unicode 18.0.0; a stable UTS, citable as a normative reference. §4 Confusable Detection — the *skeleton* algorithm ("The strings X and Y are defined to be confusable if and only if skeleton(X) = skeleton(Y)"), single- / mixed- / whole-script confusables; §5.1 mixed-script detection (a string is mixed-script if its *resolved script set* is empty); §5.2 restriction levels (ASCII-Only / Single Script / Highly Restrictive / Moderately Restrictive / Minimally Restrictive / Unrestricted). Backs the confusable/homograph trust-signal check. Fetched 2026-09-19. |
| Unicode UAX #29 — Text Segmentation | https://www.unicode.org/reports/tr29/ | Unicode 18.0.0; a stable Standard Annex, integral to the Unicode Standard. §3 Grapheme Cluster Boundaries — the *extended grapheme cluster* may span multiple code points (base + combining marks, ZWJ emoji sequences, Hangul jamo); "user-perceived character counts … should correspond to the number of segments delimited by grapheme cluster boundaries" (the formal boundary spec is §3.1 / §3.1.1). Backs the grapheme-safe truncation/count check. Fetched 2026-09-19. |
| RFC 8259 — JSON Data Interchange Format | https://www.rfc-editor.org/rfc/rfc8259 | Internet Standard STD 90. §6 Numbers: "good interoperability can be achieved by implementations that expect no more precision or range than [IEEE 754 binary64] provide," and integers "in the range [-(2**53)+1, (2**53)-1] are interoperable in the sense that implementations will agree exactly on their numeric values." Backs the "integer past 2^53 is silently rounded across a JSON boundary" check. Fetched 2026-09-19. |
| RFC 8594 — The Sunset HTTP Header Field | https://www.rfc-editor.org/rfc/rfc8594 | Informational (current, not obsoleted; May 2019). Defines the `Sunset` response header — a single HTTP-date signaling that "a URI is likely to become unresponsive at a specified point in the future" (a hint, not a guarantee) — plus a `sunset` link relation. Does NOT define a `Deprecation` header (a separate RFC, cited by name only). Backs the machine-readable deprecation-window signal in the API breaking-change discipline. Fetched 2026-09-19. |
| PostgreSQL + MySQL docs — transaction isolation & DDL locking | https://www.postgresql.org/docs/current/transaction-iso.html | PostgreSQL default isolation is **Read Committed** ("Read Committed is the default isolation level in PostgreSQL"); lost update / write skew are not prevented there without `SELECT … FOR UPDATE` / a higher level; SERIALIZABLE — "applications … must be prepared to retry transactions due to serialization failures" (SQLSTATE `40001`). MySQL/InnoDB default is **REPEATABLE READ** (dev.mysql.com/doc/refman/8.4/en/innodb-transaction-isolation-levels.html). `ALTER TABLE` acquires `ACCESS EXCLUSIVE` unless noted (conflicts with all modes) — but `ADD FOREIGN KEY` takes only the weaker `SHARE ROW EXCLUSIVE`; `ADD CONSTRAINT … NOT VALID` + `VALIDATE CONSTRAINT` (`SHARE UPDATE EXCLUSIVE`) and `CREATE UNIQUE INDEX CONCURRENTLY` are the low-lock forms (sql-altertable.html). Head-of-line queue blocking is the lock-manager wait-queue rule — "granted immediately if it does not conflict with any existing or waiting lock request" (`src/backend/storage/lmgr/README`). `ADD COLUMN` cost (same page, sql-altertable.html), verbatim: a non-volatile default is metadata-only — "making the `ALTER TABLE` very fast even on large tables … In neither case is a rewrite of the table required"; only "a volatile `DEFAULT` (e.g., `clock_timestamp()`), a stored generated column, an identity column, or a column with a domain data type that has constraints will cause the entire table and its indexes to be rewritten" (a virtual generated column never does). Five pages fetched 2026-09-19; `ADD COLUMN` rewrite-trigger lines re-verified 2026-09-21. |
| MDN Web Docs — web frontend security (4 pages) | https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage | Four pages, each fetched 2026-09-19 — postMessage (`/docs/Web/API/Window/postMessage`), Subresource Integrity (`/docs/Web/Security/Subresource_Integrity`), Referrer-Policy (`/docs/Web/HTTP/Reference/Headers/Referrer-Policy`), Trusted Types API (`/docs/Web/API/Trusted_Types_API`). `Window.postMessage` — "always verify the sender's identity using the `origin` and possibly `source` properties" (receiver checks `event.origin` + message syntax; CWE-346). Subresource Integrity — an `integrity` hash (sha256/384/512) + `crossorigin` lets the browser refuse a CDN-altered resource. Referrer-Policy — controls the `Referer` header; modern default `strict-origin-when-cross-origin` (since the Nov-2020 revision), so the finding is a *weakened* policy or a token-bearing URL. Trusted Types — the `require-trusted-types-for 'script'` CSP directive forces DOM sinks to typed values (Baseline 2026; a tinyfill for older browsers stubs the API but enforces nothing). |
| CWE-1339 — Insufficient Precision or Accuracy of a Real Number | https://cwe.mitre.org/data/definitions/1339.html | "The product processes a real number with an implementation in which the number's representation does not preserve required accuracy and precision in its fractional part, causing an incorrect result." Taxonomy anchor for precision-loss-at-a-boundary; does NOT cover non-finite (NaN/Infinity) — those are cited as IEEE 754 behavior (see the by-name list), not to this CWE. Fetched 2026-09-19. |
| Unicode CLDR — plural rules | https://cldr.unicode.org/index/cldr-spec/plural-rules | Six plural categories (zero / one / two / few / many / other); "languages vary in how they handle plurals"; `other` is the required default every language has. Fetched 2026-09-19. |
| The Twelve-Factor App — IX Disposability | https://12factor.net/disposability | "For a web process, graceful shutdown is achieved by ceasing to listen on the service port (thereby refusing any new requests), allowing any current requests to finish, and then exiting"; "For a worker process, graceful shutdown is achieved by returning the current job to the work queue"; processes "minimize startup time" and are "robust against sudden death." Backs the graceful-shutdown goal in `reliability-error-handling.md`; the readiness/LB ordering there is this skill's own load-balanced extension, not stated by 12-Factor. Fetched 2026-09-19. |
| Google Engineering Practices — Standard of Code Review | https://google.github.io/eng-practices/review/reviewer/standard.html | Core standard: approve once the change "definitely improves the overall code health," even if imperfect. |
| Diátaxis | https://diataxis.fr/ | Four documentation types: Tutorials, How-to guides, Reference, Explanation. |
| C4 model | https://c4model.com/ | Four abstraction levels: Context, Container, Component, Code. |
| OWASP Top 10:2025 — A03 detail | https://top10.owasp.org/2025/A03_2025-Software_Supply_Chain_Failures | A03 absorbed the former A06:2021 "Vulnerable and Outdated Components"; explicitly covers software that is "vulnerable, unsupported, or out of date"; guidance to upgrade "in a risk-based, timely fashion" and to "deliberately choose which version of a dependency you use and upgrade only when there is need"; names OWASP Dependency-Track / Dependency-Check / retire.js as inventory tools. |
| OpenSSF Scorecard | https://github.com/ossf/scorecard | Automated repo security scorer (0–10 per check). Check names verbatim: `Maintained` (active within ~90 days), `Dependency-Update-Tool` (Dependabot/Renovate present), `Vulnerabilities` (unfixed vulns, via the OSV service), `Pinned-Dependencies`. |
| OSV | https://osv.dev/ | Distributed open-source vulnerability database spanning 40+ package ecosystems (npm, PyPI, Go, Maven, Debian, …); `osv-scanner` scans a lockfile or SBOM and queries by package version or commit hash. |
| Semantic Versioning | https://semver.org/ | MAJOR = "incompatible API changes"; MINOR = "add functionality in a backward compatible manner"; PATCH = "backward compatible bug fixes." |
| GitHub Dependabot — version updates | https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates | Opens automated PRs to update dependencies to the latest version "even when they don't have any vulnerabilities"; documented reviewer step is to "check that your tests pass, review the changelog and release notes." (This page did **not** state that Dependabot PRs auto-trigger CI or support grouping — those are not claimed by the skill.) |
| endoflife.date | https://endoflife.date/ | Tracks end-of-life / support-lifecycle dates for 400+ products (programming languages, frameworks, databases, OSes, devices, cloud services); offers an API. |
| CISA KEV (Known Exploited Vulnerabilities catalog) | https://www.cisa.gov/known-exploited-vulnerabilities-catalog | CISA "maintains the authoritative source of vulnerabilities that have been exploited in the wild"; guidance: "Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework" (an input to prioritization, not a standalone bar). Fetched 2026-09-18. |
| FIRST EPSS (Exploit Prediction Scoring System) | https://www.first.org/epss/ | "a data-driven machine-learning model that estimates the probability that a published CVE will be exploited in the wild" "in the next 30 days"; complements CVSS (EPSS = likelihood, CVSS = severity); maintained by the EPSS Special Interest Group at FIRST. Cast as an input to focus remediation effort, not a standalone verdict. Fetched 2026-09-18. |
| Package hallucination / slopsquatting (USENIX Security 2025) | https://www.usenix.org/system/files/usenixsecurity25-spracklen.pdf | Spracklen et al., "We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs" — across 576k samples / 16 models, at least 21.7% of packages recommended by open-source models and 5.2% by commercial models were non-existent; 205,474 unique hallucinated names; ~43% recurred on every one of 10 re-runs (a predictable pre-registration target). "Slopsquatting" = an attacker registering a hallucinated name. Verified against the USENIX PDF (fetched 2026-09-19); the authors' GitHub (Spracks/PackageHallucination) corroborates 205,474 names / 576k samples / 16 models and states a 19.7% overall (all-models) hallucination rate. |
| FIRST CVSS (Common Vulnerability Scoring System) | https://www.first.org/cvss/ | "CVSS provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity"; currently v4.0; maintained by FIRST. Severity (how bad) — distinct from EPSS's exploitation likelihood and KEV's exploited-in-the-wild fact. Fetched 2026-09-18. |

Reference repository reviewed for patterns (not a standard):
`nickmaglowsch/claude-setup` — https://github.com/nickmaglowsch/claude-setup
(diff-scoped review packets; a decorrelated cross-model second opinion on
sensitive diffs — auth, payments, crypto, concurrency, DB migrations).

## Verified by direct fetch (2026-08-14) — meta-review additions

Verification date for the rows below: **2026-08-14**. Added while extending the
skill's documentation/DX, repository-hygiene, cross-agent-portability, and
durable-standards coverage.

| Standard / source | URL | What was confirmed |
|---|---|---|
| GitHub community health files | https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/about-community-profiles-for-public-repositories | Recommended community-health files: README, CODE_OF_CONDUCT, LICENSE, CONTRIBUTING, SECURITY, and issue + pull-request templates; issue templates must live in `.github/ISSUE_TEMPLATE`. (Folder precedence for other files, and "LICENSE must be in-repo," were **not** reproduced on this fetch — not asserted by the skill.) |
| OpenSSF Best Practices Badge (passing criteria) | https://www.bestpractices.dev/en/criteria/0 | Passing-level **MUST** items used as hygiene checks: a FLOSS license posted in a standard location; a published process for reporting vulnerabilities; per-release human-readable release notes; at least one automated test suite. Documented contribution requirements is **SHOULD**, not MUST. |
| OpenSSF Scorecard — checks catalog | https://github.com/ossf/scorecard/blob/f92023a3f77879f96e0c9c1305f289d755be4bb6/docs/checks.md | Verbatim check descriptions: Branch-Protection ("default and release branches are protected"), Code-Review ("requires human code review before pull requests … are merged"), CI-Tests ("runs tests before pull requests are merged"), License, Security-Policy, Maintained. (Distinct from the Scorecard repo-root row above.) (SHA-pinned f92023a; re-verified 2026-09-21) |
| AGENTS.md | https://agents.md/ | "A simple, open format for guiding coding agents" — a cross-vendor Markdown file at the repo root; nested files take precedence for their subprojects. (No adoption count or governing body asserted.) |
| Claude Code — memory / CLAUDE.md | https://code.claude.com/docs/en/memory | CLAUDE.md and auto-memory are "context, not enforced configuration. To block an action regardless of what Claude decides, use a PreToolUse hook instead." Claude Code reads `CLAUDE.md`, not `AGENTS.md`; bridge an existing `AGENTS.md` via an `@AGENTS.md` import or `ln -s AGENTS.md CLAUDE.md`. Project file at `./CLAUDE.md` or `./.claude/CLAUDE.md`. |
| pre-commit | https://pre-commit.com/ | "A framework for managing and maintaining multi-language pre-commit hooks." Config `.pre-commit-config.yaml`; installed with `pre-commit install`; runs on staged files before a commit completes. |
| Development Containers | https://containers.dev/ | A dev container "allows you to use a container as a full-featured development environment" for consistency across local/remote/CI. (Exact config-file path not asserted.) |
| github/scripts-to-rule-them-all | https://github.com/github/scripts-to-rule-them-all | Normalized script names (`script/bootstrap`, `setup`, `update`, `server`, `test`, `cibuild`, `console`) so contributors "only need to know the pattern"; goal: contribute "without first learning how to bootstrap the project or how to get its tests to run." |
| EditorConfig | https://editorconfig.org/ | `.editorconfig` standardizes indent style/size, charset, end-of-line, trailing-whitespace, and final-newline across editors/IDEs. |
| Keep a Changelog 1.1.0 | https://keepachangelog.com/en/1.1.0/ | `CHANGELOG.md`; "Changelogs are for humans, not machines"; an `Unreleased` section; categories Added / Changed / Deprecated / Removed / Fixed / Security; newest version first. |

## Verified by direct fetch (2026-08-14) — branch & merge triage additions

Verification date for the rows below: **2026-08-14**. Added for the branch,
merge & open-work triage capability (`references/branch-and-merge-hygiene.md`,
`SKILL.md` domain S). The `git` enumeration commands were additionally validated
this session against a scratch repository covering normal-merge, single- and
multi-commit squash-merge, rebase-merge, stale-unmerged, diverged, and
deleted-remote branches.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Trunk-Based Development | https://trunkbaseddevelopment.com/ | "developers collaborate on code in a single branch called 'trunk' and resist any pressure to create other long-lived development branches"; "all team members commit to trunk at least once every 24 hours"; short-lived review branches "should only last a couple of days" — beyond two days risks "a long-lived feature branch (the antithesis of trunk-based development)." No `develop` branch. |
| GitHub flow | https://docs.github.com/en/get-started/using-github/github-flow | Six ordered steps — create a branch → make changes → create a pull request → address review comments → merge your pull request → delete your branch — merging into "the default branch." The current docs contain **no** "main is always deployable" / deploy / production language (verified against the primary `github/docs` markdown); that property is attestable only via GitLab characterizing GitHub flow, not GitHub's own page. |
| GitHub — Linking a pull request to an issue | https://docs.github.com/en/issues/tracking-your-work-with-issues/using-issues/linking-a-pull-request-to-an-issue | Auto-close is default-branch-scoped: "When you merge a linked pull request into the default branch of a repository, its linked issue is automatically closed"; the closing keywords (close/closes/closed, fix/fixes/fixed, resolve/resolves/resolved) are "interpreted only when the pull request targets the repository's default branch." Fetched 2026-09-18. |
| GitLab flow | https://about.gitlab.com/topics/version-control/what-is-gitlab-flow/ | "all features and fixes go to the `main` branch while enabling `production` and `stable` branches"; a pre-production branch takes bug fixes before production; "Commits flow downstream to ensure that every line of code is tested in all environments." The **"upstream first"** phrasing is confirmed from GitLab's archived FOSS docs (`gitlab-foss` `doc/workflow/gitlab_flow.md`, pinned commit, uses `master`), not this page; `docs.gitlab.com/topics/gitlab_flow/` returned a 302 to an auth endpoint this session and was not retrieved. |
| git-flow branching model (Vincent Driessen) | https://nvie.com/posts/a-successful-git-branching-model/ | Two long-lived branches — `master` ("production-ready state") + `develop` ("latest delivered development changes for the next release"); feature branches "Must merge back into: develop"; plus release and hotfix branches. Author's 2020 note: for continuous delivery "adopt a much simpler workflow (like GitHub flow) instead of trying to shoehorn git-flow." (Original uses `master`.) |
| Patterns for Managing Source Code Branches (M. Fowler) | https://martinfowler.com/articles/branching-patterns.html | Mainline = "A single, shared, branch that acts as the current state of the product"; Continuous Integration integrates to mainline "usually less than a day's work"; Feature Branching integrates "when the feature is complete"; smaller/more-frequent integrations carry "less risk," and "Branches inevitably diverge," making later merges harder. (The exact phrase "merge debt" does **not** appear on the page.) |
| GitHub — About merge methods on GitHub | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/about-merge-methods-on-github | Merge commit (default): "all commits from the feature branch are added to the base branch in a merge commit" (uses `--no-ff`). Squash: "the pull request's commits are squashed into a single commit" for "a more streamlined Git history." Rebase: commits "added onto the base branch individually without a merge commit … resembles a fast-forward merge by maintaining a linear project history." An admin "can enforce one type of merge method … by only enabling the desired method." |
| GitHub — About protected branches | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches | Branch protection rules "define whether collaborators can delete or force push to the branch and set requirements for any pushes"; named settings incl. "Require pull request reviews before merging," "Require status checks before merging," "Require linear history," "Require merge queue," "Allow force pushes," "Allow deletions." |
| GitHub — Managing a branch protection rule | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule | Settings labelled "Require a pull request before merging," "Require approvals," "Require status checks to pass before merging," "Do not allow bypassing the above settings," "Restrict who can push to matching branches." (Verbatim labels differ from the About-protected-branches page; attributed separately.) |
| GitHub — Managing a merge queue | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue | "A merge queue helps increase velocity by automating pull request merges into a busy branch and ensuring the branch is never broken by incompatible changes"; each PR is grouped "with the latest version of the `base_branch` as well as changes from pull requests ahead of it in the queue"; required via the "Require merge queue" protection setting. |
| GitHub — Managing the automatic deletion of branches | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-the-automatic-deletion-of-branches | "You can have head branches automatically deleted after pull requests are merged"; "Branch protection rules and repository rules can also prevent branches being automatically deleted." |
| GitHub — Deleting and restoring branches in a pull request | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-branches-in-your-repository/deleting-and-restoring-branches-in-a-pull-request | A branch associated with a merged/closed PR can be deleted; "You can restore the head branch of a closed pull request." |
| git reference manual — branch / log / cherry / for-each-ref | https://git-scm.com/docs/git-branch · https://git-scm.com/docs/git-log · https://git-scm.com/docs/git-cherry · https://git-scm.com/docs/git-for-each-ref | `--merged [<commit>]` / `--no-merged [<commit>]` list branches whose tips **are / are not** reachable from `<commit>`. `git log <base>..<branch>` = commits reachable from `<branch>` but not `<base>`. `git cherry` = "Find commits yet to be applied to upstream" (prefix `-` = an equivalent is already upstream, `+` = not). `git for-each-ref --sort=committerdate refs/heads` orders local branches by last-commit date (`committerdate` is a numeric sort key; `-` prefix reverses). |

## Verified by direct fetch (2026-08-17) — ASVS

Verification date: **2026-08-17**.

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP ASVS | https://github.com/OWASP/ASVS | Latest stable version **5.0.0** (dated May 2025). Preferred requirement id form `v<version>-<chapter>.<section>.<requirement>` (e.g. `v5.0.0-1.2.5`); a bare `1.2.5` refers to the latest version. Use as a verification checklist — claiming "ASVS covered" in a review requires naming the exact chapters/requirements actually checked, not a bare "ASVS" label. (Repointed 2026-09-18 from the retired `owasp.org/www-project-application-security-verification-standard/`, now 404; ASVS 5.0's assurance-level model for **V7 (Session Management)** was re-verified by direct fetch of the `v5.0.0_release` spec on 2026-09-20 — 7.3.1 = L2, 7.3.2 = L2, 7.4.1 = L1, matching this repo's `security-appsec.md` citations; other chapters/levels not cited here remain unverified — check the 5.0 spec before citing them.) |

## Verified by direct fetch (2026-08-17) — install / Cursor portability

Verification date for the row below: **2026-08-17**. Added for `install.sh
--with-cursor` and global `~/.cursor/skills/` installs.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Cursor — Agent Skills | https://cursor.com/docs/skills | Skills load from `.agents/skills/`, `.cursor/skills/`, `~/.agents/skills/`, `~/.cursor/skills/`; **also** from Claude/Codex dirs (`.claude/skills/`, `.codex/skills/`, and the `~/` variants) for compatibility. Each skill is a folder with `SKILL.md` (YAML `name` + `description`); optional `references/`, `scripts/`, `assets/`. |

## Verified by direct fetch (2026-08-21) — WCAG success-criteria details

Verification date for the rows below: **2026-08-21**. Added for the a11y
gate-vs-standard rule (`SKILL.md` Phase 1) and the cross-view consistency pass
(`references/frontend-a11y.md`). Each row fetched from its W3C "Understanding"
page this session.

| Standard / source | URL | What was confirmed |
|---|---|---|
| WCAG 2.2 SC 1.4.3 Contrast (Minimum) | https://www.w3.org/WAI/WCAG22/Understanding/contrast-minimum.html | Level AA. Inactive-component exception, verbatim: text/images of text "that are part of an inactive user interface component … have no contrast requirement"; inactive = "not available for user interaction (e.g., a disabled control in HTML)." Basis for "a contrast gate flagging disabled controls is stricter than its standard." |
| WCAG 2.2 SC 3.2.4 Consistent Identification | https://www.w3.org/WAI/WCAG22/Understanding/consistent-identification.html | Level AA. Requirement verbatim: "Components that have the same functionality within a set of web pages are identified consistently." Basis for the same-action-two-labels cross-view finding. |
| WCAG 2.2 SC 3.2.6 Consistent Help | https://www.w3.org/WAI/WCAG22/Understanding/consistent-help.html | Level A; new in WCAG 2.2. Repeated help mechanisms (human contact details/mechanism, self-help, automated contact) "occur in the same order relative to other page content, unless a change is initiated by the user." Sibling criterion for help/contact placement. |

## Verified by direct fetch (2026-09-08) — software-house roles & agent orchestration

Verification date for the rows below: **2026-09-08**. Added for the delivery
role roster (`agentic-delivery/references/roles.md`), the evaluator/adversary
framing (`idea-critic`), and the orchestration discipline (worktree isolation,
preflight, render-surface discriminator) in `agentic-delivery` and
`references/parallel-audit.md`. Each row fetched this session; where a claim was
not on the fetched page, the row says so.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Anthropic — Building Effective AI Agents | https://www.anthropic.com/engineering/building-effective-agents | Published 2024-12-19. Named workflow patterns verbatim: **Prompt chaining**, **Routing**, **Parallelization** ("LLMs work simultaneously on a task and have their outputs aggregated"), **Orchestrator-workers** ("a central LLM dynamically breaks down tasks, delegates them to worker LLMs, and synthesizes their results"), **Evaluator-optimizer** ("one LLM call generates a response while another provides evaluation and feedback in a loop"), and autonomous **Agents**. Guidance: prefer the simplest sufficient structure; add multi-step/agentic complexity only when simpler solutions fall short. |
| Claude Code — Subagents | https://code.claude.com/docs/en/sub-agents | `docs.claude.com/en/docs/claude-code/sub-agents` 301→ this URL this session. "Each subagent runs in its own context window with a custom system prompt, specific tool access, and independent permissions." Least privilege via a `tools` allowlist or `disallowedTools` denylist. Single-responsibility: "Define a custom subagent when you keep spawning the same kind of worker with the same instructions." Parallelism: "For independent investigations, spawn multiple subagents to work simultaneously." |
| Anthropic — Agent Skills (overview) | https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview | `docs.claude.com/…/agent-skills/overview` 302→ this URL this session. `SKILL.md` YAML frontmatter requires `name` + `description`. **Progressive disclosure**: Level 1 metadata always loaded (~100 tokens/skill), Level 2 SKILL.md body loaded when triggered, Level 3 bundled resources/scripts read only as needed. `description` ≤1024 chars; `name` ≤64 chars, lowercase/digits/hyphens, cannot contain "anthropic"/"claude". Claude Code discovers filesystem Skills in `~/.claude/skills/` (personal) or `.claude/skills/` (project). "Compose capabilities: Combine Skills for complex, multistep tasks." Security note: use only trusted Skills; externally-fetched content is a risk surface. |
| MetaGPT (Hong et al.) | https://arxiv.org/abs/2308.00352 | Title "MetaGPT: Meta Programming for A Multi-Agent Collaborative Framework." Abstract confirmed: it "encodes Standardized Operating Procedures (SOPs) into prompt sequences," assigns "diverse roles to various agents" in "an assembly line paradigm," lets agents "verify intermediate results and reduce errors," and targets "cascading hallucinations caused by naively chaining LLMs." (The specific product-manager/architect/engineer/QA role list is **not** quoted verbatim from the abstract fetched this session.) |
| ChatDev (Qian et al.) | https://arxiv.org/abs/2307.07924 | Title "ChatDev: Communicative Agents for Software Development." Abstract confirmed: specialized LLM-driven agents collaborate across the software lifecycle — "design, coding, and testing" — guided in what to communicate (a chat chain) and how (via "communicative dehallucination"). (Specific role titles such as CEO/CTO and a documentation phase are **not** quoted verbatim from the abstract fetched this session.) |

## Verified by direct fetch (2026-09-08) — model-tiering, release engineering & retrospectives

Verification date for the rows below: **2026-09-08**. Added for
`references/model-tiering.md`, `references/release-engineering.md`,
`agentic-delivery/references/retrospective.md` + `template-postmortem.md` +
`template-adr.md`, the G0 appetite line, and the §8 spike/prototype-branch
convention in `branch-and-merge-hygiene.md`.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude docs — Choosing the right model | https://platform.claude.com/docs/en/about-claude/models/choosing-a-model | Names the three-tier model family and the general guidance to match model strength to task complexity rather than run everything on the strongest tier. |
| Claude docs — Optimizing for cost and intelligence | https://platform.claude.com/docs/en/about-claude/models/optimizing-for-cost-and-intelligence | Source for `model-tiering.md`'s levers: effort/reasoning-depth tuning as a same-model lever; prefix/prompt caching as the largest single cost lever on an agentic task (cost grows roughly with the square of turn count without it); the Batch API as a flat discount for unattended work; escalate-on-failure (cheap-first, re-run failures at full strength) reaching comparable pass rate for meaningfully less cost than running everything strong; a per-lane token budget as a direct cost/quality dial; a bounded advisor-consult pattern (a couple of calls per task) as a cheaper alternative to a full model swap, with a measured quality regression if over-used; and judging model choice by cost-per-*solved*-task rather than cost-per-token, since a pricier-per-token model can solve enough more tasks to cost less overall. |
| Claude docs — Prompt caching | https://platform.claude.com/docs/en/build-with-claude/prompt-caching | A cached prefix is billed well below fresh input on re-send; supports the "mark the shared fan-out packet cacheable" addition in `parallel-audit.md` §1. |
| Claude docs — Batch processing | https://platform.claude.com/docs/en/build-with-claude/batch-processing | Confirms the batch-API discount mechanism for unattended/async work named in `model-tiering.md`. |
| Aider — "Separating code reasoning and editing" | https://aider.chat/2024/09/26/architect.html | 2024-09-26. A production-shipped instance of a strong-model-plans / cheaper-model-executes split (architect/editor mode), cited as prior art for tiering plan vs. execute onto different model strengths — not quoted for specific pass-rate numbers here, since those are model-version-dated and not load-bearing for this skill's vendor-neutral guidance. |
| RouteLLM (Ong, Almahairi, Wu, Chiang, Wu, Gonzalez, Stoica, Zhang) | https://arxiv.org/abs/2406.18665 | Demonstrates the general routing principle: dynamically routing between a strong and weak LLM cuts cost substantially without giving up response quality, and a trained router transfers across different strong/weak model pairs at test time — general support for "tier by task, not by default," not a specific number this skill asserts. |
| DORA — Core metrics | https://dora.dev/guides/dora-metrics-four-keys/ | The framework is **five** metrics in two categories: Throughput (change lead time, deployment frequency, failed-deployment recovery time) and Instability (change fail rate, deployment rework rate — the share of deployments that are unplanned but happen as a result of a production incident). **Single-source caveat:** confirmed by direct fetch of this page only; re-verify against a second source before treating these exact names as final, since DORA revises this page over time. |
| DORA — research programme | https://dora.dev/research/ , https://dora.dev/ | A Google Cloud–led research programme; DORA Core is framed as the most firmly-established findings, intended as a practitioner guide. |
| *Accelerate* (Forsgren, Humble, Kim) | https://itrevolution.com/product/accelerate/ | Publisher landing page only — confirms authorship and the State of DevOps report lineage, not a source for specific statistical claims (marketing copy, not the study itself). |
| Martin Fowler — Feature Toggles | https://martinfowler.com/articles/feature-toggles.html | Four categories confirmed verbatim: Release Toggles ("should generally not stick around much longer than a week or two"), Experiment Toggles (A/B/cohort), Ops Toggles (operator kill-switch), Permissioning Toggles (feature by segment). Toggle debt named explicitly: "Savvy teams view the Feature Toggles in their codebase as inventory which comes with a carrying cost." |
| Martin Fowler — Canary Release | https://martinfowler.com/bliki/CanaryRelease.html | Traffic split to a small subset first (random sample / internal users / demographic), widened as confidence grows; names a "cluster immune system" — automatic rollback on business-metric regression, not error rate alone. |
| Martin Fowler — Blue-Green Deployment | https://martinfowler.com/bliki/BlueGreenDeployment.html | Two near-identical environments; cutover is a router flip; rollback is flipping the router back. |
| Google SRE book — Postmortem Culture: Learning from Failure | https://sre.google/sre-book/postmortem-culture/ | Blameless principle verbatim: "assumes that everyone involved in an incident had good intentions and did the right thing with the information they had." Trigger criteria: user-visible downtime/degradation past a threshold, data loss, on-call intervention, resolution time above a threshold, a monitoring failure that delayed detection, or a stakeholder request. |
| Google SRE book — Example Postmortem (Shakespeare Search) | https://sre.google/sre-book/example-postmortem/ | Template section order confirmed: Summary → Impact → Root Causes → Trigger → Resolution → Detection → Action Items → Lessons Learned (what went well / poorly / where we got lucky) → Timeline → Supporting information. Action items carry an owner, a type, and a bug-tracker reference. |
| Google SRE workbook — Alerting on SLOs | https://sre.google/workbook/alerting-on-slos/ | Multiwindow, multi-burn-rate mechanism: for a 99.9% SLO, page at a 14.4× burn rate over 1h/5m windows, page at 6× over 6h/30m, ticket at 1× over 3d/6h — the short window exists so the alert clears minutes after the issue resolves rather than staying hot on stale data. This is the citation for `role-coverage.md`'s existing, previously-uncited burn-rate language; treat this row as adding the source and the exact window/multiplier values, not as an independently re-verified claim that the pre-existing prose matched these numbers line-by-line before this citation was added. |
| Michael Nygard — "Documenting Architecture Decisions" | http://cognitect.com/blog/2011/11/15/documenting-architecture-decisions | The original ADR post. Section set confirmed verbatim: Title (short noun phrase), Context (neutral statement of forces), Decision (full sentences, active voice, "We will…"), Status (proposed/accepted/deprecated/superseded), Consequences (all of them, not just the positive). Numbered sequentially, never reused; "should be one or two pages long." |
| MADR (Markdown Architectural Decision Records) | https://adr.github.io/madr/ | Template headers confirmed: Context and Problem Statement, Decision Drivers (optional), Considered Options, Decision Outcome (with optional Consequences/Confirmation), Pros and Cons of the Options (optional), More Information (optional) — only the first three are core, the rest explicitly removable. |
| Shape Up — Ch.3 "Set Boundaries" (Appetite) | https://basecamp.com/shapeup/1.2-chapter-03 | Verbatim: "An appetite is completely different from an estimate. Estimates start with a design and end with a number. Appetites start with a number and end with a design" — "fixed time, variable scope." Basis for G0's appetite line in `agentic-delivery/SKILL.md`. |
| Shape Up — Ch.4 "Find the Elements" (Breadboarding, Fat Marker Sketches) | https://basecamp.com/shapeup/1.3-chapter-04 | A breadboard "has all the components and wiring of a real device but no industrial design"; a fat marker sketch is deliberately too broad to add detail, so the team can't skip ahead to the wrong fidelity. Cited as the design-side precedent for a disposable-by-construction exploration; `branch-and-merge-hygiene.md` §8 applies the same idea to a branch-naming convention, not to Shape Up's own design ritual. |
| Test Pyramid (Ham Vocke, on Martin Fowler's site) | https://martinfowler.com/articles/practical-test-pyramid.html | 2018-02-26. Three layers bottom-to-top — Unit, Service/Integration, UI/E2E — attributed to Mike Cohn's original pyramid. "Write lots of small and fast unit tests. Write some more coarse-grained tests and very few high-level tests." |
| Testing Trophy (Kent C. Dodds) | https://kentcdodds.com/blog/write-tests | 2019-07-13. Layers bottom-to-top: Static, Unit, Integration, E2E. An explicit, named departure from the classic pyramid's unit-heavy shape — integration tests as the best confidence/speed trade-off for a modern, I/O-heavy app. |

## Verified by direct fetch (2026-09-08) — idea-critic hardening & Conductor operating rhythm

Verification date for the rows below: **2026-09-08**. Added for
`idea-critic/SKILL.md`'s `steelman` / `strongest_attack_survived` /
premortem / model-family-decorrelation additions, and `agentic-delivery/
SKILL.md`'s Conductor operating rhythm subsection.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Anthropic — How we built our multi-agent research system | https://www.anthropic.com/engineering/multi-agent-research-system | 2025-06-13. Verbatim: "Agents typically use about 4× more tokens than chat interactions, and multi-agent systems use about 15× more tokens than chats." Subagents given only "simple, short instructions" were observed duplicating each other's work (two independently re-investigating the same ground); the fix stated is that "each subagent needs an objective, an output format, guidance on the tools and sources to use, and clear task boundaries." Scaling tiers confirmed: 1 agent for simple fact-finding, 2-4 subagents for a direct comparison, 10+ only for a complex, clearly-divided task. Over-parallelization ("spawning 50 subagents for simple queries") named as an observed failure. |
| Anthropic — Effective context engineering for AI agents | https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents | 2025-09-29. Verbatim, under "Sub-agent architectures": a subagent "returns only a condensed, distilled summary of its work (often 1,000-2,000 tokens)... the detailed search context remains isolated within sub-agents, while the lead agent focuses on synthesizing and analyzing the results." Basis for the Conductor's event-driven, status-only attention model. |
| Claude Code — Best practices for agentic coding | https://code.claude.com/docs/en/best-practices | Verbatim, on adversarial review: "A reviewer prompted to find gaps will usually report some, even when the work is sound, because that is what it was asked to do... Tell the reviewer to flag only gaps that affect correctness or the stated requirements, and treat the rest as optional" — the demand-characteristic bias `idea-critic`'s steelman + `strongest_attack_survived` fields are designed against (force the record to be specific, not merely present). Also verbatim: "a fresh context improves code review since Claude won't be biased toward code it just wrote," cited in `roles.md`'s Independence bullet. |
| MAST — "Why Do Multi-Agent LLM Systems Fail?" (Cemri, Pan, Yang, Agrawal, Chopra, Tiwari, Keutzer, Parameswaran, Klein, Ramchandran, Zaharia, Gonzalez, Stoica) | https://arxiv.org/abs/2503.13657 | Submitted 2025-03-17. Abstract confirmed verbatim: three failure categories — "(i) system design issues, (ii) inter-agent misalignment, (iii) task verification" — across 14 unique failure modes and 1600+ annotated traces from 7 open-source multi-agent frameworks. The abstract does **not** enumerate the 14 individual failure-mode names — only the 3 category names are verbatim-confirmed there. **Deepen 2026-09-20:** the full-text HTML rendering (`https://arxiv.org/html/2503.13657` — the unpinned latest version, not the pinned 2025-03-17 submission) was curl-verified this session and **does** enumerate the modes verbatim, e.g. FM-1.3 "Step repetition", FM-1.5 "Unaware of termination conditions", FM-3.2 "No or incomplete verification"; the skill now cites these specific modes for the agent-correctness fold in `security-ai-agents.md`. The abstract-only caveat still holds for the pinned submission version. |
| Nemeth, Brown & Rogers (2001), "Devil's advocate versus authentic dissent: stimulating quantity and quality" | *European Journal of Social Psychology*, 31(6), 707–720. DOI: 10.1002/ejsp.58 | Verified via Crossref bibliographic API (abstract snippet, not full text — publisher returned 403 to direct fetch): "authentic minority was superior to all three forms of 'devil's advocate'" — assigned/manufactured dissent underperformed genuine dissent on stimulating group thought. Treat the mechanism as solidly established; the exact conditions tested and effect sizes are unconfirmed from this session's fetch. |
| Nemeth, C. J. (2018), *In Defense of Troublemakers: The Power of Dissent in Life and Business* | Basic Books. ISBN 978-0465096299 | Verified via Wikipedia's "Devil's advocate" article quoting the book directly: "Inauthentic dissent (assigning someone to act as a Devil's advocate) is considerably less effective in improving group decision-making than authentic dissent," and can leave people "more entrenched in their original beliefs." Secondary paraphrase of a trade book, not a primary journal source — light corroboration for the Nemeth et al. 2001 finding and for `idea-critic`'s false-closure-REVISE pitfall, not standalone grounding. |
| Panickssery, Bowman & Feng (2024), "LLM Evaluators Recognize and Favor Their Own Generations" | https://arxiv.org/abs/2404.13076 | "GPT-4 and Llama 2 have non-trivial accuracy at distinguishing themselves from other LLMs and humans," and self-recognition capability correlates with self-preference bias. Tested on GPT-4 and Llama 2 only — **not** Claude; transfer to other model families is a reasonable inference cited as such in `idea-critic`'s Independence step, not an independently tested finding. |
| Pre-mortem (Klein, G. (2007), "Performing a Project Premortem," *Harvard Business Review*, 85(9): 18–19) | Verified via Wikipedia's "Pre-mortem" article, cross-referenced by Kahneman, *Thinking, Fast and Slow* (2011) | A premortem assumes the project has already failed and works backward to explain why — a different elicitation frame from "what might go wrong," credited with increasing the likelihood the main threats get identified. No quantified effect size confirmed from this session's fetch; cited via Wikipedia's citation of the HBR piece, not the piece itself. |

## Verified by direct fetch (2026-09-09) — `agentic-delivery/references/fast-agentic-delivery.md`

Verification date for the rows below: **2026-09-09**. Added for the new concurrency-,
scheduling-, and merge-cadence reference in the `agentic-delivery` skill.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Kanban University, *Kanban Guide* | https://kanban.university/kanban-guide/ | A WIP limit's stated purpose, verbatim: "balance utilization and still ensure the flow of work"; "limiting the work that is allowed to enter the system is an important key to reducing delay and context switching which may result in poor timeliness, quality, and potentially waste"; a WIP limit as "an enabling constraint, which gives focus and develops behaviors such as collaboration and finishing started items with high quality." |
| Google Engineering Practices — Small CLs | https://google.github.io/eng-practices/review/developer/small-cls.html | "100 lines is usually a reasonable size for a CL, and 1000 lines is usually too large, but it's up to the judgment of your reviewer." Small CLs are reviewed more quickly and more thoroughly, introduce fewer bugs ("it's easier for you and your reviewer to reason effectively about the impact"), waste less effort on a wrong direction, and simplify rollback. |
| Wikipedia — Blast radius (computing sense) | https://en.wikipedia.org/wiki/Blast_radius | "In cloud computing, the term blast radius is used to designate the impact that a security breach of one single component of an application could have on the overall composite application." A sibling technical-debt sense: "how many otherwise redundant edits on different scripts would need to be made when changing something small" — the lockstep-surfaces problem named directly. |
| GitLab Docs — Merge trains | https://docs.gitlab.com/ci/pipelines/merge_trains/ | "Use merge trains to put merge requests in a queue. Each merge request is compared to the other, earlier merge requests, to ensure they all work together." Names the problem directly: "two merge requests can each pass their own pipeline, but their combined changes can still conflict." Each queued pipeline runs the change combined with the target branch **and** every earlier queued change (a third queued MR's pipeline tests all three, combined). |
| Brendan Gregg — Linux Load Averages: Solving the Mystery | https://www.brendangregg.com/blog/2017-08-08/linux-load-averages.html | "Adding the uninterruptible state means that Linux load averages can increase due to a disk (or NFS) I/O workload, not just CPU demand." Worked example: "a heavily disk-bound system might be extremely sluggish but only have a TASK_RUNNING [CPU-runnable] average of 0.1"; a decomposed `tar` archival showed a load average of 1.19 including 0.67 from uninterruptible disk reads against only 0.37 actual CPU utilization — the basis for "don't gate concurrency on `load1` alone." |

## Verified by direct fetch (2026-09-10) — dependency cooldown & CI/CD hardening

Verification date for the rows below: **2026-09-10**. Added for the
release-age-cooldown control (`references/dependency-currency-and-upgrades.md`)
and the CI/CD trigger-and-token hardening instrument (`references/appsec-supply.md`
A03, cross-referenced from `references/security-agent-skills.md` AST02).

| Standard / source | URL | What was confirmed |
|---|---|---|
| Renovate — `minimumReleaseAge` | https://docs.renovatebot.com/configuration-options/ | Supply-chain cooldown option: "Suppress branch/PR creation for X days" / "Prevent holding broken npm packages"; Renovate delays proposing an update until a package has been public for the configured duration, reducing exposure to newly-published malicious or broken releases. Associated option `minimumReleaseAgeBehaviour`. (Dependabot `cooldown` and npm/pnpm `min-release-age`-style keys were **not** fetched this session — confirm the exact key per ecosystem before citing.) |
| GitHub Actions — Secure use reference | https://docs.github.com/en/actions/reference/security/secure-use | Privileged workflows (`pull_request_target` / `workflow_run`) share the main-branch cache and may hold write access + secrets, so they "must not explicitly check out untrusted code" (verbatim). For inline scripts, "the preferred approach to handling untrusted input is to set the value of the expression to an intermediate environment variable" rather than inlining `${{ github.event.* }}` into a `run:` script. Set the default `GITHUB_TOKEN` to "read access only for repository contents," escalating per job as required. (`persist-credentials` on `actions/checkout` still **not** on this page. Repointed 2026-09-18 — the page was renamed from "Security hardening for GitHub Actions" to "Secure use reference".) |
| NIST AI Risk Management Framework — core functions (verified 2026-09-11) | https://www.nist.gov/itl/ai-risk-management-framework | The four core function names — **Govern, Map, Measure, Manage** — appear on the official NIST ITL framework page. Only the function names were confirmed here; the full AI RMF 1.0 (AI 100-1) and the Generative AI Profile (AI 600-1) control specifics were **not** fetched this session — cite those by name only (see the by-name list below). |

## Verified by direct fetch (2026-09-13) — agent context/memory lifecycle

Verification date for the rows below: **2026-09-13**. Added for the domain-C
"context & memory lifecycle" review lens (`references/security-ai-agents.md`) and
its 🚩 tells (the non-adversarial sibling to ASI06, plus the LLM06 tree-budget
clause). Each row fetched this session; where a date or claim was not on the
fetched page, the row says so.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Anthropic — Effective harnesses for long-running agents | https://www.anthropic.com/engineering/effective-harnesses-for-long-running-agents | Published 2025-11-26. Long-running agents "running out of context in the middle of [an] implementation, leaving the next session to start with a feature half-implemented and undocumented"; mitigations named — a progress file, git history, a feature checklist, and context compaction. Basis for the "constraint/state must survive compaction" lens. Newer than the already-indexed "Effective context engineering" (2025-09-29). |
| Anthropic — Context editing (docs) | https://platform.claude.com/docs/en/build-with-claude/context-editing | Undated page. Automatic clearing of the oldest tool results at a token threshold, replaced with placeholder text; strategy `clear_tool_uses_20250919`, option `clear_tool_inputs`; **`exclude_tools`** = "tool names whose tool uses and results should never be cleared. Useful for preserving important context." Basis for "exempt the constraint/authority-bearing result from clearing." |
| Anthropic — Compaction (docs) | https://platform.claude.com/docs/en/build-with-claude/compaction | Undated page. "Compaction extends the effective context length … by automatically summarizing older context when approaching the context window limit"; later requests drop content blocks before the `compaction` block. A custom `instructions` string "don't supplement the default prompt. They replace it completely" — basis for "a replacing summary instruction must still carry the constraints." Config `compact_20260112` (seen in a page example). |
| Anthropic — Memory tool (docs) | https://platform.claude.com/docs/en/agents-and-tools/tool-use/memory-tool | Undated page. Client-side persistent store under `/memories`; tool `memory_20250818`. Verbatim security guidance: "add validation that strips sensitive data before your handler writes the file"; "Periodically delete memory files that haven't been accessed in a long time" (expiry); path-traversal protection required. Injected prompt: "ASSUME INTERRUPTION: Your context window might be reset at any moment, so you risk losing any progress that is not recorded in your memory directory"; pairs with compaction to "preserve the information that must survive summarization." Basis for the memory write-validation + expiry checks. |
| Cognition — Don't Build Multi-Agents | https://cognition.com/blog/dont-build-multi-agents | By Walden Yan, dated 2025-06-12 on the page. Verbatim: "Share context, and share full agent traces, not just individual messages"; parallel subagents that "cannot see what the other was doing … end up being inconsistent." Basis for "handoff carries the full trace, not just the latest message." |
| langchain-ai/deepagents #1698 | https://github.com/langchain-ai/deepagents/issues/1698 | Filed issue (open, labeled a bug); issue date not separately confirmed on this fetch. Title verbatim: "`SubAgentMiddleware` does not propagate `recursion_limit` to subagent graphs — subagents silently use default limit of 25" (root cause: `ainvoke` called without a `config`). Basis for the "bound the tree, not just the call — propagate the cap to spawned sub-agents" clause under LLM06. |

## Verified by direct fetch (2026-09-15) — usability heuristics

Verification date for the row below: **2026-09-15**. Added for the cited
design-quality checklist in `references/migration-parity.md` (#124).

| Standard / source | URL | What was confirmed |
|---|---|---|
| Nielsen Norman Group — 10 Usability Heuristics for User Interface Design | https://www.nngroup.com/articles/ten-usability-heuristics/ | By Jakob Nielsen; published 1994-04-24, last reviewed 2024-01-30. The 10 heuristic names (wording and order verbatim; the source renders them in Title Case): 1 Visibility of system status; 2 Match between the system and the real world; 3 User control and freedom; 4 Consistency and standards; 5 Error prevention; 6 Recognition rather than recall; 7 Flexibility and efficiency of use; 8 Aesthetic and minimalist design; 9 Help users recognize, diagnose, and recover from errors; 10 Help and documentation. Page states the 10 have "remained relevant and unchanged since 1994." |

## Referenced by name (not fetched this session — verify before citing a URL)

- **Peer security-audit skill (Cloudflare `security-audit-skill`)** — a rival skill whose verdict-evidence rules, coverage-ledger completeness rule and separate verifier idea informed `finding_verdict.py`, `coverage_ledger.py` and the fresh-verifier rule in `appsec-verify.md`. Re-implemented from scratch, no text copied; its repository was not fetched this session, so no URL is recorded and no claim about its contents is made here beyond the name.
- **Route-only security skills** — trailofbits/skills, openai/codex-security and anthropics/claude-code-security-review are named in `tool-hub.md` as opt-in routes; their licenses (including the CC-BY-SA noted for the first) and contents were not fetched, so no URL or license claim is made here.
- **Published metric/measurement standards** — cited in `data-scoring.md` (#396) as the
  constructive escape from an invented score: **CHAOSS** (community activity/health metrics +
  metric-models), **Fellegi-Sunter** (probabilistic record-linkage match tiers, incl. a
  possible-match "skip" band), **W3C PROV** (provenance/lineage), **rel=me / ORCID / schema.org
  `sameAs`** (identity), **network-science structural-position measures** (Freeman betweenness centrality; Burt structural
  holes), **ESCO / O*NET** (skills taxonomies). Named by name only — not fetched this session;
  verify each current spec/URL before citing a version or a specific claim.
- **OWASP WSTG** — how-to-test companion for each web risk.
- **OWASP Cheat Sheet Series** — concrete implementation guidance.
- **MITRE CWE / CVE** — weakness and vulnerability naming.
- **OWASP ASVS 5.0** — Application Security Verification Standard; V3 "Web Frontend Security" groups the browser-native controls in `frontend-a11y.md`: postMessage origin/syntax (§3.5.5), Subresource Integrity (§3.6.1), Referrer-Policy (§3.4.5), clickjacking / frame-ancestors (§3.4.6). Trusted Types is **not** an ASVS V3 requirement — it is a related MDN-sourced control, cited to MDN only. §-numbers from the 5.0 spec text; by name only.
- **IEEE 754** — binary floating-point arithmetic (`NaN` comparison-false / total-ordering
  semantics, `±Infinity`, subnormals). Referenced in `domain-a.md` and
  `api-contracts.md` for non-finite propagation and the double-precision safe-integer range (the
  range itself is corroborated by RFC 8259 §6 in the table above). Named by name only — not
  fetched this session (paywalled ANSI/IEEE standard).
- **MITRE ATLAS** — adversarial-ML and agent-tool attack techniques.
- **Threat-modeling methods** (named by `appsec-design.md` A06 and
  `security-ai-agents.md`): **STRIDE** (per-element spoofing / tampering / repudiation /
  info-disclosure / DoS / elevation), **PASTA** (risk/impact-centric), **attack trees**,
  **LINDDUN** (privacy threats), and **MAESTRO** (agentic-AI threat modeling,
  complementary to the OWASP ASI / MITRE ATLAS catalogs); plus the program-maturity
  frames **OWASP SAMM** and **BSIMM** (measure the org's program, not a diff — name,
  don't score). Named methods only — no URL fetched this session, except **LINDDUN**,
  whose threat-type definitions are now verified by direct fetch (see the 2026-09-21
  section below), and **STRIDE**, whose six category definitions are verified from
  Microsoft's Threat Modeling Tool page (see the 2026-09-24 threat-modeling section
  below); verify before citing specifics.
- **NIST SSDF (SP 800-218)** and the **NIST AI RMF Generative AI Profile (AI 600-1)**
  — secure-development and AI-risk lifecycle framing. (The AI RMF core function names
  are verified in the table above; these document/profile specifics were not fetched.)
- **CIS Benchmarks** — OS/container/cloud hardening baselines.
- **AWS / Azure / GCP Well-Architected Frameworks** — cloud architecture-review pillars
  (operational excellence, security, reliability, performance efficiency, cost optimization;
  sustainability on some clouds). Pillar sets and counts differ and are revised per cloud — cite
  the common set by name, do not pin a count.
- **FinOps (FinOps Foundation)** — cloud cost as a continuous practice; the inform → optimize →
  operate loop. Named by name only.
- **Chaos engineering (Principles of Chaos)** — steady-state hypothesis + blast-radius-limited
  fault injection to verify resilience. Named by name only.
- **Release It! (Michael Nygard, 2nd ed.)** — stability patterns/antipatterns (bulkheads, circuit
  breaker, timeouts, fail-fast, steady state, shed load, cascading failure). Backs the bulkhead /
  resource-isolation section in `reliability-error-handling.md`. Named by name only (book).
- **OpenTelemetry GenAI semantic conventions** (`gen_ai.*`) — LLM/agent telemetry attribute names
  (token usage, model, operation, outcome). **Still at *Development* stability and revised often —
  cite the convention names by name only; pin no version and no specific attribute list.**
- **SPACE framework** — multi-dimensional developer productivity (satisfaction, performance,
  activity, communication, efficiency). Named by name only.
- **DevEx (developer experience)** — the flow/feedback-loop/cognitive-load framing of developer
  productivity. Named by name only.
- **Model Cards** (Mitchell et al.), **Datasheets for Datasets** (Gebru et al.), **Data Cards**
  (Pushkarna et al.) — AI transparency artifacts documenting intended use, data provenance,
  subgroup performance, and limitations. Named by name only (papers not fetched this session).
- **EU AI Act** and **ISO/IEC 42001** (AI-management-system standard) — AI-governance regimes.
  Named by name only; **date/amendment-sensitive** (its obligation timeline has been revised over
  time) — name and route to counsel, never encode a deadline or version.
- **ISO/IEC 25010** — software product-quality model (the axes this review
  covers). Its 2023 edition was fetched on 2026-10-16: see the review-lens
  taxonomy section at the end of this file.
- **IEC 61508** (basic functional-safety standard) and **ISO 26262** (road
  vehicles) — named by `safety-critical.md` only to route a certification
  question to the owner and a safety engineer. Named by name only; no clause,
  level or date is cited.
- **Smart Brevity** (Axios; VandeHei, Allen & Schwartz) — lead each information unit
  with *what's new* **and** *why it matters*; the actionability pattern named in
  `ux-lists.md`. Named by name only — no URL fetched this session.
- **The Twelve-Factor App** — config/dependency/deploy hygiene.
- **RFC 2119** — requirement-keyword conventions (MUST / SHOULD / MAY), named by
  `docs-evolution-by-stage.md`. Named by name only.
- **llms.txt** — proposed convention for an LLM-oriented repo/site guide, named by
  `docs-evolution-by-stage.md`. Named by name only; a proposal, not a ratified standard.
- **"Choose boring technology" / innovation tokens** (McKinley) and **evolutionary
  architecture / fitness functions** (Ford, Parsons & Kua) — architecture-evolution
  leads named by `infra-evolution-by-stage.md`. Named by name only.
- **Conventional Commits** — commit-message discipline. (Semantic Versioning
  graduated to the verified table above this session.)
- **OWASP Dependency-Check / Dependency-Track**, **retire.js**, **Renovate**,
  **Trivy / Grype**, and the per-ecosystem auditors (**pip-audit**,
  **govulncheck**, **cargo audit**, **bundler-audit**) — SCA and
  dependency-update tooling named in `dependency-currency-and-upgrades.md`. Tools,
  not standards; confirm the current invocation per ecosystem at review time.
- **Cross-agent instruction-file conventions** — Cursor (`.cursor/rules` /
  `.cursorrules`), GitHub Copilot (`.github/copilot-instructions.md`), Windsurf
  (`.windsurf/rules` / `.windsurfrules`), Gemini CLI (`GEMINI.md`), Aider
  (`CONVENTIONS.md`). The file **names** are corroborated by the verified Claude
  Code memory doc above; per-agent semantics, frontmatter, and size caps were not
  independently fetched — confirm at imprint time.
- **Scrum Guide — Definition of Done** — the concept the skill's definition-of-done
  checklist rests on ("the state of the Increment when it meets the quality
  measures required"); cite the Scrum Guide directly if a version-specific claim
  is needed.
- **Chaos-playbook / orchestration frameworks** (named by `agentic-ceo`): GTD
  capture-and-clarify; incident command (single commander, unity-of-command,
  activity log); emergency-severity triage; "the ONE thing"; psychological
  reactance; motivational-interviewing reflective listening. Named leads only — no
  URL or figure fetched this session; verify before citing specifics. (WIP limits
  and orchestrator–worker delegation are already registered above.)
- **Product-discovery frameworks** (named by `product-discovery`): the Mom Test
  (Fitzpatrick); the jobs-to-be-done switch interview (Christensen; Klement); Torres
  continuous-discovery / opportunity-solution tree; the Ellis "very disappointed"
  product-market-fit survey; Testing Business Ideas (Bland & Osterwalder) experiment
  library; ICE / RICE prioritization; and fake-door / concierge / Wizard-of-Oz
  validation. Named leads only — no URL or figure fetched this session; verify before
  citing a specific figure or threshold.
- **Product-analytics frameworks** (named by `growth-analytics`): AARRR / "Pirate
  Metrics" (McClure); the North Star Metric framework; vanity-vs-actionable metrics;
  retention cohort analysis; "one metric that matters"; activation / aha-moment
  analysis; and the experiment-rigor leads — peeking / fixed-horizon vs sequential
  testing, always-valid / anytime-valid inference (mSPRT, confidence sequences),
  group-sequential / alpha-spending designs, CUPED variance reduction, and
  product-led growth. Named leads only — no URL or figure fetched this session; verify
  before citing a specific figure or threshold.
- **Positioning / brand frameworks** (named by `positioning`): the Value Proposition
  Canvas and business-model design (Osterwalder & Pigneur); positioning (Ries & Trout;
  April Dunford's obviously-awesome positioning); the message house / messaging
  framework; jobs-to-be-done as a positioning lens; minimum-viable-brand; premature
  scaling as a pre-PMF anti-pattern (Startup Genome; lean-startup). Named leads only —
  no URL or figure fetched this session; verify before citing a specific claim.
- **Business / unit-economics frameworks** (named by `business-ops`): unit economics
  (LTV, CAC, LTV:CAC, payback, contribution margin); value-based, cost-plus, and
  competitor-anchored pricing; the Van Westendorp price-sensitivity meter and usage-based /
  outcome-based / good-better-best packaging models; runway / burn / break-even; the securities-offering boundary (equity / SAFE
  fundraising); worker-classification tests; the GDPR/CCPA obligation triage (routed,
  not concluded). Named leads only — no URL, figure, statute, or rate fetched this
  session; route regulation questions to a licensed professional.
- **Regulated-domain regimes** (named by `business-ops`'s `regulated-domain-triage.md`
  and the `deep-code-review` privacy lenses): **PCI DSS** (card-data security
  standard), **SOC 2** and **ISO/IEC 27001** (security-attestation / ISMS
  frameworks), alongside the privacy regimes already covered in
  `privacy-compliance.md` (GDPR, UK GDPR, CCPA/CPRA, HIPAA, COPPA, and biometric-
  privacy statutes). Named leads only — no URL, article number, threshold, or
  deadline fetched this session; the triage **names the regime and routes to
  counsel**, never concludes it binds. (ISO/IEC 27001 is security/ISMS — distinct
  from ISO/IEC 25010, the product-quality model listed above.)

> When the skill needs a version-specific detail from any of these, it must fetch
> the current source at review time and cite only the URL it verified.

---

## Verification addendum (2026-08-21)

| Standard | URL | What was confirmed |
|---|---|---|
| OWASP Top 10 for Agentic Applications 2026 (announcement) | https://genai.owasp.org/2025/12/09/owasp-top-10-for-agentic-applications-the-benchmark-for-agentic-security-in-the-age-of-autonomous-ai/ | ASI01–ASI10 titles verbatim from the 2025-12-09 announcement: Agent Goal Hijack; Tool Misuse; Identity & Privilege Abuse; Agentic Supply Chain Vulnerabilities; Unexpected Code Execution; Memory & Context Poisoning; Insecure Inter-Agent Communication; Cascading Failures; Human-Agent Trust Exploitation; Rogue Agents. PDF not re-fetched this session — PDF wins on conflict. |
| OWASP Top 10 for Agentic Applications 2026 (resource) | https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ | Resource page still current 2026-08-21; published 2025-12-09. (Same resource URL as the Agentic-Applications row near the top of this file; this entry records the 2026-08-21 re-verification.) |
| OWASP GenAI LLM Top 10 2026 | https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/ | A 2026 LLM edition exists (page dated 2026-08-03). Numbered titles **not** confirmed verbatim from the PDF this session (as of 2026-08-21). **[SUPERSEDED 2026-09-08: the 2026 LLM Top 10 PDF titles ARE now confirmed verbatim — see the 2026-09-08 addendum below; cite the LLM01:2026–LLM10:2026 names, not 2025.]** |

## Verification addendum (2026-09-08)

| Standard | URL | What was confirmed |
|---|---|---|
| OWASP Top 10 for LLM Applications 2026 (PDF) | https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/ (download `OWASP-GenAI-LLM-Top-10-2026-v1.0.pdf`, 122 pages) | Titles quoted from the PDF table of contents: LLM01:2026 Prompt Injection; LLM02:2026 Sensitive Information Disclosure; LLM03:2026 Excessive Agency; LLM04:2026 Supply Chain; LLM05:2026 Data and Model Poisoning; LLM06:2026 Unbounded Consumption; LLM07:2026 Misinformation; LLM08:2026 Hidden Context Exposure; LLM09:2026 Vector and Embedding Weaknesses; LLM10:2026 Improper Output Handling. Official `/llm-top-10/` HTML still listed 2025 cards on this fetch — PDF wins. |
| OWASP Agentic Skills Top 10 (AST01–AST10) | https://owasp.org/www-project-agentic-skills-top-10/ | Titles and severities quoted from the summary table: AST01 Malicious Skills (Critical); AST02 Supply Chain Compromise (Critical); AST03 Over-Privileged Skills (High); AST04 Insecure Metadata (High); AST05 Untrusted External Instructions (High); AST06 Weak Isolation (High); AST07 Update Drift (Medium); AST08 Poor Scanning (Medium); AST09 No Governance (Medium); AST10 Cross-Platform Reuse (Medium). Project badge version-1.0-2026, updated March 2026. |

## Verification addendum (2026-09-16)

| Standard | URL | What was confirmed |
|---|---|---|
| Sherman Kent, *Words of Estimative Probability* | https://www.cia.gov/resources/csi/studies-in-intelligence/archives/vol-8-no-4/words-of-estimative-probability/ (declassified PDF: https://www.cia.gov/resources/csi/static/Words-of-Estimative-Probability.pdf) | Read the declassified PDF (pages 1–4) directly this session. CIA *Studies in Intelligence*, Vol. 8 No. 4 (1964); released via CIA Historical Review Program 1993. Confirmed thesis: undefined verbal-probability terms are read inconsistently — Kent's own Board of National Estimates read "serious possibility" (NIE 29-51) anywhere from 20:80 to 80:20 odds; the subtitle states "the case for consistent, unambiguous usage of a few key odds expressions." Cite for the read-inconsistently / define-the-tiers point only; assert no canonical numeric mapping. |
| Admiralty Code (NATO System; intelligence source & information reliability) | https://en.wikipedia.org/wiki/Admiralty_code | **Wikipedia — tertiary source; cite by name only, not as a primary authority.** Two independent axes: source reliability A–F (A completely reliable … F reliability cannot be judged) × information credibility 1–6 (1 confirmed by other sources … 6 truth cannot be judged); "each descriptor is considered in isolation." Confirms the independent-axes framing only. |

## Verified by direct fetch (2026-09-17) — SARIF interchange format

Verification date for the row below: **2026-09-17**. Added for the deep-code-review
`security-appsec.md` deterministic-corroboration lens (the ingestion-format citation).

| Standard | URL | What was confirmed |
|---|---|---|
| SARIF (Static Analysis Results Interchange Format) 2.1.0 | https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html | OASIS Standard "Static Analysis Results Interchange Format (SARIF) Version 2.1.0 Plus Errata 01", dated 28 August 2023; defines "a standard format for the output of static analysis tools." Cited as the interchange format for ingesting deterministic scanner findings into a review. |

## Verified by direct fetch (2026-09-17) — ARIA APG

Verification date for the row below: **2026-09-17**. Added for the deep-code-review
`a11y-focus.md` per-widget APG-contract lens.

| Standard | URL | What was confirmed |
|---|---|---|
| W3C ARIA Authoring Practices Guide (APG) | https://www.w3.org/WAI/ARIA/apg/ | W3C guide, title "ARIA Authoring Practices Guide (APG)"; purpose "how to apply accessibility semantics to common design patterns and widgets" via "ARIA roles, states and properties and by implementing keyboard support," with a per-pattern functional example. Confirms the APG supplies per-widget role/state/keyboard-interaction patterns for hand-built widgets. Cited as the per-widget contract in `a11y-focus.md` (specific keys per widget — e.g. tablist Arrow/Home/End — are the APG's documented pattern behavior). |

## Verified by direct fetch (2026-09-18) — mutation testing

Verification date for the rows below: **2026-09-18**. Added for the deep-code-review
`testing-situational.md` mutation-testing lens (measuring the product suite's
fault-detection, not only line coverage).

| Standard / tool | URL | What was confirmed |
|---|---|---|
| PIT (pitest) — mutation testing | https://pitest.org/ | "Traditional test coverage (i.e line, statement, branch, etc.) measures only which code is executed by your tests. It does not check that your tests are actually able to detect faults in the executed code"; "The quality of your tests can be gauged from the percentage of mutations killed." Cited for coverage-measures-execution-not-fault-detection and the mutation-score concept; PIT is the JVM engine. |
| Stryker Mutator — configuration (`thresholds.break`) | https://stryker-mutator.io/docs/stryker-js/configuration/ | The `thresholds` config exposes `break`: "mutation score < break: Error! Stryker will exit with exit code 1, indicating a build failure." Cited as the available CI-gate operator (exit non-zero below a set score). **`break` defaults to `null` — "Set `break` to `null` (default) to never let your build fail" — so it gates only once explicitly set** (`high`/`low` default 80/60 and only colour the report). No specific threshold value is endorsed — treat the number as per-repo. Stryker is the JS/TS engine. |

## Verified by direct fetch (2026-09-19) — RAG retrieval-seam & agent-trajectory evals

Verification date for the rows below: **2026-09-19**. Added for the deep-code-review
`testing-ai-evals.md` LLM-application eval lens (RAG retrieval quality + generation
faithfulness/relevancy + agent trajectory).

| Standard / tool | URL | What was confirmed |
|---|---|---|
| Lewis et al. (2020), "Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks" | https://arxiv.org/abs/2005.11401 | NeurIPS 2020. RAG = models that "combine pre-trained parametric and non-parametric memory for language generation" — a generator plus a retrieval component over external knowledge. The technique anchor for evaluating a RAG app at the retrieval seam. Fetched 2026-09-19. |
| RAGAS — RAG evaluation library | https://docs.ragas.io/en/stable/concepts/metrics/available_metrics/ | Open-source eval library (a **tool**, not a standards body). The cited available-metrics index page lists the metric *names* (context precision, context recall, faithfulness, response relevancy, …); the per-metric definitions used in the skill were read on the sub-pages this session — faithfulness = factual consistency with the retrieved context; response relevancy = the answer addresses the question; context precision / recall = the retrieved context is relevant / complete. Cited as a tool that names the concepts; the skill frames the concept, not a vendor's exact formula. Fetched 2026-09-19. |

## Verified by direct fetch (2026-09-19) — post-quantum cryptography (A04)

Verification date for the rows below: **2026-09-19**. Added for the deep-code-review
`appsec-crypto.md` A04 crypto-agility / post-quantum-readiness dimension. Names are
the NIST standards' own; no compliance deadline is encoded (the review finding is a
non-agile primitive on long-lived data, not a date-driven mandate).

| Standard / tool | URL | What was confirmed |
|---|---|---|
| NIST FIPS 203 — ML-KEM | https://csrc.nist.gov/pubs/fips/203/final | "Module-Lattice-Based Key-Encapsulation Mechanism Standard"; standardizes **ML-KEM** (params ML-KEM-512/768/1024), "believed to be secure, even against adversaries who possess a quantum computer." Published 2024-08-13. Fetched 2026-09-19. |
| NIST FIPS 204 — ML-DSA | https://csrc.nist.gov/pubs/fips/204/final | "Module-Lattice-Based Digital Signature Standard"; standardizes **ML-DSA** for digital signatures, quantum-resistant. Published 2024-08-13. Fetched 2026-09-19. |
| NIST FIPS 205 — SLH-DSA | https://csrc.nist.gov/pubs/fips/205/final | "Stateless Hash-Based Digital Signature Standard"; standardizes **SLH-DSA**, "based on SPHINCS+." Published 2024-08-13. Fetched 2026-09-19. |

## Verified by direct fetch (2026-09-19) — EU CRA & VEX (supply-chain regulation)

Verification date for the rows below: **2026-09-19**. Added for the `business-ops`
regulated-domain-triage (CRA name-and-route) and the deep-code-review `appsec-supply.md`
A03 (VEX). Named as regimes/artifacts; no compliance deadline or conformity conclusion is
encoded (business-ops routes applicability to counsel).

| Standard / tool | URL | What was confirmed |
|---|---|---|
| EU Cyber Resilience Act (CRA) — Regulation (EU) 2024/2847 | https://eur-lex.europa.eu/eli/reg/2024/2847/oj | "Regulation (EU) 2024/2847 … on horizontal cybersecurity requirements for products with digital elements." Manufacturer obligation categories confirmed: security-by-design; vulnerability handling + coordinated-vulnerability-disclosure + a security-update / support period; automatic-update + end-of-support transparency; stricter conformity assessment for "important"/"critical" categories. Exact timelines/class routed to counsel (not encoded). Fetched 2026-09-19. |
| CISA VEX — Vulnerability Exploitability eXchange (status & justification) | https://www.cisa.gov/resources-tools/resources/vulnerability-exploitability-exchange-vex-status-justification-document-june-2022 | CISA-published (June 2022, community-led). A producer-issued per-CVE assertion of whether a product is affected; status values NOT AFFECTED (with a justification), AFFECTED, FIXED, UNDER INVESTIGATION; complements (does not replace) an SBOM. Fetched 2026-09-19. |

## Verified by direct fetch (2026-09-19) — ML pipeline correctness (leakage, reproducibility, label quality)

Verification date for the rows below: **2026-09-19**. Added for the deep-code-review
`testing-ml.md` ML-pipeline-correctness lens (leakage + reproducibility) and
`data-metrics.md` label-quality bullet.

| Standard / tool | URL | What was confirmed |
|---|---|---|
| scikit-learn — Common pitfalls (data leakage) | https://scikit-learn.org/stable/common_pitfalls.html | "data leakage occurs when information that would not be available at prediction time is used when building the model" → "overly optimistic performance estimates"; "Always split the data into train and test subsets first, particularly before any preprocessing"; "never call `fit` on the test data"; a Pipeline prevents leakage in CV/tuning. Fetched 2026-09-19. |
| Breck et al. (2017), "The ML Test Score" | https://research.google/pubs/the-ml-test-score-a-rubric-for-ml-production-readiness-and-technical-debt-reduction/ | IEEE Big Data 2017; a rubric of "28 specific tests and monitoring needs" for ML production-readiness. Cited for the reproducible-training principle (retrain on the same data → the same model; seed the RNG). The specific rubric-item text was NOT reproduced on the fetched landing page — cited by paper for the principle, not a verbatim quote. Fetched 2026-09-19. |
| Northcutt, Athalye, Mueller (2021), "Pervasive Label Errors in Test Sets…" | https://arxiv.org/abs/2103.14749 | NeurIPS 2021 (Datasets & Benchmarks). "Errors in test sets are numerous and widespread: we estimate an average of at least 3.3% errors across the 10 datasets"; correcting them can flip benchmark rankings (smaller models can overtake larger); ~half of algorithmically-flagged errors confirmed genuine by crowdsourcing. Fetched 2026-09-19. |


## Verified by direct fetch (2026-09-19) — MCP (Model Context Protocol) security

Verification date for the rows below: **2026-09-19**. Added for the deep-code-review
`security-ai-agents.md` MCP server/client security section. The OWASP MCP Top 10 is named
as a **beta** regime only; its category IDs are not walked as current.

| Standard / tool | URL | What was confirmed |
|---|---|---|
| MCP Security Best Practices (official spec) | https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices | Names, with `MUST`/`SHOULD` controls: **Confused Deputy** (OAuth proxy w/ static client-id + dynamic registration + consent cookie -> per-client consent MUST run before the third-party flow; exact `redirect_uri` match; `state` set only after consent); **Token Passthrough** ("MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server"); SSRF on OAuth metadata discovery; one-click local-server consent (show the exact command); scope minimization. Fetched 2026-09-19. |
| OWASP MCP Top 10 | https://owasp.org/www-project-mcp-top-10/ | Official OWASP project, "OWASP MCP Top 10," **Phase-3 Beta Release and Pilot Testing** ("We are here right now"); lead Vandana Verma Sehgal; scope = MCP-enabled systems lifecycle, ten risk categories (`MCPxx:2025`). Named as a beta regime; categories NOT enumerated as current. Fetched 2026-09-19. |
| Tool-description poisoning & rug-pull (Willison / Invariant Labs) | https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/ | Post dated 2025-04-09. Tool-description poisoning: instructions in a tool docstring are "visible to the LLM, not normally displayed to users" (Invariant Labs demo: an `add()` docstring makes the model read a private file and pass it as a parameter). Rug pull: "MCP tools can mutate their own definitions after installation"; clients "do not notify users about changes to the tool description" -> mitigation: alert on description change. Fetched 2026-09-19. |


## Verified by direct fetch (2026-09-19) — ML fairness / bias

Verification date for the rows below: **2026-09-19**. Added for the deep-code-review
`testing-ml.md` ML-fairness detection lens. No legal disparate-impact threshold is
encoded (the code check is measure + deliberate handling + documentation; the legal
determination routes to counsel).

| Standard / tool | URL | What was confirmed |
|---|---|---|
| NIST SP 1270 — Bias in AI | https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1270.pdf | "Towards a Standard for Identifying and Managing Bias in Artificial Intelligence" (March 2022, 86 pp). Identifies **three categories of bias** — systemic, statistical/computational, human; three mitigation challenges — datasets, testing-and-evaluation (TEVV), human factors. Framing: computational fairness metrics are necessary but "human and systemic institutional and societal factors are significant sources of AI bias as well, and are currently overlooked"; and "Trustworthy and Responsible AI is not just about whether a given AI system is biased, fair or ethical, but whether it does what is claimed." PDF read directly 2026-09-19. |
| Model Cards for Model Reporting (Mitchell et al., 2019) | https://arxiv.org/abs/1810.03993 | FAT* '19. Proposes model cards documenting benchmarked evaluation "across different cultural, demographic, or phenotypic groups (e.g., race, geographic location, sex, Fitzpatrick skin type) and intersectional groups," plus the model's intended-use context, performance-evaluation procedures, and limitations. Fetched 2026-09-19. |
| RFC 9457 — Problem Details for HTTP APIs | https://www.rfc-editor.org/rfc/rfc9457.html | Obsoletes RFC 7807. Defines media type `application/problem+json` (and `application/problem+xml`); core members `type`/`status`/`title`/`detail`/`instance` (§3.1) plus extension members (§3.2). Fetched + verified 2026-09-19. |
| Google AIP-134 — Standard methods: Update | https://google.aip.dev/134 | Full-replacement update via `PUT` / `update_mask="*"`; warns "API producers need to be conscious of how adding new, mutable fields to a resource will be handled when consumers use `*` without knowledge of said new, mutable fields" — an old client's read-modify-write round-trip clears a field it predates (the Book/rating example). Fetched + verified 2026-09-19. |
| CWE-203 — Observable Discrepancy | https://cwe.mitre.org/data/definitions/203.html | "The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor." Examples cover user/account enumeration and timing side-channels. Fetched + verified 2026-09-19. |
| NIST Privacy Framework — CT.DP-P Disassociated Processing | https://csf.tools/reference/pf/pf-v1-0/ct-p/ct-dp-p/ | Control-P category "Disassociated Processing": CT.DP-P1 "processed to limit observability and linkability", CT.DP-P2 "limit the identification of individuals (de-identification, tokenization)", CT.DP-P3 "limit the formulation of inferences about individuals." Fetched + verified 2026-09-19. |
| WAI-ARIA (using-aria) — Rules of ARIA Use | https://www.w3.org/TR/using-aria/ | 4th rule verbatim: "Do not use role='presentation' or aria-hidden='true' on a focusable element." Prevents a focusable element hidden from assistive tech while still in the tab order. Fetched + verified 2026-09-19. |
| WCAG 2.2 SC 2.2.1 Timing Adjustable | https://www.w3.org/WAI/WCAG22/Understanding/timing-adjustable.html | Level A. For a time limit: turn off, adjust (>=10x default before encountering it), or extend (warned before expiry, given >=20s + a simple action, and able to extend at least ten times). Exceptions: real-time event, essential, >20 hours. Fetched + verified 2026-09-19. |
| WCAG 2.2 SC 2.2.2 Pause, Stop, Hide | https://www.w3.org/WAI/WCAG22/Understanding/pause-stop-hide.html | Level A. Moving/blinking/scrolling that auto-starts, lasts >5s, in parallel with other content needs a pause/stop/hide (unless essential); auto-updating content has no 5s grace. Fetched + verified 2026-09-19. |
| Core Web Vitals (web.dev) | https://web.dev/articles/vitals | Thresholds assessed at the 75th percentile of real-user page loads (field data). "Only field measurement can accurately capture the complete picture"; lab (Lighthouse) "is not a substitute for field measurement." Fetched + verified 2026-09-19. |
| WCAG 2.2 SC 2.3.3 Animation from Interactions | https://www.w3.org/WAI/WCAG22/Understanding/animation-from-interactions.html | Level AAA. "Motion animation triggered by interaction can be disabled, unless the animation is essential to the functionality or the information being conveyed." Applies to interaction-INITIATED non-essential motion (parallax, decorative transitions); SC 2.2.2 governs automatically-started animation instead. Fetched + verified 2026-09-19. |
| SLSA v1.0 — Build track levels | https://slsa.dev/spec/v1.0/levels | Build L1 "provenance exists" (trivial to forge, may be unsigned); L2 adds signed provenance from a hosted build platform and "downstream verification of provenance includes validating the authenticity of the provenance"; L3 adds a hardened, tamper-resistant build. Consumer verification compares expected vs actual provenance — subject digest, builder identity, canonical source. Fetched + verified 2026-09-19. |
| W3C Trace Context | https://www.w3.org/TR/trace-context/ | `traceparent` = `version-trace-id-parent-id-trace-flags` (e.g. `00-0af7…-b7ad…-01`). A vendor receiving `traceparent`/`tracestate` "MUST send it to outgoing requests" — the propagation that keeps a distributed trace unbroken across services/vendors. Fetched + verified 2026-09-19. |
| Go Memory Model | https://go.dev/ref/mem | "A data race is defined as a write … happening concurrently with another read or write … unless all the accesses involved are atomic (sync/atomic)." "Programs with races are incorrect." A racy read of a value larger than one word "can lead to inconsistent values not corresponding to a single write" and, for interface/map/slice/string, "arbitrary memory corruption." Fetched + verified 2026-09-19. |
| C++ data races (cppreference) | https://en.cppreference.com/w/cpp/language/multithread | "If a data race occurs, the behavior of the program is undefined" — a conflicting non-atomic access unordered by happens-before. Basis for the C/C++ "data race = UB" scoping (contrast Go's "incorrect"). Fetched + verified 2026-09-19. |
| Rust data races (Reference) | https://doc.rust-lang.org/reference/behavior-considered-undefined.html | "Data races." listed among behaviors considered undefined; "`unsafe` only means that avoiding undefined behavior is on the programmer; it does not change anything about the fact that Rust programs must never cause undefined behavior." Backs the "Rust `unsafe` data race = UB" scoping alongside C/C++ (contrast Go's "incorrect"/tearing). Fetched + verified 2026-09-19. |

## Verified by direct fetch (2026-09-19) — data-pipeline contract & lineage standards

| Standard / source | URL | What was confirmed |
|---|---|---|
| Confluent — Schema Evolution and Compatibility | https://docs.confluent.io/platform/current/schema-registry/fundamentals/schema-evolution.html | Compatibility modes: BACKWARD ("consumers using new schema can read data written with old schema") needs "upgrade all consumers before you start producing new events"; FORWARD ("consumers using old schema can read data written with new schema") needs "first upgrade all producers ... then upgrade the consumers"; FULL is both (add/remove optional only), producers/consumers upgrade "independently"; the `*_TRANSITIVE` variants check against all previous versions, not just the last; NONE disables checks; default BACKWARD. Fetched + verified 2026-09-19. |
| OpenLineage — Column-Level Lineage facet | https://openlineage.io/docs/spec/facets/dataset-facets/column_lineage_facet | Records "which input columns are used to produce which output columns and in what way": each output field maps to inputFields (each with namespace, dataset `name`, field) + transformations (type DIRECT/INDIRECT; subtypes e.g. IDENTITY/AGGREGATION are DIRECT, JOIN/FILTER are INDIRECT; plus a masking flag). Answers "Which root input columns are used to construct column x?" Fetched + verified 2026-09-19. |

## Verified by direct fetch (2026-09-19) — GitHub pull_request webhook taxonomy

| Standard / source | URL | What was confirmed |
|---|---|---|
| GitHub — pull_request webhook activity types | https://docs.github.com/en/webhooks/webhook-events-and-payloads | The `pull_request` event supports distinct activity types incl. `opened`, `edited`, `labeled`, `unlabeled`, `synchronize`, `closed`, `ready_for_review` (full list on page); `labeled`/`unlabeled` are separate actions from `edited`, so a label add/remove does **not** fire `edited`. Fetched + verified 2026-09-19. |

## Verified by direct fetch (2026-09-19) — reliability under stress (retry budgets & deadline propagation)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Google SRE book — Addressing Cascading Failures | https://sre.google/sre-book/addressing-cascading-failures/ | Retry budget: "Limit retries per request. Don't retry a given request indefinitely." A process-wide ceiling — "only allow 60 retries per minute in a process, and if the retry budget is exceeded, don't retry; just fail the request." Layered amplification: attempts multiply across stack layers — "a single user action may create 64 attempts (4^3) on the database." Fetched + verified 2026-09-19. |
| gRPC — Deadlines | https://grpc.io/docs/guides/deadlines/ | Deadline propagation: "gRPC converts the deadline to a timeout from which the already elapsed time is already deducted," so a downstream inherits the caller's remaining time (automatic in Java/Go, explicit opt-in in C++). Basis for "propagate the remaining deadline, don't reset a fresh timeout per hop." Fetched + verified 2026-09-19. |

## Verified by direct fetch (2026-09-19) — HTTP caching & PostgreSQL CONCURRENTLY

| Standard / source | URL | What was confirmed |
|---|---|---|
| RFC 9111 — HTTP Caching | https://www.rfc-editor.org/rfc/rfc9111 | §4.4 (invalidation): a cache "MUST invalidate the target URI" on a non-error response to an unsafe request method; related URIs (Location/Content-Location) are only "candidates for invalidation" and never cross-origin — derived-key fan-out is the application's job. §4.1 (Vary): "MUST NOT use that stored response without revalidation unless all the presented request header fields nominated by that Vary field value match"; a Vary value containing "*" "always fails to match." Fetched + verified 2026-09-19. |
| PostgreSQL — CREATE INDEX (CONCURRENTLY) | https://www.postgresql.org/docs/current/sql-createindex.html | A failed concurrent build "will fail but leave behind an 'invalid' index" that "will be ignored for querying purposes ... however it will still consume update overhead"; recover by dropping and retrying, or "rebuild the index with REINDEX INDEX CONCURRENTLY." "A regular CREATE INDEX command can be performed within a transaction block, but CREATE INDEX CONCURRENTLY cannot." Fetched + verified 2026-09-19. |

## Verified by direct fetch (2026-09-19) — time, dates & time zones

| Standard / source | URL | What was confirmed |
|---|---|---|
| TC39 Temporal — time zones & offsets | https://tc39.es/proposal-temporal/docs/timezone.html | Wall-clock time "depends on the time zone of the clock"; exact time "is the same everywhere"; `Temporal.ZonedDateTime` "encapsulates ... an exact time ... its wall-clock equivalent ... and the time zone that links the two." Basis for the instant-vs-wall-clock distinction. Fetched + verified 2026-09-19. |
| PEP 495 — Local Time Disambiguation | https://peps.python.org/pep-0495/ | "A local time that falls in the fold is called ambiguous"; "A local time that falls in the gap is called missing"; "The `fromutc()` method should never produce a time in the gap." Basis for fold/gap disambiguation at DST transitions. Fetched + verified 2026-09-19. |
| IANA tz database — Theory and pragmatics | https://data.iana.org/time-zones/tzdb/theory.html | "The `tz` database predicts future timestamps, and current predictions will be incorrect after future governments change the rules ... software can mess up after the rule change if it blithely relies on conversions made before the change." Basis for treating tzdata as a stale-able dependency + re-resolving future wall-clock times. Fetched + verified 2026-09-19. |
| Google — Leap Smear | https://developers.google.com/time/smear | "instead of applying leap seconds to our servers using clock steps, we have 'smeared' the extra second across the hours before and after each leap." Basis for the leap-second / duration caveat (choose a consistent approach; don't assume 86,400 s/day). Fetched + verified 2026-09-19. |

## Verified by direct fetch (2026-09-21) — time, dates & time zones (string / wire / schema boundary)

| Standard / source | URL | What was confirmed |
|---|---|---|
| MDN — `Date.parse()` / date string parsing | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/parse | A date-only ISO string "will imply UTC time because it's date-only," whereas a date-and-time string with no offset is "set to ... in the local timezone of the system, because it has both date and time"; "Other formats are implementation-defined and may not work across all browsers." Basis for the PARSE-site boundary face (a date-only value parses to UTC midnight and renders a day early for viewers behind UTC; a non-ISO string is unportable). Fetched + verified 2026-09-21. |
| RFC 3339 — Internet timestamps (offset grammar) | https://www.rfc-editor.org/rfc/rfc3339 | §5.6: `time-offset = "Z" / time-numoffset` and `full-time = partial-time time-offset` (no brackets — the offset is a required part of a `date-time`, not optional); §4.3: an offset of "-00:00" means "the time in UTC is known, but the offset to local time is unknown," which "differs semantically from an offset of 'Z' or '+00:00'." Basis for the WIRE-site boundary face (require an explicit offset on every ingested timestamp; `-00:00` is UTC-known / local-offset-unknown, not a typo for Z). Fetched + verified 2026-09-21. |
| RFC 9557 — RFC 3339 timestamps + time-zone annotation | https://www.rfc-editor.org/rfc/rfc9557 | "This document defines an extension to the timestamp format defined in RFC 3339 for representing additional information, including a time zone," e.g. `2022-07-08T00:14:07+01:00[Europe/Paris]`. Basis for the wire encoding of the wall-clock-time + IANA-tz-id pair a future recurrence should be stored/transmitted in. Fetched + verified 2026-09-21. |
| MDN — `Temporal.PlainDate` | https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Temporal/PlainDate | `Temporal.PlainDate` "represents a calendar date (a date without a time or time zone); for example, an event on a calendar which happens during the whole day no matter which time zone it's happening in." Basis for the SCHEMA-site boundary face (store a civil date in a date-only type that has no instant to convert). Fetched + verified 2026-09-21. |

## Verified by direct fetch (2026-09-19) — online experimentation infrastructure

| Standard / source | URL | What was confirmed |
|---|---|---|
| Google — Overlapping Experiment Infrastructure | https://research.google/blog/overlapping-experiment-infrastructure-more-better-faster-experimentation/ | "Google's infrastructure supports this vast experimentation by using orthogonal diversion criteria for experiments in different 'layers' so that each event (e.g. a web search) can be assigned to multiple experiments." Basis for isolating concurrent experiments (orthogonal layers / mutual exclusion) so they don't confound. Companion paper: Tang et al., "Overlapping Experiment Infrastructure," KDD 2010 (by name). Fetched + verified 2026-09-19. |

## Verified by direct fetch (2026-09-19) — webhooks (provider side)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Standard Webhooks (community spec) | https://github.com/standard-webhooks/standard-webhooks | Outbound-webhook signing convention: the message's "ID, timestamp and body are concatenated (delimited by full-stops) and then signed" with HMAC-SHA256 (`msg_id.timestamp.payload`); headers `webhook-id` / `webhook-timestamp` / `webhook-signature`; the signature header is "a space delimited list of signatures" to "support zero downtime secret rotation"; verify `webhook-timestamp` "is within some allowable tolerance ... to prevent replay attacks." A multi-vendor community spec (guided by an ~8-company technical steering committee), not an IETF/W3C standard — cite as a convention. Fetched + verified 2026-09-19. |

## Verified by direct fetch (2026-09-19) — streaming transports (WebSocket / SSE)

| Standard / source | URL | What was confirmed |
|---|---|---|
| WHATWG HTML — Server-sent events (§9.2) | https://html.spec.whatwg.org/multipage/server-sent-events.html | Reconnection re-sends the last id: "Set (`Last-Event-ID`, lastEventIDValue) in request's header list" when the last event ID string is not empty; the reconnection time "must initially be an implementation-defined value, probably in the region of a few seconds," with "an exponential backoff delay" on repeated failure. Fetched + verified 2026-09-19. |
| RFC 6455 — The WebSocket Protocol | https://www.rfc-editor.org/rfc/rfc6455 | A Ping "may serve either as a keepalive or as a means to verify that the remote endpoint is still responsive"; "Upon receipt of a Ping frame, an endpoint MUST send a Pong frame in response, unless it already received a Close frame"; "Message fragments MUST be delivered to the recipient in the order sent by the sender" (ordering is per-connection). Fetched + verified 2026-09-19. |
| WHATWG — WebSocket `bufferedAmount` | https://websockets.spec.whatwg.org/ | `bufferedAmount` = "the number of bytes of application data ... that have been queued using `send()` but that ... had not yet been transmitted to the network"; the flow-control example paces sends "at whatever rate the network _can_ handle," checking `bufferedAmount`. Basis for per-connection send-side backpressure. Fetched + verified 2026-09-19. |

## Verified by direct fetch (2026-09-20) — concurrency lock-ordering / deadlock prevention

| Standard / source | URL | What was confirmed |
|---|---|---|
| PostgreSQL Documentation — 13.3.4 Deadlocks (Explicit Locking) | https://www.postgresql.org/docs/current/explicit-locking.html | Consistent lock ordering is the primary defense: "The best defense against deadlocks is generally to avoid them by being certain that all applications using a database acquire locks on multiple objects in a consistent order." Retry is the fallback: "If it is not feasible to verify this in advance, then deadlocks can be handled on-the-fly by retrying transactions that abort due to deadlocks." Fetched + verified 2026-09-20. |
| cppreference — std::scoped_lock | https://en.cppreference.com/w/cpp/thread/scoped_lock | A multi-mutex lock primitive that avoids deadlock regardless of the order mutexes are passed: "If several mutexes are given, deadlock avoidance algorithm is used as if by std::lock." Basis for citing a deadlock-avoiding multi-lock primitive as an alternative to a hand-maintained global order. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — JWT algorithm confusion (A07)

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP ASVS v5.0.0 — V9.1.2 (Self-contained Tokens) | https://github.com/OWASP/ASVS/blob/v5.0.0_release/5.0/en/0x18-V9-Self-contained-Tokens.md | 9.1.2 (**Level 1**, confirmed at source): "Verify that only algorithms on an allowlist can be used to create and verify self-contained tokens, for a given context. The allowlist must include the permitted algorithms, ideally only either symmetric or asymmetric algorithms, and must not include the 'None' algorithm. If both symmetric and asymmetric must be supported, additional controls will be needed to prevent key confusion." (Verified 2026-09-20 against tag v5.0.0_release; discharges the line-115 ASVS-5.0 level caveat for V9.1.2 ONLY.) |
| OWASP JSON Web Token Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet.html | alg:none — "Make sure that `"alg":"none"` is not accepted by your JWT parser." Algorithm/key-type confusion — "if possible, hardcode the accepted algorithms and do not mix public-key digital signatures algorithms and MAC algorithms." Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — session termination & timeout (A07)

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP ASVS v5.0.0 — V7 Session Management (7.3.1 / 7.3.2 / 7.4.1) | https://github.com/OWASP/ASVS/blob/v5.0.0_release/5.0/en/0x16-V7-Session-Management.md | 7.4.1 (**L1**): "Verify that when session termination is triggered (such as logout or expiration), the application disallows any further use of the session … Applications using self-contained tokens will need a solution such as maintaining a list of terminated tokens, disallowing tokens produced before a per-user date and time or rotating a per-user signing key." 7.3.1 (L2) inactivity timeout and 7.3.2 (L2) absolute maximum session lifetime, each "such that re-authentication is enforced according to risk analysis and documented security decisions." Verified 2026-09-20 at tag v5.0.0_release. |
| OWASP Session Management Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html | Idle ranges: "Common idle timeouts ranges are 2-5 minutes for high-value applications and 15-30 minutes for low risk applications." Absolute: "an appropriate absolute timeout range could be between 4 and 8 hours." Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — supply chain: committed binary artifacts

| Standard / source | URL | What was confirmed |
|---|---|---|
| OpenSSF Scorecard — Binary-Artifacts check | https://github.com/ossf/scorecard/blob/f92023a3f77879f96e0c9c1305f289d755be4bb6/docs/checks.md | "Risk: `High` (non-reviewable code)". "This check determines whether the project has generated executable (binary) artifacts in the source repository." Remediation steps: "Remove the generated executable artifacts from the repository." / "Build from source." (The Binary-Artifacts section specifically; distinct from the other Scorecard rows above that cite the same catalog URL.) Fetched + verified 2026-09-20. (SHA-pinned f92023a; re-verified 2026-09-21) |

## Verified by direct fetch (2026-09-20) — supply chain: signed releases

| Standard / source | URL | What was confirmed |
|---|---|---|
| OpenSSF Scorecard — Signed-Releases check | https://github.com/ossf/scorecard/blob/f92023a3f77879f96e0c9c1305f289d755be4bb6/docs/checks.md | "Risk: `High` (possibility of installing malicious releases)". "This check tries to determine if the project cryptographically signs release artifacts." "Signed releases attest to the provenance of the artifact." "Note: The check does not verify the signatures." (The Signed-Releases section; distinct from the other Scorecard rows above that cite the same catalog URL.) Fetched + verified 2026-09-20. (SHA-pinned f92023a; re-verified 2026-09-21) |

## Verified by direct fetch (2026-09-20) — TLS certificate validation bypass (A04)

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP ASVS v5.0.0-12.3.2 (Secure Communication) | https://github.com/OWASP/ASVS/blob/v5.0.0_release/5.0/en/0x21-V12-Secure-Communication.md | Level 2: "Verify that TLS clients validate certificates received before communicating with a TLS server." Verified 2026-09-20 at tag v5.0.0_release. |
| OWASP ASVS v5.0.0-12.3.4 (Secure Communication) | https://github.com/OWASP/ASVS/blob/v5.0.0_release/5.0/en/0x21-V12-Secure-Communication.md | Level 2: "Verify that TLS connections between internal services use trusted certificates. Where internally generated or self-signed certificates are used, the consuming service must be configured to only trust specific internal CAs and specific self-signed certificates." Verified 2026-09-20. |
| CWE-295 — Improper Certificate Validation | https://cwe.mitre.org/data/definitions/295.html | "Improper Certificate Validation" — "The product does not validate, or incorrectly validates, a certificate." Fetched + verified 2026-09-20. |
| CWE-297 — Improper Validation of Certificate with Host Mismatch | https://cwe.mitre.org/data/definitions/297.html | "Improper Validation of Certificate with Host Mismatch" — a child of CWE-295; the specific case of an all-accepting `HostnameVerifier`. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — HTTP request/response smuggling (A01)

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP ASVS v5.0.0-4.2.1 (API and Web Service) | https://github.com/OWASP/ASVS/blob/v5.0.0_release/5.0/en/0x13-V4-API-and-Web-Service.md | Level 2: "Verify that all application components (including load balancers, firewalls, and application servers) determine boundaries of incoming HTTP messages using the appropriate mechanism for the HTTP version to prevent HTTP request smuggling. In HTTP/1.x, if a Transfer-Encoding header field is present, the Content-Length header must be ignored per RFC 2616. When using HTTP/2 or HTTP/3, if a Content-Length header field is present, the receiver must ensure that it is consistent with the length of the DATA frames." Verified 2026-09-20 at tag v5.0.0_release. |
| OWASP ASVS v5.0.0-4.2.2 (API and Web Service) | https://github.com/OWASP/ASVS/blob/v5.0.0_release/5.0/en/0x13-V4-API-and-Web-Service.md | Level 3: "Verify that when generating HTTP messages, the Content-Length header field does not conflict with the length of the content as determined by the framing of the HTTP protocol, in order to prevent request smuggling attacks." Verified 2026-09-20. |
| CWE-444 — Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | https://cwe.mitre.org/data/definitions/444.html | Title verbatim: "Inconsistent Interpretation of HTTP Requests" (common name 'HTTP Request/Response Smuggling'). Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — continuous fuzzing (test assurance)

| Standard / source | URL | What was confirmed |
|---|---|---|
| OpenSSF Scorecard — Fuzzing check | https://github.com/ossf/scorecard/blob/f92023a3f77879f96e0c9c1305f289d755be4bb6/docs/checks.md | "Risk: `Medium` (possible vulnerabilities in code)". "This check tries to determine if the project uses fuzzing" (via OSS-Fuzz membership, ClusterFuzzLite, or user-defined fuzzing functions). "Regular fuzzing is important to detect vulnerabilities that may be exploited by others, especially since attackers can also use fuzzing to find the same flaws." (Distinct from the other Scorecard rows above that cite the same catalog URL.) Fetched + verified 2026-09-20. (SHA-pinned f92023a; re-verified 2026-09-21) |

## Verified by direct fetch (2026-09-20) — API6 sensitive business flows (API Security Top 10, 2023)

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP API6:2023 — Unrestricted Access to Sensitive Business Flows | https://api-security.owasp.org/editions/2023/en/0xa6-unrestricted-access-to-sensitive-business-flows/ | "identify the business flows that might harm the business if they are excessively used." Non-human detection: "analyze the user flow to detect non-human patterns (e.g. the user accessed the 'add to cart' and 'complete purchase' functions in less than one second)." Fetched + verified 2026-09-20. |
| OWASP ASVS v5.0.0-2.4.2 (Validation and Business Logic) | https://github.com/OWASP/ASVS/blob/v5.0.0_release/5.0/en/0x11-V2-Validation-and-Business-Logic.md | Level 3: "Verify that business logic flows require realistic human timing, preventing excessively rapid transaction submissions." Verified 2026-09-20 at tag v5.0.0_release. |

## Verified by direct fetch (2026-09-20) — API4 unrestricted resource consumption (spend + memory axes)

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP API4:2023 — Unrestricted Resource Consumption | https://api-security.owasp.org/editions/2023/en/0xa4-unrestricted-resource-consumption/ | "Configure spending limits for all service providers/API integrations. When setting spending limits is not possible, billing alerts should be configured instead." Also confirmed (same page, same fetch): the "Is the API Vulnerable?" checklist names "Maximum allocable memory" and "Maximum upload file size" among the limits an API needs; the prevention list requires "Define and enforce a maximum size of data on all incoming parameters and payloads, such as maximum length for strings, maximum number of elements in arrays, and maximum upload file size (regardless of whether it is stored locally or in cloud storage)." Fetched + verified 2026-09-20. |
| CWE-770 — Allocation of Resources Without Limits or Throttling | https://cwe.mitre.org/data/definitions/770.html | Title verbatim: "Allocation of Resources Without Limits or Throttling." Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — CSV / spreadsheet formula injection (A05)

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP ASVS v5.0.0-1.2.10 (Encoding and Sanitization) | https://github.com/OWASP/ASVS/blob/v5.0.0_release/5.0/en/0x10-V1-Encoding-and-Sanitization.md | Level 3: "protected against CSV and Formula Injection ... when exporting to CSV or other spreadsheet formats (such as XLS, XLSX, or ODF), special characters (including '=', '+', '-', '@', '\t' (tab), and '\0' (null character)) must be escaped with a single quote if they appear as the first character in a field value." Also requires RFC 4180 §2.6/2.7 escaping. Verified 2026-09-20 at tag v5.0.0_release. |
| CWE-1236 — Improper Neutralization of Formula Elements in a CSV File | https://cwe.mitre.org/data/definitions/1236.html | Title verbatim: "Improper Neutralization of Formula Elements in a CSV File." Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — WCAG focus & non-text contrast

| Standard / source | URL | What was confirmed |
|---|---|---|
| WCAG 2.2 SC 1.4.11 Non-text Contrast | https://www.w3.org/WAI/WCAG22/Understanding/non-text-contrast.html | Level AA. Verbatim: "The visual presentation of the following have a contrast ratio of at least 3:1 against adjacent color(s): User Interface Components" — "Visual information required to identify user interface components and states, except for inactive components or where the appearance of the component is determined by the user agent and not modified by the author". The exemption means an unmodified user-agent-default focus style is not held to the 3:1 floor (2.4.7 still requires it visible); the floor binds author-styled indicators. Fetched + verified 2026-09-20. |
| WCAG 2.2 SC 2.4.13 Focus Appearance | https://www.w3.org/WAI/WCAG22/Understanding/focus-appearance.html | Level AAA (new in WCAG 2.2). Verbatim: "When the keyboard focus indicator is visible, an area of the focus indicator meets all the following: is at least as large as the area of a 2 CSS pixel thick perimeter of the unfocused component or sub-component, and has a contrast ratio of at least 3:1 between the same pixels in the focused and unfocused states." Basis for the focus-indicator area+contrast floor. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — WCAG 2.2 target size

| Standard / source | URL | What was confirmed |
|---|---|---|
| WCAG 2.2 SC 2.5.8 Target Size (Minimum) | https://www.w3.org/WAI/WCAG22/Understanding/target-size-minimum.html | Level AA (new in WCAG 2.2). Pointer targets >= 24 by 24 CSS px, with **five exceptions** (verbatim): **Spacing** — undersized targets "positioned so that if a 24 CSS pixel diameter circle is centered on the bounding box of each, the circles do not intersect another target or the circle for another undersized target"; **Equivalent** — another control "can achieve the underlying function" at size; **Inline** — "does not apply to inline targets in sentences, or where the size of the target is constrained by the line-height of non-target text"; **User agent control**; **Essential**. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — WCAG 2.2 accessible authentication

| Standard / source | URL | What was confirmed |
|---|---|---|
| WCAG 2.2 SC 3.3.8 Accessible Authentication (Minimum) | https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-minimum.html | Level AA (new in WCAG 2.2). Verbatim: "A cognitive function test (such as remembering a password or solving a puzzle) is not required for any step in an authentication process unless that step provides at least one of the following:" **Alternative** (another method not relying on a cognitive function test), **Mechanism** (a mechanism to assist), **Object Recognition**, **Personal Content**. Basis for allow-paste / password-manager support. Fetched + verified 2026-09-20. |
| WCAG 2.2 SC 3.3.9 Accessible Authentication (Enhanced) | https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-enhanced.html | Level AAA (new in WCAG 2.2). Same base rule as 3.3.8, but the permitted exceptions are only **Alternative** and **Mechanism** — it drops **Object Recognition** and **Personal Content**, so an image / personal-content CAPTCHA that passes 3.3.8 fails 3.3.9. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — ML cross-validation & resampling hygiene

| Standard / source | URL | What was confirmed |
|---|---|---|
| scikit-learn — Cross-validation (grouped & time-series) | https://scikit-learn.org/stable/modules/cross_validation.html | "The i.i.d. assumption is broken if the underlying generative process yields groups of dependent samples." GroupKFold "ensures that the same group is not represented in both testing and training sets." On time series, KFold/ShuffleSplit "assume the samples are independent and identically distributed, and would result in unreasonable correlation between training and testing instances (yielding poor estimates of generalization error) on time series data." Fetched + verified 2026-09-20. |
| imbalanced-learn — Common pitfalls (resampling) | https://imbalanced-learn.org/stable/common_pitfalls.html | Resampling the whole dataset before the split: "by resampling the entire dataset, both the training and testing set will be potentially balanced while the model should be tested on the natural imbalanced dataset to evaluate the potential bias of the model"; the model "will not be tested on a dataset with class distribution similar to the real use-case." Basis for resample-inside-the-fold-on-train-only. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — payment-card, health-privacy & account-lifecycle regimes

| Standard / source | URL | What was confirmed |
|---|---|---|
| PCI SSC Glossary — Sensitive Authentication Data; masking vs truncation | https://www.pcisecuritystandards.org/glossary/ | SAD "includes, but is not limited to, card verification codes, full track data (from magnetic stripe or equivalent on a chip), PINs, and PIN blocks" (transmitted/processed but not stored post-auth). "Masking Method of concealing a segment of PAN when displayed or printed." "Truncation Method of rendering a full PAN unreadable by removing a segment of PAN data. Truncation relates to protection of PAN when electronically stored, processed, or transmitted." Glossary-only (DSS requirement numbers are license-gated and not cited). Fetched + verified 2026-09-20. |
| HIPAA de-identification — 45 CFR §164.514(c) | https://www.law.cornell.edu/cfr/text/45/164.514 | The re-identification code/means "is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual." Basis: a pseudonym derived from the subject's own data (e.g. hash(name+DOB)) is reversible and fails de-identification. Legal adequacy determinations route to counsel. Fetched + verified 2026-09-20 (Cornell LII CFR text). |
| NIST SP 800-53 rev5 — AC-2 Account Management (lifecycle) | https://raw.githubusercontent.com/usnistgov/oscal-content/78650f02ad9321bb7b817846f8fbd4f2bcd620de/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json | AC-2 requires accounts be reviewed "for compliance with account management requirements," account managers notified "when users are terminated or transferred," and account management "align[ed] ... with personnel termination and transfer processes" (disable is the separate AC-2(f) action). Org-level process control; the code-visible artifact is an IaC grant with no expiry/owner/deprovision linkage. Fetched + verified 2026-09-20 (usnistgov OSCAL catalog). (SHA-pinned 78650f0; re-verified 2026-09-21) |

## Verified by direct fetch (2026-09-20) — OpenTelemetry resource semantic conventions (service & deployment identity)

| Standard / source | URL | What was confirmed |
|---|---|---|
| OpenTelemetry — service resource attributes | https://opentelemetry.io/docs/specs/semconv/registry/attributes/service/ | `service.name` "Logical name of the service."; `service.version` "The version string of the service component."; `service.namespace` "A namespace for service.name."; `service.instance.id` uniquely identifies an instance. All **Stable** (badge verified in the page's raw markup). Fetched + verified 2026-09-20. |
| OpenTelemetry — deployment resource attributes | https://opentelemetry.io/docs/specs/semconv/registry/attributes/deployment/ | `deployment.environment.name` "Name of the deployment environment (aka deployment tier)." Uniqueness note (verbatim): "deployment.environment.name does not affect the uniqueness constraints defined through the service.namespace, service.name and service.instance.id resource attributes. This implies that resources carrying the following attribute combinations MUST be considered to be identifying the same service" — i.e. same `service.name` in production and staging is, by default, the same identified service unless an environment/namespace dimension separates them. **Stable.** Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — NoSQL / distributed-store consistency (DynamoDB, Cassandra, MongoDB)

Verification date for the rows below: **2026-09-20**. Added for the deep-code-review
`concurrency-shared-state.md` "NoSQL / distributed-store TOCTOU" subsection and the
`performance-db-cost.md` hot-partition bullet. The two Cassandra rows are DataStax's
Apache Cassandra **3.0** documentation (page footer dated 2022-02-18) — a current-version
Apache Cassandra doc page (`cassandra.apache.org/doc/stable/cassandra/architecture/
dynamo.html`, fetched this session) covers tunable consistency and 4.0 LWT/transient-
replication interaction but does not restate the specific default-consistency-level or
LWT/non-LWT-mixing facts cited below; treat those two facts as foundational/version-stable
but sourced to the 3.0 doc specifically, and re-verify against current DataStax/Apache
docs before pinning a newer version number to them.

| Standard / source | URL | What was confirmed |
|---|---|---|
| AWS — DynamoDB condition expressions | https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Expressions.ConditionExpressions.html | Canonical URL confirmed via the page's own `<link rel="canonical">` (current page title "DynamoDB condition expression CLI example"). "This allows the write to proceed only if the item in question does not already have the same primary key." On `attribute_not_exists(Id)`: "When it is true, the write proceeds; when an item with that key already exists, the condition is false and DynamoDB rejects the write, which prevents an overwrite." Fetched + verified 2026-09-20. |
| AWS — DynamoDB read consistency | https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.ReadConsistency.html | "Both tables and LSIs provide two read consistency options: eventually consistent (default) and strongly consistent reads. All reads from GSIs and streams are eventually consistent." "Eventually consistent is the default read consistent model for all read operations." "If you set ConsistentRead to true, DynamoDB returns a response with the most up-to-date data, reflecting the updates from all prior write operations that were successful." "Strongly consistent reads from a global secondary index or a DynamoDB stream are not supported." Fetched + verified 2026-09-20. |
| AWS — Using Global Secondary Indexes in DynamoDB | https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/GSI.html | "the global secondary indexes on that table are updated in an eventually consistent fashion. Changes to the table data are propagated to the global secondary indexes within a fraction of a second, under normal conditions. However, in some unlikely failure scenarios, longer propagation delays might occur. Because of this, your applications need to anticipate and handle situations where a query on a global secondary index returns results that are not up to date." Also: "…if you Query a global secondary index and exceed its provisioned read capacity, your request will be throttled." (source lead-in "For example," elided). Fetched + verified 2026-09-20. |
| AWS — DynamoDB Transactions: How it works | https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/transaction-apis.html | "TransactWriteItems is a synchronous and idempotent write operation that groups up to 100 write actions in a single all-or-nothing operation. These actions can target up to 100 distinct items in one or more DynamoDB tables within the same AWS account and in the same Region. The aggregate size of the items in the transaction cannot exceed 4 MB." "You can't target the same item with multiple operations within the same transaction." Fetched + verified 2026-09-20. |
| AWS — Best practices for designing and using partition keys effectively in DynamoDB | https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/bp-partition-key-design.html | "Every partition in a DynamoDB table is designed to deliver a maximum capacity of 3,000 read units per second and 1,000 write units per second." Fetched + verified 2026-09-20. |
| DataStax — Apache Cassandra 3.0, consistency-level configuration | https://docs.datastax.com/en/cassandra-oss/3.0/cassandra/dml/dmlConfigConsistency.html | "The consistency level defaults to ONE for all write and read operations." Cassandra **3.0** doc (page footer dated 2022-02-18); see version note above. Fetched + verified 2026-09-20. |
| DataStax — Apache Cassandra 3.0, lightweight transactions | https://docs.datastax.com/en/cassandra-oss/3.0/cassandra/dml/dmlLtwtTransactions.html | "Lightweight transactions use a timestamping mechanism different than for normal operations and mixing LWTs and normal operations can result in errors. If lightweight transactions are used to write to a row within a partition, only lightweight transactions for both read and write operations should be used." Cassandra **3.0** doc (page footer dated 2022-02-18); see version note above. Fetched + verified 2026-09-20. |
| MongoDB Manual — Read Concern | https://www.mongodb.com/docs/manual/reference/read-concern/ | `"local"` level (default): "The query returns data from the instance with no guarantee that the data has been written to a majority of the replica set members. Data may be rolled back... Default for reads against the primary and secondaries." `"majority"` and `"linearizable"` levels must be requested explicitly. Fetched + verified 2026-09-20 (MongoDB Manual, version 8.3 current). |
| MongoDB Manual — Transactions, Production Considerations | https://www.mongodb.com/docs/manual/core/transactions-production-consideration/ | Runtime limit: "By default, a transaction must have a runtime of less than one minute... Transactions that exceeds this limit are considered expired and will be aborted by a periodic cleanup process" (configurable via `transactionLifetimeLimitSeconds`). (The page's `findOneAndUpdate`-inside-a-transaction example is transaction-scoped pessimistic locking — a different mechanism from the standalone filter-scoped optimistic write cited unquoted in the skill — and is not cited as a quote for that claim.) Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — serverless event-source mapping

| Standard / source | URL | What was confirmed |
|---|---|---|
| AWS Lambda — Handling errors for an SQS event source | https://docs.aws.amazon.com/lambda/latest/dg/services-sqs-errorhandling.html | Verbatim: "If your function throws an exception, the entire batch is considered a complete failure." Partial-batch reporting, verbatim: "To turn on partial batch responses, specify ReportBatchItemFailures for the FunctionResponseTypes action when configuring your event source mapping." Basis for "the fix needs both the handler's per-item failure list and the config flag." Fetched + verified 2026-09-20. |
| AWS Lambda — Using Lambda with Amazon SQS | https://docs.aws.amazon.com/lambda/latest/dg/with-sqs.html | Verbatim: "When your function successfully processes a batch, Lambda deletes its messages from the queue." "By default, if your function encounters an error while processing a batch, all messages in that batch become visible in the queue again after the visibility timeout expires" (the "By default" qualifier is what `ReportBatchItemFailures` overrides). Also verbatim (Warning): "Lambda event source mappings process each event at least once, and duplicate processing of records can occur." Fetched + verified 2026-09-20. |
| AWS Lambda — Use Lambda recursive loop detection to prevent infinite loops | https://docs.aws.amazon.com/lambda/latest/dg/invocation-recursion.html | Verbatim: "When you configure a Lambda function to output to the same service or resource that invokes the function, it's possible to create an infinite recursive loop." "Unintentional recursive loops can result in unexpected charges being billed to your AWS account. Loops can also cause Lambda to scale and use all of your account's available concurrency." Detection mechanism, verbatim: "To detect recursive loops, Lambda uses AWS X-Ray tracing headers"; stop condition, verbatim: "If your function is invoked approximately 16 times in the same chain of requests, then Lambda automatically stops the next function invocation in that request chain and notifies you." Supported-service scope, verbatim: "Lambda currently detects recursive loops between your functions, Amazon SQS, Amazon S3, and Amazon SNS." Coverage gap, verbatim: "When another AWS service such as Amazon DynamoDB forms part of the loop, Lambda can't currently detect and stop it." Fetched + verified 2026-09-20. |
| Amazon SQS — Visibility timeout | https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-visibility-timeout.html | Verbatim: "In both standard and FIFO (First-In-First-Out) queues, the visibility timeout helps prevent multiple consumers from processing the same message simultaneously. However, due to the at-least-once delivery model of Amazon SQS, there's no absolute guarantee that a message won't be delivered more than once during the visibility timeout period." Basis for the non-failure-triggered redelivery race (a slow-but-successful invocation vs. a second consumer), distinct from the failure-triggered redelivery cited above. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — capture-replay of short-lived approval bearer tokens (A07)

| Standard / source | URL | What was confirmed |
|---|---|---|
| CWE-294 — Authentication Bypass by Capture-replay | https://cwe.mitre.org/data/definitions/294.html | Title verbatim, confirmed at source: "CWE-294: Authentication Bypass by Capture-replay." Fetched + verified 2026-09-20. |
| OWASP JSON Web Token Cheat Sheet — Replay protection | https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet.html | Under "Replay protection": "A JWT deny list can typically be implemented based on the jti and iss claims:" (colon in source; introduces a code sample). Verbatim: "Freshness and replay protection can often by implementing by using a nonce bound to the session in the JWT claims. This approach is used in OpenID Connect." Verbatim: "Token reuse can be mitigated by using short expiration time in the JWT." Also names sender-constrained tokens (DPoP, TLS-bound JWT) as the mitigation for token-exfiltration risk. OWASP lists these mitigations without ranking them; the skill's own ranking — short expiry only narrows the window, while a `jti`-keyed consumed-id store, a session-bound nonce, or a sender-constrained/proof-of-possession token close it — is stated in the skill's voice, not attributed to OWASP. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — observability metric shape

Verification date for the rows below: **2026-09-20**. Added for the deep-code-review
`observability.md` "Metric type & shape correctness" subsection (histogram bucket/SLO
bracketing, quantile-averaging fallacy, counter/gauge/UpDownCounter instrument-type
correctness, lazy-metric alerting blind spot, single-unit-per-metric).

| Standard / source | URL | What was confirmed |
|---|---|---|
| Prometheus — Histograms and summaries (practices) | https://prometheus.io/docs/practices/histograms/ | On the classic (fixed-bucket) `le="0.3"`-style fraction-under-threshold query: "this expression strictly requires a bucket boundary configured at 0.3. If the histograms involved do not have a bucket with that boundary, no interpolation is applied. Instead of an estimation, no result is returned at all. If only some of the involved histograms have such a bucket, an incomplete result is returned, but without any warning, which is a pretty bad situation to be in." Native (dynamic exponential-bucket) histograms "won't get a bucket boundary at exactly 0.3, but with a decent resolution, the interpolated estimate will still be quite accurate" — the silent-failure mode is classic/fixed-bucket-specific. Separately, on aggregating a Summary's precomputed per-replica quantiles: "averaging the quantiles yields statistically nonsensical values. `avg(http_request_duration_seconds{quantile="0.95"}) // BAD!`" — correct aggregation recomputes from summed raw buckets. Fetched + verified 2026-09-20 (200, ~283KB). |
| Prometheus — Querying functions (rate/increase reset handling) | https://prometheus.io/docs/prometheus/latest/querying/functions/ | On `rate()`/`increase()` reset compensation, verbatim: "Breaks in monotonicity (such as counter resets due to target restarts) are automatically adjusted for." The adjustment is unconditional — it fires on any monotonicity break regardless of cause — so a non-restart reset still triggers it, producing a misleading reading at the reset rather than defeating the compensation. Fetched + verified 2026-09-20. |
| Prometheus — Instrumentation (practices) | https://prometheus.io/docs/practices/instrumentation/ | Counter vs. gauge, verbatim: "if the value can go down, it is a gauge... Counters can only go up (and reset, such as when a process restarts)... You should never take a rate() of a gauge." "Avoid missing metrics," verbatim: "Time series that are not present until something happens are difficult to deal with... export a default value such as 0 for any time series you know may exist in advance." Fetched + verified 2026-09-20 (200, ~202KB). |
| Prometheus — Metric and label naming (practices) | https://prometheus.io/docs/practices/naming/ | Verbatim: metric names "...MUST refer to a single unit (e.g. do not mix seconds with milliseconds) and to a single quantity (e.g. do not mix request size with request duration)." Prometheus's own convention bakes the unit into the name as a suffix (contrast with the OpenTelemetry row below). Fetched + verified 2026-09-20 (200, ~205KB). |
| OpenTelemetry — General metric semantic conventions | https://opentelemetry.io/docs/specs/semconv/general/metrics/ | "Consistent UpDownCounter timeseries" (**Status: Development**), verbatim: "the same attribute values used to record an increment SHOULD be used to record any associated decrement, otherwise those increments and decrements will end up as different timeseries." Units guidance (contrast with the Prometheus row above), verbatim: "Conventional metrics or metrics that have their units included in OpenTelemetry metadata (e.g. `metric.WithUnit` in Go) SHOULD NOT include the units in the metric name." Carve-out, verbatim: "Units may be included when it provides additional meaning to the metric name. Metrics MUST, above all, be understandable and usable." Fetched + verified 2026-09-20 (200, ~184KB; Semantic conventions v1.44.0, same version already indexed above for service/deployment resource attributes). |

## Verified by direct fetch (2026-09-20) — distributed lock liveness & fencing

Verification date for the rows below: **2026-09-20**. Added for the deep-code-review
`concurrency-shared-state.md` "Distributed lock/lease TOCTOU — liveness is not
exclusivity" subsection.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Martin Kleppmann — "How to do distributed locking" | https://martin.kleppmann.com/2016/02/08/how-to-do-distributed-locking.html | Under "Protecting a resource with a lock," verbatim: "You cannot fix this problem by inserting a check on the lock expiry just before writing back to storage. Remember that GC can pause a running thread at any point, including the point that is maximally inconvenient for you (between the last check and the write operation)." Under "Making the lock safe with fencing," the fix, verbatim: "you need to include a fencing token with every write request to the storage service... a fencing token is simply a number that increases... every time a client acquires the lock," enforced storage-side: "this requires the storage server to take an active role in checking tokens, and rejecting any writes on which the token has gone backwards." Under "Breaking Redlock with bad timings," the worked clock-skew example (node C's clock jumps forward and expires the lock while client 1 still holds A/B/C, so client 2 also acquires C/D/E) ends: "Clients 1 and 2 now both believe they hold the lock" — confirmed but not directly quoted in-skill. Fetched + verified 2026-09-20. |
| etcd docs — "etcd versus other key-value stores" (Learning → why) | https://etcd.io/docs/v3.6/learning/why/ | Verbatim: "Both of the server and client measures passing of time with their own clocks. It allows a situation that the server revokes the lease but the client still claims it owns the lease." Separately, later on the same page, verbatim: "Actually, the lease mechanism itself doesn't guarantee mutual exclusion. Owning a lease cannot guarantee the owner holds a lock of the resource." — and, after an intervening discussion of etcd's own revision-number/lease locking and the Chubby/Thor literature, verbatim: "If users need to protect resources which aren't related to etcd, the resources must provide the version number validation mechanism and consistency of replicas like keys of etcd. The lock feature of etcd itself cannot be used for protecting external resources." Also on this page: etcd's own docs map Kleppmann's fencing token to "revision number in the case of etcd," and name leader election and distributed locks together under "Common distributed patterns using etcd." Page footer: "Last modified July 10, 2026." Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — cryptographic-usage correctness (A04)

Verification date for the rows below: **2026-09-20**. Added for the nonce/IV-reuse,
constant-time-compare-generalization, and password-KDF-cost-floor fold into
`references/appsec-crypto.md` A04 (after the crypto-agility paragraph).
The two NIST PDFs were fetched and converted with `pdftotext -layout`; titles
cross-checked with `pdfinfo`. The CWE and OWASP pages were fetched as HTML and
tag-stripped for quote matching.

| Standard / source | URL | What was confirmed |
|---|---|---|
| NIST SP 800-38D — Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC | https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf | Title confirmed via `pdfinfo`. §8 uniqueness requirement, verbatim: "The probability that the authenticated encryption function ever will be invoked with the same IV and the same key on two (or more) distinct sets of input data shall be no greater than 2-32" (rendered `2^-32` in the skill; the PDF's superscript is lost in text extraction). Appendix A, verbatim: "if IVs are ever repeated for the GCM authenticated encryption function for a given key, then it is likely that an adversary will be able to determine the hash subkey from the resulting ciphertexts. The adversary then could easily construct a ciphertext forgery... the authentication assurance essentially is lost. Worse, the loss of authentication means that GCM inherits the problematic malleability of its Counter mode ciphertext... the adversary essentially could control the plaintext output of the authenticated decryption function." Fetched + verified 2026-09-20. |
| NIST SP 800-38A — Recommendation for Block Cipher Modes of Operation Methods and Techniques | https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38a.pdf | Title confirmed via `pdfinfo`. Verbatim: "For the CBC and CFB modes, the IVs must be unpredictable. In particular, for any given plaintext, it must not be possible to predict the IV that will be associated to the plaintext in advance of the generation of the IV." Verbatim, OFB reuse: "If, contrary to this requirement, the same IV is used for the OFB encryption of more than one message, then the confidentiality of those messages may be compromised." Fetched + verified 2026-09-20. |
| CWE-323 — Reusing a Nonce, Key Pair in Encryption | https://cwe.mitre.org/data/definitions/323.html | Title verbatim: "CWE-323: Reusing a Nonce, Key Pair in Encryption." Description verbatim: "Nonces should be used for the present occasion and only once." Observed-example rows verbatim: "CVE-2024-36289 social networking app reuses a nonce/key pair, allowing MITM attackers to manipulate direct messages"; "CVE-2024-21530 Rust package reuses a nonce/key pair when an object is cloned, which resets the random number generation." Fetched + verified 2026-09-20. |
| CWE-208 — Observable Timing Discrepancy | https://cwe.mitre.org/data/definitions/208.html | Title verbatim: "CWE-208: Observable Timing Discrepancy." Description verbatim: "Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not." Observed-example row verbatim: "CVE-2019-10071 Java-oriented framework compares HMAC signatures using String.equals() instead of a constant-time algorithm, causing timing discrepancies." Fetched + verified 2026-09-20. |
| OWASP Cryptographic Storage Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html | Title confirmed: "Cryptographic Storage - OWASP Cheat Sheet Series." § Encrypting Stored Keys, verbatim (the quote used in the skill body): "At least two separate keys are required for this: The Data Encryption Key (DEK) is used to encrypt the data. The Key Encryption Key (KEK) is used to encrypt the DEK. For this to be effective, the KEK must be stored separately from the DEK." Also verbatim: "The KEK should also be at least as strong as the DEK." Also checked, not quoted in the skill (§ Key Generation carries an apparent wording artifact on the live page, "data separate data-encrypting," reproduced here only for the record, not cited): "Where multiple keys are used (such as data separate data-encrypting and key-encrypting keys), they should be fully independent from each other." Fetched + verified 2026-09-20. |
| OWASP Password Storage Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html | Title confirmed: "Password Storage - OWASP Cheat Sheet Series." Verbatim: "Use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism. If Argon2id is not available, use scrypt with a minimum CPU/memory cost parameter of (2^17), a minimum block size of 8 (1024 bytes), and a parallelization parameter of 1. For legacy systems using bcrypt, use a work factor of 10 or more and with a password limit of 72 bytes." Verbatim: "The bcrypt password hashing function should only be used for password storage in legacy systems where Argon2 and scrypt are not available. The work factor should be as large as verification server performance will allow, with a minimum of 10." Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — algorithmic-complexity / resource-exhaustion DoS

Verification date for the rows below: **2026-09-20**. Added for the deep-code-review
`language-stack-redflags.md` "Denial of service / resource amplification" section
(hash-flooding, uncontrolled recursion, and excessive-size-value allocation
bullets). All three pages are CWE version **4.20** (from each page heading; the
`<title>` element additionally carries a "CWE - " prefix omitted in the quotes
below). Mitigation shapes named in the skill text for CWE-407 and library
default-depth behavior for CWE-674 are **not** on these pages and are flagged
in-line as unsourced / to-verify-against-the-target, not attributed here.

| Standard / source | URL | What was confirmed |
|---|---|---|
| CWE-407 — Inefficient Algorithmic Complexity | https://cwe.mitre.org/data/definitions/407.html | Title (page heading) verbatim: "CWE-407: Inefficient Algorithmic Complexity (4.20)". Description, verbatim: "An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached." Observed Examples, verbatim: CVE-2003-0244 and CVE-2003-0364 both "CPU consumption via inputs that cause many hash table collisions." Fetched + verified 2026-09-20. |
| CWE-674 — Uncontrolled Recursion | https://cwe.mitre.org/data/definitions/674.html | Title (page heading) verbatim: "CWE-674: Uncontrolled Recursion (4.20)". Description, verbatim: "The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack." Alternate Terms, verbatim: "Stack Exhaustion". Observed Example, verbatim: CVE-2007-1285 "Deeply nested arrays trigger stack exhaustion." Fetched + verified 2026-09-20. |
| CWE-789 — Memory Allocation with Excessive Size Value | https://cwe.mitre.org/data/definitions/789.html | Title (page heading) verbatim: "CWE-789: Memory Allocation with Excessive Size Value (4.20)". Description, verbatim: "The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated." Observed Examples, verbatim: CVE-2023-2253 "Query capability for API endpoint allows a large value for number of records to return, leading to allocation of a large array"; CVE-2008-1708 "memory consumption and daemon exit by specifying a large value in a length field." Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — pagination correctness

Verification date for the rows below: **2026-09-20**. Added for the deep-code-review
`api-contracts.md` "Public interface hygiene" page-token-opacity addendum and the
`performance-db-cost.md` `LIMIT`/`OFFSET` correctness bullet's zero-write-drift addendum.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Google AIP-158 — Pagination | https://google.aip.dev/158 | Under "Opacity," verbatim: "Page tokens provided by APIs must be opaque (but URL-safe) strings, and must not be user-parseable. This is because if users are able to deconstruct these, they will do so. This effectively makes the implementation details of your API's pagination become part of the API surface, and it becomes impossible to update those details without breaking users." Verbatim warning: "Base-64 encoding an otherwise-transparent page token is not a sufficient obfuscation mechanism." Verbatim: "Page tokens must be limited to providing an indication of where to continue the pagination process only. They must not provide any form of authorization to the underlying resources, and authorization must be performed on the request as with any other regardless of the presence of a page token." Fetched + verified 2026-09-20. |
| PostgreSQL Documentation — 7.6. LIMIT and OFFSET | https://www.postgresql.org/docs/current/queries-limit.html | `/docs/current/` resolves to PostgreSQL 18 (page title: "PostgreSQL: Documentation: 18: 7.6. LIMIT and OFFSET"); three other `postgresql.org/docs/current/...` pages are already indexed above (transaction-iso.html, sql-createindex.html, explicit-locking.html), same version-floating-alias citation practice. Verbatim: "When using LIMIT, it is important to use an ORDER BY clause that constrains the result rows into a unique order. Otherwise you will get an unpredictable subset of the query's rows." Verbatim: "The query optimizer takes LIMIT into account when generating query plans, so you are very likely to get different plans (yielding different row orders) depending on what you give for LIMIT and OFFSET. Thus, using different LIMIT/OFFSET values to select different subsets of a query result will give inconsistent results unless you enforce a predictable result ordering with ORDER BY. This is not a bug; it is an inherent consequence of the fact that SQL does not promise to deliver the results of a query in any particular order unless ORDER BY is used to constrain the order." Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — a11y: live regions, Label in Name, disclosure state

Verification date for the rows below: **2026-09-20**. Added for the deep-code-review
`a11y-live.md` / `a11y-aria.md` / `a11y-focus.md` folds: a loading/skeleton region needing a live-region announcement
(not just `aria-busy`), WCAG SC 2.5.3 Label in Name, and a disclosure toggle needing
`aria-expanded` state alongside its label/icon swap.

| Standard / source | URL | What was confirmed |
|---|---|---|
| WCAG 2.2 SC 2.5.3 Label in Name | https://www.w3.org/TR/WCAG22/#x2-5-3-label-in-name | Level A. Verbatim: "For user interface components with labels that include text or images of text, the name contains the text that is presented visually." Note, verbatim: "A best practice is to have the text of the label at the start of the name." Basis for the rule that a rewritten/descriptive `aria-label` must still contain the visible text. Fetched + verified 2026-09-20. |
| WCAG 2.2 SC 4.1.3 Status Messages | https://www.w3.org/TR/WCAG22/#x4-1-3-status-messages | Level AA. Verbatim: "In content implemented using markup languages, status messages can be programmatically determined through role or properties such that they can be presented to the user by assistive technologies without receiving focus." The glossary's **status message** definition, verbatim (confirmed at `#dfn-status-messages` in the same fetch): "change in content that is not a change of context, and that provides information to the user on the success or results of an action, on the waiting state of an application, on the progress of a process, or on the existence of errors" — explicitly covers a loading/waiting state, which sources the 4.1.3 citation for the loading/skeleton live-region fold. `aria-busy` alone does not satisfy the SC; a `role`/`aria-live` does. Fetched + verified 2026-09-20. |
| MDN — ARIA: status role | https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA/Reference/Roles/status_role | Requested `/ARIA/Roles/status_role`; 1 redirect to this canonical URL (confirmed via `curl -sIL`). Verbatim: "A status is a type of live region providing advisory information that is not important enough to justify an alert, which would immediately interrupt the announcement of a user's current activity." Verbatim: "Elements with the role status have an implicit aria-live value of polite and an implicit aria-atomic value of true." Verbatim: "Do not give focus to the status when its content updates." Basis for `role="status"` as the fix (no separate `aria-live` attribute needed). Fetched + verified 2026-09-20. |
| MDN — ARIA: aria-expanded | https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA/Reference/Attributes/aria-expanded | Requested `/ARIA/Attributes/aria-expanded`; 1 redirect to this canonical URL (confirmed via `curl -sIL`). Verbatim: "The aria-expanded attribute is applied to this focusable, interactive control that toggles the visibility of the object." Verbatim, on the paired relationship: "There are two declarations that can be applied to objects that control the visibility of another object: aria-controls, or aria-owns combined with aria-expanded." Values confirmed: `false` = "collapsed", `true` = "expanded", `undefined` (default) = "does not own or control a grouping element that is expandable." Basis for requiring `aria-expanded` (paired with `aria-controls`) on a disclosure toggle whose label/icon merely swap. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — gh CLI / GitHub Actions workflow OAuth scope

Verification date for the row below: **2026-09-20**. Added for the deep-code-review
`parallel-audit.md` gh-CLI gotcha: editing `.github/workflows/*` needs the `workflow` OAuth scope.

| Standard / source | URL | What was confirmed |
|---|---|---|
| GitHub Docs — Scopes for OAuth apps | https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps | Verbatim: the `workflow` scope "Grants the ability to add and update GitHub Actions workflow files." (The doc's next sentence adds that workflow files can be committed without this scope when identical to a file already on another branch.) Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — WebAuthn / passkey credential-layer

Verification date for the rows below: **2026-09-20**. Added for the deep-code-review
`appsec-login.md` passkey/WebAuthn fold: RP ID origin-scoping, the signature counter as a
clone-detection signal, and NIST's phishing-resistance requirements (no silent downgrade to a
weaker factor). Both fetched via `curl` (raw HTML), not a summarizer.

| Standard / source | URL | What was confirmed |
|---|---|---|
| W3C Web Authentication (WebAuthn) Level 3 | https://www.w3.org/TR/webauthn-3/ | Verbatim: a Relying Party Identifier is "a valid domain string identifying the WebAuthn Relying Party," and cross-RP privacy holds — "Relying Parties are not able to detect any properties, or even the existence, of credentials scoped to other Relying Parties" — basis for pinning RP ID server-side. On the signature counter, verbatim: "The signature counter's purpose is to aid Relying Parties in detecting cloned authenticators," and "If either is non-zero, and the new signCount value is less than or equal to the stored value, a cloned authenticator may exist ..." — basis for the `signCount <= stored` clone-detection check (the "either is non-zero" qualifier is why a regression such as stored=7 → new=0 is flagged, while an always-zero counter is not). Fetched + verified 2026-09-20. |
| NIST SP 800-63-4B (Digital Identity Guidelines — Authentication) — AAL phishing-resistance | https://pages.nist.gov/800-63-4/sp800-63b.html | Verbatim: "Applications assessed at AAL2 must offer a phishing-resistant authentication ... option"; "AAL3 authentication requires a phishing-resistant authenticator ... with a non-exportable authentication key"; "Verifiers SHALL offer at least one phishing-resistant authentication option at AAL2."; "Since syncable authenticators ... require the private key to be exportable, syncable authenticators SHALL NOT be used at AAL3." Basis for the rule that a WebAuthn flow must not silently downgrade to a non-phishing-resistant factor, and that syncable (exportable-key) passkeys are barred at AAL3. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — email one-click unsubscribe (RFC 8058)

Verification date for the row below: **2026-09-20**. Added for the deep-code-review
`api-contracts.md` transactional/bulk-email fold. Fetched via `curl` (the raw RFC `.txt`), not a
summarizer. (SPF/DKIM/DMARC are cited in the fold by their RFC numbers — 7208 / 6376 / 7489 — as
well-established mechanisms, so they carry no separate row here.)

| Standard / source | URL | What was confirmed |
|---|---|---|
| RFC 8058 — Signaling One-Click Functionality for List Email Headers | https://www.rfc-editor.org/rfc/rfc8058.txt | Verbatim: "The List-Unsubscribe header field MUST contain one HTTPS URI." "The List-Unsubscribe-Post header MUST contain the single key/value pair 'List-Unsubscribe=One-Click'." "the message MUST have a valid DomainKeys Identified Mail (DKIM) signature that covers at least the List-Unsubscribe and List-Unsubscribe-Post headers." "The POST request MUST NOT include cookies, HTTP authorization, or any other context information." "The mail sender MUST NOT return an HTTPS redirect ..." Basis for the one-click-unsubscribe rules (direct POST, no confirm-redirect, DKIM must cover the unsubscribe headers; the no-cookies/no-context rule scopes the POST's contents, not the endpoint's response). Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — NIST 800-63-4 password policy

Verification date for the row below: **2026-09-20**. Added for the deep-code-review
`appsec-login.md` password-policy deepen (current NIST reverses forced rotation / composition
rules). Fetched via `curl` (raw HTML).

| Standard / source | URL | What was confirmed |
|---|---|---|
| NIST SP 800-63-4B (Digital Identity Guidelines — Authentication) — password composition & rotation | https://pages.nist.gov/800-63-4/sp800-63b.html | Verbatim: "Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords." "Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically. However, verifiers SHALL force a change if there is evidence that the authenticator has been compromised." Basis for the deepen that flagging the *absence* of forced periodic rotation or composition rules follows outdated (2017-era) guidance — current NIST reverses both (prefer screening against a breached-credential list plus a length floor; force a change only on evidence of compromise). Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — AI-generated-code API/symbol hallucination

Verification date for the row below: **2026-09-20**. Added for the deep-code-review
`domain-a.md` fold on API hallucination (a nonexistent method/param on a *real*
dependency, distinct from the package-name hallucination already cited via the Spracklen study).
Fetched via `curl` (the arxiv abstract page).

| Standard / source | URL | What was confirmed |
|---|---|---|
| Chen et al., "Towards Mitigating API Hallucination in Code Generated by LLMs…" (FSE 2025 Industry Track) | https://arxiv.org/abs/2505.05057 | Verbatim (abstract): "Large Language Models (LLMs) assist in automated code generation but often struggle with **API hallucination, including invoking non-existent APIs and misusing existing ones in practical development scenarios**." Basis for the Domain-A check that an AI-authored call into a real dependency must be verified against the lockfile-pinned version (the case a type-checker misses at dynamic/stringly-typed call sites), distinct from package-name hallucination. Fetched + verified 2026-09-20. |


## Verified by direct fetch (2026-09-20) — OWASP Agent Control Standard (ACS)

Verification date for the row below: **2026-09-20**. Added for the deep-code-review
`security-ai-agents.md` MCP/agent-governance section (a name-only citation of ACS alongside the
OWASP MCP Top 10 pre-stable precedent; the skill pins none of ACS's method names or decision enum
as stable). Fetched via `curl` (GitHub raw README + GitHub tags API) and confirmed reachable at the
OWASP GenAI project page.

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP Agent Control Standard (ACS) — GenAI Security Project | https://genai.owasp.org/resource/agent-control-standard-acs/ · https://github.com/GenAI-Security-Project/agent-control-standard | Pre-1.0, active development: README states "Specification v0.1.0 ships today. The tagged release is v0.1.1" (GitHub tags API confirms `v0.1.1`), the next specification release v0.2.0 targets March 2027, and no v1.0 date is set. A runtime-governance *wire specification* (not a risk catalog): a separate **Guardian Agent** answers every hook with one of five dispositions — `allow`, `deny`, `modify`, `ask` (route to a human/agent/service approver), or `defer` (postpone the verdict). Three pillars: **Instrument** (hooks + the five dispositions), **Trace** (OpenTelemetry spans, OCSF events), **Inspect** (AgBOM: CycloneDX/SPDX/SWID); the Instrument pillar + wire format + audit chain is the mandatory baseline, while Trace/Inspect/field-level provenance/cryptographic signing are conformance extensions. OWASP GenAI project page reachable (HTTP 200). Basis for the name-only ACS citation in `security-ai-agents.md`; nothing pinned as stable. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — required-state exposure on custom composite widgets

Verification date for the rows below: **2026-09-20**. Added for the deep-code-review
`a11y-forms.md` fold: a shared `Field` wrapper's `aria-hidden` required asterisk needs
"required" exposed through another channel, and a custom button+listbox Select/combobox
composed inside it has none unless it sets `aria-required` itself. All four fetched via
`curl` (raw HTML), not a summarizer.

| Standard / source | URL | What was confirmed |
|---|---|---|
| WCAG 2.2 SC 3.3.2 Labels or Instructions | https://www.w3.org/TR/WCAG22/#x3-3-2-labels-or-instructions | Level A. Verbatim: "Labels or instructions are provided when content requires user input." Its Understanding page (`https://www.w3.org/WAI/WCAG22/Understanding/labels-or-instructions.html`, fetched this session) lists **ARIA2: Identifying a required field with the `aria-required` property** as an *advisory* technique (ARIA2 appears under the SC's Advisory Techniques, not its Sufficient Techniques) — ties a required-field indicator to the `aria-required` property, not the visual asterisk alone. Fetched + verified 2026-09-20. |
| WCAG 2.2 SC 4.1.2 Name, Role, Value | https://www.w3.org/TR/WCAG22/#x4-1-2-name-role-value | Level A. Verbatim: "For all user interface components (including but not limited to: form elements, links and components generated by scripts), the name and role can be programmatically determined; states, properties, and values that can be set by the user can be programmatically set; and notification of changes to these items is available to user agents, including assistive technologies." Cited narrowly for the general principle that a component "generated by scripts" carries no free semantics — not as a literal claim that 4.1.2 itself mandates `aria-required` on an author-set property. Fetched + verified 2026-09-20. |
| WAI-ARIA 1.2 — `aria-required` property | https://www.w3.org/TR/wai-aria-1.2/#aria-required | W3C Recommendation, 06 June 2023. Verbatim: "Indicates that user input is required on the element before a form may be submitted." Verbatim note: "The fact that the element is required is often presented visually (such as a sign or symbol after the widget). Using the aria-required attribute allows the author to explicitly convey to assistive technologies that an element is required." Confirmed `Used in Roles`: `checkbox`, `combobox`, `gridcell`, `listbox`, `radiogroup`, `spinbutton`, `textbox`, `tree`. Fetched + verified 2026-09-20. |
| WAI-ARIA 1.2 — `generic` role | https://www.w3.org/TR/wai-aria-1.2/#generic | W3C Recommendation, 06 June 2023. Verbatim: "A nameless container element that has no semantic meaning on its own. The generic role is intended for use as the implicit role of generic elements in host languages (such as HTML div or span), so is primarily for implementors of user agents." Backs "a `<div>`/`<span>` given `tabIndex`+`onKeyDown` but no `role` keeps its implicit `generic` mapping — focusable and operable, but with no announced role or name (WCAG 4.1.2)." Fetched + verified 2026-09-21. |
| HTML-AAM (HTML Accessibility API Mappings) 1.0 — §3.6.116 `required` | https://www.w3.org/TR/html-aam-1.0/#att-required | **W3C Working Draft, 29 August 2026 (not a Recommendation)** — cite as a draft mapping, not a finished standard. Confirmed table: HTML `required`, Element(s) `input`; `select`; `textarea` → `[WAI-ARIA-1.2] aria-required`. Basis for "a native `<select required>` gets required-state exposure mapped in for free; a custom `role="combobox"` button has no such host-language mapping." Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — code-review design section ("What to look for in a code review")

Verification date for the row below: **2026-09-20**. Added for the deep-code-review
`domain-a.md` default-path placement/design-fit bullet (issue #805).

| Standard / source | URL | What was confirmed |
|---|---|---|
| Google Engineering Practices — What to look for in a code review (Design section) | https://google.github.io/eng-practices/review/reviewer/looking-for.html | A distinct page from the already-indexed `.../reviewer/standard.html` ("The Standard of Code Review," 2026-08-13 table above) — this page opens with a note to take that Standard into account "when considering each of these points," then its first section (`<h2 id="design">Design</h2>`) states, verbatim: "The most important thing to cover in a review is the overall design of the CL. Do the interactions of various pieces of code in the CL make sense? Does this change belong in your codebase, or in a library? Does it integrate well with the rest of your system? Is now a good time to add this functionality?" Basis for the Domain A placement/timing bullet. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — SLSA v1.0 Build requirements (Hosted)

Verification date for the row below: **2026-09-20**. Added for the deep-code-review
`release-engineering.md` producer-side signed-releases fold (a valid signature proves who signed,
not where the build ran). Distinct URL from the existing SLSA v1.0 levels row above — the
technical requirements table, not the informal levels overview. Fetched via `curl` (raw HTML).

| Standard / source | URL | What was confirmed |
|---|---|---|
| SLSA v1.0 — Build track requirements | https://slsa.dev/spec/v1.0/requirements | Verbatim, the Build-platform "Isolation strength" row: "**Hosted** — All build steps ran using a hosted build platform on shared or dedicated infrastructure, not on an individual's workstation. Examples: GitHub Actions, Google Cloud Build, Travis CI." The requirements table's own checkmarks place **Hosted** at **L2 and L3** (blank at L1) — the precise level assignment behind the existing SLSA v1.0 levels row above. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — CSP directive-level hardening & DOM Clobbering

Verification date for the rows below: **2026-09-20**. Added for the deep-code-review
`frontend-a11y.md` "Security & compatibility" folds: enforceable CSP directives
(`script-src` nonce/hash + `strict-dynamic`, `object-src 'none'`, `base-uri 'none'`, and
the per-response nonce-freshness trap) and DOM Clobbering (sanitizer named-property
handling + type-checking a bare `window`/`document` global before trusting it). Both
fetched via `curl` (raw HTML), not a summarizer. Distinct rows from the repo's existing
by-name "OWASP Cheat Sheet Series" reference — these are the two specific cheat sheets
actually fetched this session. The already-indexed CWE Top 25 (2025) row above (dated
2026-08-13) was additionally re-fetched this session to confirm CWE-79 (Cross-site
Scripting) holds **rank 1** specifically (score 60.38) — the 2026-08-13 row recorded
only the unranked "top entries" list; the frontend-a11y.md CSP fold's "rank #1" claim
is sourced to this 2026-09-20 re-fetch.

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP Content Security Policy Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html | The documented Strict CSP forms, verbatim: `script-src 'nonce-{RANDOM}' 'strict-dynamic'; object-src 'none'; base-uri 'none';` (nonce-based) and the `'sha256-{HASHED_INLINE_SCRIPT}' 'strict-dynamic'` hash-based equivalent. `object-src` "specifies the URLs from which plugins can be loaded from"; `base-uri` "specifies the possible URLs that the `<base>` element can use" and sits under the page's separate "Document Directives" heading, not "Fetch Directives" (`object-src`'s heading — the only directive the page explicitly states does **not** fall back to `default-src` is `frame-ancestors`; no equivalent statement is made for `base-uri`, so no fallback-behavior claim is made here). Nonce freshness, verbatim: "Nonces are unique one-time-use random values that you generate for each HTTP response." Verbatim warning: "Don't create a middleware that replaces all script tags with \"script nonce=...\" because attacker-injected scripts will then get the nonces as well. You need an actual HTML templating engine to use nonces." A strict policy's purpose, verbatim: "protect against classical stored, reflected, and some of the DOM XSS attacks." Fetched + verified 2026-09-20. |
| OWASP DOM Clobbering Prevention Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.html | Defines DOM Clobbering, verbatim: "a type of code-reuse, HTML-only injection attack, where attackers confuse a web application by injecting HTML elements whose id or name attribute matches the name of security-sensitive variables or browser APIs ... and overshadow their value," relevant "particularly ... when script injection is not possible, e.g., when filtered by HTML sanitizers." Worked example, verbatim: injecting `<a id=config><a id=config name=url href='malicious.js'>` against code reading `window.config.url`, "to load additional JavaScript code, and obtain arbitrary client-side code execution." Sanitizer defaults, verbatim: DOMPurify's default `SANITIZE_DOM` "removes all clobbering collisions with built-in APIs and properties" only — custom/app-defined names need `SANITIZE_NAMED_PROPS: true` (isolates the namespace "by prefixing them with `user-content-` string"); the Sanitizer API "does not prevent DOM Clobbering [in] its default setting" and needs `blockAttributes` set on `id`/`name` (source page's own wording has a minor typo — "it its" for "in its" — reproduced faithfully, not an error introduced here). Also verbatim: CSP "can only mitigate some variants of DOM clobbering attacks ... but not when already-present code can be abused for code execution, e.g., clobbering the parameters of code evaluation constructs like eval()." Fetched + verified 2026-09-20. |
- **OWASP Cheat Sheet Series** — concrete implementation guidance. (Several individual
  sheets are separately verified by direct fetch with their own dated rows below —
  Cryptographic Storage, Password Storage, HTTP Headers, XS Leaks, Multifactor
  Authentication, and Transaction Authorization; this by-name entry covers the rest of
  the series not yet individually fetched.)

## Verified by direct fetch (2026-09-20) — HTTP response-header census, XS-Leaks isolation headers, MFA push/OTP hardening, and transaction authorization (WYSIWYS)

Verification date for the rows below: **2026-09-20**. Added for three `deep-code-review`
`security-appsec.md` folds (now in `appsec-edge.md`, `appsec-login.md`, and `appsec-approvals.md`): the A02 security-header census gaining `Permissions-Policy`
and the `Cross-Origin-Opener-Policy`/`Cross-Origin-Embedder-Policy`/
`Cross-Origin-Resource-Policy` trio; the A07 authentication-failures section gaining
push-notification MFA fatigue (push-bombing) and OTP handling-and-storage discipline; and
the A01 access-control section gaining transaction authorization (What-You-See-Is-What-
You-Sign plus a transaction-unique authorization credential) as an axis distinct from the
segregation-of-duties/maker-checker control already covered there. XS Leaks is a second
source for the header fold, cited by name in that fold's text alongside HTTP Headers, so
it gets its own row here too. All four OWASP Cheat Sheet Series pages fetched via
`curl -sL` (raw HTML), not a summarizer.

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP HTTP Headers Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html | Verbatim, Permissions-Policy: "Permissions-Policy allows you to control which origins can use which browser features, both in the top-level page and in embedded frames. … This means that you can configure your site to never allow the camera or microphone to be activated. This prevents that an injection, for example an XSS, enables the camera, the microphone, or other browser feature." Example given: `Permissions-Policy: geolocation=(), camera=(), microphone=()`. Verbatim, COOP: "The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents." Example: `Cross-Origin-Opener-Policy: same-origin`. Verbatim, COEP: "The HTTP Cross-Origin-Embedder-Policy (COEP) response header prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS)." Example: `Cross-Origin-Embedder-Policy: require-corp`. Verbatim, CORP: "The Cross-Origin-Resource-Policy (CORP) header allows you to control the set of origins that are empowered to include a resource. It is a robust defense against attacks like Spectre, as it allows browsers to block a given response before it enters an attacker's process." Example: `Cross-Origin-Resource-Policy: same-site`. Fetched + verified 2026-09-20. |
| OWASP XS Leaks Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/XS_Leaks_Cheat_Sheet.html | Cited as the second source for the same header fold (COOP/CORP), not a separate fold. Frame-counting attacks § Defense, COOP, verbatim: "Setting this header will prevent cross-origin documents from opening in the same browsing context group. This solution ensures that document A opening another document will not have access to the window object." — the cross-window/window-reference leak. Attacks based on error events § Defense lists three mitigations in order — SubResource protection (unique tokens), Fetch metadata (`Sec-Fetch-Site`), and CORP, verbatim: "If the server returns this header with the appropriate value, the browser will not load resources from our site or origin (even static images) in another application." — the `onload`/`onerror` resource-probing leak; CORP is one of three listed defenses there, not singled out as primary. Quick recommendations, verbatim: "If your application uses cookies, make sure to set the appropriate SameSite attribute," "consider using the mechanisms described in the framing protection section" (frame-ancestors / legacy X-Frame-Options), "To strengthen the isolation of your application between other origins, use Cross Origin Resource Policy and Cross Origin Opener Policy headers with appropriate values," and "Use the headers available within Fetch Metadata to build your own resource isolation policy" — four siblings, not two; this skill already covers the first two (SameSite, framing protection), COOP/CORP is the fold, and Fetch Metadata is out of scope for this fold (not claimed as covered). SameSite verbatim, defense-in-depth caveat: "SameSite cookies are a strong defense-in-depth mechanism against some classes of XS Leaks and CSRF attacks, which can significantly reduce the attack surface, but may not completely cut them." Fetched + verified 2026-09-20. |
| OWASP Multifactor Authentication Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html | MFA Fatigue (Push Notification Bombing), verbatim: "Attackers repeatedly send MFA push notifications, often combined with social engineering, hoping the user eventually approves one." Mitigations, verbatim: "Require challenge-response push authentication (for example, number matching) to prevent blind approval of authentication requests," "Rate-limit or cap push notifications to prevent repeated prompt abuse," "Monitor for anomalous authentication activity, such as multiple push prompts in a short period or new-device token reuse." One-Time Password (OTP) Handling and Storage, verbatim: "At a minimum, OTP implementations SHOULD: Enforce a short time-to-live (TTL); Ensure OTPs are single use; Apply strict attempt limits; Invalidate the OTP on successful verification," and "OTP implementations SHOULD NOT: Log OTP values; Store OTPs in long-term plaintext form." Fetched + verified 2026-09-20. |
| OWASP Transaction Authorization Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Transaction_Authorization_Cheat_Sheet.html | §1.1, verbatim (What You See Is What You Sign): "When the developer builds components for transaction authorizations, they should use the What You See Is What You Sign principle. An authorization method must permit a user to identify and acknowledge the data that is significant to a given transaction. For example, in the case of a wire transfer, the user should be able to identify the target account and amount." §1.5 title and body, verbatim: "Each transaction should be authorized using unique authorization credentials" — "If applications only ask for transaction authorization credentials once (such as a static password, code sent through SMS, or a token response), the user could authorize any transaction during the entire session or reuse the same credentials when they need to authorize a transaction. In this scenario, attackers can employ malware to sniff credentials and use them to authorize any transaction without the user's knowledge." Note: this cheat sheet does **not** use the phrase "time-bound" anywhere (grepped this session) — the sourced requirement is per-transaction **uniqueness**, cited as such in the skill body. This section is explicitly framed (§1.4) as orthogonal to using a distinct approving principal — it does not mention maker-checker/segregation of duties at all; that framing is this skill's own synthesis, not sourced from this page. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — lint/scanner rule-tier verification (typescript-eslint, CodeQL, ruff)

Verification date for the rows below: **2026-09-20**. Added for the deep-code-review
`method-situational.md` Phase-1 planted-defect-matrix fold: a gate can be present, non-empty,
correctly path-scoped, and not excluding the changed path — the matrix's existing
(a)-(d) checks — while still running only a narrower rule/query category that
structurally cannot catch a defect class the review otherwise cares about. All
fetched via `curl` (raw HTML), not a summarizer. The first row below supersedes an
initial read of typescript-eslint's coarser per-rule index column (which tags a rule
only "recommended" or "strict," omitting the "-type-checked" suffix); each rule's
own page states its exact enabling config and was fetched to confirm it precisely.

| Standard / source | URL | What was confirmed |
|---|---|---|
| typescript-eslint — per-rule config pages (4) | https://typescript-eslint.io/rules/no-unnecessary-condition/ · https://typescript-eslint.io/rules/no-floating-promises/ · https://typescript-eslint.io/rules/no-misused-promises/ · https://typescript-eslint.io/rules/unbound-method/ | Each rule's own page states, verbatim, which single config "enables this rule." Confirmed: `no-floating-promises`, `no-misused-promises`, and `unbound-method` are each enabled by extending `recommended-type-checked`; `no-unnecessary-condition` requires the further `strict-type-checked` — one config beyond it. (The coarser per-rule index table at https://typescript-eslint.io/rules/ tags these only "recommended" / "strict" in its config-group column, omitting the "-type-checked" suffix — the per-rule page, not that column, is the precise source cited here.) A project already on `recommended-type-checked` — type-aware, catching the promise/unbound-method class — can still be structurally blind to a `no-unnecessary-condition`-class defect. Fetched + verified 2026-09-20. |
| typescript-eslint — Configs | https://typescript-eslint.io/users/configs | Confirms the named shareable configs `recommended`, `recommended-type-checked`, `strict`, `strict-type-checked`, `stylistic`, `stylistic-type-checked` all exist as distinct, separately-adoptable configs. Fetched + verified 2026-09-20. |
| CodeQL query help — suite index | https://codeql.github.com/codeql-query-help/ | Verbatim: "View the query help for the queries included in the `default`, `security-extended`, and `security-and-quality` query suites for the languages supported by CodeQL." Confirms three distinct, named query suites — which one a CodeQL workflow actually runs is a materially different query surface, not a formality. Fetched + verified 2026-09-20. |
| ruff — the `select` setting | https://docs.astral.sh/ruff/settings/#lint_select | Verbatim: "A list of rule codes or prefixes to enable... **Default value**: See Default Rules." The worked `extend-select` example's own comment, verbatim: "On top of the defaults, enable flake8-bugbear (`B`) and flake8-quotes (`Q`)." Confirms ruff ships a documented default rule selection, distinct from and smaller than what `select`/`extend-select` can add; this skill does not pin exact rule counts on either side, since they drift across ruff releases. Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — switch/case fallthrough & unreachable-code linter rules

Verification date for the rows below: **2026-09-20**. Added for the deep-code-review
`redflags-situational.md` switch/case control-flow fold (cross-language fallthrough
reversal, unreachable-after-return, lexical declarations leaking across case clauses,
duplicate/mislabeled case). All fetched via `curl -sL` (raw HTML/Markdown), not a
summarizer. Two corrections to the working brief surfaced by these fetches: (1) C# was
initially assumed to share the C/Java/JS default-fallthrough behavior — Microsoft's own
reference states the opposite, that implicit fallthrough is a **compiler error** in C#;
(2) Java is not uniformly a default-fallthrough language — Oracle's docs confirm its
modern arrow-form `case L ->` switch does not fall through, only the classic colon form
does. Both corrections are reflected in the skill content, not just here.

| Standard / source | URL | What was confirmed |
|---|---|---|
| ESLint `no-fallthrough` | https://eslint.org/docs/latest/rules/no-fallthrough | Rule title verbatim: "Disallow fallthrough of case statements." "This rule is aimed at eliminating unintentional fallthrough of one case to the other. As such, it flags any fallthrough scenarios that are not marked by a comment." The sanctioned marker: "a comment which matches the `/falls?\s?through/i` regular expression but isn't a directive." Fetched + verified 2026-09-20. |
| ESLint `no-unreachable` | https://eslint.org/docs/latest/rules/no-unreachable | Rule title verbatim: "Disallow unreachable code after `return`, `throw`, `continue`, and `break` statements." Fetched + verified 2026-09-20. |
| ESLint `no-case-declarations` | https://eslint.org/docs/latest/rules/no-case-declarations | Rule title verbatim: "Disallow lexical declarations in case clauses." Body: lexical declarations (`let`, `const`, `function`, `class`) in a `case`/`default` clause are "visible in the entire switch block but it only gets initialized when it is assigned" — fix is wrapping each clause in a block. Fetched + verified 2026-09-20. |
| ESLint `no-duplicate-case` | https://eslint.org/docs/latest/rules/no-duplicate-case | Rule title verbatim: "Disallow duplicate case labels." Fetched + verified 2026-09-20. |
| CodeQL query help — Unreachable statement | https://codeql.github.com/codeql-query-help/javascript/js-unreachable-statement/ | ID `js/unreachable-statement`; tags include `external/cwe/cwe-561`. Verbatim: "An unreachable statement almost always indicates missing code or a latent bug and should be examined carefully." Fetched + verified 2026-09-20. |
| CodeQL query help — Duplicate switch case | https://codeql.github.com/codeql-query-help/javascript/js-duplicate-switch-case/ | ID `js/duplicate-switch-case`; tags include `external/cwe/cwe-561`. Verbatim: "if two cases in a switch statement have the same label, the second case will never be executed. This most likely indicates a copy-paste error where the first case was copied and then not properly adjusted." Fetched + verified 2026-09-20. |
| CodeQL query help — Non-case label in switch statement | https://codeql.github.com/codeql-query-help/javascript/js-label-in-switch/ | ID `js/label-in-switch`. Verbatim: "JavaScript allows to freely mix case labels and ordinary statement labels in the body of a switch statement. However, this is confusing to read … and indeed most likely the result of a typo." Fetched + verified 2026-09-20. |
| The Go Programming Language Specification — Expression switches | https://go.dev/ref/spec#Expression_switches | Verbatim: "In a case or default clause, the last non-empty statement may be a (possibly labeled) `fallthrough` statement to indicate that control should flow from the end of this clause to the first statement of the next clause. Otherwise control flows to the end of the `switch` statement." Confirms Go cases stop by default; fallthrough is opt-in only. Fetched + verified 2026-09-20. |
| The Rust Reference — Match expressions | https://doc.rust-lang.org/reference/expressions/match-expr.html | Verbatim: "The first arm with a matching pattern is chosen as the branch target of the match, any variables bound by the pattern are assigned to local variables in the arm's block, and control enters the block." No fallthrough construct exists in the grammar; exactly one arm's block ever executes. Fetched + verified 2026-09-20. |
| The Swift Programming Language — Control Flow (source) | https://raw.githubusercontent.com/swiftlang/swift-book/main/TSPL.docc/LanguageGuide/ControlFlow.md | Apple's official language guide, fetched as Markdown source from the `swiftlang/swift-book` repository (`main` branch — a moving ref as of this date; re-resolve if re-citing later) because the rendered `docs.swift.org` page is a JavaScript SPA shell that `curl` cannot read. §"Fallthrough," verbatim: "In Swift, `switch` statements don't fall through the bottom of each case and into the next one." And: "you can opt in to this behavior on a case-by-case basis with the `fallthrough` keyword." Fetched + verified 2026-09-20. |
| Microsoft C# language reference — Selection statements (`if`, `switch`) | https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/statements/selection-statements | Verbatim: "Within a switch statement, control can't fall through from one switch section to the next." And: "Every switch section must end with a break, goto, or return. Falling through from one switch section to the next generates a compiler error." Corrects an initial assumption that C# behaves like C/Java/JS — it does not; implicit fallthrough is a compile-time error, not a silent runtime bug. Fetched + verified 2026-09-20. |
| Microsoft C# language reference — Jump statements (`goto`) | https://learn.microsoft.com/en-us/dotnet/csharp/language-reference/statements/jump-statements | Verbatim: "you can also use the goto statement in the switch statement to transfer control to a switch section with a constant case label," with a worked `goto case CoffeeChoice.Plain;` example. Confirms `goto case` (not a bare `goto`) is C#'s mechanism for deliberate cross-section reuse. Fetched + verified 2026-09-20. |
| Oracle Java documentation — Switch Expressions | https://docs.oracle.com/en/java/javase/17/language/switch-expressions.html | Verbatim: arrow-form `"case L ->"` labels "eliminate the need for break statements to prevent fall through." Confirms Java's modern arrow-form switch does not fall through, unlike its classic colon-`case X:` form — Java is not uniformly a default-fallthrough language. Fetched + verified 2026-09-20. |
| cppreference — C++ attribute: `fallthrough` (since C++17) | https://en.cppreference.com/w/cpp/language/attributes/fallthrough.html | Page title confirms C++17 origin. Verbatim: "May only be applied to a null statement to create a fallthrough statement (`[[fallthrough]];`)... may only be used in a switch statement, where the next statement to be executed is a statement with a case or default label." Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-20) — lethal trifecta & MCP tool-annotation trust boundary

Verification date for the rows below: **2026-09-20**. Added for two `deep-code-review`
`security-ai-agents.md` folds: the lethal-trifecta conjunction probe (OWASP Agentic
Applications section) and a third sub-case (self-declared tool annotations) extending the
existing "Falsify asserted-but-unenforced safety properties" readOnly-grep instruction.
The already-indexed Simon Willison MCP prompt-injection page (row above, dated
2026-09-19) was additionally re-fetched this session to confirm a third claim on that same
page, used by a new MCP-section-3 bullet on Cross-Server Tool Shadowing — Willison's post
quotes Elena Cross ("The 'S' in MCP Stands for Security") verbatim: "With multiple servers
connected to the same agent, a malicious one can override or intercept calls made to a
trusted one." That citation is sourced to this 2026-09-20 re-fetch, not a new row.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Simon Willison — The lethal trifecta for AI agents | https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ | Post dated 2025-06-16. Verbatim, the three capabilities (elided where a list item's own sentence continues past the quoted span): "Access to your private data…", "Exposure to untrusted content—any mechanism by which text (or images) controlled by a malicious attacker could become available to your LLM…", "The ability to externally communicate in a way that could be used to steal your data…". Verbatim on the exfiltration channel's breadth: "If a tool can make an HTTP request—to an API, or to load an image, or even providing a link for a user to click—that tool can be used to pass stolen information back to an attacker." Verbatim, guardrails insufficiency (heading "Guardrails won't protect you"): "Here's the really bad news: we still don't know how to 100% reliably prevent this from happening." Verbatim, the remove-a-leg conclusion (same heading, several sentences later, not adjacent to the previous quote): "The only way to stay safe there is to avoid that lethal trifecta combination entirely." Fetched + verified 2026-09-20. |
| MCP specification — Server Features: Tools (`annotations` Warning) | https://modelcontextprotocol.io/specification/2025-06-18/server/tools | Version 2025-06-18. `annotations` defined (no trailing period in source) as "optional properties describing tool behavior". Verbatim Warning callout immediately below that definition: "For trust & safety and security, clients MUST consider tool annotations to be untrusted unless they come from trusted servers." Fetched + verified 2026-09-20. |
| MCP specification — Schema Reference (`ToolAnnotations`) | https://modelcontextprotocol.io/specification/2025-06-18/schema | Version 2025-06-18. Confirms the exact `ToolAnnotations` interface field names, verbatim: `title?: string`, `readOnlyHint?: boolean`, `destructiveHint?: boolean`, `idempotentHint?: boolean`, `openWorldHint?: boolean`. Verbatim (one paragraph): "NOTE: all properties in ToolAnnotations are hints. They are not guaranteed to provide a faithful description of tool behavior (including descriptive properties like `title`)." Verbatim (the following, separate paragraph): "Clients should never make tool use decisions based on ToolAnnotations received from untrusted servers." Fetched + verified 2026-09-20. |

## Verified by direct fetch (2026-09-21) — OWASP CI/CD Top 10 (CICD-SEC-4 Poisoned Pipeline Execution, SEC-5 Insufficient PBAC, SEC-6 Insufficient Credential Hygiene, SEC-7 Insecure System Configuration, SEC-9 Improper Artifact Integrity Validation)

Verification date for the rows below: **2026-09-21**. Added for the `deep-code-review`
CI/CD security folds across `appsec-supply.md` and `infra-iac-containers.md`:
poisoned-pipeline / executed-file review gates (SEC-4), secret and credential
blast-radius scoping — repo/org secrets bounded to the job/deployment environment that
needs them (SEC-5/6), self-hosted-runner isolation and single-job runners (SEC-7), and
inter-stage artifact integrity (SEC-9). Fetched directly from the OWASP project
repository's raw source files (the authoritative origin for the project's content).

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP CI/CD Top 10 — CICD-SEC-04 Poisoned Pipeline Execution | https://raw.githubusercontent.com/OWASP/www-project-top-10-ci-cd-security-risks/74b2c790d5512998f232480dde61d4d42fa692ae/CICD-SEC-04-Poisoned-Pipeline-Execution.md | Verbatim (Indirect PPE, I-PPE): "In I-PPE, an attacker injects malicious code into files referenced by the configuration file." Backs the fold that a privileged pipeline's executed-but-unprotected files (build scripts, Makefile, Dockerfile, hook/linter configs, package.json scripts) need the same enforced review gate as the workflow file. Fetched + verified 2026-09-21 (raw file, SHA-pinned `74b2c79`). |
| OWASP CI/CD Top 10 — CICD-SEC-05 Insufficient PBAC (Pipeline-Based Access Controls) | https://raw.githubusercontent.com/OWASP/www-project-top-10-ci-cd-security-risks/74b2c790d5512998f232480dde61d4d42fa692ae/CICD-SEC-05-Insufficient-PBAC.md | Front-matter `title:` verbatim: "CICD-SEC-5: Insufficient PBAC (Pipeline-Based Access Controls)". Blast-radius verbatim: "It can access secrets, access the underlying host and connect to any of the systems the pipeline in question has access to. This can lead to exposure of confidential data, lateral movement within the CI environment - potentially accessing servers and systems outside the CI environment, and deployment of malicious artifacts down the pipeline, including to production." Backs the fold that a repo/org-wide secret readable by a job that does not need it (or a secrets-bearing context exposed to untrusted PR code) can reach prod-deploy credentials, and must be scoped to the job/deployment environment that needs it. Fetched + verified 2026-09-21 (raw file, SHA-pinned `74b2c79`). |
| OWASP CI/CD Top 10 — CICD-SEC-06 Insufficient Credential Hygiene | https://raw.githubusercontent.com/OWASP/www-project-top-10-ci-cd-security-risks/74b2c790d5512998f232480dde61d4d42fa692ae/CICD-SEC-06-Insufficient-Credential-Hygiene.md | Front-matter `title:` verbatim: "CICD-SEC-6: Insufficient Credential Hygiene". Recommendation verbatim: "Ensure secrets that are used in CI/CD systems are scoped in a manner that allows each pipeline and step to have access to only the secrets it requires." Backs the fold's fix: bind prod credentials to a protected deployment environment (secrets readable only by the job that declares it) rather than a repo/org-wide secret every job can read. Fetched + verified 2026-09-21 (raw file, SHA-pinned `74b2c79`). |
| OWASP CI/CD Top 10 — CICD-SEC-07 | https://raw.githubusercontent.com/OWASP/www-project-top-10-ci-cd-security-risks/74b2c790d5512998f232480dde61d4d42fa692ae/CICD-SEC-07-Insecure-System-Configuration.md | Front-matter `title:` verbatim: "CICD-SEC-7: Insecure System Configuration". Description verbatim: "CI/CD environments are comprised of multiple systems, provided by a variety of vendors. To optimize CI/CD security, defenders are required to place strong emphasis both on the code and artifacts flowing through the pipeline, and the posture and resilience of each individual system." Example misconfiguration, verbatim list item: "A self-hosted system that has administrative permissions on the underlying OS." Fetched + verified 2026-09-21. |
| OWASP CI/CD Top 10 — CICD-SEC-09 Improper Artifact Integrity Validation | https://raw.githubusercontent.com/OWASP/www-project-top-10-ci-cd-security-risks/74b2c790d5512998f232480dde61d4d42fa692ae/CICD-SEC-09-Improper-Artifact-Integrity-Validation.md | Verbatim (Recommendations): "Prior to consuming the resource in subsequent steps down the pipeline, the resource’s integrity should be validated against the signing authority." Backs the fold that inter-job artifacts and restored caches must be integrity-checked at each stage handoff, not only at the final promotion attestation. Fetched + verified 2026-09-21 (raw file, SHA-pinned `74b2c79`). |

## Verified by direct fetch (2026-09-21) — LINDDUN privacy threat types

Verification date for the row below: **2026-09-21**. Added for two privacy residual
folds in `references/privacy-compliance.md` — intervenability beyond deletion
(rectification and processing-restriction as code, reusing the erasure copy-set and
the purpose-limitation flag) and the retroactive back-linking of a pre-login
anonymous event stream onto a now-known identity.

| Standard / source | URL | What was confirmed |
|---|---|---|
| LINDDUN privacy threat types | https://linddun.org/threat-types/ | Seven threat types listed; two used verbatim. **Unawareness & Unintervenability** = "Insufficiently informing, involving or empowering individuals in the processing of their personal data." (grounds the intervenability-beyond-deletion fold — rectification + processing-restriction as code). **Linking** = "Associating data items or user actions to learn more about an individual or group." (grounds the retroactive back-link fold). The live site uses the updated gerund category names (Linking / Identifying / Detecting); the skill body keeps LINDDUN's older spellings (Linkability / Identifiability / Detectability) for in-file consistency. Fetched 2026-09-21. |

## Verified by direct fetch (2026-09-21) — Parallel Change (expand and contract, M. Fowler)

Verification date for the row below: **2026-09-21**. Added for a `deep-code-review`
`performance-db-cost.md` §Schema-migrations fold that names a schema `RENAME` as the
canonical backward-incompatible in-place break and attributes the
expand → migrate → contract sequence already used there to its source pattern.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Martin Fowler — Parallel Change (expand and contract) | https://martinfowler.com/bliki/ParallelChange.html | Verbatim opening definition: "Parallel change, also known as expand and contract, is a pattern to implement backward-incompatible changes to an interface in a safe manner, by breaking the change into three distinct phases: expand, migrate, and contract." Phase intent, verbatim: expand — "you augment the interface to support both the old and the new versions"; migrate — "you update all clients using the old version to the new version"; contract — "remove the old version and change the interface so that it only supports the new version." Fetched + verified 2026-09-21. |

## Verified by direct fetch (2026-09-21) — OpenAI Structured Outputs guide

Verification date for the row below: **2026-09-21**. Added for a `deep-code-review`
`security-ai-agents.md` fold on handling the model's non-happy structured response —
off-schema output, `max_tokens` truncation, and safety refusals.

| Standard / source | URL | What was confirmed |
|---|---|---|
| OpenAI Structured Outputs guide | https://developers.openai.com/api/docs/guides/structured-outputs | Verbatim: "In some cases, the model might not generate a valid response that matches the provided JSON schema. This can happen in the case of a refusal, if the model refuses to answer for safety reasons, or if for example you reach a max tokens limit and the response is incomplete." And verbatim: "Since a refusal does not necessarily follow the schema you have supplied in `response_format`, the API response will include a new field called `refusal` to indicate that the model refused to fulfill the request." (301 from platform.openai.com/docs/guides/structured-outputs; fetched 2026-09-21) |

## Verified by direct fetch (2026-09-21) — OWASP API4 detail (records-per-page & execution timeouts)

Verification date for the row below: **2026-09-21**. Added for a `deep-code-review`
`security-api.md` API4 fold on the response-size (records-per-page) and
execution-time (inbound request-execution timeout) axes.

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP API Security Top 10 (2023) — API4 detail | https://api-security.owasp.org/editions/2023/en/0xa4-unrestricted-resource-consumption/ | Verbatim: "An API is vulnerable if at least one of the following limits is missing or set inappropriately (e.g. too low/high):" — enumerated limits, verbatim: "Execution timeouts"; "Maximum allocable memory"; "Maximum number of file descriptors"; "Maximum number of processes"; "Maximum upload file size"; "Number of operations to perform in a single API client request (e.g. GraphQL batching)"; "Number of records per page to return in a single request-response"; "Third-party service providers' spending limit". (308 from owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/ → api-security.owasp.org; fetched 2026-09-21) |

## Verified by direct fetch (2026-09-21) — WHATWG URL Standard (backslash normalized to slash for special schemes)

Verification date for the row below: **2026-09-21**. Added for a `deep-code-review`
`appsec-links.md` A01 fold on a client-side open-redirect guard that rejects the
protocol-relative `//host` form but not its backslash equivalent (`/\host`), which a
browser resolves to the same off-origin target.

| Standard / source | URL | What was confirmed |
|---|---|---|
| WHATWG URL Standard — special schemes & backslash handling | https://url.spec.whatwg.org/ | The special schemes are ftp, file, http, https, ws, and wss. In the *relative slash state* a special URL takes the same branch for either slash — verbatim: "If url is special and c is U+002F (/) or U+005C (\), then: If c is U+005C (\), invalid-reverse-solidus validation error. Set state to special authority ignore slashes state." — and in the *special authority ignore slashes state* a backslash is likewise consumed identically to a forward slash — verbatim: "If c is neither U+002F (/) nor U+005C (\), then set state to authority state and decrease pointer by 1." The backslash is flagged only as an `invalid-reverse-solidus` validation error, defined verbatim: "The URL has a special scheme and it uses U+005C (\) instead of U+002F (/)." (example given: "https://example.org\path\to\file"). A validation error is non-fatal — verbatim: "A validation error does not mean that the parser terminates. Termination of a parser is always stated explicitly, e.g., through a return statement." — so the parse continues and the backslash still acts as a slash. Confirmed against the raw spec HTML; reproduced with `new URL('/\\host', 'https://good.example/page').host` returning `'host'` (also for `\/host` and `\\host`). Fetched + verified 2026-09-21. |

## Verified by direct fetch (2026-09-21) — OWASP MASVS/MASTG (mobile appsec)

Verification date for the rows below: **2026-09-21**. Added for the new mobile
archetype and `deep-code-review` `references/mobile-appsec.md` (iOS / Android /
native mobile app security), grounded in the OWASP Mobile Application Security
project.

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP MASVS — Mobile Application Security Verification Standard (control groups) | https://mas.owasp.org/MASVS/ | **Eight** control groups, confirmed from the mas.owasp.org/MASVS/ index (HTTP 200 this session): **MASVS-STORAGE** (Storage), **MASVS-CRYPTO** (Cryptography), **MASVS-AUTH** (Authentication and Authorization), **MASVS-NETWORK** (Network Communication), **MASVS-PLATFORM** (Platform Interaction), **MASVS-CODE** (Code Quality), **MASVS-RESILIENCE** (Resilience Against Reverse Engineering and Tampering), **MASVS-PRIVACY** (Privacy). Individual control text quoted in `mobile-appsec.md` is verbatim from the `OWASP/masvs` repo at pinned commit `6df8fc412628f0b24792d5baed29bf7dccdf2942` (`controls/MASVS-*.md`), e.g. STORAGE-1 "The app securely stores sensitive data.", STORAGE-2 "The app prevents leakage of sensitive data.", NETWORK-1 "The app secures all network traffic according to the current best practices.", NETWORK-2 "The app performs identity pinning for all remote endpoints under the developer's control.", PLATFORM-1 "The app uses IPC mechanisms securely.", PLATFORM-2 "The app uses WebViews securely.", PLATFORM-3 "The app uses the user interface securely.", AUTH-2 "The app performs local authentication securely according to the platform best practices.", RESILIENCE-1 "The app validates the integrity of the platform.", CRYPTO-1 "The app employs current strong cryptography and uses it according to industry best practices.", CRYPTO-2 "The app performs key management according to industry best practices.", PRIVACY-2 "The app prevents identification of the user." **Version:** v2.1.0 per the `OWASP/masvs` GitHub `releases/latest` (tag `v2.1.0`, published 2024-01-18); the mas.owasp.org/MASVS/ page fetched this session did **not** display a version string — the version is sourced from the GitHub release, not the fetched page. Fetched + verified 2026-09-21. |
| OWASP MASTG — Mobile Application Security Testing Guide | https://mas.owasp.org/MASTG/ | The testing companion to MASVS (HTTP 200 this session): per-platform (Android / iOS) tests, a knowledge base, best practices, and vulnerable/secure demos, organized around the same eight MASVS control groups; it provides the how-to-test procedures for the controls MASVS defines. **Version:** v2.0.0 per the `OWASP/owasp-mastg` GitHub `releases/latest` (tag `v2.0.0`, published 2026-06-30); the mas.owasp.org/MASTG/ page fetched this session did **not** display a version string. Cited by name (with URL) as the testing companion; no specific MASTG test IDs are quoted in `mobile-appsec.md`. Fetched + verified 2026-09-21. |

## Verified by direct fetch (2026-09-21) — ARIA APG Combobox Pattern

Verification date for the row below: **2026-09-21**. Added for the deep-code-review
`a11y-focus.md` combobox-popup focus-exit-dismiss fold; complements the general
ARIA APG row above.

| Standard | URL | What was confirmed |
|---|---|---|
| W3C ARIA Authoring Practices Guide (APG) — Combobox Pattern | https://www.w3.org/WAI/ARIA/apg/patterns/combobox/ | Keyboard Interaction section. Confirmed verbatim: "Tab: The combobox is in the page `Tab` sequence."; that "the popup indicator icon or button (if present), the popup, and the popup descendants are excluded from the page `Tab` sequence"; and that the only listed popup-dismiss key is "Escape: Dismisses the popup if it is visible." Basis for the `a11y-focus.md` fold that a combobox/listbox is a single tab stop with a non-tabbable popup, so keyboard focus leaving the widget is a dismiss path separate from Escape and outside-click that must itself close the popup (else the popup is left open while focus sits on a later control — a WCAG 2.4.3 Focus Order break). The APG text does not itself state "Tab closes the popup"; the fold rests on the exclusion-from-tab-sequence fact plus the Focus Order consequence, not on an APG mandate. |

## Verified by direct fetch (2026-09-21) — WCAG bypass blocks & info-and-relationships

Sourced for the `a11y-aria.md` folds that (a) correct landmarks satisfy the automated bypass-blocks check yet a sighted keyboard-only user still needs a real skip link, and (b) a tree conveying depth only via padding + colour hides its hierarchy from assistive tech.

| Standard / source | URL | What was confirmed |
|---|---|---|
| WCAG 2.2 SC 2.4.1 Bypass Blocks | https://www.w3.org/WAI/WCAG22/Understanding/bypass-blocks.html | Level A. SC text verbatim: "A mechanism is available to bypass blocks of content that are repeated on multiple web pages." Its sufficient techniques are independent options, any one of which meets the SC: **ARIA11** (using ARIA landmarks to identify regions of a page), **G1** (adding a link at the top of each page that goes directly to the main content area), and **H69** (providing heading elements at the beginning of each section of content). Basis for the fold that correct landmarks (ARIA11) alone pass the automated bypass check while a sighted keyboard-only user, for whom landmarks are not perceivable, still needs a skip link (G1). Fetched + verified 2026-09-21. |
| WCAG 2.2 SC 1.3.1 Info and Relationships | https://www.w3.org/WAI/WCAG22/Understanding/info-and-relationships.html | Level A. SC text verbatim: "Information, structure, and relationships conveyed through presentation can be programmatically determined or are available in text." The Understanding page gives hierarchical organization shown by *indented* list items as an example of structure that must be made programmatically determinable or available in text. Basis for the fold that a tree/nav conveying parent-child depth only through left-padding and a colour accent fails 1.3.1 (with the colour accent additionally implicating 1.4.1 Use of Color). Fetched + verified 2026-09-21. |

## Verified by direct fetch (2026-09-21) — POSIX RE bracket-expression range locale-dependence

Sourced for the `lang-shell.md` Shell/Bash fold that a bracket *range* used to validate a character class (`case`/`[[ =~ ]]`/`grep`) is matched against the locale's collating sequence, so a range-based validation gate returns a different verdict under a different `LC_COLLATE` (fix: pin `LC_ALL=C` or use an explicit character set).

| Standard / source | URL | What was confirmed |
|---|---|---|
| POSIX (The Open Group Base Specifications Issue 7, 2018) — RE Bracket Expression | https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap09.html | §9.3.5 RE Bracket Expression, range expressions. Verbatim: "In the POSIX locale, a range expression represents the set of collating elements that fall between two elements in the collation sequence, inclusive"; and "in other locales, a range expression has unspecified behavior." Confirms a bracket-range match set is defined by `LC_COLLATE` (the locale's collating sequence), not by codepoint, and is unspecified outside the POSIX/C locale — the basis for treating a shell range used in a validation gate (`*[!0-9a-f]*`, `[[ =~ ^[0-9a-f]+$ ]]`, `grep '[0-9a-f]'`) as locale-dependent and pinning `LC_ALL=C` or using an explicit set. The glibc dictionary-collation manifestation (case-interleaved ranges) is the well-known concrete case, not quoted from this page; the GNU grep manual was not reachable this session and is not cited. Fetched + verified 2026-09-21. |

## Verified by direct fetch (2026-09-23) — Claude Code hooks (SubagentStop)

Sourced for `agentic-delivery/scripts/handback_cap.py` and the handback-cap section of
`agentic-delivery/references/host-enforcement.md`.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Hooks reference | https://code.claude.com/docs/en/hooks | "Exit code 2 behavior per event" table, `SubagentStop` row verbatim: can block — "Prevents the subagent from stopping, continues the subagent". `SubagentStop` "Fires when a subagent finishes"; hooks needing the final text "should use `last_assistant_message` on Stop and SubagentStop instead of reading the transcript". Inside a subagent the input also carries `agent_id` ("Unique identifier for the subagent") and `agent_type` ("Agent name (for example, `"Explore"` or `"security-reviewer"`)"). Matcher table: the `SubagentStop` matcher filters on **agent type**, same values as `SubagentStart` (`general-purpose`, `Explore`, `Plan`, custom agent names). Fetched + verified 2026-09-23. |
| Claude Code — Hooks reference (`Stop`, non-blocking output) | https://code.claude.com/docs/en/hooks | JSON output table: `systemMessage` — "Warning message shown to the user"; `continue` defaults to `true`. "Stop decision control": `decision: "block"` "prevents Claude from stopping"; `hookSpecificOutput.additionalContext` keeps "the conversation going". So an advisory `Stop` hook emits only `systemMessage` and exits 0 (backs `agentic-ceo/scripts/stop_reminder.py`). Decision-control table: SessionStart is "Context only" — `hookSpecificOutput.additionalContext` "adds context for Claude"; `UserPromptSubmit` "only injects `additionalContext` alongside" the prompt; `hookSpecificOutput` "requires a `hookEventName` field set to the event name". Handler field `timeout`: "Seconds before canceling" (command default 600, 30 on UserPromptSubmit). Examples reference scripts via `${CLAUDE_PROJECT_DIR}`. `Stop` input carries `stop_hook_active`, `last_assistant_message`, and the common `cwd` field. Fetched + verified 2026-09-24. |
| Claude Code — Hooks reference (`PostToolUse`, subagent fields) | https://code.claude.com/docs/en/hooks | Sourced for `agentic-delivery/scripts/lane_cap.py` and the status-token check in `handback_cap.py`. `PostToolUse` fires "After a tool call succeeds" and receives `tool_name`, `tool_input`, and `tool_use_id`. "Exit code 2 behavior per event" table, `PostToolUse` row: cannot block — "Exit 2 isn't honored; the tool already completed". `additionalContext` in `hookSpecificOutput` "adds context that Claude should consider"; "Exit 0 means success, and is the intended exit code when you print JSON for structured control". Common input field `session_id`: "Current session identifier"; `agent_id` is "Present only when the hook fires inside a subagent call. Use this to distinguish subagent hook calls from main-thread calls." `SubagentStop` exit 2: can block, the subagent continues. Fetched + verified 2026-09-24. |

## Verified by direct fetch (2026-09-23) — token/cost levers: model-scoped cache, subagent model pin, context editing, batch discount

Sourced for `deep-code-review/references/model-tiering.md`'s tightened prompt-caching/
batch levers and `agentic-delivery/references/host-enforcement.md`'s new subagent
model + cache-TTL pin section. Re-verifies and sharpens two URLs already indexed
above (2026-09-08, 2026-09-13) with the exact multipliers/thresholds now cited by
name in the skill text; each row fetched this session.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — How Claude Code uses prompt caching | https://code.claude.com/docs/en/prompt-caching | Verbatim, "Switching models": "Each model has its own cache. Switching with `/model` means the next request reads the entire conversation history with no cache hits, even though the content is identical." Verbatim, "Subagents and the cache": a subagent "starts its own conversation with its own system prompt and tool set, separate from the parent's. Its first request doesn't read the parent's cache, because the two prefixes differ, and it warms a cache of its own across its turns. Subagents fall outside the main-conversation TTL bucket, so they get five minutes even on a subscription until you choose a longer one." "Choose the TTL yourself": main conversation via the `promptCacheTtl` setting or `CLAUDE_CODE_PROMPT_CACHE_TTL` env var; every other request via the `subagentPromptCacheTtl` setting or `CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL` env var (both require Claude Code v2.1.242+); `FORCE_PROMPT_CACHING_5M=1` forces five minutes for both buckets and wins over either. Re-fetched 2026-09-23 (markdown endpoint, https://code.claude.com/docs/en/prompt-caching.md) for the effort and TTL-precedence detail. Verbatim, "Changing effort level": "On most models, changing the effort level mid-session means the next request reads the entire conversation history with no cache hits"; "On Opus 5.5 and Fable 5.1 with an API key or a Claude subscription, changing effort keeps the cache... This doesn't apply on Amazon Bedrock, Google Cloud's Agent Platform, or a Claude apps gateway, or when you set `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` or your organization has a HIPAA configuration." "Which TTL each request gets" table: Claude subscription within plan usage — main conversation one hour, everything else five minutes "except the server-controlled helper requests, which get one hour"; usage credits, API key, or cloud provider — five minutes for both. "When more than one control applies, Claude Code takes the first match in this order": 1. `FORCE_PROMPT_CACHING_5M=1`; 2. the bucket's environment variable; 3. the bucket's setting; 4. for a subagent's requests, the `cacheTtl` value in its `experimental` frontmatter (v2.1.248+; "ignores a `1h` there while your Claude subscription is using usage credits"); 5. `ENABLE_PROMPT_CACHING_1H=1`, "which requests one hour for both buckets"; 6. the bucket default. Fetched + verified 2026-09-23. |
| Claude Code — Subagents | https://code.claude.com/docs/en/sub-agents | Re-verified for new facts beyond the 2026-09-08 row above (same URL). Verbatim: "To apply one model to every subagent, teammate, and workflow agent, also set `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` to `1`. Requires Claude Code v2.1.257 or later." "If you set both variables, subagents run on the model in `CLAUDE_CODE_SUBAGENT_MODEL`. If you set only `CLAUDE_CODE_SUBAGENT_MODEL_FORCE`, subagents run on the main conversation's model." A subagent's own frontmatter can set `experimental.cacheTtl: 5m\|1h` to choose its own cache lifetime (requires v2.1.248+) — a per-agent opt-in, distinct from the two host-level settings above. Re-fetched 2026-09-23 (markdown endpoint, https://code.claude.com/docs/en/sub-agents.md) for the pin's exceptions. Verbatim: "While `CLAUDE_CODE_SUBAGENT_MODEL_FORCE` is on, Claude Code ignores the `model` field of every subagent definition, including the built-in Explore and Plan subagents, and Claude can't pass a model when it starts a subagent. Two kinds of subagent still run on the main conversation's model: A fork [;] A skill that runs in a subagent with `model: inherit`"; "When you set only `CLAUDE_CODE_SUBAGENT_MODEL_FORCE`, the built-in Explore subagent keeps its model cap" (Explore: "inherits from the main conversation, capped at Opus on the Claude API"). Fetched + verified 2026-09-23. |
| Claude docs — Prompt caching (pricing detail) | https://platform.claude.com/docs/en/build-with-claude/prompt-caching | Re-verified for the exact multipliers beyond the 2026-09-08 row above (same URL). Verbatim: "5-minute cache write tokens are 1.25 times the base input tokens price[;] 1-hour cache write tokens are 2 times the base input tokens price[;] Cache read tokens are 0.1 times the base input tokens price (see the table footnote for per-model exceptions)... These multipliers stack with other pricing modifiers such as the Batch API discount and data residency." Per-model read-price exceptions: 0.05x base input on Claude Opus 5.5, 0.025x on Claude Fable 5.1 and Claude Mythos 5.1. Minimum cacheable-prompt sizes (shorter prompts "cannot be cached, even if marked with `cache_control`... processed without caching, and no error is returned"): 512 tokens (Fable 5.1, Mythos 5.1, Opus 5.5, Opus 5, Fable 5, Mythos 5), 1,024 tokens (Opus 4.8, Sonnet 5, Sonnet 4.6, Sonnet 4.5), 2,048 tokens (Mythos Preview, Opus 4.7, Haiku 3.5), 4,096 tokens (Opus 4.6, Opus 4.5, Haiku 4.5). Fetched + verified 2026-09-23. |
| Claude docs — Context editing | https://platform.claude.com/docs/en/build-with-claude/context-editing | Re-verified for the exact defaults beyond the 2026-09-13 row above (same URL). The `clear_tool_uses_20250919` strategy's configuration options, verbatim defaults: `trigger` = 100,000 input tokens ("Once the prompt exceeds this threshold, clearing begins"); `keep` = 3 tool uses ("The API removes the oldest tool interactions first, preserving the most recent ones"); `clear_at_least` = none, "Ensures a minimum number of tokens is cleared each time the strategy activates... helps determine if context clearing is worth breaking your prompt cache"; `exclude_tools` = none, "List of tool names whose tool uses and results should never be cleared." Verbatim on the caching interaction: "Tool result clearing: Invalidates cached prompt prefixes when content is cleared. To account for this, clear enough tokens to make the cache invalidation worthwhile... You'll incur cache write costs each time content is cleared, but subsequent requests can reuse the newly cached prefix." Fetched + verified 2026-09-23. |
| Claude docs — Batch processing | https://platform.claude.com/docs/en/build-with-claude/batch-processing | Re-verified for the exact discount beyond the 2026-09-08 row above (same URL). Verbatim: "cutting costs by 50%"; "most batches finishing in less than 1 hour while reducing costs by 50% and increasing throughput." On stacking with prompt caching, verbatim: "The pricing discounts from prompt caching and Message Batches can stack, providing even greater cost savings when both features are used together." (Batch cache-hit rates are best-effort, "typically... ranging from 30% to 98%, depending on... traffic patterns" — not a guaranteed hit rate.) Fetched + verified 2026-09-23. |

## Verified by direct fetch (2026-09-23) — host settings that cut per-turn tokens (`settings-reference.md`, `tools-reference.md`)

Sourced for `agentic-delivery/references/host-enforcement.md`'s new "Per-turn token
levers" section. Each row fetched this session via the markdown endpoint.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — All settings (settings reference) | https://code.claude.com/docs/en/settings-reference | `bashOutputMaxChars`: "Set how many characters of a successful Bash or PowerShell command's output Claude receives inline. When output passes the limit, Claude Code saves it to a file and Claude receives a short preview plus the file's path." Type "a positive integer. Claude Code clamps the value into the range `4000` to `128000`"; default "unset, so Claude receives up to 30,000 characters inline"; requires v2.1.261+; setting it makes Claude Code ignore `BASH_MAX_OUTPUT_LENGTH`. `skillListingMaxDescChars`: caps how many characters of each skill's `description`+`when_to_use` text show in the per-turn skill listing; "longer text is cut at the cap"; default `1536`. `skillListingBudgetFraction`: caps the skill listing at "a share of the context window... When the listing is over the cap, Claude Code keeps every skill's name but drops the descriptions of the least-used skills"; type "a fraction greater than `0` and at most `1`"; default `0.01` ("reserves 1% of the context window"). `skillOverrides`: object mapping skill name to one of `"on"` (Claude sees name+description, `/name` works), `"name-only"` (name only, `/name` works), `"user-invocable-only"` (hidden from Claude, `/name` still works), `"off"` (hidden from Claude and `/` autocomplete); default unset, "every skill is `\"on\"`". `subagentPromptCacheTtl`: string `"5m"`\|`"1h"` for "the requests Claude Code makes outside the main conversation" (subagents, workflows, background/helper requests); default unset → the request's bucket default; requires v2.1.242+. Fetched + verified 2026-09-23. |
| Claude Code — Tool use reference (Bash output limits) | https://code.claude.com/docs/en/tools-reference | "Output limits" table, Valid row verbatim: "Inline up to roughly 30,000 characters by default; past that, the path of a file saved to the session directory and truncated past 64 MiB, plus a preview of up to the first 2,000 characters, and Claude reads or searches the file when it needs the rest." Confirms `bashOutputMaxChars` "sizes the inline ceiling and the read-back window together... up to 128,000 characters," at which point Claude Code "ignores `BASH_MAX_OUTPUT_LENGTH`." Fetched + verified 2026-09-23. |

## Verified by direct fetch (2026-09-23) — design-token formats and color conversion (`token_differ.py`)

Sourced for `deep-code-review/scripts/token_differ.py`, the token-value parity gate routed
from `references/migration-parity.md`'s check-order paragraph. Each row fetched this session.

| Standard / source | URL | What was confirmed |
|---|---|---|
| W3C Design Tokens Community Group — Design Tokens Format Module (2025.10 draft) | https://www.designtokens.org/tr/drafts/format/ | A token is an object with `$value`; a token's `$type` is inherited from "the closest parent group with a `$type` property." Curly-brace references `"{group.token}"` resolve to the target token's complete `$value`; local JSON Pointer references use `"$ref": "#/path/to/target"` and may address a property inside a value. References "MUST NOT be circular"; every token in a circular chain has an unknown value and an error or warning should be shown. Color `$value` is an object (`colorSpace`, `components`, optional `alpha`, optional `hex`); dimension `$value` is `{ "value", "unit" }` with unit `px` or `rem`; duration `$value` is `{ "value", "unit" }` with unit `ms` or `s`; fontFamily is a string or an array of strings; fontWeight is a number in [1, 1000] or one of the keywords thin/hairline (100), extra-light/ultra-light (200), light (300), normal/regular/book (400), medium (500), semi-bold/demi-bold (600), bold (700), extra-bold/ultra-bold (800), black/heavy (900), extra-black/ultra-black (950). The defined `$type` names are `color`, `dimension`, `fontFamily`, `fontWeight`, `duration`, `cubicBezier`, `number` (simple) and `strokeStyle`, `border`, `transition`, `shadow`, `gradient`, `typography` (composite). Fetched + verified 2026-09-23. |
| W3C — CSS Color Module Level 4 (Candidate Recommendation Draft, 13 September 2026) | https://www.w3.org/TR/css-color-4/ | Section 7.1 "Converting HSL Colors to sRGB" sample code: `hslToRgb(hue, sat, light)` with `f(n)`: `k = (n + hue/30) % 12`, `a = sat * min(light, 1 - light)`, returns `light - a * max(-1, min(k - 3, 9 - k, 1))` for `[f(0), f(8), f(4)]`. Modern color syntax lets percentage and number components be freely mixed; an alpha value may be a percentage (0% = 0.0, 100% = 1.0). Fetched + verified 2026-09-23. |

## Verified by direct fetch (2026-09-23) — orchestration-to-execution token ratio (`token_report.py`)

Sourced for `agentic-ceo/scripts/token_report.py`'s orchestration-share flag and the
one-line doctrine addition in `agentic-ceo/references/full-map.md` ("Stay strategic").

| Standard / source | URL | What was confirmed |
|---|---|---|
| AWS Well-Architected — Agentic AI Lens, AGENTCOST01-BP02 (Optimize multi-agent collaboration cost through efficient handoff patterns) | https://docs.aws.amazon.com/wellarchitected/latest/agentic-ai-lens/agentcost01-bp02.html | Verbatim: "The diagnostic metric is the orchestration-to-execution token ratio. Supervisors should consume no more than 20% of total workflow tokens, leaving 80% for workers doing execution. A ratio that drifts above 20% means coordination has grown disproportionate to work." Implementation step names the same 20% figure as an AWS Budgets alert threshold: "configure AWS Budgets alerts when orchestration overhead exceeds 20% of total workflow token cost." Fetched + verified 2026-09-23. |

## Verified by direct fetch (2026-09-24) — lane token budget (`token_report.py --budget`)

Sourced for `agentic-ceo/scripts/token_report.py`'s `--budget` gate and the lane-dispatch
bullets in `agentic-ceo/references/full-map.md` ("Stay strategic"). Each row fetched 2026-09-24. The
gate's default caps are not taken from these sources: they are starting values set near
the 90th percentile of three local sessions measured with `token_report.py --json` on
2026-09-24, per `deep-code-review/references/model-tiering.md` lever 5.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Anthropic — How we built our multi-agent research system | https://www.anthropic.com/engineering/multi-agent-research-system | Re-verified for facts beyond the 2025-06-13 row above (same URL). Verbatim: "Simple fact-finding requires just 1 agent with 3-10 tool calls, direct comparisons might need 2-4 subagents with 10-15 calls each, and complex research might use more than 10 subagents with clearly divided responsibilities" — effort budgets stated in tool calls, the basis for a per-lane tool-call cap in the brief. "token usage by itself explains 80% of the variance" (BrowseComp). The lead agent saves "its plan to Memory to persist the context, since if the context window exceeds 200,000 tokens it will be truncated"; "agents can spawn fresh subagents with clean contexts while maintaining continuity through careful handoffs." Artifact systems "reduce token overhead from copying large outputs through conversation history." |
| Claude Code — Manage costs effectively | https://code.claude.com/docs/en/costs | Verbatim: "Keep spawn prompts focused. Teammates load CLAUDE.md, MCP servers, and skills automatically, but everything in the spawn prompt adds to their context from the start" (startup overhead per lane). "Compaction: `/compact` reads the conversation it summarizes, so compacting a large context is itself a large request. When you want a fresh start instead of continuity, `/clear` costs nothing" (basis for "hand off to a fresh session" over compacting when the task ledger holds continuity). "Delegate verbose operations to subagents ... so the verbose output stays in the subagent's context while only a summary returns to your main conversation." "For simple subagent tasks, specify `model: haiku`." "Agent teams use approximately 7x more tokens than standard sessions when teammates run in plan mode." |
| Zhang et al. — Cut the Crap: An Economical Communication Pipeline for LLM-based Multi-Agent Systems (AgentPrune, ICLR 2025) | https://arxiv.org/abs/2410.02506 | Abstract verbatim: AgentPrune "is the first to identify and formally define the communication redundancy issue present in current LLM-based multi-agent pipelines"; "achieves comparable results as state-of-the-art topologies at merely $5.6 cost compared to their $43.7"; "28.1%~72.8% token reduction" when integrated into existing frameworks. Corroborates the existing handback-verbosity lever in `agentic-delivery/references/fanout-host-sizing.md`; no new lever folded. |

## Verified by direct fetch (2026-09-24) — diff-scoped threat-modeling procedure (`threat-modeling.md`)

Sourced for `deep-code-review/references/threat-modeling.md` (the four-step procedure,
its STRIDE and LINDDUN walks, the four risk responses, and the agent/LLM slice). Each
row fetched 2026-09-24.

| Standard / source | URL | What was confirmed |
|---|---|---|
| OWASP Threat Modeling Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html | Four Question Framework verbatim: "1. What are we working on? 2. What can go wrong? 3. What are we going to do about it? 4. Did we do a good enough job?" Data-flow diagrams should give "a clear view of trust boundaries, data flows, data stores, processes, and the external entities." Response options verbatim: "Mitigate: Take action to reduce the likelihood that the threat will materialize. Eliminate: Simply remove the feature or component that is causing the threat. Transfer: Shift responsibility to another entity such as the customer. Accept: Do not mitigate, eliminate, or transfer the risk." A threat model "should be maintained, updated and refined alongside the system." |
| Microsoft Threat Modeling Tool — Threats (STRIDE model) | https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats | Page updated 2026-03-04. STRIDE categories and definitions: Spoofing "Involves illegally accessing and then using another user's authentication information"; Tampering "Involves the malicious modification of data"; Repudiation "Associated with users who deny performing an action without other parties having any way to prove otherwise"; Information Disclosure "Involves the exposure of information to individuals who are not supposed to have access to it"; Denial of Service attacks "deny service to valid users"; Elevation of Privilege "An unprivileged user gains privileged access." |
| Threat Modeling Manifesto | https://www.threatmodelingmanifesto.org/ | The same four questions verbatim. Values include "A culture of finding and fixing design issues over checkbox compliance," "Doing threat modeling over talking about it," and "Continuous refinement over a single delivery." Principle: "The best use of threat modeling is to improve the security and privacy of a system through early and frequent analysis." |
| LINDDUN privacy threat types | https://linddun.org/threat-types/ | Re-fetched (first verified 2026-09-21). Seven current threat-type names: Linking, Identifying, Non-repudiation, Detecting, Data Disclosure, Unawareness & Unintervenability, Non-compliance. |
| OWASP Top 10 for LLM Applications (2025 page) | https://genai.owasp.org/llm-top-10/ | Re-fetched: the page still presents the 2025 edition (LLM01:2025 Prompt Injection, LLM02:2025 Sensitive Information Disclosure, LLM05:2025 Improper Output Handling, LLM06:2025 Excessive Agency). `threat-modeling.md` cites the 2026 IDs used by `security-ai-agents.md`, verified from the 2026 PDF in the 2026-09-08 verification addendum above. |

The OWASP Threat Modeling Cheat Sheet and Threat Modeling Manifesto quotes above were re-confirmed verbatim by a second fetch on 2026-09-24. The cheat sheet attributes the four questions to the Manifesto.

## Verified by direct fetch (2026-09-24) — bulk/agent dependency-upgrade procedure (`dependency-bulk-upgrades.md`)

Sourced for the "reaching latest-stable at scale" batching procedure: grouping, scheduling,
automerge scope, lockfile provenance verification, and grouped-update tier separation. Each
row fetched 2026-09-24.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Renovate — Automerge | https://docs.renovatebot.com/key-concepts/automerge/ | "Renovate will wait for the required tests to pass before it automerges." Non-major automerge example uses `"matchUpdateTypes": ["minor", "patch"]` restricted to `"matchCurrentVersion": "!/^0/"` because pre-1.0 versions "can make breaking changes at _any_ time." Guidance: "we recommend you enable automerge for any dependency update where you would select 'merge' anyway" — majors are excluded by default practice. |
| Renovate — `packageRules` (`separateMajorMinor`) | https://docs.renovatebot.com/configuration-options/#packagerules | "Usually you won't want to automerge _all_ PRs, for example most people would want to leave major dependency updates to a human to review first." `separateMajorMinor` isolates major updates into their own PRs; `separateMinorPatch` further splits minor from patch. |
| Renovate — Scheduling | https://docs.renovatebot.com/key-concepts/scheduling/ | "Because Renovate defaults to 'always on' and 'open PRs right away' it can overwhelm you with 'new PR' notifications. Use the schedule to control when Renovate looks for updates." |
| GitHub Docs — Optimizing PR creation for Dependabot version updates (grouping) | https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/optimizing-pr-creation-version-updates | "You can use `groups` to consolidate updates for multiple dependencies into a single pull request." Example: a group scoped to `update-types: ["minor", "patch"]` for one dependency family, where "All major updates will continue to be raised as individual pull requests" — the documented pattern for keeping majors out of a bulk group. |
| npm Docs — `npm audit` (`audit signatures`) | https://docs.npmjs.com/cli/v11/commands/npm-audit | "Registry signatures can be verified using the following `audit` command: $ npm audit signatures." "The `audit signatures` command will also verify the provenance attestations of downloaded packages." Caveat: "Because provenance attestations are such a new feature, security features may be added to (or changed in) the attestation format over time." |

## Verified by direct fetch (2026-09-24) — CI runner-minute cost controls (`ci_cost_lint.py`, `domain-k.md`)

Sourced for `scripts/ci_cost_lint.py`'s five checks and the new runner-minute-cost bullet
in `deep-code-review/references/domain-k.md`. Each row fetched 2026-09-24.

| Standard / source | URL | What was confirmed |
|---|---|---|
| GitHub Actions — Using concurrency | https://docs.github.com/en/actions/using-jobs/using-concurrency | Verbatim: "only a single job or workflow using the same concurrency group will run at a time"; a queued run is `pending`, and "any existing pending job or workflow in the same concurrency group will be canceled" by default; "To also cancel any currently running job or workflow in the same concurrency group, specify `cancel-in-progress: true`" (also settable as an expression). `queue: max` combined with `cancel-in-progress: true` is a validation error. Basis for `ci_cost_lint.py`'s CONCURRENCY check. |
| GitHub Actions — Workflow syntax, path filters and schedule | https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions | Verbatim: "If at least one path matches a pattern in the `paths` filter, the workflow runs"; for `paths-ignore`, "When all the path names match patterns in `paths-ignore`, the workflow will not run... If any path names do not match patterns in `paths-ignore`... the workflow will run"; the two filters cannot both be set for one event (use `paths` with a leading `!` to exclude instead). `on.schedule` cron is five fields — "minute (0 - 59), hour (0 - 23), day of the month (1 - 31), month (1 - 12 or JAN-DEC), day of the week (0 - 6 or SUN-SAT)" — and "The shortest interval you can run scheduled workflows is once every 5 minutes." Basis for `ci_cost_lint.py`'s PATHS-FILTER and SCHEDULE checks. The same page also documents `jobs.<job_id>.timeout-minutes`, but that specific subsection was not retrievable in this session's fetch (the page is large and the fetch tool truncated before it) — the TIMEOUT check's claimed default (GitHub's unset-job ceiling) is therefore listed by name only, below, not sourced to this URL. |
| GitHub — About protected branches | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches | Verbatim: the **Require branches to be up to date before merging** checkbox is the strict setting; "The branch must be up to date with the base branch before merging"; strict mode means "More builds may be required, as you'll need to bring the head branch up to date after other collaborators update the target branch." Basis for `ci_cost_lint.py`'s DUP-TRIGGER check treating a strict repo's `push`(default branch) + `pull_request` combination as a duplicate-run cost, and a non-strict repo's combination as not. |

**By name only (not fetched this session):** GitHub Actions `jobs.<job_id>.timeout-minutes` — the job-level timeout key defaults to GitHub's own runner ceiling when unset; the exact current default value is asserted in `domain-k.md`/`ci_cost_lint.py`'s docstring from general knowledge, not from a URL verified this session — reconfirm the exact number against the live workflow-syntax page before citing it as a fetched fact.

## Verified by direct fetch/man page (2026-09-24) — GNU-vs-BSD shell flag portability (`reaper_lint.py` GNU_FLAG_SILENCED_STDERR rule, #1158)

Sourced for the new rule flagging a GNU-only flag combined with `2>/dev/null` in a liveness/idle check
(`find -newermt`, `find -printf`, `stat -c`, `date -d`, `sed -i` used with no argument). The BSD/macOS
side was read directly from this machine's own man pages (macOS 26.5, `man <tool>`, no network); the GNU
side from `man7.org`'s mirror of the Linux man-pages project (which packages the GNU coreutils/findutils/
sed manuals). Each row read 2026-09-24.

| Standard / source | URL | What was confirmed |
|---|---|---|
| macOS `find(1)` (BSD find) | local `man find` (macOS 26.5) | STANDARDS section lists `-mmin` and `-delete` as POSIX extensions BSD find implements natively (both portable, so neither is flagged); no `-printf` or `-newermt` token appears anywhere in the page (both absent from BSD find). The `-delete` section states "Depth-first traversal processing is implied by this option" — the same auto-`-depth` behavior GNU documents, so `-delete` carries no verified GNU/BSD divergence and is not flagged either. |
| `find(1)` — Linux man-pages (GNU findutils) | https://man7.org/linux/man-pages/man1/find.1.html | `-printf format` is documented verbatim ("True; print format on the standard output..."). `-newerXY reference` is documented with X/Y each one of `actBcmt`; "If Y is t, then reference is interpreted directly as a time" — `-newermt` is that primary with X=m, Y=t. "The use of the -delete action on the command line automatically turns on the -depth option" (matches BSD's own implied-depth behavior above). |
| macOS `stat(1)` (BSD stat) | local `man stat` (macOS 26.5) | SYNOPSIS is `stat [-FLnq] [-f format \| -l \| -r \| -s \| -x] [-t timefmt] [file ...]` — format is `-f`, not `-c`; no `-c` flag exists on this stat at all. |
| `stat(1)` — Linux man-pages (GNU coreutils) | https://man7.org/linux/man-pages/man1/stat.1.html | `-c, --format=FORMAT` documented verbatim: "use the specified FORMAT instead of the default; output a newline after each use of FORMAT." |
| macOS `date(1)` (BSD date) | local `man date` (macOS 26.5) | SYNOPSIS (`date [-nRu] ... [-r filename] [-r seconds] ...`, plus the `-j -f input_fmt` parsing form) has no `-d` flag at all. |
| `date(1)` — Linux man-pages (GNU coreutils) | https://man7.org/linux/man-pages/man1/date.1.html | `-d, --date=STRING` documented verbatim: "display time described by STRING, not 'now'." |
| macOS `sed(1)` (BSD sed) | local `man sed` (macOS 26.5) | SYNOPSIS is `sed [-EHalnru] command [-I extension] [-i extension] [file ...]` — `-i` takes a mandatory `extension` argument (an empty string for no backup, e.g. `sed -i '' ...`); it cannot be given with zero arguments. |
| `sed(1)` — Linux man-pages (GNU sed) | https://man7.org/linux/man-pages/man1/sed.1.html | `-i[SUFFIX], --in-place[=SUFFIX]` documented verbatim, with the suffix in brackets — "the suffix can be omitted entirely," so `sed -i 's/a/b/' file` (no argument between `-i` and the script) is valid GNU sed but a BSD-argument error / wrong-file-consumed on macOS. |

**Omitted as unverified (this session):** `find -mmin` and `find ... -delete` — both are documented, portable primaries on BSD/macOS find per the STANDARDS section above, so neither is a GNU-only flag; they are not flagged by the new rule even though the originating incident report suggested checking them.

## Verified by direct fetch (2026-09-24) — GitHub Actions minimum-cost profile (`agentic-delivery/references/host-enforcement.md`, `ci_cost_lint.py` new checks)

Sourced for the "Minimum-cost CI & token profile" doctrine and `ci_cost_lint.py`'s
PUSH-TRIGGER / INTEGRATION-PR-BRANCH / REQUIRED-PATHS-FILTER / WEEKLY-SCHEDULE /
CONSOLIDATION checks. Each row fetched 2026-09-24 in a prior session (scratchpad
research `gha-cost-levers.md` + `gha-cost-evil-twin.md`), reused here per this
repo's own rule that a same-day, already-fetched source may be cited without a
redundant re-fetch.

| Standard / source | URL | What was confirmed |
|---|---|---|
| GitHub Docs — Billing and usage | https://docs.github.com/en/actions/concepts/billing-and-usage | "GitHub Actions usage is free for standard GitHub-hosted runners in public repositories, and for self-hosted runners." No private-repo carve-out on the self-hosted half — applies regardless of visibility. |
| GitHub Docs — Actions runner pricing | https://docs.github.com/en/billing/reference/actions-runner-pricing | Verbatim: "GitHub rounds the minutes and partial minutes each job uses up to the nearest whole minute" (ceiling, not round-to-nearest — a 10-second job still bills a full minute). Direct per-minute rates confirmed: Linux 1-core $0.002, Linux 2-core $0.006, Linux 2-core arm64 $0.005, Windows 2-core $0.010, macOS 3-4 core $0.062/min. |
| GitHub Docs — Secure use reference | https://docs.github.com/en/actions/reference/security/secure-use | Self-hosted runners on private repos: "anyone who can fork the repository and open a pull request … [is] able to compromise the self-hosted runner environment," secrets and `GITHUB_TOKEN` included. Recommended mitigation: ephemeral/JIT runners on a clean environment per job. |
| GitHub Docs — Managing a merge queue | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue | Merge queues are available on any public repository, or a private repository owned by an organization on GitHub Enterprise Cloud — not Team, not Pro, not a personal-account repo. Adding `merge_group:` to `on:` is required or status checks never trigger once a PR enters the queue. |
| GitHub Docs — Commit statuses (REST) | https://docs.github.com/en/rest/commits/statuses | "Users with push access in a repository can create commit statuses for a given SHA" — any token with push access (or the narrower `repo:status` scope) can post any state for any SHA, with no coupling to whether a gate actually ran. Basis for requiring a separate, non-push-scoped identity before a locally-posted commit status counts as a required check. |

**By name only (not fetched this session):** GitHub Budgets alert thresholds — a
repo/org owner configures which percentages of a spend cap trigger an alert;
the profile's "50/80/100%" is this doctrine's own recommended cadence, not a
claimed GitHub platform default (the platform's own default percentages were
only confirmed via a search-engine snippet in the prior research session, not
a direct fetch — reconfirm before citing a specific default number as fetched
fact).

## Verified by direct fetch (2026-09-27) — `SubagentStart` hook input/output fields (`subagent_start_inject.py`)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Hooks reference | https://code.claude.com/docs/en/hooks | Verbatim, "SubagentStart input": "In addition to the common input fields, SubagentStart hooks receive `agent_id` with the unique identifier for the subagent and `agent_type` with the agent name that the matcher filters on." Verbatim, the JSON-output table for `SubagentStart`: "SubagentStart hooks can't block subagent creation, but they can inject context into the subagent... you can return:" a table with field `additionalContext`, description "String added to the subagent's context at the start of its conversation, before its first prompt." Common input fields table confirms `session_id`, `prompt_id`, `transcript_path`, `cwd`, `scratchpad_dir`, `permission_mode`; `hook_event_name` appears 38 times across the page's JSON examples (each hook event's own example payload), consistent with this repo's existing `stop_reminder.py` reading `data.get("hook_event_name")`. |

## Verified by direct fetch (2026-09-27) — WCAG 2.1.2 No Keyboard Trap (`a11y-focus.md`)

| Standard / source | URL | What was confirmed |
|---|---|---|
| W3C — WCAG 2.1, Success Criterion 2.1.2 No Keyboard Trap | https://www.w3.org/TR/WCAG21/#no-keyboard-trap | Verbatim, Level A: "If keyboard focus can be moved to a component of the page using a keyboard interface, then focus can be moved away from that component using only a keyboard interface, and, if it requires more than unmodified arrow or tab keys or other standard exit methods, the user is advised of the method for moving focus away." |

## Verified by direct fetch (2026-09-28) — Next.js `instrumentation.ts` runtime-specific imports (`lang-js-ts.md`)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Next.js — Guides: How to set up instrumentation | https://nextjs.org/docs/app/guides/instrumentation | Verbatim, "Importing runtime-specific code": "Next.js calls `register` in all environments, so it's important to conditionally import any code that doesn't support specific runtimes (e.g. Edge or Node.js). You can use the `NEXT_RUNTIME` environment variable to get the current environment," with the exact example: `if (process.env.NEXT_RUNTIME === 'nodejs') { await import('./instrumentation-node') }` / `if (process.env.NEXT_RUNTIME === 'edge') { await import('./instrumentation-edge') }`. Confirms the positive-condition guard is the documented shape. |

## Verified by direct fetch (2026-09-28) — hand-rolled `fetch` replacement footguns (`security-appsec.md`)

| Standard / source | URL | What was confirmed |
|---|---|---|
| WHATWG Fetch Standard — null body status | https://fetch.spec.whatwg.org/#responses | Verbatim: "A null body status is a status that is 101, 103, 204, 205, or 304." Backs the check that a `Response` built for one of these statuses must be given a `null` body. |
| Node.js API docs — `dns.lookup(hostname[, options], callback)` | https://nodejs.org/api/dns.html | Verbatim: the `all` option, "When `true`, the callback returns all resolved addresses in an array. Otherwise, returns a single address. Default: `false`." The callback's `address`/`family` params are "Not provided when `options.all` is `true`"; instead an `addresses` array of `{address, family}` objects is passed. Backs the check that a custom `lookup` callback must handle the `{ all: true }` array shape, not just a single address. |

## Verified by direct fetch (2026-10-07) — review size and attention

| Standard / source | URL | What was confirmed |
|---|---|---|
| "Bigger Isn't Always Better" (LLM code review, arXiv abstract) | https://arxiv.org/abs/2606.15689 | Small preprint, 150 samples (100 synthetic bugs, 50 real bug-fix PRs): F1 0.657 on diffs under 10 lines vs 0.043 on diffs over 150 lines. Backs the DIFF size bands in `method-situational.md`; directional, not a rate. |
| "Does Order Matter?" (file ordering in code review, arXiv abstract) | https://arxiv.org/abs/2609.22610 | 330,343 multi-file PRs: each additional modified file lowers the odds of any review comment by about 8.7
## Verified by direct fetch (2026-10-07) — review size and attention

| Standard / source | URL | What was confirmed |
|---|---|---|
| "Bigger Isn't Always Better" (LLM code review, arXiv abstract) | https://arxiv.org/abs/2606.15689 | Small preprint, 150 samples (100 synthetic bugs, 50 real bug-fix PRs): F1 0.657 on diffs under 10 lines vs 0.043 on diffs over 150 lines. Backs the DIFF size bands in `method-situational.md`; directional, not a rate. |
| "Does Order Matter?" (file ordering in code review, arXiv abstract) | https://arxiv.org/abs/2609.22610 | 330,343 multi-file PRs: each additional modified file lowers the odds of any review comment by about 8.7%; latent-bug rate rises from 56.7% at file position 1 to 61.5% at position 30. Backs chunking, the per-file ledger and blast-radius ordering. |

## Verified by direct fetch (2026-10-07) — Claude Code plugin marketplace (`README.md` team-wide install, `commands/`, `.claude-plugin/marketplace.json`)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Create a marketplace | https://code.claude.com/docs/en/plugin-marketplaces | `.claude-plugin/marketplace.json` requires `name`, `owner`, `plugins`; each entry needs `name` and `source`; entry name must equal the plugin's `plugin.json` name; `claude plugin validate`; add with `claude plugin marketplace add` / `/plugin marketplace add`, install id `<plugin>@<marketplace>`. |
| Claude Code — Marketplace reference | https://code.claude.com/docs/en/plugins/marketplace-reference | Top-level and entry fields; relative-path `source` (`"."` is the marketplace root, valid for git-hosted marketplaces); `github` source `ref`/`sha`; entry `version` loses to `plugin.json` `version` (validator warns); reserved marketplace names. |
| Claude Code — Host and maintain a marketplace | https://code.claude.com/docs/en/plugins/host-marketplace | Auto-update is off by default and has no `marketplace.json` field; users or admins enable it; a new copy is delivered only when the computed version changes (`plugin.json` first, then entry; omit both to track commits); `#<ref>` on the add command pins a branch or tag; `/plugin marketplace update <name>`. |
| Claude Code — Manage plugins for your organization | https://code.claude.com/docs/en/plugins/org | Managed settings (server-managed, MDM, or `managed-settings.json`) with `extraKnownMarketplaces` (per-entry `autoUpdate`) and `enabledPlugins` (`plugin@marketplace`) register and install for every machine; `strictKnownMarketplaces` allowlist. |
| Claude Code — Add components to a plugin | https://code.claude.com/docs/en/plugins/components | A plugin's `skills/<dir>/SKILL.md` runs as `/<plugin>:<dir>`; `commands/<file>.md` runs as `/<plugin>:<file>`; command files take the same frontmatter as skills; commands are the older format. |
| Claude Code — Skills | https://code.claude.com/docs/en/skills | Frontmatter `description`, `argument-hint`, `disable-model-invocation`; `$ARGUMENTS` substitution. |

## Verified by direct fetch (2026-10-07) — agent host sandboxes and approval modes (`docs/host-safety.md`)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Configure the sandboxed Bash tool | https://code.claude.com/docs/en/sandboxing | Sandbox is off by default; `sandbox.enabled: true` in a settings file or `/sandbox` turns it on; OS-enforced on macOS, Linux and WSL2, not native Windows; covers shell commands only (file tools, MCP servers and hooks run outside it). |
| Codex — Agent approvals and security | https://learn.chatgpt.com/docs/agent-approvals-security | `sandbox_mode` and `approval_policy` in `~/.codex/config.toml`; modes `workspace-write` (default in version-controlled folders), `read-only` (default elsewhere), `danger-full-access` (alias `--yolo`); macOS Seatbelt, Linux `bwrap` plus seccomp; network off by default in `workspace-write`; `.git`, `.agents/`, `.codex/` stay read-only. The older `developers.openai.com/codex/security` URL redirects here. |
| Cursor — Run modes | https://cursor.com/docs/agent/security/run-modes | Run modes Auto-review (recommended), Allowlist, Run Everything (no sandbox); sandbox is Seatbelt on macOS, Landlock plus seccomp on Linux; `sandbox.json` (`~/.cursor/` or `.cursor/`) keys `readBoundary`, `additionalReadPaths`, network policy. |
| Gemini CLI — Sandboxing | https://google-gemini.github.io/gemini-cli/docs/cli/sandbox.html | Off by default; enable with `-s`, `GEMINI_SANDBOX`, or `sandbox: true` under `tools` in `settings.json`; macOS Seatbelt profile default `permissive-open` (network allowed) or Docker/Podman. |
| Gemini CLI — Configuration | https://google-gemini.github.io/gemini-cli/docs/get-started/configuration.html | Project file `.gemini/settings.json`; `tools.sandbox`, `tools.core`, `tools.allowed`, `tools.exclude` default undefined; `--approval-mode` values `default`, `auto_edit`, `yolo`. |
| OpenCode — Permissions | https://opencode.ai/docs/permissions/ | `permission` in `opencode.json`, values `allow`/`ask`/`deny`, bash glob patterns with last-match-wins; most permissions default `allow`, `external_directory` and `doom_loop` default `ask`; no OS sandbox mentioned. |
| VS Code — Agent sandboxing | https://code.visualstudio.com/docs/agents/run/agent-sandboxing | `chat.agent.sandbox.enabled` default `off`; macOS no prerequisites, Linux/WSL2 need `bubblewrap` and `socat`; `chat.agent.sandbox.network.allowNetwork` default `true`; `chat.agent.sandbox.allowUnsandboxedCommands` default `true`. |
| VS Code — Security | https://code.visualstudio.com/docs/copilot/security | `chat.tools.global.autoApprove` bypasses all approvals; `chat.tools.terminal.autoApprove` per-command rules; enterprise policy `ChatToolsTerminalEnableAutoApprove`. |
| GitHub Copilot CLI — Allowing tools | https://docs.github.com/en/copilot/how-tos/copilot-cli/allowing-tools | `--allow-all-tools`, `--allow-all`/`--yolo`, `--allow-tool`, `--deny-tool` (deny wins); read-only operations auto-allowed; no OS sandbox documented. |
| Windsurf (docs now at Devin Desktop) — Terminal | https://docs.devin.ai/desktop/terminal | Auto-execution levels Disabled, Allowlist Only, Auto, Turbo (all except deny list); allow and deny lists with prefix wildcards; team admins can cap the level; no sandbox mentioned. |
| Kiro — Permissions | https://kiro.dev/docs/permissions/ | Capabilities (`fs_read`, `fs_write`, `shell`, ...) with effects deny/ask/allow, deny wins; user file `~/.kiro/settings/permissions.yaml`; untrusted workspaces prompt more; no OS sandbox mentioned on that page. |
| Cline — Auto Approve and YOLO mode | https://docs.cline.bot/features/auto-approve | Fetched 2026-10-16. Per-category toggles; "Execute safe commands" covers commands the model flags safe, "Execute all commands" extends to `requires_approval` ones; no fixed allowlist; YOLO mode auto-approves every file, terminal, browser and MCP action; the page recommends isolated or sandboxed environments but documents no Cline sandbox. |
| Cline — Skills | https://docs.cline.bot/customization/skills | Fetched 2026-10-16. A skill may hold a `scripts/` folder; "Scripts can be executed directly" and only their output enters context. |
| Roo Code — Auto-Approving Actions | https://roocodeinc.github.io/Roo-Code/features/auto-approving-actions/ | Fetched 2026-10-16 (the old `docs.roocode.com` host redirects here). "Always approve execute operations" plus `roo-cline.allowedCommands` and `roo-cline.deniedCommands` (longest prefix wins, deny wins ties, `*` allows or denies all); no OS sandbox mentioned, so `unverified`. |
| Roo Code — Skills | https://roocodeinc.github.io/Roo-Code/features/skills/ | Fetched 2026-10-16. Skills may bundle helper scripts beside `SKILL.md`; whether Roo runs them under the command allowlist is not stated (`unverified`). |
| Factory Droid — Sandbox | https://docs.factory.com/autonomy-and-safety/sandbox | Fetched 2026-10-16. OS-enforced: Seatbelt on macOS, bubblewrap plus seccomp on Linux and WSL2; `sandbox.enabled: true` turns it on; modes `per-command` (default) and `whole-process`; if isolation is unavailable Droid refuses to start rather than run unsandboxed. |
| Factory Droid — Autonomy Level | https://docs.factory.com/autonomy-and-safety/auto-run | Fetched 2026-10-16 (the old `/cli/user-guides/auto-run` path redirects here). Levels Off, Low, Medium, High by risk; `permissionRules` allow, ask or block; `--skip-permissions-unsafe` skips prompts but not command blocks; command rules "are not operating-system isolation". |
| Factory Droid — Skills | https://docs.factory.com/harness/skills | Fetched 2026-10-16 (old `/cli/configuration/skills` redirects here). Project skills live in `.factory/skills/<name>/`; supporting `scripts/` the skill can call; `allowed-tools` is metadata and "standard skill invocation is not a runtime sandbox". |
| Hermes Agent — Security | https://hermes-agent.nousresearch.com/docs/user-guide/security | `~/.hermes/config.yaml` `terminal.backend` (local, ssh, docker, singularity, modal, daytona, vercel_sandbox); `approvals.mode` smart (default), manual, off; YOLO via `--yolo`, `/yolo`, `HERMES_YOLO_MODE=1`. |
| Aider — Options | https://aider.chat/docs/config/options.html | `--yes-always` (default false) confirms everything; `/run` and `/test` exist; no sandbox documented. Aider is not an install target. |
| Dev Containers | https://containers.dev/ | Open specification for containers as development environments; `devcontainer.json`; spec at the `devcontainers/spec` repository. |
| VS Code — Dev Containers | https://code.visualstudio.com/docs/devcontainers/containers | A container as a full development environment; with isolated container volumes the workspace is not bound to the local filesystem. |

## Verified by direct fetch (2026-10-07) — Claude Code sandbox (operating layer `sandbox` + `permissions.deny`)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Configure the sandboxed Bash tool | https://code.claude.com/docs/en/sandboxing | The sandbox is off by default; `sandbox.enabled: true` in a settings file turns it on; `allowUnsandboxedCommands: false` disables the unsandboxed retry so Claude Code ignores `dangerouslyDisableSandbox`; the OS applies the boundary to Bash commands and the processes they start (writes limited to the working directory, a temp directory and added directories by default); explicit permission deny rules are always respected. |
| Claude Code — Sandbox autonomy keys | https://code.claude.com/docs/en/sandboxing | `autoAllowBashIfSandboxed` "still defaults to `true`, so sandboxed commands keep running without prompts"; a command matching `excludedCommands` "goes through the regular permission flow"; Go CLIs (`gh`, `gcloud`, `terraform`) "may fail TLS verification under Seatbelt", fix `gh *` in `excludedCommands`; `network.allowedDomains` starts empty (example `["github.com", "*.npmjs.org"]`); `network.allowLocalBinding: true` lets sandboxed commands listen on macOS ports; `filesystem.allowWrite` example `["~/.kube", "/tmp/build"]`; protected paths such as `.claude/skills` stay write-denied with no exemption (`git checkout`/`merge` touching them fails with `unable to unlink old`); `docker` is incompatible (exclude e.g. `docker compose *`); jest needs `--no-watchman`; `open`/`osascript` fail with `-600` (fix `allowAppleEvents` in user settings or exclude `open *`). Backs `docs/host-safety.md#autonomy-ready-defaults`. Fetched + verified 2026-10-08. |

## Verified by direct fetch (2026-10-08) — live reload without a restart (`perun_auto_update.py`, install output)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Skills | https://code.claude.com/docs/en/skills | "Edit a skill during a session": a skill added, edited, or removed under the project `.claude/skills/` is picked up "within the current session, without a restart". |
| Claude Code — Settings files and precedence | https://code.claude.com/docs/en/settings | "When edits take effect": Claude Code "applies most edits to the running session without a restart, including edits to `permissions`, `hooks`"; keys read only at session start include `model` (switch with `/model`) and `effortLevel` (switch with `/effort`). |

## Verified by direct fetch (2026-10-11) — Next.js server action dispatch (`nextjs-app-router.md`)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Next.js — Mutating Data | https://nextjs.org/docs/app/getting-started/mutating-data | "Invoking Server Functions" note: "The client currently dispatches and awaits them one at a time. This is an implementation detail and may change." Scope is the client, not per page; may change. Fetched + verified 2026-10-11. |

## Verified by direct fetch (2026-10-13; Du et al. row 2026-10-28) — council (`idea-critic/references/council.md`)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Wang et al., Self-Consistency | https://arxiv.org/abs/2203.11171 | Sampling many reasoning paths and taking the most consistent answer improves over chain-of-thought (e.g. +17.9% GSM8K, +6.4% StrategyQA). The cheap baseline the council must beat. Fetched + verified 2026-10-13. |
| "Should we be going MAD?" | https://arxiv.org/abs/2311.17371 | Multi-agent debate in current form does not reliably beat self-consistency or multi-path ensembling; sensitive to hyperparameters. Basis for the kill criterion. Fetched + verified 2026-10-13. |
| Wang et al., Mixture-of-Agents | https://arxiv.org/abs/2406.04692 | Layered heterogeneous agents; open-source-only MoA 65.1% vs GPT-4 Omni 57.5% on AlpacaEval 2.0. Motivates mixed-model `--cmd`. Fetched + verified 2026-10-13. |
| Claude Council (skill) | https://github.com/amgadelgamal/claude-council | Four Claude persona subagents, anonymized peer critique, chairman synthesis; all members Claude, no stated evidence rule. Fetched + verified 2026-10-13. |
| Du et al., Multiagent Debate | https://arxiv.org/abs/2305.14325 | Several model instances propose and debate over rounds to a shared answer; claimed gains in reasoning and fewer hallucinations. Fetched + verified 2026-10-28. |

Veche vs these (2026-10-28): added anonymized Borda peer ranking, a timebox default and a blocking alarm; chairman synthesis is intentionally absent (deterministic tally instead); external councils plug in via `--cmd`.

By name, not fetched (no URL): Huang et al. on debate vs self-consistency at equal response count (search summary only).

## Verified by direct fetch (2026-10-15) — rival comparison (`docs/perun-vs-rivals.md`)

Pages read 2026-10-15; star counts are from the rendered page, single source, no commit dates shown.

| Source | URL | What was confirmed |
|---|---|---|
| obra/superpowers | https://github.com/obra/superpowers | Skill bundle; plugin-marketplace install. Star count not cited. Verified 2026-10-15. |
| garrytan/gstack | https://github.com/garrytan/gstack | About 136.5k stars; role skills, `/qa`, `/ship`. Verified 2026-10-15. |
| wshobson/agents | https://github.com/wshobson/agents | 40.8k stars; 94 plugins, 185 skills, 202 agents, 105 commands. Verified 2026-10-15. |
| SuperClaude | https://github.com/SuperClaude-Org/SuperClaude_Framework | 23.9k stars. Verified 2026-10-15. |
| anthropics/skills | https://github.com/anthropics/skills | 181.3k stars. Verified 2026-10-15. |
| anthropics/knowledge-work-plugins | https://github.com/anthropics/knowledge-work-plugins | 29.7k stars; slash commands and MCP connectors. Verified 2026-10-15. |
| phuryn/pm-skills | https://github.com/phuryn/pm-skills | 27.1k stars; 69 skills. Verified 2026-10-15. |
| coreyhaines31/marketingskills | https://github.com/coreyhaines31/marketingskills | 54.8k stars. Verified 2026-10-15. |
| blader/humanizer | https://github.com/blader/humanizer | 57.2k stars; 26 detection patterns. Verified 2026-10-15. |
| hardikpandya/stop-slop | https://github.com/hardikpandya/stop-slop | 18.0k stars; 5-dimension score. Verified 2026-10-15. |
| conorbronsdon/avoid-ai-writing | https://github.com/conorbronsdon/avoid-ai-writing | 5.0k stars; 0-100 detector script. Verified 2026-10-15. |
| promptfoo/promptfoo | https://github.com/promptfoo/promptfoo | 26.0k stars; evals and red-team scans. Verified 2026-10-15. |
| Claude Code agent teams | https://code.claude.com/docs/en/agent-teams | Experimental, off by default; task list, mailbox, hooks; documented limits. Verified 2026-10-15. |

## Verified by direct fetch (2026-10-15) — Claude Code plugin install (`README.md` Quick start)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code, Create a marketplace | https://code.claude.com/docs/en/plugin-marketplaces | `/plugin marketplace add <path>` registers a marketplace; `<owner>/<repo>` is the GitHub form; install id is `<plugin-name>@<marketplace-name>`; in a session `/plugin install name@marketplace` opens the plugin details panel where you install. Fetched + verified 2026-10-15. |
| Claude docs — Pricing (model rates) | https://platform.claude.com/docs/en/about-claude/pricing | `docs.claude.com/en/docs/about-claude/pricing` redirects here (302). Per-model USD/MTok (input / 5m write / 1h write / cache read / output) copied into `DEFAULT_RATES` in `token_report.py`: Opus 5.5 4/5/8/0.20/20; Opus 5, 4.8, 4.7, 4.6, 4.5 5/6.25/10/0.50/25; Sonnet 5.5 2/2.50/4/0.10/10; Sonnet 5 2/2.50/4/0.20/10; Sonnet 4.6, 4.5 3/3.75/6/0.30/15; Haiku 4.5 1/1.25/2/0.10/5; Fable 5.1 10/12.50/20/0.25/50; Fable 5 10/12.50/20/1/50. Haiku 5.5 is tiered per request by prompt size and priced via `LONG_RATES`; verbatim table rows "Claude Haiku 5.5 (for prompts up to 100,000 tokens)" $0.10 / $0.125 / $0.20 / $0.01 / $0.50 and "(for prompts over 100,000 tokens)" $0.50 / $0.625 / $1 / $0.05 / $2.50 per MTok (input / 5m write / 1h write / cache read / output); "A request's prompt length counts all of its input tokens, including cache reads and cache writes. Each request is priced on its own: a request over the threshold pays the higher prices even when part of its prompt is a cache hit." API id spellings other than those seen in local transcripts (claude-opus-4-8, claude-opus-5, claude-opus-5-5, claude-sonnet-5, claude-sonnet-5-5, claude-haiku-4-5, claude-haiku-5-5, claude-fable-5) are unverified; a wrong id stays UNPRICED. Fetched + verified 2026-10-22 (every default row re-checked against the table that day; the earlier fetch was 2026-10-15). |

## Verified by direct fetch (2026-10-16) — host-native install manifests (`README.md` Quick start)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Codex, Build plugins | https://developers.openai.com/codex/plugins/build | Repo marketplace lives at `$REPO_ROOT/.agents/plugins/marketplace.json`; each entry needs `name`, `source` (`{"source":"local","path":"./..."}`), `policy.installation`, `policy.authentication`, `category`; `.codex-plugin/plugin.json` is the compatibility manifest (`name`, `version`, `description`, `skills`, `interface`); `codex plugin marketplace add owner/repo` and local paths. The page names no CLI install command; `codex plugin add <plugin>@<marketplace>` was confirmed from `codex 0.145.0 plugin --help` and a real local install. Fetched + verified 2026-10-16. |
| Gemini CLI, Extensions reference | https://geminicli.com/docs/extensions/reference/ | `gemini-extension.json` fields `name`, `version`, `description`, `contextFileName` (falls back to `GEMINI.md`), `mcpServers`, others; no field is marked required; skills load from `skills/` at the extension root; `gemini extensions install <github-url-or-path>`. Page banner: Gemini CLI replaced by Antigravity CLI on 2026-06-18. Fetched + verified 2026-10-16. |
| GitHub Copilot CLI, plugin marketplaces | https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/plugins-marketplace | `marketplace.json` goes in `.github/plugin/`; "Copilot CLI also looks for the `marketplace.json` file in the `.claude-plugin/` directory"; `copilot plugin marketplace add owner/repo`. No install command or `plugin.json` rule on the page. Fetched + verified 2026-10-16. |

## Verified by direct fetch (2026-10-16) — agent skill roots (`install.sh --with-extra-hosts`)

| Standard / source | URL | What was confirmed |
|---|---|---|
| OpenCode, Agent skills | https://opencode.ai/docs/skills/ | Project skills load from `.opencode/skills/<name>/SKILL.md` (also `.claude/skills` and `.agents/skills`); `name` must match the directory, `description` required. |
| Windsurf (docs now at Devin Desktop), Skills | https://docs.devin.ai/desktop/cascade/skills | Preferred workspace root is `.devin/skills/<name>/`; `.windsurf/skills/<name>/` is documented as a legacy path that is still read, so Perun keeps `.windsurf/skills`. `name` and `description` required. |
| Cline, Skills | https://docs.cline.bot/customization/skills | Workspace roots `.cline/skills/` (recommended), `.clinerules/skills/`, `.claude/skills/`; `name` must equal the directory name, `description` limit 1024 characters. |
| Roo Code, Skills | https://roocodeinc.github.io/Roo-Code/features/skills | Project roots `.roo/skills/{skill-name}/SKILL.md` and `.agents/skills/{skill-name}/SKILL.md`; `name` must match the directory. `docs.roocode.com/features/skills` redirects here (301). |
| Kiro, Skills | https://kiro.dev/docs/skills/ | Workspace root `.kiro/skills/`; `name` must match the folder, lowercase letters, digits and hyphens, at most 64 characters. |
| Amp, Skills | https://ampcode.com/docs/customize/skills | Project roots `.agents/skills/` and `.claude/skills/` (both already default Perun installs); no Amp-specific root, so no new directory was added. |
| Factory Droid, Skills | https://docs.factory.com/cli/configuration/skills | Project root `<repo>/.factory/skills/<skill-name>/SKILL.md`; `name` and `description` required. `docs.factory.ai/cli/configuration/skills` redirects here (308). |
| Continue, Rules | https://docs.continue.dev/customize/deep-dives/rules | Rules live in `.continue/rules` as Markdown or YAML; the page does not mention SKILL.md or skills, so Continue was not added. |

## Verified by direct fetch (2026-10-16) — agent skill roots, hosts parity (`install.sh --with-extra-hosts`, default roots)

Pages were fetched with a summarising fetch tool on 2026-10-16; each row records only what the summary quoted from the page. Superpowers' README is the rival host list used in H10 of `perun-vs-rivals.md`.

| Standard / source | URL | What was confirmed |
|---|---|---|
| obra/superpowers, README (rival host list) | https://raw.githubusercontent.com/obra/superpowers/main/README.md | Installation section lists 16 harnesses with separate install steps: Claude Code, Antigravity, Codex App, Codex CLI, Cursor, Devin CLI, Factory Droid, Gemini CLI, GitHub Copilot CLI, Grok Build CLI, Kimi Code, OpenCode, Pi, Qwen Code, Hermes Agent, Muse. The README states no total; 16 is a count of that list. |
| Qwen Code, Skills | https://qwenlm.github.io/qwen-code-docs/en/users/features/skills/ | Project root `.qwen/skills/` (personal `~/.qwen/skills/`); each skill is a directory with `SKILL.md`; `name` and `description` required; the page states no directory-name rule. |
| Qwen Code, Sandbox | https://qwenlm.github.io/qwen-code-docs/en/users/features/sandbox/ | Whole-CLI sandbox (Seatbelt, Docker, Podman) via `tools.sandbox`, `-s`/`--sandbox` or `QWEN_SANDBOX`; Linux tool sandbox via `tools.executionSandbox`; no default stated, methods shown as opt-in; "Approval and YOLO do not expand the filesystem or network policy." |
| Grok Build, Skills | https://docs.x.ai/build/features/skills-plugins-marketplaces | Project root `./.grok/skills/` (walked up to the repo root), user `~/.grok/skills/`; user-level `~/.agents/skills/` is also discovered; the page names no project-level `.agents/skills`. `name` and `description` among the supported frontmatter fields; extra keys ignored. |
| Grok Build, Sandbox | https://docs.x.ai/build/features/sandbox | OS sandbox (Landlock on Linux, Seatbelt on macOS), profile `off` is the default; `grok --sandbox workspace`, `[sandbox] profile` in `~/.grok/config.toml`, `GROK_SANDBOX`; profiles `workspace`, `devbox`, `read-only`, `strict`. |
| Devin CLI, Skills | https://docs.devin.ai/cli/extensibility/skills/overview | Project roots `.agents/skills/`, `.devin/skills/`, `.windsurf/skills/`: "We support the `.agents` skills standards". The page does not list required frontmatter fields or a name rule. No new directory added (`.agents/skills` is a default Perun install). |
| Kimi Code, Agent Skills | https://www.kimi.com/code/docs/en/kimi-code-cli/customization/skills.html | Project roots `.kimi-code/skills/` and `.agents/skills/` (project root is the nearest directory with `.git`); `name` and `description` must both be provided in directory form. No new directory added (`.agents/skills` is a default Perun install). |
| Pi, Skills | https://pi.dev/docs/latest/skills | Pi supports `~/.agents/skills/` and project `.agents/skills/` (searched from the working directory through its ancestors); names lowercase letters, digits, hyphens, at most 64 characters; skills without a description are not loaded; project skills load after project trust. The page did not mention `.pi/skills`, so it was not added. |
| Hermes Agent, Skills | https://hermes-agent.nousresearch.com/docs/user-guide/features/skills | Project roots `<project-root>/.hermes/skills/` ("Hermes-native") and `<project-root>/.agents/skills/`; project skills are not auto-loaded from a cloned repo until `hermes skills trust` is run for it; frontmatter `name` "recommended", no field labelled required. |
| Cursor, Skills | https://cursor.com/docs/skills | Project roots `.agents/skills/` and `.cursor/skills/` (also `.claude/skills/`, `.codex/skills/`); `name` (lowercase letters, digits, hyphens; must match the parent folder) and `description` required. |
| Antigravity, Skills | https://antigravity.google/docs/skills | Workspace root `<workspace-root>/.agents/skills/<skill-folder>/`; `description` required, `name` optional (folder name when omitted); the CLI uses the same workspace path, with a different global path. No new directory added (`.agents/skills` is a default Perun install). A Google codelab on the same topic gave an inconsistent global path, so only the workspace path is used. |
| Muse, Skills (skipped) | https://www.withone.ai/blog/muse-code-skills-not-mcp/md | Third-party blog, not vendor docs: project skills from `.agents/skills` or `.claude/skills`. No vendor page was found, so Muse is listed as skipped, not as supported. |

## Verified by direct fetch (2026-10-16) — pipeline optimizer (fix catalogue and measurement fields: `pipeline_profile.py`, `pipeline-optimizer.md`)

Every page was fetched on 2026-10-16 with a plain HTTP client (HTTPS URLs, no JavaScript), tags stripped, and each quoted phrase below was checked to occur verbatim in the page text (whitespace-normalised). Where a page shows a gap next to inline code, the quote stops before it. A saving the script prints is computed from the repo's own measurements; these sources only back the mechanism each fix relies on, never a number.

| Standard / source | URL | What was confirmed |
|---|---|---|
| GitHub Docs — Managing a merge queue | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue | "A merge queue helps increase velocity by automating pull request merges into a busy branch and ensuring the branch is never broken by incompatible changes."; it "does not require a pull request author to update their pull request branch and wait for status checks to finish before trying to merge"; "You must use the merge_group event to trigger your GitHub Actions workflow when a pull request is added to a merge queue."; a minimum group size "is useful if merges to your base branch trigger a lengthy CI build or deploy process". |
| GitHub Docs — Dependency caching reference | https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching | "On a cache miss, the action automatically creates a new cache if the job completes successfully."; "GitHub will remove any cache entries that have not been accessed in over 7 days."; "By default, the limit is 10 GB per repository". |
| actions/cache source, `restoreImpl.ts` | https://raw.githubusercontent.com/actions/cache/main/src/restoreImpl.ts | The restore step logs `Cache restored from key: ${cacheKey}` on a hit and `Cache not found for input keys: ...` on a miss, and a comment says `cache-hit` is intentionally not set to `false` on a miss. The hit rate therefore comes from step logs (the strings `cache_metrics` counts), not from a job field. |
| GitHub Docs — REST workflow jobs | https://docs.github.com/en/rest/actions/workflow-jobs | The example job object carries `"started_at": "2020-01-20T17:42:40Z", "completed_at": "2020-01-20T17:44:39Z"` and a `steps` array whose items carry `"name": "Set up job", "status": "completed", "conclusion": "success", "number": 1, "started_at"` and their own `completed_at`. The page text has no `created_at` for a job: queue wait is read from the live response, see the next row. |
| GitHub REST API, live response (observed, not a docs page) | https://api.github.com/repos/protocol/perun/actions/runs/{run_id}/jobs | Observed 2026-10-16 in the profiled response (30 runs, their jobs): every job carries `created_at`, `started_at`, `completed_at`, and every step `number`, `started_at`, `completed_at`. The script reads queue wait as `started_at` minus `created_at`; a job without `created_at` counts as 0 s of queue wait (a floor, not an estimate). The docs example above omits the field, so this row is an observation, not a documented guarantee. |
| GitHub Docs — REST workflow runs | https://docs.github.com/en/rest/actions/workflow-runs | "per_page integer The number of results per page (max 100)."; run objects carry `"run_attempt": 1, "run_started_at": "2020-01-22T19:33:08Z"` and a `head_commit` with a `message`; "You can use the REST API to view, re-run, cancel, and view logs for workflow runs in GitHub Actions." |
| GitHub Docs — Rate limits for the REST API | https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api | "The primary rate limit for unauthenticated requests is 60 requests per hour."; "If you exceed your primary rate limit, you will receive a 403 or 429 response, and the x-ratelimit-remaining header will be 0". |
| GitHub Docs — Larger runners | https://docs.github.com/en/actions/concepts/runners/larger-runners | "Larger runners are managed virtual machines with more resources than standard GitHub-hosted runners"; the feature list starts "More RAM, CPU, and disk space". |
| GitHub Docs — GitHub-hosted runners reference | https://docs.github.com/en/actions/reference/runners/github-hosted-runners | "Use of the standard GitHub-hosted runners is free and unlimited on public repositories."; the public-repository table lists `Linux 4 16 GB 14 GB x64 ubuntu-latest`, i.e. 4 CPUs and 16 GB (the private-repository table lists 2 CPUs and 8 GB), which is why the shard fix defaults to 4 jobs. |
| GitHub Docs — Running variations of jobs in a workflow (matrix) | https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations | "A matrix strategy lets you use variables in a single job definition to automatically create multiple job runs"; "If any of the jobs with continue-on-error: false fail, all jobs that are in progress or queued will be cancelled." |
| Martin Fowler — Continuous Integration | https://martinfowler.com/articles/continuousIntegration.html | "The commit build is the one that has to be done quickly, as a result it will take a number of shortcuts that will reduce the ability to detect bugs."; "If the secondary build detects a bug, that's a sign that the commit build could do with another test."; "For most projects, however, the XP guideline of a ten minute build is perfectly within reason." |
| Software Engineering at Google, ch. 23 Continuous Integration | https://abseil.io/resources/swe-book/html/ch23.html | "CI should optimize quicker, more reliable tests on presubmit and slower, less deterministic tests on post-submit."; "Our general rule of thumb is: only fast, reliable ones."; "we typically limit presubmit tests to just those for the project where the change is happening."; "After a change has been submitted, we use TAP to asynchronously run all potentially affected tests, including larger and slower tests." |
| Google Testing Blog — Flaky Tests at Google and How We Mitigate Them | https://testing.googleblog.com/2016/05/flaky-tests-at-google-and-how-we.html | "We define a "flaky" test result as a test that exhibits both a passing and a failing result with the same code."; "A tool that monitors the flakiness of tests and if the flakiness is too high, it automatically quarantines the test."; "For projects that see lots of flaky test failures, we currently re-run failing tests one time and only report as a failure if it fails twice in a row." |
| pytest-xdist — Running tests across multiple CPUs (distribution) | https://pytest-xdist.readthedocs.io/en/stable/distribution.html | `--dist load` (default): "Sends pending tests to any worker that is available, without any guaranteed order." |
| Playwright — Sharding | https://playwright.dev/docs/test-sharding | "Sharding in Playwright means splitting your tests into smaller parts called "shards"."; "In a CI pipeline, each shard can run as a separate job, making use of the hardware resources available in your CI pipeline, like CPU cores, to run tests faster." |
| Predictive Test Selection (Machalica, Samylkin, Porth, Chandra; arXiv 1810.05286) | https://arxiv.org/abs/1810.05286 | The abstract says the learned strategy "reduces the total infrastructure cost of testing code changes by a factor of two". Used only as evidence that selecting a subset of tests per change is a recognised lever, not for any number the script prints. |
| ESLint — Command Line Interface Reference | https://eslint.org/docs/latest/use/command-line-interface | `--cache`: "Store the info about processed files in order to only operate on the changed ones." |
| TypeScript — TSConfig reference | https://www.typescriptlang.org/tsconfig/ | `incremental`: "Tells TypeScript to save information about the project graph from the last compilation to files stored on disk." |
| Ruff — Settings | https://docs.astral.sh/ruff/settings/ | `cache-dir`: "By default, Ruff stores cache results in a .ruff_cache directory in the current project root." |
| mypy — The mypy daemon | https://mypy.readthedocs.io/en/stable/mypy_daemon.html | "running mypy using the mypy daemon can be 10 or more times faster than the regular command-line mypy tool" |
| Git — githooks | https://git-scm.com/docs/githooks | pre-push: "This hook is called by git-push[1] and can be used to prevent a push from taking place."; pre-commit "can be bypassed with the --no-verify option". |
| DORA — Software delivery performance metrics | https://dora.dev/guides/dora-metrics/ | Change lead time: "The amount of time it takes for a change to go from committed to version control to deployed in production." The script measures first push to merge only, a proxy for the first leg. |
| Wikipedia — Amdahl's law | https://en.wikipedia.org/wiki/Amdahl%27s_law | "the overall performance improvement gained by optimizing a single part of a system is limited by the fraction of time that the improved part is actually used."; "even with an infinite number of processors, the speedup is constrained by the unparallelizable portion." |
| Wikipedia — Critical path method | https://en.wikipedia.org/wiki/Critical_path_method | "is an algorithm for scheduling a set of project activities."; a critical path is determined by identifying "the longest stretch of dependent activities". |

## Verified by direct fetch (2026-10-16) — auto-compact + SessionStart re-inject (operating layer `autoCompactWindow`, `handoff_inject.py`)

Pages were fetched with a summarising fetch tool on 2026-10-16; each row records only what the summary quoted from the page. The `settings-reference` page is long, so the `autoCompactWindow` row was read from its second 100000-character slice.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Settings reference | https://code.claude.com/docs/en/settings-reference.md | `autoCompactWindow`: scope "Any file"; type number of tokens from `100000` to `1000000` (capped at the model's context window); default unset, so Claude Code picks a window tuned for the model; `--autocompact` overrides it for one session and `CLAUDE_CODE_AUTO_COMPACT_WINDOW` takes precedence over both; a per-model `modelSettings` value beats a top-level `autoCompactWindow` in the same file. The page's `modelSettings` entry also allows `"auto"`, but the top-level entry quotes no `"auto"`. |
| Claude Code — Hooks reference | https://code.claude.com/docs/en/hooks.md | SessionStart matchers `startup`, `resume`, `clear`, `compact` ("Auto or manual compaction"), `fork`; input has `source`; plain-text stdout of a SessionStart hook is added to Claude's context; `hookSpecificOutput.additionalContext` is wrapped in a system reminder at the start of the conversation. |
| Claude Code — Context window | https://code.claude.com/docs/en/context-window.md | "What survives compaction": SessionStart hooks that match the `compact` source run after compaction and their output is added to the compacted context; Claude Code compacts automatically as the window fills; compaction replaces the conversation with a summary. |

## Verified by direct fetch (2026-10-16) — capability matrix rivals (`docs/capability-matrix.md`)

Every rival in the capability matrix was read on 2026-10-16. GitHub facts (stars, last push, license, renames) come from the unauthenticated GitHub REST API (`api.github.com/repos/<owner>/<repo>`, one call per repository); README text was read from `raw.githubusercontent.com`; documentation and product pages were read with `curl` (matched lines only) or a summarising fetch tool, as each row says, and each row records only what that read showed. The URL in each row is the human-facing page the matrix links. Star counts and push dates are popularity and recency signals, not quality evidence. Vendor-reported numbers are quoted as such and were not re-run.

| Source | URL | What was confirmed |
|---|---|---|
| Anthropic pr-review-toolkit | https://github.com/anthropics/claude-code/tree/main/plugins/pr-review-toolkit | Plugin README (read from raw.githubusercontent.com): six agents, comment-analyzer, pr-test-analyzer, silent-failure-hunter, type-design-analyzer, code-reviewer, code-simplifier. Stars and push date are the parent repository's (`anthropics/claude-code`). GitHub API: 151,186 stars, last push 2026-10-15, no SPDX license id from the API, not archived. Verified 2026-10-16. |
| Claude Code `/code-review` | https://code.claude.com/docs/en/code-review-local.md | Docs page (curl, matched lines): `/code-review` takes an effort level from `low` to `ultra`; `--fix` asks Claude to apply the findings through the permission mode; `--comment` posts inline comments on a GitHub PR or a note on a GitLab MR (through `glab`); the review runs as a background subagent. Verified 2026-10-16. |
| obra/superpowers | https://github.com/obra/superpowers | README skills list: brainstorming, using-git-worktrees, writing-plans, subagent-driven-development (a fresh subagent per task, two-stage review), test-driven-development, requesting-code-review ("Critical issues block progress"), finishing-a-development-branch. GitHub API: 300,447 stars, last push 2026-10-10, MIT, not archived. Verified 2026-10-16. |
| CodeRabbit | https://www.coderabbit.ai/ | Summarising fetch: AI review of every PR, learns from usage, Quiet, Chill and Assertive profiles, Triage (scores, ranks and routes PRs), Change Stack for large diffs, Security scans and a Slack agent; GitHub and GitLab logos; no pricing shown; customer figures on the page are vendor-reported and were not checked. Verified 2026-10-16. |
| phuryn/pm-skills | https://github.com/phuryn/pm-skills | README: "69 PM skills and 42 chained workflows across 9 plugins". GitHub API: 27,112 stars, last push 2026-10-16, MIT, not archived. Verified 2026-10-16. |
| anthropics/knowledge-work-plugins | https://github.com/anthropics/knowledge-work-plugins | README: 11 plugins (productivity, sales, customer-support, product-management, marketing, legal, finance, data, enterprise-search, bio-research, cowork-plugin-management); each bundles skills, connectors, slash commands and sub-agents. GitHub API: 29,853 stars, last push 2026-10-16, Apache-2.0, not archived. Verified 2026-10-16. |
| deanpeters/Product-Manager-Skills | https://github.com/deanpeters/Product-Manager-Skills | README: 77 skills and 6 command workflows, v0.84 dated August 10, 2026, CC BY-NC-SA 4.0 (the API reports no SPDX id). GitHub API: 7,426 stars, last push 2026-10-16, no SPDX license id from the API, not archived. Verified 2026-10-16. |
| garrytan/gstack | https://github.com/garrytan/gstack | README: sprint skills (office-hours, plan-ceo-review, plan-eng-review, review, qa, cso, ship, land-and-deploy, canary, benchmark, retro, design-review, autoplan), `/careful`, `/freeze`, `/guard`, `./setup --host auto`, a per-host support table and a model policy with a read-only `gstack-models` command. The repository description says 23 tools. GitHub API: 136,652 stars, last push 2026-10-16, MIT, not archived. Verified 2026-10-16. |
| bmad-code-org/BMAD-METHOD | https://github.com/bmad-code-org/BMAD-METHOD | README: structured workflows and multiple-agent discussions; product, architecture, UX, development and testing perspectives; modules include a Test Architect and a Creative Intelligence Suite (the API reports no SPDX id). GitHub API: 54,219 stars, last push 2026-10-16, no SPDX license id from the API, not archived. Verified 2026-10-16. |
| FoundationAgents/MetaGPT | https://github.com/FoundationAgents/MetaGPT | README: one-line requirement to user stories, competitive analysis, requirements, data structures, APIs and documents; product managers, architects, project managers and engineers; `Code = SOP(Team)`; names the MGX product. GitHub API: 70,882 stars, last push 2026-01-21, MIT, not archived. Verified 2026-10-16. |
| Claude Code agent teams | https://code.claude.com/docs/en/agent-teams | Docs page (summarising fetch): experimental and disabled by default (`CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1`); a lead plus teammates; shared task list with dependencies and file-lock claiming; mailbox; `TeammateIdle`, `TaskCreated` and `TaskCompleted` hooks (exit code 2); limitations: no resume of in-process teammates, task status can lag, one team per session, no nested teams, same-file edits overwrite. Verified 2026-10-16. |
| ruvnet/ruflo | https://github.com/ruvnet/ruflo | README: "An agent meta-harness for Claude Code and Codex"; plugins ruflo-core, ruflo-console (the "agent cockpit") and ruflo-mods (routing and policy enforcement). The API redirected the earlier name `ruvnet/claude-flow` here. GitHub API: 75,468 stars, last push 2026-10-16, MIT, not archived. Verified 2026-10-16. |
| OrchestratorInc/agent-orchestrator | https://github.com/OrchestratorInc/agent-orchestrator | README: local desktop workspace; a worker session per task with its own branch and worktree; project-aware orchestrator; live Kanban of workers, PRs, CI and review; checks for updates automatically; the repository description says any harness. The API redirected `ComposioHQ/agent-orchestrator` here. GitHub API: 13,238 stars, last push 2026-10-16, Apache-2.0, not archived. Verified 2026-10-16. |
| JuliusBrussee/caveman | https://github.com/JuliusBrussee/caveman | README: `/caveman` and `/ultracave` voice; ten questions on one model: "Answer concisely" 4,334 output tokens, `/caveman` 4,119, `/ultracave` 2,693; a JetBrains paired test (86 tasks, p = 0.82, 8.5% fewer output tokens) cited as outside evidence; Blocks (397 to 76 tokens for one test run), Browse (129.8x smaller page), Waste fixes; `caveman status`, `caveman off browse`; 30+ agents. All figures are vendor-reported. GitHub API: 113,001 stars, last push 2026-10-15, Apache-2.0, not archived. Verified 2026-10-16. |
| DietrichGebert/ponytail | https://github.com/DietrichGebert/ponytail | README: the ladder, lite, full and ultra levels, `/ponytail-review`, `/ponytail-audit`, a status band above the prompt, install through `/plugin marketplace add`; benchmark of 39 tasks on Opus 5.5 with 5 runs each (vendor-reported). GitHub API: 164,961 stars, last push 2026-10-16, MIT, not archived. Verified 2026-10-16. |
| multica-ai/andrej-karpathy-skills | https://github.com/multica-ai/andrej-karpathy-skills | README: one CLAUDE.md with four principles (Think Before Coding, Simplicity First, Surgical Changes, Goal-Driven Execution). The API redirected `forrestchang/andrej-karpathy-skills` here. GitHub API: 220,271 stars, last push 2026-04-20, no SPDX license id from the API, not archived. Verified 2026-10-16. |
| Claude Code Concise output style | https://code.claude.com/docs/en/output-styles.md | Docs page (curl, matched lines): four built-in styles besides Default; Concise is "Responses lead with the result and leave out preamble, narration, and recaps". Verified 2026-10-16. |
| rtk-ai/rtk | https://github.com/rtk-ai/rtk | README: "filters and compresses command outputs before they reach your LLM context. Single Rust binary, 100+ supported commands, <10ms overhead"; `rtk init --agent <agent>` installs hooks; `rtk gain` shows a savings dashboard; two editions (Apache-2.0 plus BUSL-1.1 with the compression engine, Apache-2.0 only without it). The 60 to 90% figure is from the repository description (vendor-reported). GitHub API: 83,601 stars, last push 2026-10-16, Apache-2.0, not archived. Verified 2026-10-16. |
| microsoft/LLMLingua | https://github.com/microsoft/LLMLingua | README: "LLMLingua Series | Effectively Deliver Information to LLMs via Prompt Compression"; LongLLMLingua; LLMLingua-2 "boasting a 3x-6x speed improvement over LLMLingua"; integrations with Prompt flow, LangChain and LlamaIndex. GitHub API: 6,756 stars, last push 2026-09-10, MIT, not archived. Verified 2026-10-16. |
| Claude Code cost management | https://code.claude.com/docs/en/costs | Docs page (summarising fetch): `/usage` shows session cost, a prompt-cache line and a plan breakdown attributed to skills, subagents, plugins and MCP servers; `/insights`; workspace spend limits; OpenTelemetry export; `--max-budget-usd`; token-reduction levers (clear between tasks, compaction instructions, model choice, deferred MCP tools, hooks that pre-filter output, effort level). Verified 2026-10-16. |
| openai/codex-plugin-cc | https://github.com/openai/codex-plugin-cc | README: `/codex:review`, `/codex:adversarial-review` ("a steerable challenge review"), `/codex:rescue`, `/codex:transfer`, `/codex:status`, `/codex:result`, `/codex:cancel`. GitHub API: 34,283 stars, last push 2026-07-08, Apache-2.0, not archived. Verified 2026-10-16. |
| karpathy/llm-council | https://github.com/karpathy/llm-council | README: three stages (first opinions, anonymized review, a chairman writes the final answer); OpenRouter key; "I'm not going to support it in any way". The API reports no SPDX license. GitHub API: 25,502 stars, last push 2025-11-22, no SPDX license id from the API, not archived. Verified 2026-10-16. Re-fetched 2026-10-28: reviewers rank anonymized peers; README is silent on how rankings are aggregated. |
| amgadelgamal/claude-council | https://github.com/amgadelgamal/claude-council | README: council of Claude subagents with personas (Architect, Skeptic, Pragmatist, Researcher), anonymized peer review and a chairman; zero API keys; caveat that all members are Claude. GitHub API: 25 stars, last push 2026-06-12, MIT, not archived. Verified 2026-10-16. |
| togethercomputer/MoA | https://github.com/togethercomputer/MoA | README: layered Mixture-of-Agents with proposer layers and an aggregator (`moa.py`, Together API). The repository description reports 65.1% on AlpacaEval with open-source models (vendor-reported). GitHub API: 2,983 stars, last push 2025-01-07, Apache-2.0, not archived. Verified 2026-10-16. |
| promptfoo/promptfoo | https://github.com/promptfoo/promptfoo | README: "a CLI and library for evaluating and red-teaming LLM-based apps"; `promptfoo eval`; red-teaming docs linked. GitHub API: 26,054 stars, last push 2026-10-16, MIT, not archived. Verified 2026-10-16. |
| guardrails-ai/guardrails | https://github.com/guardrails-ai/guardrails | README: Input and Output Guards that detect, quantify and mitigate specific risks; structured data from LLMs; the July 6, 2026 entry says validators move to PyPI packages and hosted remote inferencing is discontinued. GitHub API: 7,527 stars, last push 2026-10-15, Apache-2.0, not archived. Verified 2026-10-16. |
| blader/humanizer | https://github.com/blader/humanizer | README: 26 detection patterns; "Humanizer edits for human readers. Getting past AI detectors is not a goal"; a blind test of 16 of 16 is vendor-reported. GitHub API: 57,485 stars, last push 2026-09-28, MIT, not archived. Verified 2026-10-16. |
| conorbronsdon/avoid-ai-writing | https://github.com/conorbronsdon/avoid-ai-writing | README: "Audit & rewrite content to remove AI writing patterns"; detect-only and edit-in-place modes; voice profiles; a bundled detector that scores text 0 to 100; npm package `avoid-ai-writing-detector`; a detector CI workflow. GitHub API: 5,045 stars, last push 2026-10-15, MIT, not archived. Verified 2026-10-16. |
| GitHub merge queue | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue | Docs page (summarising fetch): queued PRs build in a temporary `merge_group` branch with the latest base plus the PRs ahead; a failing PR is removed and the rest rebuilt; settings for merge method, build concurrency, only-merge-non-failing, status check timeout, group size and wait time. Verified 2026-10-16. |
| Mergify | https://docs.mergify.com/merge-queue/ | Docs page (summarising fetch): tests each PR against the latest code; speculative parallel checks; batching into single CI runs; priority rules; the page claims a 60-90% CI cost reduction (vendor-reported). Verified 2026-10-16. |
| Graphite | https://graphite.com/docs/graphite-merge-queue | Docs page (summarising fetch; graphite.dev answers 301 to graphite.com): stack-aware merge queue; a stack validated in parallel; a fast-forward merge setting (Graphite only); no CI rerun for a change already validated. Verified 2026-10-16. |
| Claude Code compaction and context tools | https://code.claude.com/docs/en/context-window.md | Docs page (summarising fetch, saved text searched): `/compact` replaces the conversation with a structured summary; startup content is restored or dropped per "What survives compaction". Verified 2026-10-16. |
| thedotmack/claude-mem | https://github.com/thedotmack/claude-mem | README: "Persistent memory compression system built for Claude Code"; "automatically capturing tool usage observations, generating semantic summaries"; a mem-search skill; the npm package installs the SDK only, the plugin hooks come from the marketplace install. GitHub API: 101,183 stars, last push 2026-10-16, Apache-2.0, not archived. Verified 2026-10-16. |
| mem0ai/mem0 | https://github.com/mem0ai/mem0 | Repository description: "The Memory Layer for AI Agents"; the README has a benchmark table with LoCoMo 92.5, 7.0K tokens, p50 latency 0.88 s (vendor-reported). GitHub API: 67,293 stars, last push 2026-10-16, Apache-2.0, not archived. Verified 2026-10-16. |
| vercel-labs/skills | https://github.com/vercel-labs/skills | README: `npx skills add`, `use`, `list`, `find`, `remove`, `update`, `init`; `-a, --agent`; "Supports OpenCode, Claude Code, Codex, Cursor, and 75 more"; a table of per-agent project and global skill directories. The README sections read do not state how a source repository's skills are discovered. GitHub API: 35,206 stars, last push 2026-10-09, MIT, not archived. Verified 2026-10-16. |
| intellectronica/ruler | https://github.com/intellectronica/ruler | README: a single `.ruler/` source of truth distributed to each agent's configuration files; nested rule loading; MCP server propagation; targeting through `ruler.toml`. GitHub API: 2,946 stars, last push 2026-10-14, MIT, not archived. Verified 2026-10-16. |
| ccusage/ccusage | https://github.com/ccusage/ccusage | README points to `apps/ccusage/README.md`: analyses coding-agent CLI token usage and costs from local data; daily, weekly, monthly and session reports for Claude Code, Codex, OpenCode, Amp, Droid, Codebuff, Hermes Agent and pi-agent; https://ccusage.com/ describes it as "Usage analysis tool for coding (agent) CLIs". The API redirected `ryoppippi/ccusage` here. GitHub API: 19,028 stars, last push 2026-10-16, no SPDX license id from the API, not archived. Verified 2026-10-16. |
| Maciek-roboblog/Claude-Code-Usage-Monitor | https://github.com/Maciek-roboblog/Claude-Code-Usage-Monitor | README: "privacy-first Claude Usage-Ops companion for Claude Code" with a Rich live terminal monitor; official statusline `rate_limits` capture with labeled local estimates as fallback; forecasting and pace. GitHub API: 8,745 stars, last push 2026-07-05, MIT, not archived. Verified 2026-10-16. |
| LiteLLM budgets | https://docs.litellm.ai/docs/proxy/users | Docs page (summarising fetch): budgets on virtual keys, teams, members and internal users; "After the key crosses it's `max_budget`, requests fail"; `budget_duration` resets a budget; budgets need a database. Verified 2026-10-16. |
| Claude Code `/simplify` and `/security-review` | https://code.claude.com/docs/en/commands.md | Docs page (curl, matched lines): `/simplify [target]` (cleanup review with four agents, applies fixes), `/security-review`, `/code-review` with `/review` as an alias, `/compact [instructions]`, `/context [all]` ("Shows optimization suggestions"), `/usage` (aliases `/cost`, `/stats`), `/insights`, `/doctor`, `/fewer-permission-prompts`. Verified 2026-10-16. |
| SonarQube | https://www.sonarsource.com/products/sonarqube/ | Product page (summarising fetch): code verification in the IDE and CI/CD; maintainability, reliability and technical debt; vulnerabilities and security hotspots; quality gates; AI Code Assurance and AI CodeFix. Verified 2026-10-16. |
| codeflash-ai/codeflash | https://github.com/codeflash-ai/codeflash | README: "a general purpose optimizer for Python"; LLMs generate optimization ideas, tests check correctness, benchmarks measure performance, then merge-ready PRs; `codeflash --all`. The API reports no SPDX license. GitHub API: 248 stars, last push 2026-10-15, no SPDX license id from the API, not archived. Verified 2026-10-16. |
| pbakaus/impeccable | https://github.com/pbakaus/impeccable | README: "1 skill, 24 commands, live browser iteration, and 59 deterministic detector rules"; the CLI and browser extension run the deterministic rules with no LLM and no API key; commands include `audit`, `critique` and `polish`. GitHub API: 81,864 stars, last push 2026-10-16, Apache-2.0, not archived. Verified 2026-10-16. |
| dequelabs/axe-core | https://github.com/dequelabs/axe-core | README: rules for WCAG 2.0, 2.1 and 2.2 at levels A, AA and AAA plus best practices; "on average 57% of WCAG issues automatically"; "incomplete" results for manual review; "returns zero false positives (bugs notwithstanding)". GitHub API: 7,657 stars, last push 2026-10-15, MPL-2.0, not archived. Verified 2026-10-16. |
| Lighthouse | https://developer.chrome.com/docs/lighthouse/overview | Docs page (summarising fetch): audits for performance, accessibility, SEO and more; run from Chrome DevTools, the command line, a Node module or PageSpeed Insights. Verified 2026-10-16. |
| coreyhaines31/marketingskills | https://github.com/coreyhaines31/marketingskills | README: marketing skills for AI agents covering conversion optimization, copywriting, SEO and analytics; MIT; Verified Partners fund the work through disclosed tool integrations. GitHub API: 55,032 stars, last push 2026-10-15, MIT, not archived. Verified 2026-10-16. |
| kenryu42/cc-safety-net | https://github.com/kenryu42/cc-safety-net | README: "blocks destructive commands and access to secrets such as SSH keys and `.env` files before the tool call runs"; "It is not a sandbox"; a host list including Claude Code, Codex and Cursor. The API redirected `kenryu42/claude-code-safety-net` here. GitHub API: 1,642 stars, last push 2026-10-16, MIT, not archived. Verified 2026-10-16. |
| disler/claude-code-hooks-mastery | https://github.com/disler/claude-code-hooks-mastery | README: 13 hook lifecycle events with payloads; the PreToolUse hook "Blocks dangerous commands (`rm -rf`, `.env` access)". The API reports no SPDX license. GitHub API: 3,943 stars, last push 2026-03-04, no SPDX license id from the API, not archived. Verified 2026-10-16. |
| Claude Code Bash sandbox | https://code.claude.com/docs/en/sandboxing.md | Docs page (curl, matched lines): an OS-enforced boundary around shell commands on macOS, Linux and WSL2; limits files and network domains; "The sandbox covers shell commands only", so file tools, MCP servers and hooks run outside it. Verified 2026-10-16. |
| Claude Code plugin marketplaces | https://code.claude.com/docs/en/plugins/host-marketplace.md | Docs page (curl, matched lines): "Background auto-update is off for your marketplace by default"; a user selects Enable auto-update in `/plugin`, or an administrator sets `autoUpdate: true` on the marketplace's `extraKnownMarketplaces` entry in managed settings. Verified 2026-10-16. |
| Claude Code, Settings reference (supports section 11) | https://code.claude.com/docs/en/settings-reference.md | Docs page (curl, matched lines): `autoCompactWindow` is a number of tokens from `100000` to `1000000`, or `"auto"` in a per-model entry; `/autocompact` saves it. Verified 2026-10-16. |

## Verified by direct fetch (2026-10-16) — SubagentStop transcript fields and transcript format (`handback_cap.py` lane audit)

Pages were fetched with a summarising fetch tool on 2026-10-16; each row records only what the summary quoted from the page. The hooks reference is long: the `SubagentStop` section was read from its second 100000-character slice, the matcher and parallel-execution rules from its first.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Hooks reference (`transcript_path`, `SubagentStop`) | https://code.claude.com/docs/en/hooks | Common input field `transcript_path`: "Path to conversation JSON. The transcript file is written asynchronously and may lag the in-memory conversation, so it may not yet include the current turn's most recent messages when a hook fires. Hooks that need the final assistant text of the current turn should use `last_assistant_message` on Stop and SubagentStop instead of reading the transcript." The `SubagentStop` input example carries `transcript_path`, `agent_id`, `agent_type`, `agent_transcript_path` (example `~/.claude/projects/.../abc123/subagents/agent-def456.jsonl`) and `last_assistant_message`; "The `transcript_path` is the main session's transcript, while `agent_transcript_path` is the subagent's own transcript stored in a nested `subagents/` folder." So a lane audit reads `agent_transcript_path`, never `transcript_path`. The page gives no entry format for the transcript; the only hint is the `.jsonl` extension. Cross-checked 2026-10-16 against the hook-input schema inside the installed Claude Code 2.1.301 binary: on `SubagentStop`, `agent_transcript_path` is a required string and `last_assistant_message` is optional. |
| Claude Code — Hooks reference (matchers, parallel execution) | https://code.claude.com/docs/en/hooks | "All matching hooks run in parallel." A matcher of only letters, digits, `_`, `-`, spaces, `,` and `|` is an exact string or list of exact strings; one that "Contains any other character" is a JavaScript regular expression, tested unanchored with `RegExp.prototype.test`. The `SubagentStop` matcher filters on agent type, "same values as `SubagentStart`". The page does not mention lookaheads; a negative lookahead is standard JavaScript regex syntax. Backs the two-entry handback-cap setup in `host-enforcement.md` (the default entry must exclude the type that gets a raised cap, because a block from either entry wins). |
| Claude Code — Manage sessions | https://code.claude.com/docs/en/sessions.md | "By default, Claude Code stores transcripts as JSONL at `~/.claude/projects/<project>/<session-id>.jsonl`"; "Each line is a JSON object for a message, tool use, or metadata entry. The entry format is internal to Claude Code and changes between versions, so scripts that parse these files directly can break on any release." Hence the audit parses defensively and reports `COULD_NOT_CHECK` for a file it cannot read. The `text` and `tool_use` block shape it reads was observed on local transcripts on 2026-10-16; it is not documented. |
| Claude Code — Persist sessions to external storage | https://code.claude.com/docs/en/agent-sdk/session-storage.md | Subagent transcripts are mirrored under `subpath: "subagents/agent-<id>"` and the subpath "follows the on-disk layout"; "Entries are JSON-safe objects, one per line in the local JSONL." Backs the derived `<session>/subagents/agent-<agent_id>.jsonl` fallback when `agent_transcript_path` is absent. |

## Verified by direct fetch (2026-10-16) — host session commands (`context_nudge.py` host hints and work-kind tiers)

Pages were fetched on 2026-10-16 and read in full: with curl from the URL or source file a row names, except the Claude Code commands page, which a fetch tool returned whole. The commands pages of the other six hosts were also fetched through a summarising fetch tool, which gave the same rows wherever it reached them. `context_nudge.py` lists only commands shown below, and `scripts/test-host-command-hints.sh` pins that per host. "Not shown" means absent from the page read, not that the host lacks the command.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Commands | https://code.claude.com/docs/en/commands.md | Full page text read. `/compact` "Free up context by summarizing the conversation so far"; `/clear` "Start a new conversation with empty context" (aliases `/reset`, `/new`); `/autocompact` "Set the auto-compact window" (needs Claude Code v2.1.221 or later); `/context` "Visualize current context usage"; `/usage` "Show session cost, plan usage limits, and activity stats" (`/cost` and `/stats` are aliases); `/model` "Switch the AI model"; `/effort` "Set the effort level: `low` to `xhigh`, `max`, or `auto`"; `/resume` "Resume a conversation by ID or name, or open the session picker". The `/model` and `/effort` rows refer to a confirmation step and a cache warning. |
| Claude Code — Environment variables | https://code.claude.com/docs/en/env-vars.md | `CLAUDECODE`: "Set to `1` in subprocesses Claude Code spawns (Bash and PowerShell tools, tmux sessions, hook commands, status line commands, stdio MCP server subprocesses). IDE extensions also set this in their integrated terminals." |
| Claude Code — Hooks reference | https://code.claude.com/docs/en/hooks.md | `UserPromptSubmit` input has a `prompt` field; "Plain text stdout: Claude Code adds stdout it treats as plain text to Claude's context" (injected as a system reminder that starts with the hook's name). The cache cost of a model switch is in the earlier "Claude Code — How Claude Code uses prompt caching" row (`code.claude.com/docs/en/prompt-caching`). |
| Codex CLI — Slash commands | https://developers.openai.com/codex/cli/slash-commands | The URL answers 308 to `https://learn.chatgpt.com/docs/developer-commands?surface=cli`; the target's HTML was read in full. "Built-in slash commands" table: `/compact` "Summarize the visible chat to free tokens."; `/clear` "Clear the terminal and start a fresh chat."; `/new` "Start a new chat inside the same CLI session."; `/model` "Choose the active model (and reasoning effort, when available)."; `/resume` "Resume a saved chat from your session list."; `/status` "Display session configuration and token usage."; `/usage` "View account token usage or use a rate-limit reset." `/reasoning` "Choose the reasoning effort for the current chat." appears only under "Extension commands" / "Available slash commands" (the IDE extension composer), so it is not used for the CLI. The built-in table shows no `/context`, `/cost`, `/effort` or `/stats`. |
| Codex CLI — Hooks | https://developers.openai.com/codex/hooks | Redirects to `https://learn.chatgpt.com/docs/hooks`; HTML read in full. Only plugin-bundled hook commands are documented to receive `PLUGIN_ROOT` and `PLUGIN_DATA` ("Codex-specific extension"); no variable is documented for user or project hooks and the page has no `CODEX_*` name, so Perun detects Codex CLI only through `PERUN_HOST`. |
| Gemini CLI — Commands | https://geminicli.com/docs/reference/commands/ | Source `https://raw.githubusercontent.com/google-gemini/gemini-cli/main/docs/reference/commands.md` read in full. `/compress` "Replace the entire chat context with a summary."; `/clear` "Clear the agent conversation context (active conversation history) and start a new session"; `/model` "Manage model configuration." (`/model set <model-name>`); `/stats` "Display detailed statistics for the current Gemini CLI session." (`model` sub-command: token counts and quota); `/resume` "Browse and resume previous conversation sessions" (`/chat` is an alias). No effort or thinking command; no `/compact`, `/usage` or `/context`. |
| Gemini CLI — Hooks and shell tool | https://raw.githubusercontent.com/google-gemini/gemini-cli/main/docs/hooks/index.md | Hook environment: `GEMINI_PROJECT_DIR`, `GEMINI_PLANS_DIR`, `GEMINI_SESSION_ID`, `GEMINI_CWD`, and `CLAUDE_PROJECT_DIR` "(Alias) Provided for compatibility". `docs/tools/shell.md` (same repository path): the shell tool sets `GEMINI_CLI=1` in the subprocess. `docs/hooks/reference.md`: "Silence is Mandatory: Your script **must not** print any plain text to `stdout` other than the final JSON." |
| GitHub Copilot CLI — Command reference | https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-command-reference | Published page is 451867 characters; the summarising tool read the first 100000 (`/clear`, `/new`, `/reset`, `/compact`). Source `https://raw.githubusercontent.com/github/docs/main/content/copilot/reference/copilot-cli-reference/cli-command-reference.md` read in full: `/clear [PROMPT]` "Start a new conversation." (`/new`, `/reset`); `/compact` "Summarize the conversation history to reduce context window usage."; `/context` "Show the context window token usage and visualization."; `/model` (`/models`) "changes the model, reasoning effort, or context window for the current session only"; `/resume` (`/continue`) "Switch to a different session by choosing from a list"; `/usage` "Display session usage metrics and statistics, including per-model token totals." `--effort=LEVEL` is a launch flag; no `/effort` slash command. The documented environment variables are configuration inputs (`COPILOT_HOME`, `COPILOT_MODEL`, and so on); none identifies the host to a hook, so Perun detects Copilot CLI only through `PERUN_HOST`. |
| GitHub Copilot CLI — Hooks reference | https://raw.githubusercontent.com/github/docs/main/content/copilot/reference/hooks-reference.md | Source file in the github/docs repository, read in full: "Command and HTTP config-file `userPromptSubmitted` hooks have their output dropped, including `modifiedPrompt`." |
| Cursor — CLI slash commands | https://cursor.com/docs/cli/reference/slash-commands.md | Full page text read (documents the Cursor CLI; no IDE slash-command page was read). `/model` "Select a model."; `/clear` "Start a new chat session." (aliases `/new`, `/new-chat`, `/newchat`); `/resume` "Open recent chats and resume one"; `/summarize` "Summarize the conversation to reduce context." (`/compress` alias). `/max-mode` "Toggle Max Mode on legacy request-based plans" is not an effort control. No usage, cost or context command is shown. |
| Cursor — Hooks | https://cursor.com/docs/hooks.md | Hook scripts always receive `CURSOR_PROJECT_DIR` and `CURSOR_VERSION` (also `CLAUDE_PROJECT_DIR`, "Alias for project dir (Claude compatibility)"). `beforeSubmitPrompt` output is `continue` and `user_message` ("<message shown to user when blocked>"). |
| OpenCode — TUI | https://opencode.ai/docs/tui/ | Source `https://raw.githubusercontent.com/anomalyco/opencode/dev/packages/web/src/content/docs/tui.mdx` read in full. `/compact` "Compact the current session." (`/summarize`); `/new` "Start a new session." (`/clear`); `/models` "List available models."; `/sessions` "List and switch between sessions." (`/resume`, `/continue`). `/thinking` only toggles display; "To toggle actual reasoning capabilities, use `ctrl+t` to cycle through model variants." No slash command shows usage or cost. |
| OpenCode — CLI and Models | https://opencode.ai/docs/cli/ | Source `docs/cli.mdx` (same repository path as the TUI row): `opencode stats` "Show token usage and cost statistics for your OpenCode sessions."; the documented `OPENCODE_*` variables are configuration inputs (for example `OPENCODE_CLIENT` "Client identifier (defaults to `cli`)"), none a marker that a hook can rely on, so Perun detects OpenCode only through `PERUN_HOST`. `docs/models.mdx`: "Use the keybind `variant_cycle` to quickly switch between variants." with reasoning-effort variants. |
| Qwen Code — Commands | https://qwenlm.github.io/qwen-code-docs/en/users/features/commands/ | Source `https://raw.githubusercontent.com/QwenLM/qwen-code/main/docs/users/features/commands.md` read in full. `/compress` "Replace chat history with summary to save Tokens" (`/summarize`); `/clear` "Clear conversation history and free up context" (`/reset`, `/new`); `/context` "Show context window usage breakdown"; `/model` "Switch model used in current session"; `/effort` "Set reasoning effort for thinking-capable models"; `/stats` "Open the interactive usage statistics dashboard" (alias `/usage`; `/stats model` "Show per-model token breakdown and estimated cost"); `/resume` "Resume a previous conversation session" (`/continue`). |
| Qwen Code — Hooks | https://raw.githubusercontent.com/QwenLM/qwen-code/main/docs/users/features/hooks.md | "`QWEN_PROJECT_DIR`, `CLAUDE_PROJECT_DIR` and `GEMINI_PROJECT_DIR` are set to the project directory in the environment of every command hook." Perun uses only `QWEN_PROJECT_DIR` as the marker, because the other two are shared with other hosts. |

## Verified by direct fetch (2026-10-16) — Claude Code hooks: main session vs subagent, per-turn id, PreToolUse and UserPromptSubmit output (`ceo_altitude_guard.py`)

Sourced for `agentic-delivery/scripts/ceo_altitude_guard.py`. The page is about 270000 characters; it was fetched on 2026-10-16 with a summarising fetch tool in 100000-character slices, and the last slice was searched only for `agent_id` and `agent_type` (no match). Each row records only what the summary quoted from the page.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Hooks reference, common input fields (`agent_id`, `agent_type`) | https://code.claude.com/docs/en/hooks.md | "`agent_id` and `agent_type` tell your script which agent a hook fired in, such as a subagent, an in-process teammate, or the agent you chose with `--agent`". `agent_id`: "Unique identifier for the subagent or in-process teammate the hook fires in." `agent_type`: "Present when the session uses `--agent` or the hook fires inside a subagent." Hooks in settings files "also run inside subagents. When a subagent calls a tool, tool events such as `PreToolUse` and `PostToolUse` fire the same configured hooks as in the main conversation, and the input carries the `agent_id` and `agent_type` common input fields that identify the subagent." So `agent_id` marks a subagent or teammate, and `agent_type` alone cannot tell a subagent from a main session started with `--agent`. This fetch did not return a sentence saying outright that the main session omits `agent_id`; the 2026-09-24 row above quotes one ("Present only when the hook fires inside a subagent call. Use this to distinguish subagent hook calls from main-thread calls") that this fetch did not return. The guard therefore treats "no `agent_id`" as the main session and, if that is wrong, goes silent instead of blocking a lane. |
| Claude Code — Hooks reference, common input fields (`prompt_id`) | https://code.claude.com/docs/en/hooks.md | `prompt_id`: "UUID identifying the user prompt currently being processed. Matches the `prompt.id` attribute on OpenTelemetry events ... Absent until the first user input". The page does not say how often it changes beyond that; the guard uses it as the per-turn key and also resets the turn at `UserPromptSubmit`. |
| Claude Code — Hooks reference, PreToolUse decision control | https://code.claude.com/docs/en/hooks.md | `PreToolUse` input adds `tool_name`, `tool_input`, `tool_use_id`. `hookSpecificOutput.permissionDecision` takes `allow`, `deny`, `ask` or `defer`; `"deny"` "prevents the tool call" and `permissionDecisionReason` is "shown to Claude" for `deny`. `additionalContext` is a "String added to Claude's context alongside the tool result". Precedence across hooks: "`deny` > `defer` > `ask` > `allow`". Exit 0 with no output "means the hook has no decision to report"; exit 2 blocks (stderr is the reason) even when JSON is printed; a timed-out `PreToolUse` command hook "doesn't block the tool call". |
| Claude Code — Hooks reference, UserPromptSubmit | https://code.claude.com/docs/en/hooks.md | `UserPromptSubmit` hooks receive the `prompt` field "containing the submitted text"; the event also "fires on turns Claude Code starts on its own". On exit 0, plain-text stdout and `additionalContext` are added to Claude's context (so a hook that must stay silent prints nothing); exit 2 blocks the prompt. |
| Claude Code — Hooks reference, SubagentStart / SubagentStop | https://code.claude.com/docs/en/hooks.md | `SubagentStart` and `SubagentStop` hooks receive `agent_id` and `agent_type`; `SubagentStop` also receives `agent_transcript_path` and `last_assistant_message`. "Not every SubagentStop event comes from a subagent Claude spawned": for Claude Code's own internal agents `agent_type` is the agent name the session runs as, "and an empty string when the session runs without one". |

## Verified by direct fetch (2026-10-16) — GitHub Actions prices, free minutes, skip rules and filter patterns (`ci_cost_advisor.py`, policy key `ci`)

Sourced for the rates, plan allowances and runner-label table in `scripts/ci_cost_advisor.py`, its path-filter
evaluation and its `[skip ci]` advice. Every row below was fetched on 2026-10-16 as the page's Markdown source
(docs.github.com article API); the numbers in `RATES` and `PLANS` equal the tables quoted here
(`scripts/test_ci_cost_advisor.py` pins that).

| Standard / source | URL | What was confirmed |
|---|---|---|
| GitHub Docs — Actions runner pricing | https://docs.github.com/en/billing/reference/actions-runner-pricing | Verbatim: "GitHub rounds the minutes and partial minutes each job uses up to the nearest whole minute." Per-minute rates (USD): Linux 1-core (x64) `actions_linux_slim` $0.002; Linux 2-core (x64) `actions_linux` $0.006; Linux 2-core (arm64) `actions_linux_arm` $0.005; Windows 2-core (x64 and arm64) $0.010; macOS 3-core or 4-core (M1 or Intel) `actions_macos` $0.062. Larger runners have their own rates (for example Linux 4-core $0.012, macOS 12-core $0.077). Verbatim: "Included minutes cannot be used for larger runners." and "The larger runners are not free for public repositories." |
| GitHub Docs — GitHub Actions billing | https://docs.github.com/en/billing/concepts/product-billing/github-actions | Verbatim: "GitHub Actions usage is free for self-hosted runners and for public repositories that use standard GitHub-hosted runners." Private repositories get a monthly quota of standard-runner minutes by plan: GitHub Free 2,000; GitHub Pro 3,000; GitHub Free for organizations 2,000; GitHub Team 3,000; GitHub Enterprise Cloud 50,000; "Your free minutes reset to the full amount at the start of each billing cycle", and minutes are "charged to the repository owner", so the allowance is shared by every private repository on the account. With no payment method on file, usage is blocked once the quota is used. Worked example: GitHub Team, 5,000 minutes beyond the quota (3,000 Linux, 2,000 Windows) = $38 ($18 + $20). The page does not say how Windows or macOS minutes draw down the quota, so `ci_cost_advisor.py` values included minutes at the Linux 2-core rate and calls its "billed" figure a lower bound. |
| GitHub Docs — Billing and usage (Actions) | https://docs.github.com/en/actions/concepts/billing-and-usage | Same free-usage statement for public repositories and self-hosted runners. "If you reuse a workflow, billing is always associated with the caller workflow", so a job that only calls a reusable workflow is not priced from the caller's file. |
| GitHub Docs — GitHub-hosted runners reference | https://docs.github.com/en/actions/reference/runners/github-hosted-runners | The standard-runner label table for private repositories: `ubuntu-slim` (1 CPU, a container on a shared VM, also available in public repositories); `ubuntu-latest`, `ubuntu-24.04`, `ubuntu-22.04`, `ubuntu-26.04`; `windows-latest`, `windows-2025`, `windows-2022`; `ubuntu-24.04-arm`, `ubuntu-22.04-arm`, `ubuntu-26.04-arm`; `windows-11-arm`, `windows-11-vs2026-arm`; `macos-15-intel`, `macos-26-intel`; `macos-latest`, `macos-14`, `macos-15`, `macos-26`, `xcode-27` (public preview). "These runners use your GitHub account's allotment of free minutes, and are then charged at the per minute rates." Any other label (a larger runner, a runner group, a custom name) is left unpriced by the advisor. |
| GitHub Docs — Skipping workflow runs | https://docs.github.com/en/actions/how-tos/manage-workflow-runs/skip-workflow-runs | Workflows triggered by `push` or `pull_request` are not triggered when the commit message of a push, or the HEAD commit of a pull request, contains `[skip ci]`, `[ci skip]`, `[no ci]`, `[skip actions]` or `[actions skip]` (or a `skip-checks: true` trailer); the instructions apply to those two events only. A workflow skipped this way, or by path or branch filtering, leaves its checks in a "Pending" state, and "A pull request that requires those checks to be successful will be blocked from merging." |
| GitHub Docs — Troubleshooting required status checks | https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks | Table "Handling skipped but required checks": a workflow skipped by path filtering, branch filtering or a commit message leaves its checks "Pending" and "block[s] merging" (fix: "Avoid requiring workflows that can be skipped"); a job skipped by a conditional "reports 'Success'". Successful check statuses are `success`, `skipped` and `neutral`. Basis for never proposing a path filter or `[skip ci]` for a required workflow. |
| GitHub Docs — Workflow syntax for GitHub Actions | https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax | `paths`/`paths-ignore`: "When all the path names match patterns in `paths-ignore`, the workflow will not run. If any path names do not match patterns in `paths-ignore`, even if some path names match the patterns, the workflow will run."; in `paths` a matching `!` pattern after a positive match excludes the path and a later positive match includes it again; "Path patterns must match the whole path, and start from the repository's root"; with no changed files the workflow does not run; path filters are not evaluated for tag pushes. Filter pattern cheat sheet: `*` zero or more characters but not `/`; `**` zero or more of any character; `?` zero or one of the preceding character; `+` one or more of the preceding character; `[]` a character class; `!` at the start negates. `cancel-in-progress` may be an expression (`${{ !contains(github.ref, 'release/')}}` is the page's example). `jobs.<job_id>.timeout-minutes` default: 360. |

**By name only (observed, not stated in the fetched docs):** an unauthenticated `HEAD https://github.com/<owner>/<repo>`
answers 200 for a public repository (observed for this repository) and 404 for one that does not exist (observed);
`ci_cost_advisor.py` reads 404 as "private or missing" and treats it as private, the billable case, but a private
repository was not probed this session. The measured job times used to illustrate the advisor on this repository
(the `gates` job about 14 minutes, the release job 7 to 16 seconds) were read from the public Actions run lists at
github.com/protocol/perun/actions on 2026-10-16.

## Verified by direct fetch (2026-10-16) — review-lens taxonomy and the lens references (`safety-critical.md`, `energy-efficiency.md`, `delivery-speed.md`, `code-structure.md`, `product-impact.md`, `compatibility-portability.md`)

Pages were fetched with a summarising fetch tool on 2026-10-16; each row records only what the summary quoted or listed. ISO's own page for ISO/IEC 25010 returned HTTP 403, so the ISO/IEC 25010 rows rest on a standards-store listing (scope text) and on iso25000.com, a secondary site that documents the model. Neither is the normative text, and a quote is cut where the fetch cut it. The by-name entry for ISO/IEC 25010 above is superseded by the first rows below.

### Quality taxonomies

| Standard / source | URL | What was confirmed |
|---|---|---|
| ISO/IEC 25010:2023, scope (genorma listing) | https://genorma.com/en/standards/iso-iec-25010-2023/amp | "Systems and software engineering — Systems and software Quality Requirements and Evaluation (SQuaRE) — Product quality model", dated "Nov 15, 2023", replaces ISO/IEC 25010:2011 (withdrawn). "The product quality model is composed of nine characteristics (which are further subdivided into subcharacteristics)". The ISO page https://www.iso.org/standard/78176.html returned HTTP 403. |
| ISO/IEC 25010 model, first page (iso25000.com) | https://iso25000.com/index.php/en/iso-25000-standards/iso-25010 | Functional suitability (completeness, correctness, appropriateness); Performance efficiency (time behaviour, resource utilization, capacity); Compatibility (co-existence, interoperability); Interaction capability (appropriateness recognizability, learnability, operability, user error protection, user engagement, inclusivity, user assistance, self-descriptiveness); Reliability (faultlessness, availability, fault tolerance, recoverability). The page states no edition year; the names match the 2023 edition. |
| ISO/IEC 25010 model, later pages (iso25000.com) | https://iso25000.com/index.php/en/iso-25000-standards/iso-25010?start=5 and `?start=9` | Security (confidentiality, integrity, non-repudiation, accountability, authenticity, resistance); Maintainability (modularity, reusability, analysability, modifiability, testability); Flexibility (adaptability, scalability, installability, replaceability); Safety (operational constraint, risk identification, fail safe, hazard warning, safe integration). Safety definitions, cut at the fetch limit: constrains operation "to within safe parameters or states"; identifies "a course of events or operations that can expose life, property or environment"; places itself in "a safe operating mode, or" reverts "to a safe condition"; "provides warnings of unacceptable risks to operations or internal controls"; "maintain safety during and after integration with one or more components". |
| ISO/IEC 25010, 2011 edition (Wikipedia, tertiary) | https://en.wikipedia.org/wiki/ISO/IEC_25010 | Describes the 2011 edition only: eight characteristics (functional suitability, performance efficiency, compatibility, usability, reliability, security, maintainability, portability), no Safety. It does not cover the 2023 edition. |
| OWASP ASVS 5.0.0 chapters | https://github.com/OWASP/ASVS/tree/v5.0.0/5.0/en (repository: https://github.com/OWASP/ASVS) | Latest stable 5.0.0, May 2025. Chapter file names: V1 Encoding and Sanitization; V2 Validation and Business Logic; V3 Web Frontend Security; V4 API and Web Service; V5 File Handling; V6 Authentication; V7 Session Management; V8 Authorization; V9 Self-contained Tokens; V10 OAuth and OIDC; V11 Cryptography; V12 Secure Communication; V13 Configuration; V14 Data Protection; V15 Secure Coding and Architecture; V16 Security Logging and Error Handling; V17 WebRTC. The repository page lists no chapters or levels. |
| OWASP Top 10 for LLM Applications, landing page | https://genai.owasp.org/llm-top-10/ | On 2026-10-16 the page still headlines the 2025 edition: LLM01 Prompt Injection; LLM02 Sensitive Information Disclosure; LLM03 Supply Chain; LLM04 Data and Model Poisoning; LLM05 Improper Output Handling; LLM06 Excessive Agency; LLM07 System Prompt Leakage; LLM08 Vector and Embedding Weaknesses; LLM09 Misinformation; LLM10 Unbounded Consumption. The 2026 edition verified from its PDF on 2026-09-08 (above) is the one `domain-c.md` walks. |
| WCAG 2.2 | https://www.w3.org/TR/WCAG22/ | W3C Recommendation dated 12 December 2024; four principles (perceivable, operable, understandable, robust); 13 guidelines; levels A, AA, AAA. New in 2.2: 2.4.11 Focus Not Obscured (Minimum) AA; 2.4.12 Focus Not Obscured (Enhanced) AAA; 2.4.13 Focus Appearance AAA; 2.5.7 Dragging Movements AA; 2.5.8 Target Size (Minimum) AA; 3.2.6 Consistent Help A; 3.3.7 Redundant Entry A; 3.3.8 Accessible Authentication (Minimum) AA; 3.3.9 Accessible Authentication (Enhanced) AAA. Only the first 100,000 of 269,706 characters were read. |
| Google Engineering Practices — What to look for in a code review | https://google.github.io/eng-practices/review/reviewer/looking-for.html | Lenses: Design, Functionality, Complexity, Tests, Naming, Comments, Style, Consistency, Documentation, Every Line, Context, Good Things. Areas needing a qualified reviewer: "privacy, security, concurrency, accessibility, internationalization, etc." Optional preferences carry a "Nit:" prefix. |
| Google Engineering Practices — Speed of code reviews | https://google.github.io/eng-practices/review/reviewer/speed.html | "One business day is the maximum time it should take to respond to a code review request"; "The velocity of the team as a whole is decreased"; for a large change the typical response is to ask for several smaller ones. |
| Google Engineering Practices — Small CLs (re-fetched) | https://google.github.io/eng-practices/review/developer/small-cls.html | "100 lines is usually a reasonable size for a CL, and 1000 lines is usually too large"; 200 lines in one file may be fine, spread across 50 files usually too large; no hard rules. |
| DORA — metrics | https://dora.dev/guides/dora-metrics/ | Throughput: change lead time, deployment frequency, failed deployment recovery time. Instability: change fail rate, deployment rework rate. No numeric benchmarks on the page. |
| Core Web Vitals (web.dev), re-fetched | https://web.dev/articles/vitals | LCP within 2.5 seconds, INP of 200 milliseconds or less, CLS of 0.1 or less, at the 75th percentile of page loads. |

### Review-tool lens lists

| Tool | URL | What was confirmed |
|---|---|---|
| CodeRabbit | https://docs.coderabbit.ai/guides/code-review-overview | Comment categories: Security & Privacy; Stability & Availability; Data Integrity & Integration; Functional Correctness; Performance & Scalability; Maintainability & Code Quality. Severities: Critical, Major, Minor, Trivial, Info. Integrates "50+ open-source linters and security scanners" (none named). The landing page https://docs.coderabbit.ai/ lists no categories. |
| Greptile | https://www.greptile.com/docs/code-review/greptile-json-reference | `commentTypes`: logic, syntax, style (default all three; the page gives no definitions and has no security or performance type); `strictness` 1, 2 or 3, default 2 (meanings not on the page). The introduction page lists no review categories. |
| Qodo | https://docs.qodo.ai/code-review | Agents evaluate "correctness, standards compliance, architecture, and risk". Named finding categories: Requirement gaps ("Catch PRs that miss their linked spec"), UX deviations (drift from a linked Figma design), Cross-repository conflicts (breaking changes in related repositories), Skill-related findings; a review effort mode. The older address https://qodo-merge-docs.qodo.ai/tools/review/ redirects here. |
| Sourcery | https://docs.sourcery.ai/reviews/anatomy-of-a-review/ | Each comment starts with a kind label (examples `issue (bug_risk):` and `nitpick (performance):`); security comments carry a 🚨 marker; blocking security findings fail the status check. No complete category list or severity scale on the page. |
| SonarQube Server | https://docs.sonarsource.com/sonarqube-server/2025.4/user-guide/rules/overview and https://docs.sonarsource.com/sonarqube-server/latest/core-concepts/clean-code/software-qualities/ | Software qualities Security, Reliability, Maintainability (MQR mode categorises rules by them); Standard Experience rule types code smell, bug, vulnerability, security hotspot; coding attributes consistency, intentionality, adaptability, responsibility; impact severities Blocker, High, Medium, Low, Info. The definition page (https://docs.sonarsource.com/sonarqube-server/latest/core-concepts/clean-code/definition/) names sub-attributes including Efficient ("uses resources without needless waste"), Lawful ("respects licensing and copyright regulation"), Trustworthy ("abstains from revealing or hard-coding private information") and Respectful ("refrains from using discriminatory and offensive language"); the fetch summary mislabelled one definition, so no other sub-attribute text is relied on. |
| GitHub Copilot code review | https://docs.github.com/en/copilot/how-tos/use-copilot-agents/request-a-code-review/use-code-review and https://docs.github.com/en/copilot/concepts/agents/code-review | Comments carry a severity of High, Medium or Low. Effort levels: Lite ("targeted feedback on glaring issues such as bugs, security vulnerabilities, and style inconsistencies") and Balanced (deeper analysis of complex logic, security-sensitive code and cross-service changes). Steered by `.github/copilot-instructions.md`, path-specific `.github/instructions/*.instructions.md` and `AGENTS.md`. Leaves a "Comment" review by default, not an approval. No complete category list. |
| Anthropic code-review plugin | https://github.com/anthropics/claude-code/blob/main/plugins/code-review/README.md | Four parallel agents (two CLAUDE.md compliance, one bug scan limited to the changes, one git blame and history); each issue scored 0 to 100, default threshold 80. Filtered as false positives: pre-existing issues, code that looks like a bug but is not, pedantic nitpicks, issues linters will catch, general quality issues unless in CLAUDE.md, issues with lint-ignore comments. |

### Sources behind the six lens references

| Standard / source | URL | What was confirmed |
|---|---|---|
| Wikipedia, Fail-safe (tertiary) | https://en.wikipedia.org/wiki/Fail-safe | "Fail-safe means that a device will not endanger lives or property when it fails"; fail-secure, "also called fail-closed", means "access or data will not fall into the wrong hands in a security failure"; example: in a fire, fail-safe systems unlock doors for escape, fail-secure keeps them locked. |
| Green Software Foundation — SCI standards page | https://greensoftware.foundation/standards/sci/ | "SCI = (E × I + M) per R"; cites ISO/IEC 21031:2024 and an ISO accreditation date of April 2024 on its timeline; latest numbered version v1.1, October 2024; "actively developing". |
| Green Software Foundation — SCI specification | https://sci.greensoftware.foundation/ | Version 1.1.0; SCI = C per R, expanded to (O + M) per R with O = E × I and M = TE × TS × RS; E energy in kWh, I region-specific carbon intensity in gCO2eq/kWh, M embodied emissions, R functional unit. The specification page itself does not mention ISO. |
| AWS Well-Architected — Sustainability Pillar | https://docs.aws.amazon.com/wellarchitected/latest/sustainability-pillar/sustainability-pillar.html | Publication date November 6, 2024; the Framework has six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, sustainability. |
| Android — wake locks | https://developer.android.com/develop/background-work/background-tasks/awake/wakelock | "Creating and holding wake locks can have a dramatic impact on the device's battery life. You shouldn't use wake locks if there are any suitable alternatives"; if needed, "hold it for as short a time as possible". |
| MDN — requestAnimationFrame | https://developer.mozilla.org/en-US/docs/Web/API/Window/requestAnimationFrame | "`requestAnimationFrame()` calls are paused in most browsers when running in background tabs or hidden `<iframe>`s, in order to improve performance and battery life." |
| GitHub Actions — dependency caching | https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching | `restore-keys` searched in sequential order; runs cannot restore caches created for child or sibling branches but can restore from the current and default branch (and, for a pull request, the base branch); entries not accessed for over 7 days are removed; default limit 10 GB per repository (values as stated on 2026-10-16); the `setup-*` actions create and restore dependency caches for npm, Yarn, pnpm, pip, pipenv, Poetry, Gradle, Maven, RubyGems, Go and NuGet. |
| Docker — build cache | https://docs.docker.com/build/cache/ | "If a layer changes, all other layers that come after it are also affected." |
| Docker — optimize build cache | https://docs.docker.com/build/cache/optimize/ | "try to make expensive steps appear near the beginning of the Dockerfile"; "Steps that change often should appear near the end"; copy the package management files first and install in earlier layers; cache mounts; `.dockerignore`. |
| madge | https://github.com/pahen/madge | `madge --circular path/src/app.js` finds circular dependencies; JavaScript (AMD, CommonJS, ES6); `--orphans`. TypeScript is not listed as supported in the README text read. |
| dependency-cruiser | https://github.com/sverweij/dependency-cruiser | Validates dependencies "against (your own) rules"; detects circular dependencies and orphans; JavaScript, TypeScript, CoffeeScript (ES6, CommonJS, AMD); sample rules use a `forbidden` array. |
| Import Linter | https://github.com/seddonym/import-linter | "Import Linter allows you to impose constraints on the imports between your Python modules."; tagline "Lint your Python architecture." The contract types page returned 404; no contract type is cited. |
| ArchUnit | https://www.archunit.org/ | Checks "dependencies between packages and classes, layers and slices, check for cyclic dependencies and more" of Java code with a plain unit test framework. |
| webpack — tree shaking | https://webpack.js.org/guides/tree-shaking/ | Dead-code elimination that relies on the static structure of ES2015 modules; the `sideEffects` `package.json` property marks files safe to prune; "A side effect is defined as code that performs a special behavior when imported, other than exposing one or more exports"; pitfalls include re-exports with side effects and CSS imported only for effect. The page does not use the word "barrel". |
| Python — `-X importtime` | https://docs.python.org/3/using/cmdline.html | Shows module name, cumulative time and self time for each import; added in 3.7. |
| React — Strict Mode | https://react.dev/reference/react/StrictMode | Runs "one extra setup+cleanup cycle in development for every Effect"; calls component functions and some updaters twice in development; the checks are development-only and do not affect the production build. |
| MDN — Navigator.sendBeacon() | https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon | Intended for analytics and diagnostics; `unload` and `beforeunload` are unreliable ("especially on mobile, the browser will not fire these events"); send on `visibilitychange` when the page becomes hidden; queued data limited to 64 KiB (65,536 bytes). |
| npm — package.json `engines` | https://docs.npmjs.com/cli/v10/configuring-npm/package-json#engines | Specifies supported Node and npm versions; "advisory only" unless the user has set `engine-strict`; "will only produce warnings" when installed as a dependency; unspecified means any version. |
| Git — gitattributes | https://git-scm.com/docs/gitattributes | `text` normalises line endings to LF in the index on add; `text=auto` lets Git decide; `eol=lf` and `eol=crlf` set the working-tree ending and only take effect with `text` or `text=auto` (and specifying `eol` sets `text`). |
| Web Platform Baseline | https://web.dev/baseline | "Widely available": 30 months after the "newly interoperable" date; core browsers Chrome (desktop and Android), Edge, Firefox (desktop and Android), Safari (macOS and iOS). |
| Browserslist | https://github.com/browserslist/browserslist | A shared config of target browsers and Node versions for tools such as Autoprefixer and Babel, set in `.browserslistrc` or the `browserslist` key of `package.json`; `defaults` is `> 0.5%, last 2 versions, Firefox ESR, not dead` and is used when no config produces a valid result. |

Not read, so not relied on: the Go specification's import-cycle sentence (the fetch truncated before it); the Greptile getting-started page (returned empty); the IEC functional-safety page (HTTP 403). Named only, no fetch: IEC 61508 (the basic functional-safety standard for electrical, electronic and programmable electronic safety-related systems) and ISO 26262 (road vehicles), which `safety-critical.md` names to route a certification question; no clause, level or date from either is cited.

## Verified by direct fetch (2026-10-16) — Claude Code hooks (PreToolUse matcher, MCP tool names, decision control; `agentic-delivery/scripts/comms_guard.py`)

Fetched with a summarising fetch tool on 2026-10-16. The page is 270831 characters long; the slices 0-100000 and 100000-200000 were read and 200000-270831 were not. Each row records only what the summary quoted from the page.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Hooks reference (matcher patterns) | https://code.claude.com/docs/en/hooks | `"*"`, `""` or an omitted matcher matches all. A value made only of letters, digits, `_`, `-`, spaces, `,` and `\|` is an exact string, or a list of exact strings separated by `\|` or `,`. Any other character makes it a JavaScript regular expression, unanchored: "`^Notebook` matches any tool whose name starts with `Notebook`"; "`Edit.*` matches both `Edit` and `NotebookEdit`; wrap the pattern in `^` and `$`, as in `^Edit$`". |
| Claude Code — Hooks reference (match MCP tools) | https://code.claude.com/docs/en/hooks | "MCP tools follow the naming pattern `mcp__<server>__<tool>`"; "`mcp__memory__.*` matches all tools from the `memory` server"; a bare `mcp__memory` "is compared as an exact string and matches no tool"; plugin servers are `mcp__plugin_<plugin-name>_<server-name>__<tool>`. How claude.ai connector servers are named was not in the slices read, so the operating-layer matcher accepts any server segment that contains `Linear` or `linear`. |
| Claude Code — Hooks reference (PreToolUse input) | https://code.claude.com/docs/en/hooks | Common input fields `session_id`, `transcript_path`, `cwd`, `permission_mode`, `hook_event_name`; PreToolUse adds `tool_name`, `tool_input`, `tool_use_id`. The Bash `tool_input` has `command`, `description`, `timeout`, `run_in_background`. An MCP tool's input also carries `mcp_server`, an object with the server's `name` and a `source`. |
| Claude Code — Hooks reference (PreToolUse decision control, exit codes) | https://code.claude.com/docs/en/hooks | `hookSpecificOutput` "requires a `hookEventName` field"; `permissionDecision` is `allow`, `deny`, `ask` or `defer`; `permissionDecisionReason` is shown to Claude for `deny` and to the user for `ask`; precedence across hooks is `deny` > `defer` > `ask` > `allow`. "Exit 0 means success, and is the intended exit code when you print JSON for structured control." "Exit with code 2 to block the action": on PreToolUse Claude sees the stderr message as the denial reason. Other exit codes are non-blocking errors ("The action goes ahead"); "A timed-out `command`, `http`, or `mcp_tool` hook doesn't block the tool call." |
| Claude Code — Hooks reference (`if` field, timeout) | https://code.claude.com/docs/en/hooks | The `if` field is a permission rule such as `"Bash(git *)"`, evaluated only on tool events, "exactly one permission rule"; the default `command` hook timeout is 600 seconds. The operating layer does not use `if`: `comms_guard.py` filters the command itself and registers with `\|\| true`. |

## Verified by direct fetch (2026-10-16) — memory, handoff and docs hygiene (`focus_kit.py`, `references/focus-kit.md`)

Both pages were fetched on 2026-10-16 and each row quotes sentences read from the fetched page text. The context-window sentences come from the text of that page's interactive simulation.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — How Claude remembers your project (size and auto-memory limits) | https://code.claude.com/docs/en/memory | CLAUDE.md: "target under 200 lines per CLAUDE.md file"; imports "don't reduce its context cost, because imported files also load at launch" and recurse "with a maximum depth of four hops". Auto memory sits at `~/.claude/projects/<project>/memory/` ("derived from the git repository, so all worktrees and subdirectories within the same repo share one auto memory directory") as a `MEMORY.md` index plus one topic file per memory. "The first 200 lines of `MEMORY.md`, or the first 25KB, whichever comes first, are loaded at the start of every conversation"; the page's comparison table says "Every session (first 200 lines or 25KB)". Topic files are not loaded at startup: Claude reads them on demand. After a write Claude Code reminds Claude to "keep one line per entry, move detail into topic files, and merge or drop stale entries". |
| Claude Code — How Claude remembers your project (what survives `/compact`) | https://code.claude.com/docs/en/memory | "Project-root CLAUDE.md survives compaction: after `/compact`, Claude re-reads it from disk and re-injects it into the session." An instruction that "was given only in conversation" does not persist; the page says to add conversation-only instructions to CLAUDE.md. |
| Claude Code — Explore the context window | https://code.claude.com/docs/en/context-window | "Compaction replaces the conversation with a structured summary. System prompt, CLAUDE.md, memory, and MCP tools reload automatically. Claude Code also re-reads up to five of the files modified most recently and re-injects the skills you invoked. The skill listing does not reload." "After `/compact`, Claude Code re-injects the body of each skill you invoked, capped at 5,000 tokens per skill." |

## Verified by direct fetch (2026-10-16) — sandbox preflight and autonomy advisor (`agentic-delivery/scripts/sandbox_preflight.py`, `lane_guard.py`, `terse_reply_check.py`)

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Configure the sandboxed Bash tool | https://code.claude.com/docs/en/sandboxing | `sandbox.excludedCommands` entries use `Bash(...)` rule syntax (no wildcard is an exact match; `docker *` matches with or without arguments), match the text of the call (a script that calls `docker` internally does not match, `npx` and absolute paths do not), and a call stays sandboxed when it has a `cd`, a redirect or `$(...)`; an excluded command goes through the regular permission flow; `/sandbox` opens the panel (Mode, Overrides, Config); `sandbox.filesystem.allowWrite` for paths outside the working directory; `sandbox.network.allowedDomains` starts empty; troubleshooting: `jest` needs `--no-watchman`, Go CLIs such as `gh` can fail TLS verification on macOS (exclude `gh *`), `docker` is incompatible, git over SSH fails on macOS (HTTPS remote, or exclude `git fetch *`, `git pull *`, `git push *`), database clients and other non-HTTP tools ignore the proxy (exclude the script, optionally with an ask rule), `allowLocalBinding` is macOS only (on Linux and WSL2 a command's localhost is private), protected paths such as `.claude/skills` stay write-denied. `/sandbox exclude <pattern>` is NOT on this page; it appears only in Claude Code's own sandbox error text, so it is unverified against the docs. |
| Claude Code — Settings reference | https://code.claude.com/docs/en/settings-reference | `sandbox.network.allowUnixSockets` (macOS only; array of socket paths; default blocks every Unix socket), `allowAllUnixSockets`, `allowLocalBinding` (macOS only), `allowMachLookup` (macOS XPC/Mach services; "such as the iOS Simulator or Playwright"; service names not listed), `sandbox.filesystem.allowWrite`, sandbox path prefixes (`~/`, `/`, `./`). |
| Claude Code — Configure permissions | https://code.claude.com/docs/en/permissions | `permissions.allow`/`ask`/`deny`; evaluated deny, then ask, then allow, first match wins; Bash `*` matches any text including spaces and a trailing ` *` also matches the bare command; every subcommand of a compound command must match; `npx` and similar runners are not stripped; built-in read-only commands run without a prompt; `/permissions` lists and edits rules; `WebFetch(domain:...)` rules; `.claude/settings.local.json` is the user's own untracked file, `~/.claude/settings.json` applies to every project, project `permissions.allow` needs the trust dialog. |
| Claude Code — Commands | https://code.claude.com/docs/en/commands | `/sandbox` is listed as "Toggle sandbox mode"; no `exclude` subcommand is documented. |
| Claude Code — Worktrees | https://code.claude.com/docs/en/worktrees | A `.worktreeinclude` file (`.gitignore` syntax) copies gitignored files that match into every worktree Claude Code creates with git, subagent worktrees included; a manual `git worktree add` or another host gets none, which `lane_guard.py`'s banlist copy covers. |
| Claude Code — Hooks reference | https://code.claude.com/docs/en/hooks | Plain-text stdout of a `UserPromptSubmit` or `SessionStart` hook is added to Claude's context; SessionStart matchers `startup`, `resume`, `clear`, `compact`, `fork`. |
| Codex — Agent approvals and security | https://learn.chatgpt.com/docs/agent-approvals-security | `approval_policy = "on-request"` (commands the sandbox allows run without approval) and `sandbox_mode = "workspace-write"` in `~/.codex/config.toml`; network is off by default and enabled with `[sandbox_workspace_write]` `network_access = true`; `[features.network_proxy]` takes a `domains` table (syntax not shown); command allow rules live on a separate Rules page whose syntax is not on this page. |

## Verified by direct fetch (2026-10-19) — usage-cost levers (`agentic-ceo/scripts/token_report.py --advise`, `agentic-delivery/scripts/cost_statusline.py`)

Every page was fetched on 2026-10-19; a lever the pages did not show is not recommended. Fetched and unused, so not cited: the hooks reference (no cost lever found in it). Dollar figures reuse the dated rate rows above; a model with no rate row is `UNPRICED`.

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Manage costs effectively | https://code.claude.com/docs/en/costs | `/usage` shows the session cost and, after the first response, a `Prompt cache (main)` line (request count, share of input tokens served from cache, misses, whether the cache is warm; needs v2.1.251 or later). Keep CLAUDE.md under 200 lines. Extended thinking tokens are billed as output tokens. Source for the `token_report.py --advise` levers `/clear`, `/compact`, `/context`, `/mcp` and MCP-server pruning. |
| Claude Code — Commands | https://code.claude.com/docs/en/commands | Built-in commands used as levers: `/usage` (also `/cost`, `/stats`), `/context`, `/compact`, `/clear`, `/autocompact`, `/model`, `/effort`, `/statusline`, `/mcp`, `/memory`. `/autocompact` is named only because this page lists it. |
| Claude Code — Settings reference | https://code.claude.com/docs/en/settings-reference | Keys read by `--advise` as already-set checks: `autoCompactWindow` (valid range 100K to 1M; `/autocompact` and `--autocompact` set it per model or per launch; `CLAUDE_CODE_AUTO_COMPACT_WINDOW` wins over the others), `bashOutputMaxChars`, `statusLine`. `modelPricing` is a managed-settings key. No settings key for tool search is documented, so none is read. MCP keys (index rows, scope "Any file"): `disabledMcpjsonServers` "Reject specific servers from a project's `.mcp.json`"; `enabledMcpjsonServers` "Approve specific servers from a project's `.mcp.json`"; `enableAllProjectMcpServers` "Approve every server in project `.mcp.json` files without a prompt". Verified 2026-10-19. |
| Claude Code — Settings files and precedence | https://code.claude.com/docs/en/settings | User (`~/.claude/settings.json`), project (`.claude/settings.json`) and local (`.claude/settings.local.json`) scopes; `statusLine` is accepted in user or project settings. `--advise --project` reads these three plus `$CLAUDE_CONFIG_DIR`. Project local `.claude/settings.local.json` is a settings scope ("You, in this one project only") that Claude Code applies over the committed `.claude/settings.json`, so a `statusLine` written there is read like one in project settings. Verified 2026-10-19. "Lists merge instead of overriding": a list key set in more than one file is combined, not replaced (model-list keys excepted); `--advise` merges list keys the same way. Verified 2026-10-19. |
| Claude Code — Environment variables | https://code.claude.com/docs/en/env-vars | Env levers read as already-set checks: `CLAUDE_AUTOCOMPACT_PCT_OVERRIDE`, `CLAUDE_CODE_AUTO_COMPACT_WINDOW`, `BASH_MAX_OUTPUT_LENGTH`, `CLAUDE_CODE_SUBAGENT_MODEL`, `ENABLE_TOOL_SEARCH`, `MAX_MCP_OUTPUT_TOKENS`; `ANTHROPIC_MODEL` "Name of the model setting to use" (verified 2026-10-19). |
| Claude Code — Model configuration | https://code.claude.com/docs/en/model-config | `/model`, `/effort` and the `effortLevel` and `model` settings are the model and effort levers; `CLAUDE_CODE_SUBAGENT_MODEL` sets the model for subagents. |
| Claude Code — Customize your status line | https://code.claude.com/docs/en/statusline | `statusLine` is `{"type": "command", "command": ...}` (optional `padding`, `refreshInterval`) in user or project settings; the command gets a JSON session object on stdin with `cost.total_cost_usd` (client-side list-price estimate, may differ from the bill), `context_window.used_percentage` and `prompt_cache.hit_ratio` / `last_miss_cause`. Output shows only after exit code 0; a non-zero exit or empty output blanks the line. Runs under the same workspace-trust rule as settings hooks. The page does not say which environment variables or working directory the command gets, so the command resolves `cost_statusline.py` from `CLAUDE_PROJECT_DIR`, else the git top level of its working directory, else that directory, and prints nothing if the script is not there. |
| Claude Code — Connect Claude Code to tools via MCP | https://code.claude.com/docs/en/mcp | Project-scope servers live in `.mcp.json` under a top-level `mcpServers` key. Tool search defers MCP tool definitions by default; `ENABLE_TOOL_SEARCH=false` loads them upfront. Claude Code warns when one MCP tool output passes 10,000 tokens; `MAX_MCP_OUTPUT_TOKENS` defaults to 25,000. |
| Claude Code — Memory | https://code.claude.com/docs/en/memory | CLAUDE.md size guidance (under 200 lines) and `/memory`; the same guidance is on the costs page. |
| Claude Code — How Claude Code uses prompt caching | https://code.claude.com/docs/en/prompt-caching | Each model has its own cache, so a `/model` switch re-reads the context uncached; compaction also rewrites the cached prefix. Basis for the `cache-switch` and `ctx-drops` advice rules. |

**By name only, not verified:** that tsx's IPC pipe is the cause of `listen EPERM` under the macOS sandbox comes from field reports, not from a docs page; the docs confirm only that the macOS sandbox blocks every Unix socket by default. The Playwright `allowMachLookup` service names are not documented.

## Token-lever peer READMEs (fetched 2026-10-20)

Public pages read to fill the peer cells in [`docs/bench/token-levers/README.md`](bench/token-levers/README.md). Each row records what the page says, not an independent check of its numbers.

| Tool | URL | What was confirmed |
|---|---|---|
| caveman | https://github.com/JuliusBrussee/caveman | `caveman stats`, `/caveman-stats`, `caveman learn` ("Ranks where your tokens go"; "Not yet" measured), Warm cache ("Not yet" measured); "33.2% fewer input tokens, whole sessions" (885,793 to 591,673, 54 runs); output 6,983 to 2,693 tokens on 10 questions; page notes "Be concise" is the real baseline. Verified 2026-10-20. |
| ponytail | https://github.com/DietrichGebert/ponytail | "-53% code, -41% time, -26% cost, -45% tokens", 39 tasks, Opus 5.5, 5 runs, self-run; per-task band and local board; "The rule was never 'fewest tokens.'" Verified 2026-10-20. |
| RTK | https://github.com/rtk-ai/rtk | "60-90% on common dev commands"; `rtk gain` measures command-output savings and "is not the same as cutting your bill"; tokens are bytes/4; Bash tool calls only. Verified 2026-10-20. |
| context-mode | https://github.com/mksglu/context-mode | "315 KB becomes 5.4 KB. 98% reduction" in KB; `ctx_stats`; statusline "$ saved this session". The last 15,848 of 115,848 characters were not read. Verified 2026-10-20. |
| Headroom | https://github.com/chopratejas/headroom | "20% fewer tokens for coding agents, 60-95% fewer tokens for JSON"; `headroom savings`; CacheAligner flags prefix-busting content; savings scale with payload repetition. Verified 2026-10-20. |
| ccusage | https://github.com/ryoppippi/ccusage | Daily, weekly, monthly, session and 5-hour-block reports in USD; cache creation and read tokens shown separately; `--breakdown` per model. Verified 2026-10-20. |

## Verified by direct fetch (2026-10-21) — usage-optimization levers added to `token_report.py --advise` (`idle-resume`, `cache-bust`, `effort`)

Every page was fetched on 2026-10-21. A lever these pages did not show is not recommended. Fetched and not used as a lever: the `idleCompaction` setting (the settings-reference fetch showed only its index row, so its default and behavior are unconfirmed), and `skillListingMaxDescChars` (documented, but no transcript usage, timestamp or model field measures it, so no rule fires it).

| Standard / source | URL | What was confirmed |
|---|---|---|
| Claude Code — Manage costs effectively | https://code.claude.com/docs/en/costs | "Clear between tasks: Use `/clear` to start fresh when switching to unrelated work"; `/rename` before clearing and `/resume` to return. "Thinking tokens are billed as output tokens"; lower the effort level "with `/effort` or in `/model`". "Cache misses: your first message after a break longer than the cache lifetime misses the cache and reprocesses your full context." `/usage` `Prompt cache (main)` line names the likely cause of the last miss (v2.1.251 and v2.1.260). Basis for `idle-resume` and `effort`. |
| Claude Code — How Claude Code uses prompt caching | https://code.claude.com/docs/en/prompt-caching | "Actions that invalidate the cache": switching models, changing effort level (per-effort cache on most models; the cache is kept on Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1 with an API key or subscription), fast mode, connecting or removing an MCP server (when tool definitions load upfront), enabling or disabling a plugin that provides MCP servers, denying an entire tool, compaction (an expected rebuild, like tool-result clearing), many images, upgrading. "Actions that keep the cache": editing files, editing CLAUDE.md mid-session. Cache TTL is five minutes or one hour (`promptCacheTtl`, `CLAUDE_CODE_PROMPT_CACHE_TTL`). "After a break longer than the cache lifetime ... the summarization request reprocesses the full history as uncached input", so `/compact` costs the most after a long break. Basis for `cache-bust` and `idle-resume`. |
| Claude Code — Model configuration | https://code.claude.com/docs/en/model-config | `/effort` takes a level name, `auto` or `status`; levels `low`, `medium`, `high`, `xhigh`, `max` on supported models ("Models not listed here do not support effort"); the `effortLevel` setting and `CLAUDE_CODE_EFFORT_LEVEL` env var; the saved per-model level lives under `modelSettings`. "You are charged for all thinking tokens generated, even when collapsed or redacted." The `effort` rule stays silent when any of these is set. |
| Claude Code — Commands | https://code.claude.com/docs/en/commands | Table rows: `/clear [name]` ("Start a new conversation with empty context"), `/compact [instructions]`, `/effort [level\|auto\|status\|ultracode [on\|off]]`, `/usage`. |
| Claude Code — Settings reference | https://code.claude.com/docs/en/settings-reference | `effortLevel` ("Before v2.1.251, `/effort` wrote this key"), `modelSettings` (saved effort level per model, v2.1.251 or later), `promptCacheTtl` (v2.1.242 or later). Read by `effort` as already-set checks. |

## Verified by direct fetch (2026-10-22) — idea-critic `findings` classes

| Source | URL | What it grounds |
|---|---|---|
| addyosmani/agent-skills — doubt-driven-development | https://raw.githubusercontent.com/addyosmani/agent-skills/main/skills/doubt-driven-development/SKILL.md | Idea source only (re-implemented, not copied): a fresh-context reviewer gets the artifact and contract, not the claim, and each finding is sorted into one of four classes (contract misread, valid and actionable, valid trade-off, noise). `idea-critic` keeps four classes under its own names (`real`, `misread`, `accepted-cost`, `noise`). Verified 2026-10-22. |

## Verified by direct fetch (2026-10-23) — whole-app security-review mode (`references/security-review-mode.md`)

| Source | URL | What it grounds |
|---|---|---|
| GitHub Actions — Secure use reference | https://docs.github.com/en/actions/reference/security/secure-use | "Pin references to actions to a commit SHA in your workflow files."; the `GITHUB_TOKEN` should be granted the minimum required permissions, with the default set to read-only for repository contents; "Avoid using the `pull_request_target` and `workflow_run` workflow triggers with untrusted pull requests or code content."; set untrusted expression values to an intermediate environment variable; self-hosted runners "should almost never be used for public repositories". Section 3. |
| GitHub Actions — OpenID Connect concepts | https://docs.github.com/en/actions/concepts/security/openid-connect | OIDC trust is established in the cloud provider for specific workflows and roles; the provider checks the token's subject and other claims against configured conditions. Section 3. |
| GitHub Actions — OIDC reference | https://docs.github.com/en/actions/reference/security/oidc | Audience and subject claims are used together to scope cloud role access; subjects can filter by environment, branch or tag; the job must grant `id-token: write`; "you must define at least one condition, so that untrusted repositories can't request access tokens." Section 3. |
| SLSA v1.0 — About | https://slsa.dev/spec/v1.0/about | "SLSA does not address organizations that intentionally produce malicious software"; SLSA "is only one part of a thorough approach to supply chain security." Basis for "valid provenance is not trust". Section 3. |
| SLSA v1.0 — Verifying artifacts | https://slsa.dev/spec/v1.0/verifying-artifacts | Consumers "SHOULD compare the provenance against expected values" (builder identity, canonical source repository); "provenance doesn't do anything unless somebody inspects it." Section 3. |
| npm — config (`ignore-scripts`) | https://docs.npmjs.com/cli/v11/using-npm/config | `ignore-scripts` defaults to `false`; when true "npm does not run scripts specified in package.json files", but explicitly run commands (`npm start`, `npm test`, `npm run`) still run their script without pre- or post-scripts. Section 4. |
| npm — scripts | https://docs.npmjs.com/cli/v11/using-npm/scripts | The install lifecycle (`preinstall`, `install`, `postinstall`, `prepare`) runs scripts of an installed package ("These are run from the scripts of `<pkg-name>`"); `prepare` runs on local `npm install` without arguments. Section 4. |
| MCP — Security Best Practices | https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices | Scope Minimization (minimal initial scopes, incremental elevation, avoid wildcard or omnibus scopes); Token Passthrough ("MUST NOT accept any tokens that were not explicitly issued for the MCP server"); Local MCP Server Compromise (show the exact command, sandbox with minimal privileges, prefer `stdio`). Section 5. |
| MCP — Tools (2025-06-18) | https://modelcontextprotocol.io/specification/2025-06-18/server/tools | Clients "MUST consider tool annotations to be untrusted unless they come from trusted servers"; a human in the loop SHOULD be able to deny tool invocations; clients SHOULD show tool inputs before calling, validate results before passing them to the LLM, and log tool usage for audit; `listChanged` notification. Section 5. |
| OWASP Secrets Management Cheat Sheet | https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html | Section 2.7.2 regular rotation limits the life of a stolen credential; section 9.2 remediation: exposed keys get immediate revocation, a new secret must be quickly created and deployed, responders need who had access and when it was used; section 2.6 audit logs must resist tampering and record who requested a secret. Section 2. |
| endoflife.date — per-product JSON | https://endoflife.date/api/nodejs.json | Fetched 2026-10-23: each release cycle object carries `cycle`, `releaseDate`, `eol`, `latest`, `latestReleaseDate`, `lts`, `support`, `extendedSupport`. Basis for the end-of-life lookup in section 6; no version value is quoted. The API documentation pages were not retrievable, so no other endpoint is claimed. |
| OSV — documentation | https://google.github.io/osv.dev/ | OSV aggregates vulnerability databases in the OpenSSF Vulnerability format and can be queried by version number or commit hash; the page does not describe lockfile scanning, so section 6 claims none and routes version matching to `security-appsec.md`. |
| zizmor — usage | https://docs.zizmor.sh/usage/ | Fetched 2026-10-27: `--format=json` (alias of `json-v1`, flat array, `ident`, 0-based `row`), exit codes 11-14 for findings, `--offline`. Backs the zizmor row in `tool-hub.md`. |
| Bandit — man page | https://bandit.readthedocs.io/en/latest/man/bandit.html | Fetched 2026-10-27: `-f json`, `-q`, `--exit-zero`; the JSON shape is not documented there. |
| gosec — README | https://github.com/securego/gosec/blob/master/README.md | Fetched 2026-10-27: `-fmt=json`, `-out`, `-no-fail`; the JSON shape is not documented there. |
| Grype — CLI and configuration reference | https://oss.anchore.com/docs/reference/grype/cli/ | Fetched 2026-10-27: `-o json`, `sbom:` / `dir:` / `file:` sources, `--fail-on`; configuration reference documents `GRYPE_DB_AUTO_UPDATE`. |
| Checkov — CLI reference | https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html | Fetched 2026-10-27: `-f`, `-o`, `--quiet`, `--skip-download`, `--soft-fail`; the JSON shape is not documented there. |
| hadolint — README | https://github.com/hadolint/hadolint/blob/master/README.md | Fetched 2026-10-27: `-f json`, `--no-fail`; the JSON shape is not documented there. |
| Snyk Agent Scan — README and CLI reference | https://github.com/snyk/agent-scan/blob/main/README.md | Fetched 2026-10-27: `scan`/`inspect`, `--json`; no offline mode documented, scanning can start MCP servers. Basis for marking it unverified. |
| Grype — configuration reference | https://oss.anchore.com/docs/reference/grype/configuration/ | Fetched 2026-10-27: `db.auto-update` with env `GRYPE_DB_AUTO_UPDATE`; no dedicated offline setting listed. |
| Snyk Agent Scan — CLI reference | https://github.com/snyk/agent-scan/blob/main/docs/cli-reference.md | Fetched 2026-10-27: `--json`, `--ci` exit codes 0/1/2; no local-only mode (`inspect` still starts stdio MCP servers and contacts remote ones). |