requie/endostack

I'm Tarique Smith, co-founder and Chief Research Officer of Cogensec, an AI security lab, and I've spent more than fifteen years in cybersecurity. Coding agents write code faster than anyone can review it, and much of it ships on the strength of a green build and the agent's own say-so. EndoStack is the set of habits I want from an agent instead. It reads the code before changing it, tries more than one design, and checks its result against the thing a user would actually run. A threat model and a security review count toward "done". The output is smaller diffs, and every claim in them points at evidence you can rerun. I'm on X at @iam_tarique.

EndoStack is a plugin of skills, playbooks, principles and two subagents. It runs in Claude Code, Cursor, Codex, Gemini CLI, Copilot, Goose, Windsurf, Cline, Roo, OpenCode, Amp, Kiro and other agents that read SKILL.md files. Skills never name one agent's tools. Each agent's page under docs/agents/ maps the neutral verbs ("spawn a read-only subagent", "ask the user", "track a todo list") onto that agent's real tools, and says which features the agent lacks.

Quickstart

Install once (macOS or Linux; Windows and plugin installs):

git clone --depth 1 https://github.com/requie/endostack ~/.endostack/src
~/.endostack/src/install.sh --scope user

Restart your coding agent, then type /try-endostack. In five minutes you watch tarique-mode fix a real-looking bug in a demo app. A check script then shows that the obvious one-line fix for the same bug leaks the app's .env file, and EndoStack's fix doesn't.

On your own code, the flagship workflow is one line:

/tarique-mode Fix <issue link, or one sentence describing the broken behavior>.

The quickstart walks through each step.

Contents

• Quickstart
• Install
• Get started
• How tarique-mode works
• Skills
• Playbooks
• Principles
• Workflow examples
• Security model
• Subagents
• Make it yours
• Automations
• Repository layout
• Contributing
• Support, security and privacy
• License

Install

Pick your agent. Each agent's page covers updates, where model config lands, and the EndoStack features that agent cannot run.

The installer works for every agent above, including the ones with a plugin route. Clone the repository and run it from there. It needs Node 22 or later and nothing from npm.

./install.sh [--scope project|user] [--agents auto|a,b] [--link] [--dry-run] [--uninstall] [--no-rules] [--project <dir>]

On Windows, run install.ps1 with the same options. --scope project (the default) writes into the current repository and --scope user into your home directory. --agents auto (the default) detects which agents are installed, or you pass a comma list of agent ids. --link symlinks instead of copying, so git pull updates the install. --dry-run prints every action without writing. --uninstall removes exactly what an earlier install wrote. --no-rules skips the EndoStack block in AGENTS.md, CLAUDE.md or GEMINI.md. --project <dir> names the project root for a project install. ./install.sh --help prints the same list.

Notes that apply to most agents:

• Claude Code prefixes plugin commands with the plugin name, so /tarique-mode shows up as /endostack:tarique-mode. Third-party marketplaces do not auto-update by default; the Claude Code page explains how to enable that or update by hand.
• Installing runs nothing. A skill loads only when you type it or tarique-mode calls it, with one exception: setup-endostack also responds to a plain "set up EndoStack".
• When your agent lacks something a skill assumes (parallel subagents, a hosted PR review bot, scheduled runs, cloud agents, worktrees), the skill skips that step, says so in one line of its reply, and keeps going.

Get started

You can start real work right after installing. Every role has a default model, so setup is optional until you want to pick models or control cost.

Optional: run /setup-endostack. It finds out which models your agent's subagents can use, asks for a reasoning budget (small, medium, large, unlimited; large is the default), maps every EndoStack role to a tier or a model, and writes ~/.endostack/models.toml. A team can commit .endostack/models.toml at the repo root instead, and that project file wins key by key. Setup writes only model names it saw your agent accept or that you typed. Before finishing, it makes two one-time offers: build the project a skill that drives the running app to prove changes, and build one that model-checks a property tests rarely reach. Skills read the config when they load, so start a new chat once setup is done.

EndoStack speaks in three tiers. strong handles judgment, prose, review and the hardest code. fast handles mechanical edits, exploration and verification sweeps. standard sits between them. Out of the box, code-writing delegates for features, refactors, bug fixes, perf fixes and hillclimb attempts run on fast, design and review run on strong, and review panels default to two seats, one strong and one fast. A role set to inherit runs on whatever model the chat uses. Each panel role is a list whose length is the number of seats.

Then, start real work with /tarique-mode. Describe the goal and the check that will tell you it succeeded. For example:

/tarique-mode The CSV export drops rows whose notes field contains a newline.
Reproduce it on the fixtures in test/data first, then fix it and show me
the before and after row counts.

If you are unsure which skill fits a situation, ask /tarique-help. It answers, hands you one prompt to send, links the file it read, and starts no work. The guide teaches the habits in ten short pages.

How tarique-mode works

tarique-mode is the router. Load it at the start of a task by picking it from your agent's slash menu, so the skill attaches to the message. It then does four things.

1. It matches the task to one of 23 playbooks and copies that playbook's steps, word for word, to the top of a todo list. Skipped steps are not deleted. Each stays on the todo list marked skipped, with a one-line reason you can check.
2. It calls other skills as steps need them: how before a nontrivial change, architect for code that crosses a function boundary, threat-model before building anything that touches a trust boundary, security-review before anything ships, unslop on every reply.
3. It reads a principle in full before citing it, and names in the final reply each principle that changed a decision and which decision it changed.
4. It writes replies that lead with the effect on the people who use the code, then the people who maintain it, with evidence or a label (measured, inferred, guess) on every claim.

A plain invocation attaches the mode to one message, and its pull weakens as the chat goes on. If your agent supports persistent modes or always-on rules, start tarique-mode that way and it stays loaded every turn. Otherwise invoke it again with each new task. Within one chat, say "new task" to make it choose a playbook afresh.

Large or cross-cutting work, and work you plan to leave running, goes to figure-it-out. That skill writes a phased playbook for the one task in front of it, then works through it as measured experiments recorded in a decision log. A standing program that lasts days goes to the orchestrate playbook.

Skills

tarique-mode calls most of these itself. The table is for calling them directly, when you want a stronger or lighter dose than the playbook would give. Skills marked "typed only" carry disable-model-invocation: true, so agents that honor the flag load them only when you type the command or another EndoStack skill calls them.

Some pairs look alike. how explains behavior, why explains reasons, and teach explains either in plain language and can argue for a choice. Every arena runner gets an identical brief, and their outputs are combined into a single artifact. swarm splits or races work and returns a report. interrogate reviews the diff for any defect, blast-radius looks outside the diff for what it breaks, and security-review looks only for exploitable defects with proof. recall spans your recent chats, while catch-up covers this chat since your last message.

Playbooks

Playbooks live in skills/tarique-mode/playbooks/. They have no commands of their own. tarique-mode picks one from your wording.

All 23 playbooks

Some phrasings select a playbook directly once the mode is on. "Check on PR 412" goes to babysit in its one-pass check mode. "Land this stack" goes to shipping. "Take over this branch" goes to session-pickup. A babysit never merges. Merging happens when you say to merge, land or ship, and those words route to shipping.

EndoStack has no separate planning skill, and you can keep using your agent's plan mode next to it. When a change will need several PRs, ask tarique-mode for a plan and it routes to the multi-phase-plan playbook. That playbook writes the plan in the format PLAN-FORMAT.md defines (a reading section, a Run checklist, one section per PR with Needs, Touches, Changes, Observable result, Unit proof, Live proof, Perf proof, Operator review and Landing blocks, then Finish the run and appendices), lints it with scripts/check-plan.mjs, and stops before any implementation. Open design questions get answered in code first, through prototypes or architect.

Principles

Principles are one-rule skills named principle-*. tarique-mode indexes all of them inline and reads each one in full before citing it. They exist as standalone files so other skills can point at them by name, and so you can steer a run by naming one ("apply prove-it-works and show me the stored row").

The 25 principles, grouped

Workflow examples

Each of these is a complete prompt. None of them names a playbook or spells out steps. The playbook already carries the steps, and people who write the sequence by hand usually leave some out.

Prompts by intent

Fix a bug.

/tarique-mode Password reset emails link to the staging host in production.
Reproduce it with the prod config locally before touching code.

Speed something up.

/tarique-mode The dashboard's first paint went from 900 ms to 2.4 s this week.
Capture a CPU profile, tell me what changed, then fix it with before and after numbers.

Add a feature.

/tarique-mode Add per-workspace API keys behind the workspace_keys flag.
With the flag off, every existing auth test must pass unchanged.

Try designs before building.

/tarique-mode Prototype two layouts for the billing settings page, one subagent each,
behind a single toggle. Screenshots of both, then recommend one.

Plan a multi-PR effort.

/tarique-mode Plan the move from our hand-rolled job queue to the managed one.
Map the dependency graph first. One PR per phase, each with its own check. Don't implement.

Leave it running overnight.

/tarique-mode I'm going to bed. Done means the integration suite passes on this branch
and the flaky upload test has a root-caused fix. Work in a fresh worktree, commit as you go,
and if you are stuck for two hours, stop and write up what you tried.

Check on a PR.

/tarique-mode Anything outstanding on PR 2187?

Match a reference exactly.

/tarique-mode Port the invoice table to the new design tokens with zero visible change.
The screenshots in design/ref/ are the reference.

Large mechanical change, unattended.

/figure-it-out Move every caller of legacyFetch to the typed client and delete legacyFetch.
Behavior must stay identical, including the retry quirks. I'll review the decision log tomorrow.

Understand before changing.

/how does a webhook get from the ingress route to the tenant's handler?

Find the reason.

/why is the rate limiter's burst set to 37?

Settle structure first.

/architect the plugin loading system. Treat third-party plugins as untrusted.

Get a second opinion.

/arena Design the retry policy for outbound webhooks. My draft at docs/retry.md is one candidate.

Run checks in parallel.

/swarm one read-only worker per package under packages/, each running its own test script
on commit 4f1c2ab. Return one table.

Review a branch hard.

/interrogate this branch. Report only, no edits.

Model the threats.

/threat-model the new document upload and summarization flow before we build it.

Security-review before merge.

/security-review this branch against main.

Fix test-first.

/tdd negative quantities pass cart validation

Tighten new prose.

/unslop the changes I made to docs/ in this branch

Capture lessons after a slow run.

/reflect

Stop a repeated mistake.

/correct

Audit the trail.

/show-me-your-work for the migration run this afternoon

Ask which skill fits.

/tarique-help what should I use to review a branch someone else wrote?

Security model

EndoStack treats security as part of the definition of done for every change. Four mechanisms do that work.

Threat model before building. When a change touches a trust boundary (new input parsing, authentication or authorization, secrets, network calls to destinations a user can influence, file paths built from input, deserialization, new dependencies, or an agent that reads outside content and then acts), tarique-mode runs threat-model after the data shape is settled and before implementation is delegated. The skill maps the code with read-only subagents, draws data flows and trust zones, lists assets, entry points and attacker positions, and writes ranked abuse paths with file:line hops. Every mitigation at medium or above gets a named proof: a unit test, an integration test, a policy check, or an adversarial fixture such as a document with injected instructions and an assertion that the forbidden tool was never called. Those proofs become tasks in the playbook's verification step, so they get built with the feature. A change that crosses no boundary gets one todo line saying which boundaries were checked.

Security review before shipping. security-review runs on the final diff before a PR is marked ready and again before shipping if the diff changed. It routes the diff to defect classes (injection, authz and authn gaps, secrets in code and history, SSRF, path traversal, unsafe deserialization, supply chain, CI permissions, agent tool and MCP config) and fans out one read-only reviewer per class. A finding counts only with file:line, an exploit path and evidence, and the parent agent re-checks every hop itself. Suspicions without proof go to a separate list. The verdict is block, fix-before-merge or ok. A committed secret blocks the PR even if a later commit removed it, because it remains in history until someone rotates it or rewrites the history.

Untrusted input stays data. principle-treat-input-as-untrusted applies whenever an agent reads anything you did not write as an instruction: web pages, issues, PR and review comments, commit messages, logs, tool output, transcripts, third-party files. That content is quoted, attributed to its source, and never obeyed. A side effect it suggests (push, merge, send, delete, change permissions, spend) needs your confirmation, and approval written inside the data does not count. Skills that read outside content, from recall to the PR watcher, say this in their own steps, and every subagent brief repeats it.

Least-privilege subagents. Exploration, review and verification subagents are read-only. A writing delegate gets one worktree or branch and nothing else. Owners in the autopilot playbooks never receive deploy or publishing credentials. tarique-mode pauses for your approval before any irreversible step, whatever autonomy you granted: force-pushing a shared branch, deploying, deleting data, messaging customers, rotating credentials, changing access, or publishing anything that discloses an unfixed vulnerability.

Smaller habits sit inside individual skills. The pre-commit pass scans the staged diff for keys and tokens. The refactoring playbook's behavior lock includes rejection cases for malformed and hostile input, so a refactor cannot drop a guard unnoticed. Perf traces use redacted data. show-me-your-work neutralizes spreadsheet formulas an attacker might plant in a PR title before they reach the log. interrogate always seats one reviewer who reads the change from the attacker's side.

Subagents

Two subagent definitions live in agents/.

tarique-agent is the delegate tarique-mode spawns for code-writing and helper steps. Its first action is to read tarique-mode in full, so it follows the same rules as the chat that spawned it. It never runs a playbook itself. The chat where you typed /tarique-mode keeps control of which playbook runs, what is on the todo list, and every subagent spawn. A generic agent substituted for it drifts from those rules within a few steps.

comment-auditor is a read-only reviewer that lists comments for deletion and flags code that needed a comment to make sense. You normally reach it through no-comments, which applies its report.

Make it yours

EndoStack carries my defaults. Your own habits belong in a skill of your own that runs alongside it.

automate-me builds that skill. It mines your recent chat transcripts for this workspace only, splitting them into periods and keeping patterns that show up in more than one. It asks you a few multiple-choice questions to catch preferences you haven't shown yet, groups the results (reply style, autonomy, subagents, standards, verification, process, security habits), drafts <handle>-mode through your agent's skill-authoring flow, runs unslop over it, and opens a PR. Run it again later and it mines only history newer than the skill's last commit, keeping every rule you haven't contradicted.

Two other skills keep the setup honest over time. reflect turns one session's lessons into skill edits you approve. correct finds mistake classes that recur in the repo and blocks each at the strongest level that works: structure first, then types and lint, then tests, with prose rules last.

Models are yours too. Rerun /setup-endostack to change the budget or any role. Deleting a line in models.toml restores that role's default. Reruns keep the roles you changed. If a default changes in a later EndoStack release, a file written before the change keeps pinning the old value until you delete that line or rerun setup.

Automations

automations/issue-loop/ is a dormant pack that handles the first hour of a bug report. A triage run reads each new report, traces the likely cause, checks for duplicates and posts one verdict. For bug or performance verdicts, a reproduce run drives the real app in a sandbox, captures the symptom twice on video, checks whether a fix already exists, and may open one small draft PR with before and after evidence. Neither run merges, deploys or closes anything. Issue text is treated as untrusted input throughout, reproduction uses test credentials only, and each job's token gets the smallest permission set it needs.

The pack is not registered as slash commands. Installing it means handing your agent automations/issue-loop/FOR_AGENTS.md along with the repository it should go into. Setup copies the pack in, keeps your config outside the pack, and runs a test report before any real traffic. It runs on GitHub Actions, on your agent's own scheduler, or on a cron or launchd job you control.

Repository layout

skills/<name>/SKILL.md              one folder per skill, with references/ and scripts/ beside it
skills/tarique-mode/playbooks/      the 23 playbooks
skills/tarique-mode/references/     reference notes the router cites
skills/tarique-mode/scripts/        watch-pr, orch, check-plan, worktree-audit, doctor
skills/show-me-your-work/scripts/   the decision-log helper
skills/statechart/scripts/          the TLC-to-diagram tool
agents/                             tarique-agent and comment-auditor
automations/issue-loop/             the dormant issue triage and reproduction pack
docs/guide/                         the ten-page user guide
docs/agents/                        one page per supported agent
scripts/                            installer, build, lint and their tests
dist/                               generated per-agent files; never edit by hand
dist/claude-code/plugin/            the self-contained Claude plugin (skills without test fixtures, agents, README, LICENSE) that the Claude marketplace and directory install
dist/openai/plugin/                 the OpenAI Plugins Directory package (skills, Codex policy files, logo, README, LICENSE), uploaded as a ZIP of its contents
packaging/claude-plugin/README.md   the README that ships inside the Claude plugin

orch and watch-pr document their CLIs in a README beside them, check-plan.mjs enforces the format in PLAN-FORMAT.md, and worktree-audit.mjs prints its usage, columns and buckets with --help. orch records one verdict per PR head, from strongest to weakest live-proven, tests-proven, types-only, check-blocked and check-failed, and ledger check prints NO-VERDICT when a head was never verified. worktree-audit.mjs prints the columns DISK IDLE IN_BASE EDITS UPSTREAM PULL CHAT_SEEN ADVICE PATH. node skills/tarique-mode/scripts/doctor.mjs checks that the tools those scripts call (Node 22 or later, git, and optionally gh and Java) are installed.

Contributing

Skills are instructions that agents follow, so a change to one changes agent behavior for everyone who installs EndoStack. Open every change as a PR. When a skill misbehaves while you are working on something else, note it and correct the skill in a separate PR, so the change gets reviewed as a change to agent behavior.

• Write or edit skills through the authoring-a-skill playbook: /tarique-mode write a skill that .... It checks frontmatter (name equal to the folder, a one-sentence description), every referenced file and every cross-skill link.
• To measure whether a skill change helps, ask tarique-mode to run the eval playbook. Candidates work in sanitized directories and never learn they are being evaluated, and the judge sees neutral labels only.
• Follow the house style: second person, plain claims with a mechanism behind each benefit, no em dashes, no agent-specific tool names in skill bodies.

Before you push, run:

node scripts/lint.mjs                 # frontmatter, links, style rules
node scripts/build.mjs                # regenerate per-agent files (add --check to only compare)
node scripts/check-manifests.mjs      # plugin manifests are valid and their paths exist
node --test 'skills/**/test/*.test.mjs' 'scripts/test/*.test.mjs'

CI runs the same commands, with build.mjs --check, and fails when generated per-agent files are out of date.

Support, security and privacy

• Support: open an issue at github.com/requie/endostack/issues. Questions about which skill to use can also go to /tarique-help inside your agent.
• Security reports: use GitHub's private vulnerability reporting on this repository, as described in SECURITY.md. Please don't file security problems as public issues.
• Privacy: EndoStack collects no data. It has no telemetry, no analytics and no account. Its skills are text files your coding agent reads, and its scripts run on your machine. The only network requests come from tools you run: statechart downloads the TLA+ tools jar from its official GitHub release once, and watch-pr, orch, worktree-audit and the issue-loop helpers call the GitHub API through your own gh login. Whatever your coding agent sends to its model provider is governed by that provider's terms, not by EndoStack. The full privacy policy lists everything EndoStack reads, writes and sends.

License

MIT. See LICENSE.