Research findings: meta-harness landscape & Claude first-party support

[wimaan3]

Durable record of the June 2026 landscape review (two parallel research streams: Claude first-party support + OSS prior art).

⚠️ Verification caveat: gathered by general research agents, not the citation-verifying research path. Treat specific version numbers, star counts, and the more exotic hook names as leads to verify before acting. Re-run shaky claims through the verified-research path when we act on them.

Part 1 — Claude first-party support

• Hooks are Anthropic's official governance mechanism. We already use 4 (UserPromptSubmit, PreToolUse, PostToolUse, Stop) — the sanctioned approach.
• Claude Agent SDK (in-process hooks, canUseTool permission callback, headless/CI-native, multi-provider) is the biggest opportunity vs. shell hooks → spun off (see linked issue).
• SubagentStop + subagents (per-agent tool limits + model routing) = native path for the external rubric critic (External rubric critic (separate-model verifier) #68).
• settings.json permissions = declarative policy-as-code alongside the gate.
• Native gaps Anthropic does not close: deterministic retry-on-failure, structured audit schema, prompt-rewrite enforcement guarantee — our Stop-gate retry loop + receipts already fill several (validation).
• ⚠️ Exotic hook names reported (PostToolBatch, TaskCompleted, ConfigChange, WorktreeCreate, …) are unverified — confirm against live docs.

Part 2 — OSS landscape & our novelty

The "wrap-agent → intercept → fail-closed → audit" pattern is productized, but almost entirely for SECURITY/safety, not SE quality.

• MS Agent Governance Toolkit (MIT): same architecture, explicitly security-only (not build/lint/test/coverage) — closest structural analog.
• Codacy Guardrails: the one tool gating coding agents on quality — but proprietary, IDE/cloud-coupled, language-limited, per-line lint.
• agentgateway / Invariant / NeMo / LlamaFirewall = security; promptfoo / DeepEval / Inspect = LLM-output evals.
• White space (our defensible core): a model/harness-agnostic, open-source meta-harness enforcing holistic SE conformance (build+format+lint+typecheck+coverage/mutation ratchet+security+identity+layout) as a single fail-closed gate with receipts over any agent. Nobody ships this. (NousResearch/hermes-agent #406 independently reaches for the same idea.)

Adopt, don't reinvent (linked into existing issues)

• gitleaks / TruffleHog → secrets (Secrets scanning in the gate and CI #57)
• mutmut / Cosmic Ray + Hypothesis / CrossHair → mutation/property "meaningful signal" (Mutation testing — oracle-strength signal beyond coverage #55)
• LlamaFirewall CodeShield → insecure-code static check in the security gate (Secrets scanning in the gate and CI #57)
• OPA/Rego + agentgateway → externalized policy + substrate-neutral interposition (spun off)

Spawned issues

• Evaluate the Claude Agent SDK as alternative/augment to shell hooks
• Evaluate OPA/Rego + agentgateway for substrate-neutral interposition
• Positioning & differentiation: SE-quality sibling to security meta-harnesses

Relates to: #48 (research sweep), #55, #57, #68.

[wimaan3]

Spawned actionable issues: #71 (Claude Agent SDK), #72 (OPA + agentgateway), #73 (positioning). Plus the requested automation audit: #74.