The security check that never ran — shipping agentic-framework v4.1

This week, the framework known as agentic-framework v4.1.0 experienced a security check that did not run correctly. The private-key scanner had been displaying "No private keys detected" on every single run, even though it was healthy and green in the CI system. This failure went unnoticed until the review chain began to investigate further.

Agentic-framework is a Claude Code plugin that transforms Claude into an orchestrated team, consisting of 21 specialist subagents, 10 slash commands, 9 skills, and 5 hooks. One such hook, the peer-review Stop gate, ensures that a session does not end prematurely if committed work has not been reviewed.

The current version, v4.1.1, addressed three issues and revealed one that had been broken throughout the entire time. The first issue involved configuration that had drifted slowly over time. This was fixed by canonicalizing effort, adding necessary entries to the MCP plugin manifest, and ensuring that specific tools were included in allowlists.

Another issue was related to the migration process of a legacy ~/.claude installation onto the plugin pipeline. A script named migrate-legacy had two unnoticed bugs: it could inadvertently delete tracked hook files, leave the checkout dirty, and still exit with a status of 0. These issues were resolved by adding a live dirty-guard, changing the exit code to 2 with the offending paths named, and writing tests to cover various scenarios.

The final issue was a bug in the scanner's private-key check. The grep command, which searches for private keys, was treating leading dashes as an option cluster and exiting with status 2, resulting in the script printing "No private keys detected" on every run, even if the directory contained a planted PEM. The security-specialist discovered this issue and a peer-review-critic reproduced it before approving the fix.

To fix the private-key check, the scanner's line was modified to add -e, which excludes the scanner's own source. The change was verified by running tests on both a planted key directory and a clean directory. PR #41 consisted of five commits.

The security check that never ran, along with the other fixes, went through a rigorous review process involving code-review-gatekeeper, security-specialist, peer-review-critic, and multiple CI jobs, all of which reported success. The current measured state of the framework shows 15 validator checks, 88 assertions in the consistency suite, 103 in the migration suite, and 34 in the plugin-manifests, all of which exit successfully. The framework's code agents wrote and reviewed these changes.