Claude-cod-top-2026

Evidence-aware Goal Operating Layer for Claude Code

Give Claude Code a goal. It builds an explainable plan, composes the right capabilities, executes within a bounded autonomy budget, verifies the result, and remembers what worked.

Other tools make an agent more capable. This one makes more capability safe to hand over — by making every result checkable.
Trust and evidence aren't the product; they're the control system that lets you give the agent more autonomy without more blind faith.

The failure it was built to catch

Agent writes a test.
Runs it on synthetic data it just generated.
Reports F1=1.000 ✅ SUCCESS.
You deploy.
Real-world data crashes everything.

This is Validation Theater, and the Verify stage of the loop exists to stop it.
Every claim carries an evidence marker —
[VERIFIED-REAL] (real data, sources cited) vs [VERIFIED-SYNTHETIC] (mock data, never valid for production claims).
Hard rule baked into rules/integrity.md: synthetic ≠ real.

_{Backed by 95 hooks · 13 agents + 3 teams · 2651 tests · 85% coverage · MIT · Deploy in 5 min}

📋 No install? Get the rules only:
docs/anti-hallucination.md — single file, ~500 tokens, paste into your CLAUDE.md.
Catches Validation Theater on its own. Compatible with any Claude Code config.

What is this?

Claude-cod-top-2026 is an Evidence-aware Goal Operating Layer for Claude Code.

Give Claude Code a goal; it turns it into an explainable plan, composes the right capabilities (skills, agents, tools, memory), executes within a bounded autonomy budget, verifies the result, and remembers what worked. It does not try to replace memory systems, skill catalogs, virtual engineering teams, or AI tool managers — it composes whichever of those you use.

Trust & Evidence — the evidence gates, oracle checks, validation-theater detection, stop conditions, and null-result memory — is the mandatory control system of that product, not the whole of it. It is what makes handing the agent more work safe: more capability, made checkable — not capability withheld.

See docs/positioning.md for the full comparison and where this fits alongside tools like memory layers, skill catalogs, and multi-agent frameworks.

Status, honestly: conceptually strong, clean-install path fixed and re-verified (see install.sh acceptance checks), dogfood evidence still growing (2 real runs so far — see experiments/). Not a claim of "production-ready" yet.

🚀 Start Here (pick your path)

New to this? Don't install everything at once. Pick the path that matches your goal:

Minimal path (recommended to start): installs just 3 files — CLAUDE.md, integrity.md, security.md. No hooks, no agents, no complexity. Add more when you need it.

Quick Start

# One-liner — Mac / Linux / WSL
git clone https://github.com/sergeeey/Claude-cod-top-2026.git && cd Claude-cod-top-2026 && bash install.sh --profile=standard --non-interactive

Windows (PowerShell): git clone https://github.com/sergeeey/Claude-cod-top-2026.git; cd Claude-cod-top-2026; bash install.sh --profile=standard --non-interactive

After install: restart Claude Code (/clear or new session) — hooks activate automatically.

Plugin Install (recommended — Claude Code v2.1.80+)

# Register this repo as a marketplace source (once per machine)
/plugin marketplace add sergeeey/Claude-cod-top-2026

# Install the plugin
/plugin install claude-cod-top-2026

Windows note: Claude Code doesn't pre-register third-party marketplaces on Windows. Add to your ~/.claude/settings.json manually if /plugin marketplace add fails:

"extraKnownMarketplaces": {
  "claude-cod-top-2026": {
    "source": { "source": "github", "repo": "sergeeey/Claude-cod-top-2026" }
  }
}

Classic Install (all platforms)

git clone https://github.com/sergeeey/Claude-cod-top-2026.git
cd Claude-cod-top-2026

bash install.sh                                    # interactive
bash install.sh --link full                        # symlink + auto-update
bash install.sh --profile=full --non-interactive   # CI / headless

Deeper Methodology

Two more layers exist beyond what's on this page — auditing recurring agent loops (evidence classification, synthetic-data detection, human escalation) and an Oracle-Aware Evolutionary Mode for searching a field of solution variants without fooling yourself against an unaudited judge. Both moved to docs/methodology-deep-dive.md so this page stays a 2-minute read — full detail there, including the /evolve-solution command spec.

What This Config Does NOT Do

• Does not replace human code review — it adds a second layer, not a substitute
• Does not guarantee zero hallucinations — reduces frequency and adds detection
• Works only with Claude Code (not Cursor, Codex, VS Code Copilot, Gemini)
• Not independently verified beyond a single-developer workflow
• Does not come with enterprise SLA or paid support
• Does not manage secrets or rotate API keys — use a proper vault

Why This Config?

Claude Code без этого конфига — как Ferrari на ручнике: мощный, но большая часть потенциала не используется. With this config — коммиты проходят автоматические проверки, агенты помнят контекст между сессиями, повторяющиеся ошибки фиксируются и эскалируются в правило.

Most configs are a single CLAUDE.md bloated to 3000+ tokens. This is different:

When to Use This vs everything-claude-code

everything-claude-code is a great alternative — bigger, multi-platform, Anthropic Hackathon Winner. Both are MIT, pick what fits.

Use everything-claude-code if:

• You want multi-language coverage (TS, Go, Java, Kotlin, Rust, C++, PHP — 12+ ecosystems)
• You work across multiple harnesses (Codex, Cursor, OpenCode, Gemini — not just Claude Code)
• You want a GUI dashboard for browsing components
• You like the paid tier path (ECC Tools GitHub App, free / pro / enterprise)

Use this config if:

• "Validation Theater" is a $$$ risk for you, not abstract — Evidence Policy is enforced as hard rule, not just a skill
• You work with sensitive data (PII, finance, healthcare) — built-in redaction hook scrubs sensitive strings before any external MCP call
• You need to read every hook before installing — only ~10 MB, plain Python, no JS dependencies, every file readable in 10 minutes
• You prefer Claude Code only with deep specialization over multi-platform breadth
• You speak Russian — README and rules have RU-first sections, useful for CIS dev teams

Comparison at a glance:

If multi-language / cross-harness matters more than anti-hallucination focus — pick ECC. If anti-hallucination on sensitive data is your job-critical risk — pick this one.

95 Hooks — 24 Events

Hooks run 100% of the time — deterministic Python guards, not probabilistic instructions.

⚡ Power Modes — Magic Keywords

Type anywhere in your prompt:

Modes are additive — ralph security audit = Persistent mode + security-audit skill.

13 Agents + 3 Teams

╔══════════════════════════════════════════════════════════╗
║  STRATEGIC — Opus          ·  20% of tasks               ║
║  boyko-agent(memory:user)  architect sec-auditor teacher  ║
╠══════════════════════════════════════════════════════════╣
║  WORKHORSE — Sonnet        ·  80% of tasks               ║
║  builder(worktree)  tester(worktree)  explorer  reviewer  ║
╠══════════════════════════════════════════════════════════╣
║  TEAMS — parallel execution                              ║
║  review-squad  →  reviewer + sec-auditor (parallel)      ║
║  build-squad   →  builder  + tester     (isolated wt)    ║
║  research-squad →  explorer + verifier  (search+verify)  ║
╚══════════════════════════════════════════════════════════╝

7 agents with persistent memory (diagram above shows the 8 most-used; security-guard also carries memory:project) · 2 agents with worktree isolation · Sonnet-first, Opus escalation only

Evidence Policy

Every factual claim is tagged:

[VERIFIED-HIGH]    ≥2 sources confirmed       → can be used as fact
[VERIFIED-MEDIUM]  1 source + inference        → careful wording
[VERIFIED-LOW]     indirect evidence           → "there are signs, but..."
[UNKNOWN]          no confirmation             → do not guess

Confidence Scoring 0.0–1.0 based on source count. Rationalization Prevention — 10 common AI excuses with countermeasures baked into rules.

Status Line

Zero token cost — always visible at the bottom of the terminal:

[claude-sonnet] ▓▓▓▓▓▓▓░░░░░░░░░░░░░ 35% | main | $0.42 | 3m5s

Security

InputGuard — 8 injection categories (scoped to MCP tool calls only — built-in tools like Read/Bash are trusted by definition, see hooks/input_guard.py):

PII Redaction — 12 patterns stripped before external MCP calls: National IDs · Bank cards · IBAN · API keys · GitHub tokens · Slack tokens · AWS keys · JWT · Generic secret assignments · Email · Phone · IPs

Testing

pip install pytest pytest-cov ruff mypy

pytest tests/ -v --cov=hooks --cov-report=term-missing   # see CI badge above for exact count
ruff check hooks/ scripts/ tests/
mypy hooks/utils.py hooks/input_guard.py
bash tests/test_all.sh   # 3 shell suites: hooks · install · skills

Obsidian Integration

Two automation hooks keep your Obsidian vault in sync with Claude Code activity:

Vault layout (~/.claude/memory/):

wiki/          ← processed knowledge (auto-generated)
raw/           ← quick drop → auto-converted at session end
mocs/          ← Maps of Content (6 MOCs)
_auto/wiki/    ← thematic indices (Claude-Code / Lessons / Projects)
daily/         ← session reports

graph.json colorGroups must be set while Obsidian is closed — the app overwrites on launch.

MCP Profiles

CORE (default)    SCIENCE              DEPLOY
context7          + ncbi-datasets      + vercel
basic-memory      + uniprot            + netlify
playwright        + pubmed-mcp         + supabase
ollama                                 + sentry

~/.claude/mcp-profiles/switch-profile.ps1 science

CircuitBreaker auto-fallback: context7 → WebSearch · playwright → WebFetch · ollama → cloud

Claude-cod-top-2026/
├── CLAUDE.md                      Core config (deployed from claude-md/CLAUDE.md, ~120 lines)
│
├── rules/                         17 modular rules (loaded on demand)
│   ├── coding-style.md
│   ├── security.md
│   ├── testing.md
│   ├── integrity.md
│   ├── memory-protocol.md
│   ├── context-loading.md
│   ├── permissions.md
│   └── mentor-protocol.md
│
├── hooks/                         95 hooks + utils.py/hook_state.py/severity_calibrator.py (shared libs)
│   ├── utils.py                   21 shared functions (DRY)
│   ├── settings.json              Hook registry + 27 deny patterns
│   ├── input_guard.py             Prompt injection
│   ├── mcp_circuit_breaker.py     MCP resilience
│   ├── statusline.py              Terminal status bar
│   └── ...                        39 more hooks
│
├── agents/                        13 active + 3 teams
│   ├── navigator.md               boyko-agent — Strategic (Opus, memory:user)
│   ├── builder.md                 Code (Sonnet, worktree)
│   ├── reviewer.md                Review (Sonnet, memory:project)
│   ├── sec-auditor.md             Security (Opus, memory:project)
│   └── teams/                     review-squad · build-squad · research-squad
│
├── skills/
│   ├── core/                      12 universal skills
│   └── extensions/                116 domain skills
│
├── assets/                        Visual assets
│   ├── banner.svg                 Hero banner (animated)
│   └── pipeline.svg               Hook execution pipeline diagram
│
├── tests/                         2651 tests · 112 files
├── docs/                          Architecture · guides · anti-patterns
├── mcp-profiles/                  3 profiles (core/science/deploy)
└── .github/workflows/ci.yml       pytest + ruff + mypy + secrets scan

Used in Production

Verified incidents from the author's own workflow (single developer, one codebase):

• pre_commit_guard blocked accidental push to main during a hotfix
• pattern_extractor auto-logged debugging lessons from fix: commits
• memory_guard kept activeContext.md current across 3 deploy cycles

Scope: single developer · personal project · not independently verified.