@hivehub/rulebook
Tool-agnostic AI development framework. Standardize projects across Claude Code, Cursor, Gemini, Codex, Windsurf, Copilot with automated templates, quality gates, persistent memory, and framework detection for 28 languages, 17 frameworks, 13 MCP modules,
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): Direct dependency; used by transitive packages in the ecosystem. | ai | |
| phantom-deps | phantom-dep:js-yaml | AI (phantom-deps): Direct dependency; used by inquirer and config parsing. | ai | |
| phantom-deps | phantom-dep:cli-cursor | AI (phantom-deps): Direct dependency; used by inquirer for terminal UI. | ai | |
| phantom-deps | phantom-dep:picocolors | AI (phantom-deps): Direct dependency; used by chalk and other CLI tools. | ai | |
| phantom-deps | phantom-dep:ansi-escapes | AI (phantom-deps): Direct dependency; used by blessed and terminal utilities. | ai | |
| phantom-deps | phantom-dep:node-notifier | AI (phantom-deps): Direct dependency; used for desktop notifications. | ai | |
| phantom-deps | phantom-dep:@types/blessed | AI (phantom-deps): Framework-scoped type package; loaded by convention with blessed. | ai |
Versions (showing 18 of 18)
| Version | Deps | Published |
|---|---|---|
| 7.0.1 | 17 / 16 | |
| 5.8.2 | 17 / 16 | |
| 5.8.1 | 17 / 16 | |
| 5.8.0 | 17 / 16 | |
| 5.7.0 | 17 / 16 | |
| 5.5.2 | 18 / 17 | |
| 5.5.1 | 18 / 17 | |
| 5.5.0 | 18 / 17 | |
| 5.4.0 | 18 / 17 | |
| 5.3.3 | 18 / 16 | |
| 5.3.2 | 18 / 16 | |
| 5.3.1 | 18 / 16 | |
| 5.3.0 | 18 / 16 | |
| 5.2.1 | 18 / 16 | |
| 3.0.0 | 17 / 15 | |
| 2.1.0 | 16 / 15 | |
| 2.0.0 | 16 / 15 | |
| 1.2.0 | 16 / 15 |
v7.0.1
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (caikpigosso) on 2026-07-19, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.