
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@nomark-ai/method
Advanced tools
The Nomark Method — a governed, instinct-learning Claude Code harness. Standalone, no portfolio coupling.
The Nomark Method — a governed, instinct-learning Claude Code harness, packaged for standalone use.
Drop-in for any project. No portfolio sync, no telemetry, no phone-home. The learning loop (instincts, memory, trust) lives entirely in your repo.
#!/usr/bin/env bash
# The canonical NOMARK Method install command. This file is the ONE place it
# exists: every document that shows it transcludes these bytes verbatim, and the
# clean-machine E2E executes this file. PACKAGE_SOURCE is the substitution seam
# the E2E binds to a locally packed tarball — leave it unset and you install the
# published package. Run this inside the project directory you want to govern.
npx "${PACKAGE_SOURCE:-@nomark-ai/method}" init
That's it. Run it inside the project directory you want to govern. One command:
.nomark/, scripts/, CHARTER.md, NOMARK.md, CLAUDE.md, SOLUTION.md, progress.md.claude plugin marketplace add against the bundled private (local-path) marketplace.claude plugin install nomark-method@nomark-method-marketplace --scope project (non-interactive).The skills / agents / hooks / commands ship as the nomark-method Claude Code plugin — nothing is hand-copied into your .claude/, which kills the forgotten-copy failure class. Restart Claude Code after install so the plugin loads.
It refuses to overwrite an existing .claude/ or .nomark/ unless you pass --force. If the claude CLI isn't on your PATH, the two plugin commands are printed for you to run manually.
To scaffold a different directory, pass it to the bootstrapper as init ./my-project.
The skills / agents / hooks / commands come from the installed nomark-method plugin (in Claude Code's plugin cache), not from your repo. The bootstrapper writes only project-local state:
your-project/
├── .claude/
│ ├── CLAUDE.md Session-start instructions for Claude Code
│ └── settings.json enabledPlugins: { nomark-method: true } (written by plugin install)
├── .nomark/
│ ├── schemas/ JSON schemas for governance artifacts
│ ├── lifecycles/ Lifecycle manifests (discover → plan → build → verify → ship)
│ ├── config/ Default config (context brackets, etc.)
│ └── resources.json Empty starter — your verified infrastructure registry
├── scripts/ Lifecycle engine, drift scorer, instinct index, MEE event log
├── tasks/instincts/ Instinct lifecycle dirs (pending → proven → promoted → dormant)
├── CHARTER.md The constitution. Read first.
├── NOMARK.md The method. Read second.
├── SOLUTION.md Stub for your project's solution spec.
└── progress.md Stub for active task state.
/board) evaluates ambiguous decisions through 5 lenses.discover → plan → build → verify → ship with trust gates and artifact tracking./tdd-cycle, /tdd-feature, /autopilot enforce red-green-refactor..nomark/memory/ stores YAML-fronted decision history, indexed and searchable via /memory..nomark/resources.json is a verified registry. The resource-graph-guard hook stops Claude from inventing infrastructure references.The full Nomark stack also includes:
nomark-cloud — hosted sync, dashboards, peer coordination (opt-in infra).This package strips all of those at build time. You get a fully functional, fully local Nomark harness. If you later want to plug into the broader ecosystem, see www.nomark.ai.
This package is the method — how you govern your dev process.
If you want to embed Nomark concepts (engine, agents, evals) into your own application, you want a different package:
@nomark-ai/engine — open core (TypeScript / Python).@nomark-ai/pro — advanced features.claude CLI used for plugin install)The plugin installs from a marketplace source. For a private marketplace (a private git repo), Claude Code's background install/auto-update authenticates git over HTTPS — which needs a credential helper. The bootstrapper's preflight warns when none is configured. Two supported paths:
Interactive / developer machine — configure git auth once:
gh auth setup-git # or use an SSH remote for the marketplace repo
Zero-touch / CI (no interactive auth) — pre-bake the plugin cache with CLAUDE_CODE_PLUGIN_SEED_DIR. Point it at a directory that already contains the resolved plugin payload (the same layout npm run build:plugin produces), so claude plugin install seeds from disk instead of fetching over the network:
export CLAUDE_CODE_PLUGIN_SEED_DIR=/path/to/prebaked/plugins
Then run the install command above in the target project — marketplace add and install both resolve from the seed dir.
This makes the install hermetic — no git credentials, no network — which is the intended path for CI images and unattended provisioning. (C3)
The execution surface is a plugin, so updates are a plugin operation — not a re-copy:
claude plugin marketplace update nomark-method-marketplace
claude plugin update nomark-method@nomark-method-marketplace # restart to apply
Project-local scaffolding (CHARTER.md, NOMARK.md, scripts/, .nomark/ schemas) is a one-shot drop you own and can refresh by re-running the install command with --force in a fresh checkout, merging selectively.
Apache-2.0. See LICENSE. Third-party attributions: ATTRIBUTION.md.
The Apache-2.0 licence applying to this package grants rights only to the licensed copyright and the associated patent rights described in that licence. No licence is granted to use the NOMARK name, logos, branding, trade dress, or other trademarks except as separately authorised in writing by NOMARK.
This package is developed inside the NOMARK monorepo (the repository.directory field in package.json names its home there). From the package's own directory in a monorepo checkout:
npm run build # snapshot the harness (scrubs portfolio coupling)
npm test # smoke-test the init script in a temp dir
The build script lives at scripts/build-harness.cjs.
FAQs
The Nomark Method — a governed, instinct-learning Claude Code harness. Standalone, no portfolio coupling.
We found that @nomark-ai/method demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.