Granite0x Security Thread

What it claims

The thread assembles a working Claude Code multi-agent system from ten specific GitHub repos, split into a "graph" layer (coordinate a fleet of agents) and a "loop" layer (make one agent trustworthy). The organizing claim: every node in the graph is an agent running a loop, so a graph built out of loops you can't trust is "a faster way to ship bugs across a fleet." Each repo entry gives star count, license, install command, and a stated trap. Star/license figures were pulled from the GitHub API the morning of posting.

The ten repos, with commands and traps

Graph layer:

• G1 bernstein (726★, Apache-2.0) — plain-Python DAG scheduler, zero model in the coordination loop; loads a task DAG, detects cycles, batches [P]-marked tasks concurrently, runs each node in its own git worktree behind a lint/type/test gate. pip install bernstein && bernstein init && bernstein -g "Add rate limiting". Trap: heavy platform (1,765 Python files, own .sdd/ workspace, bearer-token server); the DAG is hand-authored, not inferred.
• G2 agent-worktree (267★, MIT) — git-worktree-per-agent CLI; dry-run merge that aborts and resets on conflict. npm install -g agent-worktree, then wt run -- claude. Trap: a primitive, not a scheduler.
• G3 wshobson/agents (38,185★, MIT) — real Claude Code plugin marketplace: 203 specialist subagents across 94 plugins, tiered (Opus for 55 architecture/security/review roles, Haiku for ops). /plugin marketplace add wshobson/agents. Trap: staffing all 203 burns your context window.
• G4 fivetaku/insane-research (108★, MIT) — 7-phase research graph; Phase 3 fans out 3–5 sub-agents throttled to 2–3 concurrent (guard against >16-agent fan-out that trips "Server temporarily overloaded"); Phase 6 is a deterministic code gate (scripts/validate_ledger.py) that alone writes verified_claims.json. Trap: skip validation and synthesis has nothing to cite.

Loop layer:

• L1 beads (25,603★, MIT) — graph-over-versioned-SQL replacement for markdown TODOs; bd ready, bd remember, bd prime (~50 tokens); closed work decays to a 70%-smaller self-written stub. npm install -g @beads/bd. Trap: .beads/ on iCloud/Dropbox corrupts the DB (error 522).
• L2 waku-agent (440★, MIT) — the whole agent loop in waku/loop/agent.py, ~95 lines; no done flag, bounded by max_iterations (default 10). Trap: swallows tool errors into normal-looking output, so a silently-wrong tool reads as correct.
• L3 serena (26,813★, MIT) — the repo reclaiming Claude Code's ~16,000 tokens of un-editable built-in tool descriptions; forbids Read/Edit for discovery and forces symbol-level retrieval over MCP. uv tool install -p 3.13 serena-agent && serena setup claude-code. Trap: verifies nothing; strongest refactors need the paid JetBrains backend.
• L4 superpowers (260,116★, MIT) — TDD methodology enforcing an "Iron Law" (no production code without a failing test); dormant skills cost ~100 words. /plugin install superpowers@claude-plugins-official. Trap: persuasion, not a syscall — a model can fake seeing red.
• L5 claude-review-loop (706★, no license) — a Stop hook returning {"decision":"block"} to force an OpenAI Codex review (up to 4 parallel reviewers) before exit; fails open. npm i -g @openai/codex && claude plugin marketplace add hamelsmu/claude-review-loop && claude plugin install review-loop@hamel. Trap: no LICENSE file; only checks a review file exists, agent may skip findings. Alternative: npx cc-sdd@latest (3,581★, MIT).
• L6 workshop (937★, MIT) — captures a run, replays the trace against edited code on a local daemon (port 5899), diffs tool calls until spans go green. /instrument-agent. Trap: replay against a production handler can hit your real DB, billing, and email.

Shape

flowchart TD
  G1[bernstein: DAG scheduler] --> N
  G2[agent-worktree: isolation] --> N
  G3[wshobson/agents: roles] --> N
  N[each node = one agent] --> L
  subgraph L[the loop per node]
    L1[beads memory] --> L2[waku iterate] --> L3[serena context] --> L4[superpowers skills] --> L5{L5 gate: 2nd model} 
    L5 -->|block| L2
    L5 -->|pass| L6[workshop proof]
  end
  G4[insane-research: whole shape in one plugin]

Limits

Star/license counts are point-in-time (day of posting). L5 (claude-review-loop) ships with no license, which may block commercial adoption. bernstein is a large, opinionated platform, not a drop-in. The thread is one practitioner's synthesis read from source, not benchmarked; it offers no comparative performance numbers, only the 16k-token figure and per-repo file/line counts.