TechTalks Stack Kits & Production Security Platform

Official open-source repository for TechTalks (techtalks.itsumarfarooq.com). A monorepo of full-stack project foundations pre-wired with AI agent rules, skills, design tokens and OWASP-mapped security controls, alongside a 22-lesson web security masterclass.

• Author & Maintainer: Umar Farooq (Senior Full-Stack & Security Engineer)
• Website: techtalks.itsumarfarooq.com
• Kits Hub: /kits/
• Kit Status Board: /status/ — which kits are actually verified
• OWASP Coverage Matrix: /security/coverage/ — 433 controls mapped to Top 10:2025
• Security Masterclass: /security/

What this project claims, and what it does not

This repository reports only what it can demonstrate:

• Measured: agent context cost per kit (tiktoken cl100k_base), structural gates, security controls mapped to OWASP Top 10:2025, and which eval tasks actually execute and pass.
• Not measured, and not claimed: tokens an agent needs to complete a build, and first-try correctness. Both require running a live agent; this repo does not, so it reports neither. Earlier releases printed hardcoded constants for these — see the CHANGELOG 2.0.0 entry.
• Maturity is earned, not declared. A kit cannot mark itself verified in kit.yaml; the label is derived from executed verification runs. Today that is 3 verified, 32 scaffold.

---

What is a Stack Kit?

A Stack Kit is a project foundation for one exact technology combination (e.g. Laravel + Filament + PostgreSQL). Every kit bundles:

1. Starter (starter/): application source with rootless Docker Compose and .env.example.
2. Single-source rules (rules/source/*.md): transpiled by tools/transpiler.py into 8 agent dialect targets — AGENTS.md, CLAUDE.md, CODEX.md, .clinerules, .cursor/rules/*.mdc, .github/copilot-instructions.md, .agents/rules/*.md, .windsurfrules. Dialects are rendered, not copied: CODEX.md leads with the verification contract, and .clinerules strips code fences because Cline prepends it to every request.
3. Agent skills (skills/): reusable workflows following the Anthropic Agent Skills spec.
4. Design tokens (DESIGN.md): colour, typography, dark mode, WCAG AA.
5. Security manifest (security/checks.json): every control carries an OWASP Top 10:2025 category, severity, CWE and an evidence pointer to the file that enforces it. Validated against schemas/kit-security-checks.schema.json.
6. Build steps (steps/agent-build-steps.md): numbered prompts with verification commands.
7. Eval tasks (evals/tasks/<slug>_tasks.json): each with a real verify command.

Verified vs scaffold

A verified kit has been installed and executed: its test suite runs, and each declared security control was mutation-tested — the protection was removed to confirm the test actually fails without it. A test that cannot fail is not a test.

Kit	Suite	Mutation-checked controls
flask-htmx-sqlite	27 tests	CSRF, XSS escaping, SQL parameterization, log redaction, audit trail
django-api-ninja	39 tests	tenant isolation (BOLA), schema strictness, token auth, Celery serialization
laravel-api-sanctum	21 tests, 44 assertions	tenant scope, policy authorization, mass-assignment filtering

The other 32 kits are scaffolds: rules, security manifest and structure are complete and drift-checked, which makes them useful as agent context packs, but nothing has been executed. /status/ is the live breakdown.

---

Stack Kits Status Matrix

35 kits — 24 verified, 0 partial, 11 pending toolchain, 0 scaffold, 0 failing. 101/145 eval tasks execute and pass.

Context tokens are what an agent must read before writing code, measured with tiktoken cl100k_base. Tiers derive from that number. Starter LOC excludes installed dependencies.

Kit	Maturity	Context tokens	Tier	Starter LOC	Verification
rag-fastapi-qdrant	Verified	3,063	B	646	5/5 passed
rag-haystack-weaviate	Verified	1,989	A	544	5/5 passed
rag-langgraph-agentic	Verified	2,087	A	732	5/5 passed
rag-llamaindex-pgvector	Verified	2,990	B	742	5/5 passed
rag-local-private	Verified	3,761	B	799	5/5 passed
agentic-langgraph-crewai	Verified	1,238	A+	303	4/4 passed
django-api-ninja	Verified	3,054	B	605	4/4 passed
django-tailwind-postgresql	Verified	1,893	A+	481	4/4 passed
flask-htmx-sqlite	Verified	2,466	A	574	4/4 passed
laravel-ai-features	Verified	1,803	A+	1,191	4/4 passed
laravel-api-sanctum	Verified	2,264	A	1,202	4/4 passed
laravel-filament-mysql	Verified	1,916	A	1,496	4/4 passed
laravel-filament-postgresql	Verified	2,984	B	1,602	4/4 passed
laravel-livewire-postgresql	Verified	3,042	B	1,386	4/4 passed
laravel-mysql	Verified	1,396	A+	963	4/4 passed
mcp-tools-kit	Verified	1,562	A+	636	4/4 passed
nextjs-approuter-supabase	Verified	1,791	A+	595	4/4 passed
nextjs-prisma-postgresql	Verified	1,690	A+	496	4/4 passed
python-litestar-postgresql	Verified	3,197	B	280	4/4 passed
reverse-engineering-security	Verified	1,684	A+	681	4/4 passed
security-devsecops-ci	Verified	2,259	A	297	4/4 passed
security-llm-guardrails	Verified	2,587	A	511	4/4 passed
security-owasp-api	Verified	2,218	A	386	4/4 passed
security-passkeys-auth	Verified	2,487	A	701	4/4 passed
elixir-phoenix-liveview	Pending toolchain	1,878	A+	401	0 tasks undefined
go-chi-templ-htmx	Pending toolchain	3,528	B	113	0 tasks undefined
go-fiber-api	Pending toolchain	1,885	A+	186	0 tasks undefined
go-gin-postgresql	Pending toolchain	1,883	A+	187	0 tasks undefined
laravel-mongodb	Pending toolchain	2,853	A	857	0 tasks undefined
ruby-rails-hotwire	Pending toolchain	2,405	A	111	0 tasks undefined
rust-actix-postgresql	Pending toolchain	2,088	A	279	0 tasks undefined
rust-axum-postgresql	Pending toolchain	1,964	A	196	0 tasks undefined
rust-leptos-fullstack	Pending toolchain	2,021	A	91	0 tasks undefined
rust-loco-sqlite	Pending toolchain	2,030	A	173	0 tasks undefined
ts-hono-bun-sqlite	Pending toolchain	2,063	A	122	0 tasks undefined

---

Monorepo Structure

.
├── .github/                     # Issue forms, PR template, CI validation workflow
│   ├── ISSUE_TEMPLATE/
│   │   ├── bug-report.yml
│   │   └── new-kit-proposal.yml
│   ├── PULL_REQUEST_TEMPLATE.md
│   └── workflows/validate-kits.yml
├── assets/                      # Compiled CSS, JS filters, branding
│   ├── css/styles.css
│   └── js/kits-filter.js
├── docs/                        # Community documentation & starter issues
│   └── starter-issues.md
├── evals/                       # Automated benchmark evaluation suite
│   ├── runner.py
│   ├── tasks/
│   └── README.md
├── kits/                        # The Stack Kits monorepo
│   ├── index.html               # Public kits catalog with interactive search
│   ├── laravel-filament-postgresql/
│   ├── laravel-livewire-postgresql/
│   ├── laravel-mongodb/
│   └── nextjs-approuter-supabase/
├── schemas/                     # JSON Schemas for machine-readable kit artifacts
│   └── kit-security-checks.schema.json
├── security/                    # Production Security Masterclass (22 lessons)
│   ├── index.html               # Central security hub directory
│   ├── coverage/                # OWASP Top 10:2025 coverage matrix (generated)
│   ├── coverage.json            # Machine-readable aggregate (generated)
│   └── laravel/                 # Laravel & AI security track + interactive checklist
├── templates/                   # Reusable starting templates for new kits
│   ├── kit.yaml
│   ├── AGENTS.md
│   ├── DESIGN.md
│   ├── SECURITY.md
│   ├── SKILL.md
│   └── README.md
├── tools/                       # Multi-agent build and validation CLI tools
│   ├── lib/                     # Shared libraries
│   │   ├── owasp.py             # OWASP Top 10:2025 taxonomy & control classifier
│   │   └── security_checks.py   # Manifest load / normalize / validate
│   ├── audit_kit.py             # 18-checkpoint kit completeness audit
│   ├── build_chrome.py          # Single-source site header + footer
│   ├── build_kit_pages.py       # Static kit detail page generator
│   ├── build_security_matrix.py # OWASP coverage matrix generator
│   ├── build_status_board.py    # Kit maturity board + README table
│   ├── check_encoding.py        # UTF-8 BOM gate
│   ├── transpiler.py            # Single-source rules transpiler (8 dialects)
│   ├── validate_checks.py       # Security manifest schema validator & migrator
│   └── validate_manifest.py     # Kit manifest specification validator
├── CHANGELOG.md                 # Release history
├── CODE_OF_CONDUCT.md           # Community guidelines
├── CONTRIBUTING.md              # Contributor onboarding & quality standards
├── LICENSE                      # MIT License
├── index.html                   # Platform homepage
├── llms.txt                     # AI discovery & documentation index
└── sitemap.xml                  # Search engine index

---

Local Development & CLI Tooling

1. Validate All Kit Manifests

python tools/validate_manifest.py kits/laravel-filament-postgresql/kit.yaml

2. Transpile Rules into 8 Agent Formats

# AGENTS.md, CLAUDE.md, CODEX.md, .clinerules, .cursor/rules/*.mdc,
# .github/copilot-instructions.md, .agents/rules/*.md, .windsurfrules
python tools/transpiler.py --kit kits/laravel-filament-postgresql

# Verify zero rule drift, including stale generated files (enforced in CI)
python tools/transpiler.py --kit kits/laravel-filament-postgresql --check

Dialects are rendered, not copied: CODEX.md leads with the verification contract, and .clinerules strips code fences because Cline prepends it to every request. The two per-rule directories are owned by the transpiler, so a renamed rule's old output is pruned rather than left for an agent to load alongside the current one.

2b. Validate & Audit Security Manifests

# Validate every kit's security/checks.json against the JSON Schema
python tools/validate_checks.py

# Migrate a legacy manifest to canonical v2 (preserves hand-tuned OWASP tags)
python tools/validate_checks.py --fix

# Re-derive OWASP/severity after editing tools/lib/owasp.py
python tools/validate_checks.py --reclassify

# Full 18-checkpoint completeness audit for one kit
python tools/audit_kit.py laravel-filament-postgresql

# Regenerate the OWASP Top 10:2025 coverage matrix
python tools/build_security_matrix.py
python tools/build_security_matrix.py --check   # CI freshness gate

3. Run Verification & Context-Cost Measurement

python evals/runner.py                  # executes every task that defines a verify command
python evals/runner.py --kit flask-htmx-sqlite
python tools/build_status_board.py      # regenerate status.json + /status/ from those results

What is measured, and what is not. The runner counts the real context an agent must load before it can work in a kit — its rules dialect plus DESIGN.md, SECURITY.md and the build steps — using tiktoken cl100k_base. Across the catalogue that is 1,238–3,828 tokens (median 2,088). Efficiency tiers are derived from that measured number, so a grade always traces back to something you can reproduce.

Tokens to complete a build, and first-try agent correctness, are not reported, because determining them requires running a live agent and this runner does not. Earlier revisions printed hardcoded constants for those figures; they were removed. A constant presented as a measurement is worse than no measurement.

Maturity is earned, not declared. /status/ grades every kit from executed results, never from a self-assigned field in kit.yaml:

Label	Meaning
verified	all eval tasks define real commands, the executed ones passed, starter ships ≥250 LOC
partial	some tasks ran and passed; others have no verify command yet
scaffold	structure and rules are complete and drift-checked, but nothing has been executed
failing	a structural gate or an executed task failed

3b. Encoding & Hygiene Gates

python tools/check_encoding.py          # rejects UTF-8 BOMs in parsed files
python tools/check_encoding.py --fix

A BOM is invisible in an editor but breaks .env parsing, renders into HTML before <!doctype>, and trips strict JSON/SQL parsers.

3bb. Running Verification Across Every Toolchain

python tools/ci_matrix.py                   # which kits run in which CI job
python tools/ci_matrix.py --toolchain rust  # slugs for one job
python tools/ci_matrix.py --json

Most kits cannot be verified on a single machine — the catalogue spans Go, Rust, Elixir, Ruby, Bun, PHP, Node and Python. .github/workflows/verify-kits.yml runs one job per toolchain, and each job asks ci_matrix.py which kits it owns rather than carrying a hardcoded list. The grouping comes from the same requires / requires_python fields evals/runner.py uses to decide whether to execute or skip, so a job can never be handed a kit whose toolchain it did not install.

Each job uploads its *_metrics.json; a final job merges them all and regenerates the status board, so the published board reflects every toolchain rather than whichever one the last runner happened to have.

3c. Site Header & Footer (single source)

python tools/build_chrome.py            # rewrite nav + footer across every page
python tools/build_chrome.py --check    # CI gate: fail on drift
python tools/build_chrome.py --list     # preview which pages would change

The navbar and footer live once in tools/build_chrome.py. The page generators (build_kit_pages.py, build_security_matrix.py, build_status_board.py) import nav_html() / footer_html() from it, and the CLI rewrites the static pages. Previously both were duplicated across ~78 hand-maintained HTML files, so a link added in one place silently went missing from the rest.

4. Build Website CSS & Showcase Pages

npm install
npm run build:css
python tools/build_kit_pages.py

---

Contributing

We welcome new kit proposals, skills, and rule improvements! Please review CONTRIBUTING.md and pick an issue labeled good first issue in docs/starter-issues.md.

License

Open-source under the MIT License. © 2026 Umar Farooq. Not affiliated with Laravel LLC, Filament, Anthropic, or OpenAI.