StartupBros-com/hov-stack

I'm Will Mitchell. I'm not the president of YC and I'm not on the React core team. I'm a marketer who has been vibe coding full time for almost four years, shipping solo on Windows. hov-stack is my answer. This is the Claude Code harness I work in every day, not a copy of it. My Codex and Pi setups load skills from it too.
Fork it. Improve it. Make it yours.
Receipts, not adjectives:
In the 60 days to 2026-10-19: 4,302 pull requests merged across 17 repos. Everything that got there is in this repo: the rules, the guards, the permission lists, the skills.
What nobody else ships: the permission lists. 291 allow, 75 ask and 70 deny entries, grown from refusals through /denial-triage, plus 12 hooks that run before a tool call lands. The other published stacks ship skills; this one ships the part that decides what an agent may run.
## Who this is for
Non-technical builders who want a working setup without learning any of it. Paste the sentence below and you are done.
Solo operators running several businesses on one machine. The guards and the permission lists exist so parallel agents stop colliding.
Claude Code users with a setup already who want to cherry-pick the guards, the rules file, or the memory workflow.
## Install, about a minute
Builders:
bash
git clone --depth 1 https://github.com/StartupBros-com/hov-stack ~/hov-stack && cd ~/hov-stack && ./setup
Everyone else, open Claude Code anywhere and paste:
> Set me up from https://github.com/StartupBros-com/hov-stack. Read its README and HARNESS.md first, run its setup, apply what fits this machine, and tell me what you skipped and why.
./setup needs git and node. Its plugin steps also need Claude Code 2.1.76 or later, since older releases refuse the hov marketplace's manifest. It symlinks this repo into ~/.claude, so the checkout has to stay where you cloned it. It keeps your existing memory and secrets where they are, and moves anything it replaces to ~/.hov-stack-backups/. If you already have a settings.json it is left alone and the seed lands next to it as settings.hov-stack.json. Your own settings, CLAUDE.md additions and environment variables go in the private overlay (below), which setup reads and never writes. It then installs dcg after checking its checksum and signature (it shows dcg's licence first; ./setup --no-dcg leaves dcg out), adds the hov marketplace, and installs the default plugins (papercut, skill-tuner, memory-dream, design-rails). A step that cannot run (offline, no claude yet, a platform dcg has no build for) is reported with the command to run later, and ./setup --check shows what is in place without changing anything. tests/repo/setup.test.sh checks these promises on every push, against a stand-in claude and a stubbed download, and dcg/tests/install-test.sh checks that a tampered archive or a signature from another key installs nothing.
Then start a new Claude Code session and type /hov-setup, setup's second stage. Five plugins need what a script cannot do for you: a login, a sudo or Windows prompt, or a paid plan. They are pro-gate, wsl-cdp, token-eater, product-video and sign-it. The skill shows which of them you have and installs the ones you pick. It then takes each through its own setup, one at a time, ending in a check the session runs. Passwords and tokens go only into each plugin's own login, never into the chat.