Foundation

Cross-cutting plugins that sit under the SDLC ribbon. Every Zava service pins these explicitly — they are never satisfied transitively by phase kits.

Foundation secure-baseline

Cross-cutting baseline — secure-coding instructions, docs style guide, security reviewer persona. Every Zava service pins this.

Foundation provision-kit

PROVISION stage (Day-0) — provision-golden-path skill. Files the governed request through the platform IssueOps front door, watches the run live, verifies the new repo + live URL, and explains the guardrails (template lineage, secretless OIDC, scoped RBAC, deploy pipeline).

Why no transitive shortcut? Consumption patterns — the rationale for explicit foundation pins.