Foundation

Cross-cutting plugins that sit under the SDLC ribbon. Every Zava service pins these explicitly — they are never satisfied transitively by phase kits.

Foundation secure-baseline

Cross-cutting baseline — secure-coding instructions, docs style guide, security reviewer persona. Every Zava service pins this.

Why no transitive shortcut? Consumption patterns — the rationale for explicit foundation pins.