@jeiemgi/cckit 0.1.6

package/skills/kit-onboard/SKILL.md

@@ -0,0 +1,50 @@
+---
+name: kit-onboard
+description: Run the claude-kit two-tier onboarding interview — the wide-range GLOBAL profile (asked once in a lifetime, writes ~/.claude/kit.profile.<user>.json) and the per-PROJECT interview (one batched round, pre-filled from your profile + what's detected in this directory). Use AUTOMATICALLY when the user asks to onboard, set up the kit for the first time, "interview me", create my kit profile, configure a new project, or when /kit-init runs against a project with no kit profile yet. Pairs with /kit-add to stack modules (e.g. software) later.
+when_to_use: First contact with the kit on a machine (no global profile yet), or starting a new project. Portable (Tier A) — runs in Claude Code, Cowork, and claude.ai Projects via AskUserQuestion.
+allowed-tools: Bash, Read, AskUserQuestion
+---
+
+# kit-onboard — the two-tier interview (D11)
+
+Two tiers. The ASKING is yours (AskUserQuestion). The DERIVING + WRITING is deterministic and
+lives in the engine — never hand-edit config JSON; call the scripts.
+
+Engine (under `${CLAUDE_PLUGIN_ROOT}`):
+- `scripts/lib/kit-interview.sh --catalog TIER` — the question set (`global` | `project`).
+- `scripts/lib/kit-interview.sh --render TIER --dir DIR` — same, with each `default` PRE-FILLED
+  from the global profile + repo detection. **Render, don't read raw — the defaults are the point.**
+- `scripts/kit-onboard.sh global  --answers FILE` — persist tier-1 to the global profile.
+- `scripts/kit-onboard.sh project --answers FILE --dir DIR` — persist tier-2 (manifest-tracked).
+- `scripts/kit-onboard.sh status` — has the global profile been created? (rc 1 = not yet)
+
+## Tier 1 — global profile (ONCE in a lifetime)
+
+1. Run `scripts/kit-onboard.sh status`. **If it reports a profile already exists, SKIP tier 1**
+   entirely — the wide-range interview is once-ever. Go straight to tier 2.
+2. Otherwise render the catalog: `scripts/lib/kit-interview.sh --render global`.
+3. Ask the questions with **AskUserQuestion** — one batched round. For each question use its
+   `header`, `question`, and `options` (mark the `recommended` option first, label it
+   "(Recommended)"); seed the selection from `default`. Text questions (e.g. name) → free input.
+4. Build an answers JSON `{ "<key>": "<chosen value>", ... }` (keys = each question's `key`), write
+   it to a temp file, and persist: `scripts/kit-onboard.sh global --answers /tmp/kit-global.json`.
+
+## Tier 2 — this project (batched, pre-filled)
+
+1. Render: `scripts/lib/kit-interview.sh --render project --dir <project-dir>`. Defaults are already
+   filled from the global profile (language, owner) and the directory (project name ← folder, etc.).
+2. Ask with **AskUserQuestion** — one batched round, defaults pre-selected. Confirm or change.
+3. Persist: `scripts/kit-onboard.sh project --answers /tmp/kit-project.json --dir <project-dir>`.
+4. **The `software` question is a control answer, not a config field.** If the user answers
+   `yes`, immediately run the **kit-add** flow for the software module (the software wizard:
+   versioning / deploy / CI) — see the `/kit-add` command. If `no`, stop: it stays a free
+   workspace, and they can run `/kit-add software` any time.
+
+## Rules
+
+- **Render before asking** — never invent question text or defaults; the catalog is the source.
+- **One batched AskUserQuestion round per tier** — don't drip-feed.
+- **Skip tier 1 if a profile exists** (`kit-onboard.sh status`). Tier 2 always runs per project.
+- The global profile lives OUTSIDE any project (`~/.claude/`); the project config is manifest-tracked
+  (safe to update/uninstall later). Both are user-owned identity — the engine writes, never invents.
+- Mode stays `guided` by default (local-first, D16): warnings, never blocks. Enforced is opt-in.

package/skills/kit-security-sweep/SKILL.md

@@ -0,0 +1,57 @@
+---
+name: kit-security-sweep
+description: Full security audit of the project's apps. A security expert scans for AI/prompt injection, auth/session weaknesses, CORS/CSP issues, and dependency CVEs; findings are filed as GitHub issues and roadmapped. Named kit-security-sweep (not security-review) so it doesn't shadow the Claude Code builtin /security-review (diff audit).
+when_to_use: When you want a project security sweep with filed issues + roadmap entries — before a release, after a significant feature, or on demand. For a quick diff/code audit without issue filing, use the builtin /security-review instead.
+---
+
+# /kit-security-sweep
+
+Plugin-direct skill — reads `.claude/kit.config.json` from the working directory; the project's
+Security agent lives at `.claude/agents/security/AGENT.md`.
+
+## What this process does
+
+1. **Security expert** scans the active apps for vulnerabilities (see `.claude/agents/security/AGENT.md`)
+2. A GitHub issue is filed for every finding (`role:security`, `kind:security`, severity label) — security findings file directly, no confirm round-trip
+3. **Tech Lead** reviews findings and rolls them into the project's roadmap / a Security Hardening milestone
+
+## Inputs
+
+None required. Optionally pass `--app <name>` to scope to one app.
+
+## Execution
+
+### Phase 1 — Security Audit (Security agent)
+
+Spawn the Security agent (`.claude/agents/security/AGENT.md`) with the full threat model from that file.
+Ask it to output findings grouped by severity + a flat "Issues to file" list at the end.
+
+### Phase 2 — Issue filing (PM)
+
+For each finding, create a GitHub issue on the project repo (`KIT_REPO` from kit.config):
+
+```bash
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-config.sh" && load_kit_config
+gh issue create --repo "$KIT_REPO" \
+  --title "<finding title>" \
+  --label "role:security,kind:security,priority:<critical|p1|p2|p3>" \
+  --body "<risk / evidence / fix>"
+# add --milestone "<Security milestone>" when the project has one
+```
+
+### Phase 3 — Roadmap (Tech Lead)
+
+Roll the filed issues into the project's roadmap surface / Security Hardening milestone.
+CRITICAL findings block the distribution/release milestone.
+
+## Output
+
+- GitHub issues filed for every finding
+- The project roadmap / Security Hardening milestone updated
+
+## Rules
+
+- Never mark a security finding as "won't fix" without explicit owner sign-off
+- CRITICAL findings block the distribution/release milestone
+- All security issues use label `role:security`
+- Prompt injection findings also get label `kind:security`

package/skills/kit-ship/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: kit-ship
+description: End-to-end delivery for a user request — fix the issue, then run the full kit cycle (start → PR → CI → merge → close → update kit) using the kit-task commands. One command takes an open issue from code to merged-on-base with the board kept in sync.
+when_to_use: When the user says "fix #N and ship it", "do the full cycle on #N", "fix this and merge it", or hands you a tracked issue to take all the way to the base branch. For just opening a PR use /kit-task-pr; for PR+merge with no implementation use /kit-task-pr-auto.
+---
+
+# kit-ship
+
+Takes one issue from **open → implemented → merged on the base branch → closed → kit refreshed**,
+chaining the existing kit-task commands. This is the orchestrator that wraps the manual sequence,
+with the sharp edges baked in (see **Hard rules**). Plugin-direct — the kit-task skills it chains
+resolve from `${CLAUDE_PLUGIN_ROOT}`.
+
+## Inputs
+
+| Field        | Required | Notes                                                                 |
+| ------------ | -------- | --------------------------------------------------------------------- |
+| Issue number | ✓*       | `157`. *If the user gives a request with no issue, create one first via `/kit-task-new`, then proceed. |
+| Skip merge   | optional | `--pr-only` → stop after the PR (don't merge). Default merges.         |
+
+## The cycle
+
+| # | Step | Command / action |
+| - | ---- | ---------------- |
+| 1 | **Read the issue** | `gh issue view <N>` — understand scope. If ambiguous/large/decision-heavy → stop and ask (don't ship blind). |
+| 2 | **Start** | `/kit-task-start <N> --worktree` — branch `<kind>/<N>-<slug>` from the fresh base branch, mark **In Progress**. |
+| 3 | **Implement** | Do the actual work to the issue's acceptance criteria, following project conventions + the relevant agent's domain. |
+| 4 | **Verify locally** | Run the affected workspace's `build` / `typecheck` / `lint` (e.g. `pnpm -F <pkg> build typecheck`) or `bash -n` for scripts. Don't open a PR on red. |
+| 5 | **PR** | `/kit-task-pr <N>` — commit, push, open PR to the base branch, mirror labels/milestone, add to board, move issue **In Review**. |
+| 6 | **Wait for CI** | If the project has a required check, poll until it's not pending (background `until` loop). **Pending ≠ failing — wait; never force-merge.** |
+| 7 | **Merge** | `/kit-task-pr-merge` once green — squash to the base, switch to base, pull, delete local+remote branch + worktree. |
+| 8 | **Close** | `gh issue close <N>` + set board **Done**. **Required** when `Closes #N` does NOT auto-fire (PRs that merge to a non-default branch don't trigger GitHub auto-close). |
+| 9 | **Update kit (only if the change touched the plugin source)** | bump version (`/kit-dev ship`) + `/plugin update`. |
+
+Report at the end: issue state, PR number + merged status, branch cleaned, board reflects Done.
+
+## Hard rules
+
+- **Don't ship blind.** If step 1 finds the issue ambiguous, large, or decision-heavy, stop and ask — this skill executes scoped work, it doesn't make product calls.
+- **Never force-merge over pending CI.** Wait for the check. Only a *failing* (not pending) check stops the cycle — report it verbatim and stop.
+- **Always close the issue manually** (step 8) when auto-close won't fire on the base branch. The board is the source of truth.
+- **Always end on the base branch, clean.** Merged branch + worktree deleted; never leave the user on the feature branch.
+- One issue → one PR. If scope balloons mid-implementation, stop and split rather than growing a monster PR.

package/skills/kit-task-close/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: kit-task-close
+description: Close a GitHub issue after its PR merged. Sets the board Status to Done (if enabled). If the issue is a plan parent, flips the plan status to Complete once all deliverables are merged (no archive folder — completed plans stay visible).
+when_to_use: After a PR merges, to finalize the issue ledger. Most issues auto-close from PR `Closes #N` — use this for issues without a PR or to backfill the plan status.
+---
+
+# kit-task-close
+
+Plugin-direct skill — thin caller over the ONE canonical home
+`${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-task-ops.sh` (`kto_task_close`) for the issue-close +
+board-Done git-mechanic (kit-engine-boundary #1/#2). The optional plan-badge flip stays here (it
+edits a repo file → needs a worktree/PR), wrapping the op. The op respects the `KIT_PROJECTS_V2`
+board toggle.
+
+## Preconditions
+
+1. Issue has a merged PR (`Closes #N`) OR an explicit no-PR reason in the closing comment
+2. If a plan file is linked, the file exists
+
+If neither holds, **abort** and route to `/kit-task-pr` first.
+
+## Inputs
+
+| Field        | Required | Notes                                          |
+| ------------ | -------- | ---------------------------------------------- |
+| Issue number | ✓        | `123` or full URL                              |
+| Summary      | ✓        | 1–3 sentences — what was done, where it landed |
+
+## Execution
+
+```bash
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-config.sh" && load_kit_config
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/role-identity.sh"
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/gh-project.sh"
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-task-ops.sh"
+
+kto_task_close "$NUM" "$SUMMARY"
+```
+
+If a plan file is linked and all its deliverable PRs are merged, flip its status badge on a
+worktree branch + PR (a repo change — never the main checkout; no archive folder, completed plans
+stay visible):
+
+```bash
+if [[ "$KIT_PLANS_FORMAT" != "none" ]]; then
+  PLAN_FILE=$(gh issue view "$NUM" --repo "$KIT_REPO" --json body --jq .body \
+    | grep -oE "$KIT_PLANS_DIR/[a-zA-Z0-9_/-]+\.(md|mdx)" | head -1)
+  if [[ -n "$PLAN_FILE" && -f "$PLAN_FILE" ]]; then
+    ALL_MERGED=true
+    for pr in $(awk '/^##+ .*[Dd]eliverables/{f=1; next} f && /^## /{exit} f' "$PLAN_FILE" | grep -oE '#[0-9]+' | grep -oE '[0-9]+' | sort -u); do
+      [[ "$(gh pr view "$pr" --repo "$KIT_REPO" --json state -q .state 2>/dev/null)" != "MERGED" ]] && { ALL_MERGED=false; echo "⚠ PR #$pr not merged — plan stays Active"; break; }
+    done
+    if $ALL_MERGED; then
+      sed -i '' -e 's/^status: .*/status: Complete/' -e 's/status="Active"/status="Complete"/' "$PLAN_FILE" 2>/dev/null \
+        || sed -i -e 's/^status: .*/status: Complete/' -e 's/status="Active"/status="Complete"/' "$PLAN_FILE"
+      echo "✓ Plan flipped to Complete: $PLAN_FILE — commit via /kit-task-pr"
+    fi
+  fi
+fi
+```
+
+## Rules
+
+- Never bypass the PR workflow — abort if no PR closed this issue and no explicit reason
+- Never edit plan file content beyond the status flip · don't delete or move the plan file ·
+  don't reopen the issue afterward

package/skills/kit-task-new/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: kit-task-new
+description: Create a new GitHub issue — applies labels, milestone, and (if enabled) Projects v2 fields in one flow. Prefer this over raw `gh issue create` so the board stays in sync.
+when_to_use: When the owner or a sub-agent identifies a new piece of work to track.
+---
+
+# kit-task-new
+
+Plugin-direct skill — thin caller over the ONE canonical home
+`${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-task-ops.sh` (`kto_task_new`). The verb logic lives there,
+never inline here (kit-engine-boundary #1/#2). The op respects `KIT_BASE_BRANCH` (for the Plan blob
+link) and the `KIT_PROJECTS_V2` board toggle.
+
+## What it does
+
+One flow → creates a GitHub issue **and** (if Projects v2 is enabled) adds it to the board with Role, Status (Todo), and Plan Link set. Reads project config from `.claude/kit.config.json`.
+
+## Inputs (ask via AskUserQuestion when missing — do not invent)
+
+| Field      | Required | Notes                                         |
+| ---------- | -------- | --------------------------------------------- |
+| Title      | ✓        | Format: `[<role>] <imperative summary>`       |
+| Role       | ✓        | One of the project's `roles` (see kit.config) |
+| Kind       | ✓        | task / plan / adr / scaffold / spike          |
+| Priority   | ✓        | p1 / p2 / p3                                  |
+| Milestone  | ✓        | One of the project's `milestones`             |
+| Plan link  | optional | Path under the project's plans dir            |
+| Blocked by | optional | `#N, #M`                                      |
+| Body       | ✓        | Context + DoD checklist + acceptance          |
+
+Validate Kind/Priority/Role against the project's closed sets before dispatching — the op does not invent label families.
+
+## Execution
+
+```bash
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-config.sh" && load_kit_config
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/role-identity.sh"
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/gh-project.sh"
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-task-ops.sh"
+
+kto_task_new "$TITLE" "$ROLE" "$KIND" "$PRIORITY" "$MILESTONE" "$PLAN_LINK" "$BLOCKED_BY" "$USER_BODY"
+```
+
+The function prints `✓ <issue-URL>` and echoes the new issue number.
+
+## Rules
+
+- Never file without confirming title + role + priority with the owner
+- Never create new label families on the fly — validate against the project's closed sets; fail loudly if a kind/priority/role is unknown
+- If the milestone doesn't exist, ask before creating it
+- Always assign `@me` — the op does this

package/skills/kit-task-pr/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: kit-task-pr
+description: Commit current changes, push the branch, open a PR with the right template, labels, milestone, and link to the parent issue (+ board if enabled).
+when_to_use: When work on an issue branch is ready for review. Replaces ad-hoc `gh pr create`.
+---
+
+# kit-task-pr
+
+Plugin-direct skill — thin caller over the ONE canonical home
+`${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-task-ops.sh` (`kto_task_pr`). The verb logic lives there,
+never inline here (kit-engine-boundary #1/#2). The op respects `KIT_BASE_BRANCH` (default `develop`)
+and the `KIT_PROJECTS_V2` board toggle, so the same code serves any project.
+
+## Inputs
+
+| Field          | Required | Notes                                                      |
+| -------------- | -------- | ---------------------------------------------------------- |
+| Issue number   | ✓        | Derived from branch name `<kind>/<N>-<slug>` if not passed |
+| Summary        | ✓        | 1–3 bullets — the PR body's `## Summary`                   |
+| Commit message | optional | Defaults to `<role>: <issue title>`                        |
+
+Ask via `AskUserQuestion` when the Summary is missing — never invent it.
+
+## Execution
+
+```bash
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-config.sh" && load_kit_config
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/role-identity.sh"
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/gh-project.sh"
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-task-ops.sh"
+
+kto_task_pr "" "$SUMMARY"            # issue # parsed from the branch
+# kto_task_pr 173 "$SUMMARY" "tech-lead: admin Clerk sign-in"   # explicit
+```
+
+The function prints `✓ <PR-URL>`.
+
+## Rules
+
+- Never open a PR for a branch off the `<kind>/<N>-<slug>` convention — the op aborts with instructions
+- Never invent a Summary — ask if missing (the op refuses an empty Summary) · never push to the base branch directly
+- PR mirrors issue labels · if no milestone, the op omits it (no block)
+- If `gh pr create` fails because the branch hasn't diverged, the op surfaces the error verbatim (likely forgot to commit)

package/skills/kit-task-pr-auto/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: kit-task-pr-auto
+description: Same as kit-task-pr (commit, push, open PR) then immediately attempts to merge via kit-task-pr-merge. One command to land a branch end-to-end.
+when_to_use: When work is ready to ship without a separate review step.
+---
+
+# kit-task-pr-auto
+
+Runs `/kit-task-pr` then `/kit-task-pr-merge` back-to-back.
+
+## Inputs
+
+Same as `kit-task-pr` — see `${CLAUDE_PLUGIN_ROOT}/skills/kit-task-pr/SKILL.md`.
+
+## Execution
+
+1. Execute the full `kit-task-pr` flow, capturing the PR URL/number.
+2. Immediately execute the full `kit-task-pr-merge` flow using that PR number.
+
+If the PR can't be merged immediately (draft, checks pending, conflicts), report the blocker and stop — do not loop or retry silently.
+
+## Rules
+
+- Inherits all rules from `kit-task-pr` and `kit-task-pr-merge`
+- If `kit-task-pr` fails, stop — do not attempt merge
+- If merge fails due to conflicts, attempt the rebase fix from `kit-task-pr-merge` before giving up
+- Always end on the base branch with a clean pull on success

package/skills/kit-task-pr-merge/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: kit-task-pr-merge
+description: Squash-merge the open PR for the current branch, switch to the base branch, and pull. Auto-rebases onto the base if conflicts are detected.
+when_to_use: When work on an issue branch is ready to land. Always run after `/kit-task-pr`.
+---
+
+# kit-task-pr-merge
+
+Plugin-direct skill — thin caller over the ONE canonical home
+`${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-task-ops.sh` (`kto_task_pr_merge`). The verb logic lives
+there, never inline here (kit-engine-boundary #1/#2). The op respects `KIT_BASE_BRANCH` (default
+`develop`) and closes the PR's linked issues (native auto-close only fires on the default branch).
+
+## Inputs
+
+| Field     | Required | Notes                                          |
+| --------- | -------- | ---------------------------------------------- |
+| PR number | optional | Defaults to the open PR for the current branch |
+
+## Execution
+
+```bash
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-config.sh" && load_kit_config
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/role-identity.sh"
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/gh-project.sh"
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-task-ops.sh"
+
+kto_task_pr_merge            # open PR for the current branch
+# kto_task_pr_merge 845      # an explicit PR number
+```
+
+After it returns on the base branch, run the kit-sync drift check (advisory; never blocks):
+
+```bash
+MAIN_WT=$(git worktree list --porcelain | awk '/^worktree /{print $2; exit}')
+KIT_TOUCHED=$(git -C "$MAIN_WT" show --name-only --pretty=format: HEAD 2>/dev/null \
+  | grep -E '^(scripts/(lib/|kit$|kit-)|\.claude/(skills|rules|hooks|lib|agents)/)' | sort -u || true)
+if [[ -n "$KIT_TOUCHED" ]]; then
+  echo ""
+  echo "⚠ kit-sync: this change touched kit-managed files — review for upstream (/kit-contribute):"
+  printf '   %s\n' $KIT_TOUCHED
+  echo "   kit ⇄ project must stay in sync; an un-upstreamed change can be clobbered by /kit-update."
+fi
+```
+
+## Rules
+
+- Never merge a DRAFT PR — undraft first
+- Never force-push to the base branch
+- If rebase conflicts can't auto-resolve, the op aborts cleanly and surfaces the conflicting files
+- If merge fails for a non-conflict reason (failing checks), the op reports verbatim and does not retry
+- The op always ends on the base branch with a clean pull on success, and always cleans up the merged branch + worktree
+- Never delete a branch that still has an open PR or unpushed commits not on the base branch's remote

package/skills/kit-task-start/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: kit-task-start
+description: Start work on a GitHub issue — branch from the base branch (optionally an isolated worktree associated with the issue), mark the issue In Progress on the board (if enabled), switch to the branch.
+when_to_use: When beginning work on a tracked issue. Always run before editing files. Replaces ad-hoc `git checkout -b`.
+---
+
+# kit-task-start
+
+Plugin-direct skill — runs straight from `${CLAUDE_PLUGIN_ROOT}` (no per-project `scripts/`
+checkout needed). Helpers are sourced from the plugin; repo state (`gh`, `git`, the board) is
+the project you're standing in. Reads `.claude/kit.config.json` from the working directory.
+
+## Inputs
+
+| Field        | Required | Notes                                                       |
+| ------------ | -------- | ----------------------------------------------------------- |
+| Issue number | ✓        | `123`                                                       |
+| Slug         | optional | Short kebab suffix; defaults to a slug of the issue title   |
+| `--worktree` | optional | Isolated worktree instead of switching the main tree. **Required for parallel / sub-agent work.** Dir `<kind>+<N>-<slug>` encodes issue **#N**, so `kit-gc` won't wipe it while the issue is open. |
+
+Read the issue to derive the **kind** label — the branch prefix matches it.
+
+## Execution
+
+```bash
+source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/kit-config.sh" && load_kit_config
+[[ "$KIT_PROJECTS_V2" == "true" ]] && { source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/gh-project.sh"; load_project_ids; }
+BASE="${KIT_BASE_BRANCH:-main}"   # branch off the integration branch (override per project)
+
+NUM=""; SLUG_OVERRIDE=""; WORKTREE=0
+for a in "$@"; do
+  case "$a" in
+    --worktree) WORKTREE=1 ;;
+    *) [[ -z "$NUM" ]] && NUM="$a" || SLUG_OVERRIDE="$a" ;;
+  esac
+done
+META=$(gh issue view "$NUM" --repo "$KIT_REPO" --json title,labels,projectItems)
+TITLE=$(echo "$META" | jq -r .title)
+KIND=$(echo "$META" | jq -r '.labels[].name' | grep '^kind:' | head -1 | cut -d: -f2)
+[[ -z "$KIND" ]] && KIND="task"
+
+if [[ -n "$SLUG_OVERRIDE" ]]; then SLUG="$SLUG_OVERRIDE"; else
+  SLUG=$(echo "$TITLE" | sed -E 's/^\[[^]]+\][[:space:]]*//' \
+    | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9]+/-/g; s/^-|-$//g' | cut -c1-40)
+fi
+BRANCH="$KIND/$NUM-$SLUG"
+
+git fetch origin "$BASE" --quiet
+if [[ "$WORKTREE" -eq 1 ]]; then
+  # Worktree dir encodes the issue: <kind>+<N>-<slug> -> kit-gc protects it while #N is open.
+  WT_DIR=".claude/worktrees/${KIND}+${NUM}-${SLUG}"
+  if git worktree list --porcelain | grep -q "/${KIND}+${NUM}-${SLUG}$"; then
+    echo "✓ Worktree already exists: $WT_DIR (branch $BRANCH)"
+  else
+    git worktree add -B "$BRANCH" "$WT_DIR" "origin/$BASE"
+  fi
+  echo "→ cd $WT_DIR   # work happens here; one branch per worktree"
+else
+  [[ -n "$(git status --porcelain)" ]] && { echo "✗ Working tree not clean — or use --worktree."; exit 1; }
+  git checkout -B "$BRANCH" "origin/$BASE"
+fi
+
+if [[ "$KIT_PROJECTS_V2" == "true" ]]; then
+  ITEM_ID=$(echo "$META" | jq -r --arg t "$KIT_PROJECT_TITLE" '.projectItems[]? | select(.title==$t) | .id')
+  [[ -n "$ITEM_ID" ]] && project_set_single_select "$ITEM_ID" "$STATUS_FIELD_ID" "$STATUS_OPT_IN_PROGRESS"
+fi
+
+echo "✓ Branch $BRANCH (from $BASE) — issue #$NUM In Progress"
+```
+
+## Rules
+
+- Never start from a non-base branch (trunk-based) · never start with a dirty tree (in-place mode) — or use `--worktree`
+- **Parallel / sub-agent work MUST use `--worktree`** — one branch per worktree, never share a checkout. The worktree↔issue association keeps `kit-gc` from wiping in-progress work.
+- If the issue has no `role:` label, fail loudly and ask for triage
+- Never skip the board status update when Projects v2 is enabled

package/skills/kit-task-sync/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: kit-task-sync
+description: Query GitHub issues (+ Projects v2 if enabled) and print a status table grouped by Role. Flags blocked items and items missing a board entry.
+when_to_use: "What's the state of work?", "what's blocked?", "show me the board", or the start of any chapter that needs current ground truth instead of a stale snapshot.
+---
+
+# kit-task-sync
+
+Plugin-direct skill — the script resolves from `${CLAUDE_PLUGIN_ROOT}`.
+
+## What it does
+
+Runs `${CLAUDE_PLUGIN_ROOT}/scripts/task-sync.sh` — pure bash over `gh` CLI + jq. Reads
+`.claude/kit.config.json` (from the working directory) for the repo and board. Read-only —
+never mutates state.
+
+## Execution
+
+```bash
+"${CLAUDE_PLUGIN_ROOT}/scripts/task-sync.sh" [--role <Name>] [--milestone <label>]
+```
+
+## Output format
+
+Markdown table grouped by Role, sorted by Status (In Progress → Blocked → Todo → In Review → Done within 7 days), followed by:
+
+```
+**Blocked:** none ✓
+**No board entry:** none ✓
+**Stale (>14 days):** none ✓
+```
+
+## Rules
+
+- Pure read — never mutate
+- If `scripts/.project-ids.env` is missing and Projects v2 is enabled, prompt to run `${CLAUDE_PLUGIN_ROOT}/scripts/capture-project-ids.sh`
+- bash 3.2+ compatible (macOS system bash)

package/templates/CLAUDE.md.tmpl

@@ -0,0 +1,106 @@
+# {{PROJECT_NAME}}
+
+> Scaffolded by [claude-kit](https://github.com/tuempresadigital/claude-kit) — profile `{{PROFILE}}`.
+> Project config lives in `.claude/kit.config.json`. Edit freely; this file is yours now.
+
+<!-- IF:MEMORY -->
+## MANDATORY — Session Start Protocol
+
+**Do this before answering anything else:**
+
+1. Call `mempalace_status` — loads the MemPalace overview and recent decisions
+2. If the user's first message mentions a specific topic, call `mempalace_search "<topic>" wing={{WING}}`
+
+Skip only if the message is a pure file lookup with no decision context needed.
+<!-- /IF:MEMORY -->
+
+## Agents
+
+Spawn the matching agent for any domain task — do not answer domain decisions from the orchestrator level.
+
+{{AGENT_TABLE}}
+
+Agent definitions: `.claude/agents/<name>/AGENT.md`.
+
+## Skills
+
+{{SKILL_TABLE}}
+
+Invoke a skill when the user types `/<skill-name>` or when its `when_to_use` matches.
+
+<!-- IF:STACK_SKILLS -->
+## Stack conventions (auto-applying skills)
+
+Build conventions are **stack-gated skills** — each applies **only when its technology is in this
+project's `package.json`**. Before building features, check which apply:
+
+- `feature-build-refine` — when **RefineDev** (`@refinedev/*`) is present
+- `supabase-patterns` — when **Supabase** (`@supabase/supabase-js`) is present
+
+If the matching technology isn't in the stack, the skill simply doesn't apply. Add more per
+technology the same way. None are mandatory across the board.
+<!-- /IF:STACK_SKILLS -->
+
+<!-- IF:SPECKIT -->
+## Spec-driven development (Spec Kit)
+
+This project uses **Spec Kit** for feature work. Build through the SDD lifecycle with review gates:
+
+`/speckit-specify → /speckit-clarify → /speckit-plan → /speckit-tasks → /speckit-analyze → /speckit-implement`
+
+Run `/speckit-constitution` once per project. The `speckit` skill installs/identifies Spec Kit and
+explains the lifecycle.<!-- IF:STACK_SKILLS --> Any stack convention skill that matches the stack
+becomes the Spec Kit `feature-module.md` override.<!-- /IF:STACK_SKILLS --> Pick one branch authority
+— Spec Kit's git extension OR the kit's `task-*` skills — not both.
+<!-- /IF:SPECKIT -->
+
+## Task management
+
+- **Source of truth:** GitHub issues<!-- IF:PROJECTS_V2 --> + Projects v2 board (`https://github.com/users/{{GH_OWNER}}/projects/{{PROJECT_NUMBER}}`)<!-- /IF:PROJECTS_V2 -->
+- Repo: `{{GH_REPO}}`
+- **Never** maintain task lists in markdown — use `gh issue` + the `task-*` skills
+- Milestones: {{MILESTONES_HUMAN}}
+<!-- IF:PLANS -->
+- Plans live in `{{PLANS_DIR}}` (format: `{{PLANS_FORMAT}}`) — see `.claude/rules/plan-output-format.md`
+<!-- /IF:PLANS -->
+
+## PR workflow
+
+Every issue lands on `main` through a Pull Request. No direct commits to `main`.
+
+| Step              | Skill              | What it does                                            |
+| ----------------- | ------------------ | ------------------------------------------------------- |
+| 1. Pick an issue  | `/kit-task-sync`       | See the open board, choose what's unblocked             |
+| 2. Start work     | `/kit-task-start <N>`  | Branch `<kind>/<N>-<slug>` from main + mark In Progress |
+| 3. Do the work    | —                  | Code, write plans, etc.                                 |
+| 4. Open PR        | `/kit-task-pr <N>`     | Commit + push + open PR with template/labels/milestone  |
+| 5. Review + merge | `/kit-task-pr-merge`   | Squash-merge PR, switch to main, pull                   |
+| 6. Close          | `/kit-task-close <N>`  | Close issue (auto on `Closes #N`) + archive plan        |
+
+### Branch naming
+
+`<kind>/<issue-number>-<slug>` — kinds: `task`, `plan`, `adr`, `scaffold`, `spike`.
+
+### PR conventions
+
+- Title = exact issue title · Body includes `Closes #N`
+- Labels + milestone inherited from the issue · One PR per issue (coupled migration chains group into one) · Squash merge, linear history
+
+## Rules
+
+- Keep this file tight — point to files, don't duplicate content.
+- Bullets and tables preferred. No long intros.
+- Communication style → `.claude/rules/communication-style.md`
+<!-- IF:DESIGN -->
+- All design + adjustment questions → Designer agent (`.claude/rules/design-routing.md`)
+<!-- /IF:DESIGN -->
+<!-- IF:PLANS -->
+- Plan output format → `.claude/rules/plan-output-format.md`
+<!-- /IF:PLANS -->
+<!-- IF:MEMORY -->
+- Persistent memory protocol → `.claude/rules/mempalace.md`
+<!-- /IF:MEMORY -->
+
+## Language
+
+Default working language: {{COMMS_LANG}}. Match the language {{OWNER_NAME}} uses.