claude-code-kit 0.16.0__tar.gz → 0.17.0__tar.gz

{claude_code_kit-0.16.0 → claude_code_kit-0.17.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.16.0",
+      "version": "0.17.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.16.0 → claude_code_kit-0.17.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.16.0 → claude_code_kit-0.17.0}/CHANGELOG.md

@@ -4,6 +4,69 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.17.0] — 2026-06-17
+
+**Make agent-side learning capture an init-time, cost-aware choice — and make it actually remember.**
+The kit can now reflect on what *Claude itself* changed during a session and record durable learnings
+into `.claude/agent-memory/` (recalled next session by `load-learnings.sh`), via a fully-detached
+background `claude` job that **never blocks your session or next prompt**. How often that runs is the
+token-cost knob, so it is now a question at `claude-kit init` (`capture_mode`) rather than a fixed
+behavior — "everyone has their own way to memorize." Four modes (see `catalog/capture.yaml`):
+
+- **`off`** — no auto-capture; record with `/remember` when you choose (zero background cost).
+- **`session-end`** — one background capture when a session ends (~1/session). Lost on abrupt close.
+- **`session-end-catchup`** *(default, recommended)* — adds a SessionStart **catch-up** that, on the
+  next launch, captures any prior session that ended *without* being captured — i.e. one closed
+  abruptly with Ctrl-C / a hard kill / a closed terminal, where `SessionEnd` never ran. ~1/session,
+  robust to abrupt close.
+- **`per-task`** — capture after each file-editing task (Stop), scoped to that task's edits via a
+  line-count sentinel. Most resilient, highest token cost.
+
+One script (`hooks/scripts/capture-learnings.sh`) backs all of it, dispatched by an argument
+(`end`/`stop`/`catchup`); a per-transcript "done" marker lets a clean exit tell catch-up "already
+handled," so a session is never captured twice.
+
+**Two correctness fixes folded in (the previous SessionEnd capture looked done but did not actually
+remember):**
+- **Recall now works.** The background agent wrote the learning file but could not index it in
+  `MEMORY.md`, which is the *only* file `load-learnings.sh` reads — so learnings were invisible to
+  future sessions. Root cause: `.claude/` is a Claude-Code-protected path that `--permission-mode
+  acceptEdits` cannot write from a detached, no-TTY background agent. The capture child now runs with
+  `--permission-mode bypassPermissions` (safe here: file tools only, no shell, prompt-confined to
+  `.claude/agent-memory/`), and the prompt makes indexing in `MEMORY.md` mandatory + self-verified.
+  Round-trip (write → index → recall) verified end-to-end.
+- **`load-learnings.sh` zero-entry crash** — `grep -c … || echo 0` emitted `"0\n0"` → `integer
+  expected`; fixed with `|| true` + `${ENTRIES:-0}`.
+
+Conservative + safe by construction (golden rule #1 — stack-agnostic, fail-safe): every mode degrades
+to a silent no-op without `jq`/`claude`/a transcript or when the project has no `agent-memory/`, and
+only spawns when there were actual file edits. The job inherits the user's logged-in auth, runs
+hook-free (`--settings '{"disableAllHooks":true}'`); recursion is broken by `CLAUDE_KIT_NO_AUTOCAPTURE=1`
+(passed to the child), which doubles as the user opt-out. `CLAUDE_KIT_CAPTURE_MODEL` optionally pins a
+model (default: inherit the user's).
+
+### Added
+- **`capture_mode` init choice** — new `catalog/capture.yaml` (the four modes → hook sets, default
+  `session-end-catchup`); a `Selection.capture_mode` field; an interactive prompt (profile-aware
+  default: **lean → off**, otherwise the recommended catch-up); `--config` / `--defaults` support;
+  `catalog.capture_mode_options()` + a branch-free `catalog._apply_capture_mode()` that swaps the
+  capture hooks for the chosen mode (golden rule #6 — pure data + set op).
+- **Three capture triggers** in `HOOK_REGISTRY`, all backed by the one `capture-learnings.sh`:
+  `capture-learnings` (SessionEnd, `end`), `capture-learnings-catchup` (SessionStart, `catchup`),
+  `capture-learnings-stop` (Stop, `stop`). The recommended default is wired into the plugin
+  (`hooks/hooks.json`) and the no-pip fallback (`templates/settings.json`).
+
+### Changed
+- `catalog/profiles.yaml` — the standard profile no longer hard-lists `capture-learnings`; capture is
+  installed by `capture_mode`, not profile membership (`load-learnings` recall stays profile-driven).
+- **Docs** — `README.md`, `rules/agent-memory.md`, `docs/agentic-patterns.md` (Ch. 9),
+  `docs/coverage-audit.md`, `skills/remember/SKILL.md`, and `CONTRIBUTING.md` describe the configurable,
+  abrupt-close-robust capture.
+
+### Fixed
+- Background capture now reliably **indexes** learnings in `MEMORY.md` (was write-only → unrecalled).
+- `load-learnings.sh` no longer errors on a zero-entry index.
+
 ## [0.16.0] — 2026-06-16
 
 **Adopt a full React/Tailwind/Radix design-system rule set as always-on React overlay rules.** Three

{claude_code_kit-0.16.0 → claude_code_kit-0.17.0}/CONTRIBUTING.md

@@ -39,7 +39,10 @@ locally, and how to release.
 - **Rule** → add `rules/<name>.md`; cross-reference siblings as `.claude/rules/<name>.md`.
 - **Hook** → add a script to `hooks/scripts/`, register it in the `HOOK_REGISTRY` in
   `src/claude_kit/hooks.py`, wire it in `hooks/hooks.json` (plugin), and list its id in the relevant
-  profile's `hooks:`.
+  profile's `hooks:`. (Exception: the agent-side capture hooks `capture-learnings[-catchup|-stop]` are
+  **not** profile-listed — they're installed by the init-time `capture_mode` choice via
+  `catalog/capture.yaml` + `catalog._apply_capture_mode`. One script, three triggers, dispatched by an
+  arg.)
 - **Stack** (framework / database) → a **data change**: add an entry to `catalog/stacks.yaml`
   (`label`, `overlay_rules`, optional `overlay_agents`, `skills`, `stack_dir`, `commands`) and create
   `templates/stacks/<stack_dir>/rules/<name>.md` (+ `agents/` for a database). Mark not-yet-ready

{claude_code_kit-0.16.0 → claude_code_kit-0.17.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.16.0
+Version: 0.17.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -41,7 +41,7 @@ with a quality gate between every phase. **No application code. No Docker. Confi
 [![CI](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml)
 [![Changelog](https://img.shields.io/badge/changelog-md-blue.svg)](CHANGELOG.md)
 
-🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
+🚀 [Quick start](#quick-start) · ✨ [Features](#features) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
 
 </div>
 
@@ -68,7 +68,10 @@ refuses to advance a phase until its **quality gate** passes. You drive it all w
 - 👥 **Scope to your team** — `individual` / `team` (default) / `organization`. Org scope adds a
   vibe-coding layer so PMs, designers, QA, support, and founders can drive work safely too.
 - 🧠 **Remembers across sessions** — working memory (`CONTINUITY.md`) survives context compaction, and a
-  learnings loop (`agent-memory/`) means the same mistake isn't made twice.
+  learnings loop (`agent-memory/`) means the same mistake isn't made twice. Learnings are captured
+  automatically — from your corrections *and*, in a non-blocking background job, from what Claude
+  changed. How aggressively to capture is a cost-aware choice at `init` (`capture_mode`: off · on
+  clean exit · + catch-up for sessions closed abruptly · per task).
 - 📦 **Two channels, one source** — a first-class Claude Code **plugin** *and* a **pip** scaffolder.
 
 > Inspired by the autonomous-SDLC idea, rebuilt from the ground up **for Claude Code**, and kept small
@@ -167,6 +170,116 @@ README.claude-sdlc.md
 
 ---
 
+## Features
+
+A complete, governed autonomous SDLC — installed as configuration, driven by `/sdlc`, and tunable to
+your stack, rigor, and team. The full surface, grouped by what it does:
+
+### 🔁 Pipeline & quality gates
+
+- **Gate-enforced progression** — every phase ends in a quality gate that passes *only* with zero open
+  Critical/High/Medium findings; no silent advancement (see [the pipeline](#the-pipeline)).
+- **Profile-scoped gates** — `lean` runs `code-review · build-green`; `standard` adds spec / EM /
+  coverage / security / contract; `enterprise` adds `pipeline-green · observability-ready · acceptance`.
+- **Fast-track mode** — changes under 5 files collapse to Developer → Code Reviewer → Tester → PR,
+  skipping the heavyweight stages.
+- **Anti-sycophancy guard** — a *unanimous* PASS is treated as suspicious and triggers an adversarial
+  `devils-advocate` pass before the gate may close.
+
+### 🤖 The agent roster
+
+- **28 specialized agents** in [`agents/`](agents/), each tagged with a `tier`
+  (orchestrator · stage-lead · specialist · review) and installed per profile.
+- **An Orchestrator that never writes code** — it decomposes work, runs independent lanes in parallel,
+  and blocks each phase on its gate.
+- **Database overlay agents** layer in per database — PostgreSQL adds
+  `postgres-specialist · migration-specialist · db-performance-reviewer`; MongoDB adds
+  `mongodb-specialist · migration-specialist`.
+- **6 organization personas** (`pm-copilot` · `founder-prototype-agent` · `support-ticket-engineer` ·
+  `data-workflow-agent` · `internal-tools-builder` · `staff-pm-reviewer`) unlock in org scope so
+  non-engineers can drive work safely.
+
+### 🔍 Self-verification & review
+
+- **RARV self-check** — every agent runs Reason → Act → Reflect → Verify and must show a *green Verify*
+  (real commands run, not imagined) before handing off.
+- **Blind parallel review** — independent reviewers judge a work stream separately, and a
+  `merge-reviewer` reconciles parallel lanes at every join point.
+- **Risk-classified work** — a read-only `risk-classifier` labels each task low/medium/high/restricted
+  and names the gates it requires (enterprise + org).
+
+### 📐 Rules & skills
+
+- **23 stack-agnostic core rules** in [`rules/`](rules/) — `mandatory-workflow`, `quality-gates`,
+  `rarv-cycle`, `continuity`, plus eight agent-operation rules and `autonomy-levels` +
+  `risk-classification` (see [`docs/agentic-patterns.md`](docs/agentic-patterns.md)).
+- **51 on-demand skills** in [`skills/`](skills/) — spec-driven dev, planning, TDD, debugging, code
+  review, threat modeling, and more — activated by context and led by the `sdlc` entrypoint.
+- **Profile-subset install** — each profile installs a strict subset of agents, skills, hooks, and
+  rules (`lean ⊂ standard ⊂ enterprise`), from fast track to full audit.
+
+### 🧱 Stacks & overlays
+
+- **Stack-agnostic core** — the pipeline assumes no language or framework; it never writes your app
+  code and never needs Docker.
+- **10 stack overlay rules** layer matching guidance on top — React, FastAPI, Go/net-http, PostgreSQL,
+  MongoDB — wired to your exact lint/test/build commands.
+- **A full React design system** — picking React installs design tokens, UX patterns, and
+  mobile/Capacitor guidelines that the UI skills and `ui-designer` agent read.
+
+### 🎚️ Profiles, scopes & the org layer
+
+- **3 rigor profiles** — `lean ⊊ standard ⊊ enterprise` decide how many agents, skills, hooks, and
+  gates are active.
+- **3 usage scopes** — `individual` / `team` (default) / `organization`, with a vibe-coding layer in
+  org scope.
+- **5 autonomy levels** — from Advisory (plan & review only) through Autonomous (PR) to
+  Enterprise-controlled, each adding deterministic guardrail hooks.
+- **7 capability packs + 10 org policy rules** under [`templates/org/`](templates/org/) (secrets, PII,
+  compliance, production-data) install only in organization scope (see
+  [`docs/org-capabilities.md`](docs/org-capabilities.md)).
+
+### 🧠 Memory & continuous learning
+
+- **Working memory across sessions** — `CONTINUITY.md` survives context compaction so the pipeline
+  never loses its place.
+- **A learnings loop** — `agent-memory/` captures fixes from your corrections *and*, in a non-blocking
+  background job, from what Claude changed, so the same mistake isn't made twice.
+- **Cost-aware capture** — how aggressively learnings are captured (`capture_mode`: off · on clean
+  exit · + catch-up · per task) is a choice at `init`.
+
+### 🛠️ Hooks & deterministic guards
+
+- **16 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
+  `guard-secrets`, `guard-destructive-git`, `lint-fix`, `type-check`, and `validate-settings` run
+  deterministically.
+- **Advisory, never-blocking warnings** — `warn-llm-io`, `warn-large-edits`, `warn-missing-tests`, and
+  `warn-sensitive-files` flag risk without halting work.
+- **Graceful degradation** — hooks need a POSIX shell + `jq` and silently no-op when absent, so the
+  kit still functions everywhere.
+
+### 📦 Distribution & lifecycle
+
+- **Two channels, one source** — a first-class Claude Code **plugin** *and* a `pip` scaffolder
+  (`claude-kit` / `ckit` / `claude-sdlc`) generate identical config.
+- **Catalog-driven extensibility** — adding a stack, framework, database, profile, MCP server, or org
+  pack is a [`catalog/`](catalog/) YAML edit, never a code change; 9 MCP server fragments ship ready.
+- **Safe, edit-preserving upgrades** — `upgrade` refreshes kit/overlay files via per-file `owner` +
+  checksum, never clobbers your edits, backs up changes, and restores deleted files (`diff` previews
+  first).
+
+### ♻️ Reuse-first by design
+
+- **Adopt only the genuinely-new** — each external review fetches the real source, adversarially maps
+  it against existing files, and ships only the non-duplicative gaps (see
+  [what we adopted](#influences--what-we-adopted)).
+- **Opt-in LLM/AI security** — `security-and-hardening` covers the OWASP LLM Top 10 (input/output
+  guardrails, PII vault) as bypassable guidance, distinct from the mandatory appsec gate.
+- **A worked example + self-test matrix** — [`examples/`](examples/) shows an end-to-end run, and a
+  profile×stack×scope test matrix backs the stack-agnostic claim.
+
+---
+
 ## How it works
 
 ```mermaid
@@ -302,7 +415,7 @@ It is **not** a runtime, an orchestration engine, or a code library. That framin
 | **[wshobson/agents](https://github.com/wshobson/agents)** & similar agent collections | Large libraries of individual subagent prompts you pick from | claude-kit ships a **smaller, opinionated set wired into a sequenced pipeline with owned quality gates** — agents aren't a menu, they're stages that hand off and block on each other. Adopt-by-reuse, not by accumulation. |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | A spec-driven workflow (constitution → spec → tasks → analyze) | claude-kit **absorbed spec-kit's coverage-gate idea** (the `story-planner` 1f gate + `task-tracker-sync`) into a **broader** lifecycle that also covers review, security, build, test, release, and observability gates. Complementary, wider scope. |
 | **claude-flow / multi-agent runtimes** | Runtime orchestrators that *execute* swarms of agents | claude-kit produces **portable configuration**, not a running process — the orchestration is described in rules the host (Claude Code) executes. No daemon, no lock-in, no app code. |
-| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, ~28 agents, ~52 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
+| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 51 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
 
 **Choose claude-kit when** you want a consistent, reviewable, **gate-enforced** autonomous-SDLC setup
 that's the same across every repo and stack, installs in seconds, ships nothing you have to run, and
@@ -349,7 +462,7 @@ that's the same across every repo and stack, installs in seconds, ships nothing
 | `incident-responder` | Production-incident triage, mitigation, and postmortem (enterprise scope) |
 | `pr-raiser` | Final checks, commit hygiene, and PR creation |
 | **DB overlays** | installed for the selected database — PostgreSQL → `postgres-specialist` · `migration-specialist` · `db-performance-reviewer`; MongoDB → `mongodb-specialist` · `migration-specialist` |
-| **Org personas** | `pm-copilot` · `founder-prototype-agent` · `support-ticket-engineer` · `data-workflow-agent` · `internal-tools-builder` (organization scope only) |
+| **Org personas** | `pm-copilot` · `founder-prototype-agent` · `support-ticket-engineer` · `data-workflow-agent` · `internal-tools-builder` · `staff-pm-reviewer` (organization scope only) |
 
 </details>
 

{claude_code_kit-0.16.0 → claude_code_kit-0.17.0}/README.md

@@ -14,7 +14,7 @@ with a quality gate between every phase. **No application code. No Docker. Confi
 [![CI](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml)
 [![Changelog](https://img.shields.io/badge/changelog-md-blue.svg)](CHANGELOG.md)
 
-🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
+🚀 [Quick start](#quick-start) · ✨ [Features](#features) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
 
 </div>
 
@@ -41,7 +41,10 @@ refuses to advance a phase until its **quality gate** passes. You drive it all w
 - 👥 **Scope to your team** — `individual` / `team` (default) / `organization`. Org scope adds a
   vibe-coding layer so PMs, designers, QA, support, and founders can drive work safely too.
 - 🧠 **Remembers across sessions** — working memory (`CONTINUITY.md`) survives context compaction, and a
-  learnings loop (`agent-memory/`) means the same mistake isn't made twice.
+  learnings loop (`agent-memory/`) means the same mistake isn't made twice. Learnings are captured
+  automatically — from your corrections *and*, in a non-blocking background job, from what Claude
+  changed. How aggressively to capture is a cost-aware choice at `init` (`capture_mode`: off · on
+  clean exit · + catch-up for sessions closed abruptly · per task).
 - 📦 **Two channels, one source** — a first-class Claude Code **plugin** *and* a **pip** scaffolder.
 
 > Inspired by the autonomous-SDLC idea, rebuilt from the ground up **for Claude Code**, and kept small
@@ -140,6 +143,116 @@ README.claude-sdlc.md
 
 ---
 
+## Features
+
+A complete, governed autonomous SDLC — installed as configuration, driven by `/sdlc`, and tunable to
+your stack, rigor, and team. The full surface, grouped by what it does:
+
+### 🔁 Pipeline & quality gates
+
+- **Gate-enforced progression** — every phase ends in a quality gate that passes *only* with zero open
+  Critical/High/Medium findings; no silent advancement (see [the pipeline](#the-pipeline)).
+- **Profile-scoped gates** — `lean` runs `code-review · build-green`; `standard` adds spec / EM /
+  coverage / security / contract; `enterprise` adds `pipeline-green · observability-ready · acceptance`.
+- **Fast-track mode** — changes under 5 files collapse to Developer → Code Reviewer → Tester → PR,
+  skipping the heavyweight stages.
+- **Anti-sycophancy guard** — a *unanimous* PASS is treated as suspicious and triggers an adversarial
+  `devils-advocate` pass before the gate may close.
+
+### 🤖 The agent roster
+
+- **28 specialized agents** in [`agents/`](agents/), each tagged with a `tier`
+  (orchestrator · stage-lead · specialist · review) and installed per profile.
+- **An Orchestrator that never writes code** — it decomposes work, runs independent lanes in parallel,
+  and blocks each phase on its gate.
+- **Database overlay agents** layer in per database — PostgreSQL adds
+  `postgres-specialist · migration-specialist · db-performance-reviewer`; MongoDB adds
+  `mongodb-specialist · migration-specialist`.
+- **6 organization personas** (`pm-copilot` · `founder-prototype-agent` · `support-ticket-engineer` ·
+  `data-workflow-agent` · `internal-tools-builder` · `staff-pm-reviewer`) unlock in org scope so
+  non-engineers can drive work safely.
+
+### 🔍 Self-verification & review
+
+- **RARV self-check** — every agent runs Reason → Act → Reflect → Verify and must show a *green Verify*
+  (real commands run, not imagined) before handing off.
+- **Blind parallel review** — independent reviewers judge a work stream separately, and a
+  `merge-reviewer` reconciles parallel lanes at every join point.
+- **Risk-classified work** — a read-only `risk-classifier` labels each task low/medium/high/restricted
+  and names the gates it requires (enterprise + org).
+
+### 📐 Rules & skills
+
+- **23 stack-agnostic core rules** in [`rules/`](rules/) — `mandatory-workflow`, `quality-gates`,
+  `rarv-cycle`, `continuity`, plus eight agent-operation rules and `autonomy-levels` +
+  `risk-classification` (see [`docs/agentic-patterns.md`](docs/agentic-patterns.md)).
+- **51 on-demand skills** in [`skills/`](skills/) — spec-driven dev, planning, TDD, debugging, code
+  review, threat modeling, and more — activated by context and led by the `sdlc` entrypoint.
+- **Profile-subset install** — each profile installs a strict subset of agents, skills, hooks, and
+  rules (`lean ⊂ standard ⊂ enterprise`), from fast track to full audit.
+
+### 🧱 Stacks & overlays
+
+- **Stack-agnostic core** — the pipeline assumes no language or framework; it never writes your app
+  code and never needs Docker.
+- **10 stack overlay rules** layer matching guidance on top — React, FastAPI, Go/net-http, PostgreSQL,
+  MongoDB — wired to your exact lint/test/build commands.
+- **A full React design system** — picking React installs design tokens, UX patterns, and
+  mobile/Capacitor guidelines that the UI skills and `ui-designer` agent read.
+
+### 🎚️ Profiles, scopes & the org layer
+
+- **3 rigor profiles** — `lean ⊊ standard ⊊ enterprise` decide how many agents, skills, hooks, and
+  gates are active.
+- **3 usage scopes** — `individual` / `team` (default) / `organization`, with a vibe-coding layer in
+  org scope.
+- **5 autonomy levels** — from Advisory (plan & review only) through Autonomous (PR) to
+  Enterprise-controlled, each adding deterministic guardrail hooks.
+- **7 capability packs + 10 org policy rules** under [`templates/org/`](templates/org/) (secrets, PII,
+  compliance, production-data) install only in organization scope (see
+  [`docs/org-capabilities.md`](docs/org-capabilities.md)).
+
+### 🧠 Memory & continuous learning
+
+- **Working memory across sessions** — `CONTINUITY.md` survives context compaction so the pipeline
+  never loses its place.
+- **A learnings loop** — `agent-memory/` captures fixes from your corrections *and*, in a non-blocking
+  background job, from what Claude changed, so the same mistake isn't made twice.
+- **Cost-aware capture** — how aggressively learnings are captured (`capture_mode`: off · on clean
+  exit · + catch-up · per task) is a choice at `init`.
+
+### 🛠️ Hooks & deterministic guards
+
+- **16 event hook scripts** in [`hooks/`](hooks/) enforce the pipeline outside the model —
+  `guard-secrets`, `guard-destructive-git`, `lint-fix`, `type-check`, and `validate-settings` run
+  deterministically.
+- **Advisory, never-blocking warnings** — `warn-llm-io`, `warn-large-edits`, `warn-missing-tests`, and
+  `warn-sensitive-files` flag risk without halting work.
+- **Graceful degradation** — hooks need a POSIX shell + `jq` and silently no-op when absent, so the
+  kit still functions everywhere.
+
+### 📦 Distribution & lifecycle
+
+- **Two channels, one source** — a first-class Claude Code **plugin** *and* a `pip` scaffolder
+  (`claude-kit` / `ckit` / `claude-sdlc`) generate identical config.
+- **Catalog-driven extensibility** — adding a stack, framework, database, profile, MCP server, or org
+  pack is a [`catalog/`](catalog/) YAML edit, never a code change; 9 MCP server fragments ship ready.
+- **Safe, edit-preserving upgrades** — `upgrade` refreshes kit/overlay files via per-file `owner` +
+  checksum, never clobbers your edits, backs up changes, and restores deleted files (`diff` previews
+  first).
+
+### ♻️ Reuse-first by design
+
+- **Adopt only the genuinely-new** — each external review fetches the real source, adversarially maps
+  it against existing files, and ships only the non-duplicative gaps (see
+  [what we adopted](#influences--what-we-adopted)).
+- **Opt-in LLM/AI security** — `security-and-hardening` covers the OWASP LLM Top 10 (input/output
+  guardrails, PII vault) as bypassable guidance, distinct from the mandatory appsec gate.
+- **A worked example + self-test matrix** — [`examples/`](examples/) shows an end-to-end run, and a
+  profile×stack×scope test matrix backs the stack-agnostic claim.
+
+---
+
 ## How it works
 
 ```mermaid
@@ -275,7 +388,7 @@ It is **not** a runtime, an orchestration engine, or a code library. That framin
 | **[wshobson/agents](https://github.com/wshobson/agents)** & similar agent collections | Large libraries of individual subagent prompts you pick from | claude-kit ships a **smaller, opinionated set wired into a sequenced pipeline with owned quality gates** — agents aren't a menu, they're stages that hand off and block on each other. Adopt-by-reuse, not by accumulation. |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | A spec-driven workflow (constitution → spec → tasks → analyze) | claude-kit **absorbed spec-kit's coverage-gate idea** (the `story-planner` 1f gate + `task-tracker-sync`) into a **broader** lifecycle that also covers review, security, build, test, release, and observability gates. Complementary, wider scope. |
 | **claude-flow / multi-agent runtimes** | Runtime orchestrators that *execute* swarms of agents | claude-kit produces **portable configuration**, not a running process — the orchestration is described in rules the host (Claude Code) executes. No daemon, no lock-in, no app code. |
-| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, ~28 agents, ~52 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
+| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 51 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
 
 **Choose claude-kit when** you want a consistent, reviewable, **gate-enforced** autonomous-SDLC setup
 that's the same across every repo and stack, installs in seconds, ships nothing you have to run, and
@@ -322,7 +435,7 @@ that's the same across every repo and stack, installs in seconds, ships nothing
 | `incident-responder` | Production-incident triage, mitigation, and postmortem (enterprise scope) |
 | `pr-raiser` | Final checks, commit hygiene, and PR creation |
 | **DB overlays** | installed for the selected database — PostgreSQL → `postgres-specialist` · `migration-specialist` · `db-performance-reviewer`; MongoDB → `mongodb-specialist` · `migration-specialist` |
-| **Org personas** | `pm-copilot` · `founder-prototype-agent` · `support-ticket-engineer` · `data-workflow-agent` · `internal-tools-builder` (organization scope only) |
+| **Org personas** | `pm-copilot` · `founder-prototype-agent` · `support-ticket-engineer` · `data-workflow-agent` · `internal-tools-builder` · `staff-pm-reviewer` (organization scope only) |
 
 </details>
 

claude_code_kit-0.17.0/catalog/capture.yaml

@@ -0,0 +1,37 @@
+# claude-kit learning-capture modes — the cost↔coverage choice surfaced at `claude-kit init`.
+#
+# The kit closes the self-improving loop two ways: RECALL (`load-learnings` SessionStart hook injects
+# `.claude/agent-memory/MEMORY.md`) and CAPTURE (a detached background `claude` job records what the
+# agent itself changed/learned). This file governs ONLY the agent-side CAPTURE trigger — how often /
+# when it fires — because that is where token cost accrues and preferences differ. RECALL and the
+# user-side `learning-detection` hook stay profile-driven.
+#
+# One script (`hooks/scripts/capture-learnings.sh`) backs every mode, dispatched by an argument
+# (`end` / `stop` / `catchup`); the registry in `src/claude_kit/hooks.py` maps each hook id below to
+# that script + event. `catalog._apply_capture_mode()` is the ONLY consumer: it strips the union of all
+# modes' hooks from the resolved set (so the profile / the enterprise `all` token never force a capture
+# trigger) and adds back exactly the chosen mode's hooks, ensuring `load-learnings` (recall) is present
+# whenever capture is on. Adding/retuning a mode is a pure data edit here — no code change (golden rule #6).
+
+version: 1
+
+# Used by `--defaults`, the plugin install, and shown as the recommended pick. The interactive prompt
+# overrides this to `off` for the lean profile (lean is intentionally minimal).
+default: session-end-catchup
+
+modes:
+  "off":
+    label: "Off — capture only when you run /remember (zero background cost)"
+    hooks: []
+
+  session-end:
+    label: "On clean exit — one background capture when a session ends (~1/session; skipped on abrupt close)"
+    hooks: [capture-learnings]
+
+  session-end-catchup:
+    label: "On clean exit + catch-up — also captures sessions closed abruptly (Ctrl-C/kill), on next launch (recommended; ~1/session)"
+    hooks: [capture-learnings, capture-learnings-catchup]
+
+  per-task:
+    label: "Per task — capture after each file-editing task; most resilient, highest token cost"
+    hooks: [capture-learnings-stop]

{claude_code_kit-0.16.0 → claude_code_kit-0.17.0}/catalog/profiles.yaml

@@ -88,6 +88,9 @@ profiles:
     # non-API projects on standard while enforcing backward-compatibility for API-exposing backends
     # (e.g. FastAPI). Promoted from enterprise-only per brief #2 P0-1 — see CHANGELOG 0.13.0.
     gates: [spec-complete, em-approved, code-review, build-green, test-coverage, security-clear, contract-clear]
+    # NOTE: the agent-side capture hooks (capture-learnings / -catchup / -stop) are deliberately NOT
+    # listed here — they are installed by the init-time `capture_mode` choice via catalog/capture.yaml
+    # (see catalog._apply_capture_mode), not by profile membership. load-learnings (recall) stays.
     hooks: [load-continuity, load-learnings, load-autonomy, skill-routing, learning-detection, guard-rm-rf, guard-push-main, guard-destructive-git, protect-secrets, guard-commit-secrets, warn-shared-modules, warn-llm-io, lint-fix, type-check]
 
   enterprise:

{claude_code_kit-0.16.0 → claude_code_kit-0.17.0}/docs/agentic-patterns.md

@@ -25,7 +25,7 @@ they are already embodied in its rules, agents, skills, and the orchestration mo
 | 6 | Planning | `agents/spec-doc-writer`, `story-planner`, `technical-architect`; `skills/spec-driven-development`, `planning-and-task-breakdown`, `scope`, `sprint` | covered (strong) |
 | 7 | Multi-Agent Collaboration | 28 agents; subagents + Agent-Teams worked example in orchestration-patterns | covered (strong) |
 | 8 | Memory Management | `rules/continuity.md` (working) + `rules/agent-memory.md` (durable, now with the **working/episodic/semantic/procedural** taxonomy); `skills/remember`, `consolidate-learnings`, `context-engineering` | covered (taxonomy added) |
-| 9 | Learning & Adaptation | `rules/agent-memory.md`; `skills/remember`; the `load-learnings` SessionStart hook | covered |
+| 9 | Learning & Adaptation | `rules/agent-memory.md`; `skills/remember`; the `load-learnings` SessionStart hook; **auto-capture from two sides** — the `learning-detection` UserPromptSubmit hook (user corrections) **and** the configurable `capture-learnings` hook (a non-blocking background job over Claude's own work, fired per the init-time `capture_mode`: SessionEnd · +SessionStart catch-up for abrupt closes · per-task Stop) | covered |
 | 10 | Model Context Protocol (MCP) | `catalog/mcp.yaml` → `.mcp.json`; `skills/browser-testing-with-devtools`; design guidance in `rules/tool-design.md` | covered (strong) |
 | 11 | Goal Setting & Monitoring | **`rules/goal-setting-and-monitoring.md`** (new) + spec acceptance criteria + `acceptance-reviewer` + quality-gates process signals | **rule added** |
 | 12 | Exception Handling & Recovery | **`rules/agent-resilience.md`** (new) + gate retry budgets + `skills/debugging-and-error-recovery` (product bugs) | **rule added** |

{claude_code_kit-0.16.0 → claude_code_kit-0.17.0}/docs/coverage-audit.md

@@ -41,7 +41,7 @@ enforcement class:
 |------------|-------|----------|----------------|
 | **Autonomous-action safety** (P0-1) | **RULE — always-on** | `rules/agent-guardrails.md` §3 block/confirm/allow posture + verify-the-target + §1 "untrusted content never authorizes"; cross-ref `rules/risk-classification.md` restricted tier; deterministic backstops `hooks/scripts/guard-destructive-git.sh` + `rm -rf`/push-main guards | all profiles (rule + the existing guard hooks) |
 | **Anti-fabrication of verdicts** (P0-2) | **RULE + auto-Critical** | `rules/quality-gates.md` §2.5 (verdict must cite real command + output) and §1 (fabricated/assumed/partial verdict = auto-Critical); reinforced in `rules/agent-guardrails.md` §2 + `rules/rarv-cycle.md` | all gates, all profiles (a fabricated verdict blocks like any Critical) |
-| **Memory hygiene** (P1-1) | **RULE — always-on** | `rules/agent-memory.md` "Memory hygiene" (verify-before-trust, cited selective attachment, CLAUDE.md precedence); `rules/continuity.md` start-of-turn line; `remember` skill staleness check | all profiles (advisory discipline) |
+| **Memory hygiene** (P1-1) | **RULE — always-on** | `rules/agent-memory.md` "Memory hygiene" (verify-before-trust, cited selective attachment, CLAUDE.md precedence); `rules/continuity.md` start-of-turn line; `remember` skill staleness check. Capture is automatic from both sides: the `learning-detection` UserPromptSubmit hook (user corrections) + the configurable `capture-learnings` hook (a non-blocking background job over Claude's own work) | all profiles (advisory discipline); capture via the init-time `capture_mode` choice (default: on clean exit + catch-up) |
 | **Resume snapshot** (P1-2) | **RULE + MECH** | `rules/continuity.md` schema for `.claude/state/pipeline-snapshot.json` + reload-not-rerun protocol; written/read by `orchestrator` + `sdlc` skill; dir created by the pip installer (gitignored) and `load-continuity.sh` | all profiles (state mechanism + rule) |
 | **Plan-phase critique** (P1-3) | **GATED — standard+**; RULE in lean | standard+: `devils-advocate` on the spec before EM approval is final (`mandatory-workflow.md` §1e.5, `quality-gates.md` §3, orchestrator Stage PC) — UPHELD blocks the spec gate. lean: the `spec-doc-writer` self-critique (RARV) only, no agent | standard+ (blocking); lean (advisory self-critique) |
 | **Implementer house style** (P2-1) | **RULE + code-review checks** | `templates/CLAUDE.md` "Surgical Changes" (delete-vs-shim, validate-at-boundary, cite `path:line`; no-narration cross-ref `documentation.md` §6); `sdlc-code-reviewer` Change-Hygiene checks (shim = Medium, redundant validation = Low, narration = Low) | all profiles (rule); the code-review gate enforces the checks |

{claude_code_kit-0.16.0 → claude_code_kit-0.17.0}/hooks/hooks.json

@@ -5,7 +5,8 @@
       "hooks": [
         { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-continuity.sh\"" },
         { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-learnings.sh\"" },
-        { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-autonomy.sh\"" }
+        { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/load-autonomy.sh\"" },
+        { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/capture-learnings.sh\" catchup" }
       ]
     }
   ],
@@ -57,5 +58,13 @@
         { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/type-check.sh\"" }
       ]
     }
+  ],
+  "SessionEnd": [
+    {
+      "matcher": "",
+      "hooks": [
+        { "type": "command", "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/scripts/capture-learnings.sh\" end" }
+      ]
+    }
   ]
 }