claude-code-kit 0.18.0__tar.gz → 0.20.0__tar.gz

{claude_code_kit-0.18.0 → claude_code_kit-0.20.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.18.0",
+      "version": "0.20.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.18.0 → claude_code_kit-0.20.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.18.0 → claude_code_kit-0.20.0}/.gitignore

@@ -17,6 +17,11 @@ venv/
 # concepts were paraphrased into rules/, never its text). Keep the binary out of the repo.
 Agentic_Design_Patterns.pdf
 
+# Internal source archive for the zap-vapt-scanning skill — the skill ships only the genericized
+# script under skills/zap-vapt-scanning/scripts/; the original company tool (branding + logo) is
+# kept locally and must never be committed.
+zap-vapt-tool.zip
+
 # Local Claude Code working state (this repo's own; not part of the distributable kit).
 # This already covers the live working-memory file at .claude/CONTINUITY.md.
 # Do NOT add a bare `CONTINUITY.md` here: with no leading slash it matches at every

{claude_code_kit-0.18.0 → claude_code_kit-0.20.0}/CHANGELOG.md

@@ -4,6 +4,135 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.20.0] — 2026-06-20
+
+**Expand the stack-specific skill collection: 21 new skills + 7 fold-in enhancements + a security pass,
+plus a BigQuery skill extend/trim (now 43 skills).**
+
+### Added
+
+21 new skills under `skills/`. Twenty are genericized engineering skills surfaced by cross-repo gap
+analysis (one from a live production Grafana, one bundling an internal OWASP ZAP VAPT tool, and two
+security-architecture skills from a cross-repo security gap analysis), grounded in real production
+Python/FastAPI, Node/Express, and React services; the twenty-first (`shannon-ai-pentest`) is
+documentation for an external third-party tool (see Security):
+
+- **Backend & infra** — `configargparse-yaml-env-layering` (3-layer YAML→configargparse→Pydantic config),
+  `redis-caching-patterns` (multi-tenant namespacing, TTL, graceful degradation, SCAN invalidation),
+  `gcs-file-storage-patterns` (uploads, signed URLs via impersonation, read CSV/Excel),
+  `file-export-and-reporting` (Excel/CSV generation + StreamingResponse downloads),
+  `api-pagination-filtering-sorting` (query conventions + response metadata),
+  `gcp-cloud-run-github-actions` (Cloud Run deploy via GitHub Actions),
+  `notifications-and-messaging` (multi-provider email/SMS with fallback).
+- **AI/LLM** — `anthropic-vertex-integration` (Claude on Vertex AI via AnthropicVertex SDK),
+  `langfuse-llm-tracing` (LLM tracing, Python + TypeScript).
+- **Node/Express** — `node-express-service` (app factory, MODE dispatch, convict, middleware),
+  `node-objection-knex` (Objection + Knex data layer + Joi validation).
+- **Frontend** — `zustand-state-patterns`, `tanstack-react-query-patterns`,
+  `react-hook-form-zod-patterns`, `radix-tailwind-component-patterns`, `vitest-rtl-msw-patterns`.
+- **Observability** — `grafana-dashboards-and-alerts` (Grafana dashboard JSON model, `$datasource` +
+  cascading `label_values` template variables, RED-metric PromQL across NGINX ingress / OTel
+  span-metrics / pod utilization, multi-stage unified-alert rules with label-based routing
+  (slack_0/pagerduty_0/webhook_0) + dashboard/panel deep-link annotations, Tempo service graphs, and
+  dashboards-as-code provisioning). Grounded in a live production multi-cluster Grafana (~137
+  dashboards, 150 alert rules; Prometheus/Tempo/Pyroscope/managed-cloud datasources) and fully
+  genericized — pairs with `observability-and-logging` (which emits the metrics these dashboards plot).
+- **Security** — `zap-vapt-scanning` (a complete, self-contained OWASP ZAP **VAPT/DAST** setup: the
+  bundled single-file `zap_vapt.py` launches ZAP headless, replays endpoints from curl / simple lines /
+  a Postman collection, runs passive (and gated active) scans, joins alerts to the most-specific
+  endpoint, and renders a branded PDF VAPT report. All report identity — company, location, logo, and
+  the Created By / Approved By sign-off names — is supplied at run time via CLI flags or prompts;
+  nothing is hardcoded, and the `ReportMeta` defaults ship blank. `--selftest` runs 18 logic checks
+  with no ZAP required. Genericized from an internal tool — passive default; `--active` is
+  deny-by-default for state-changing verbs and requires a typed `yes`). Also `shannon-ai-pentest` — a
+  documentation/operating skill for **Shannon** by Keygraph, an autonomous **white-box** AI pentester
+  that reads an app's source, runs **real proof-of-concept exploits** against the live app, and reports
+  only proven findings. Documents the external **AGPL-3.0** `npx @keygraph/shannon` CLI (commands +
+  flags), AI-provider/model-tier config (Anthropic/Bedrock/Vertex/proxy), the YAML engagement config
+  (auth + login-flows + TOTP, scope avoid/focus rules, report filters), the workspace/report layout,
+  and the safety rules. **Shannon is not vendored** — it is installed separately; this skill bundles no
+  AGPL code, only original documentation with full attribution (verified accurate against the upstream
+  docs).
+- **Security architecture** — `edge-to-service-trust-boundary` (the HMAC-signed forwarded-identity
+  contract between an API gateway/edge and the services behind it: the edge signs identity/tenant headers
+  + a timestamp, downstream services verify with a constant-time compare and **fail closed**, reject
+  replayed/skewed requests, **detect conflicts** when identity is resolvable from multiple sources, and
+  still enforce their own authz; documents the `verify_signature=False`-then-trust, naked-header-trust,
+  and fail-open anti-patterns — complements `auth-and-rbac` + `multi-tenancy-patterns`) and
+  `kubernetes-workload-hardening` (runtime/manifest-layer hardening: pod/container `securityContext`,
+  default-deny `NetworkPolicy` + explicit allows, **digest-pinned** images, resource requests/limits,
+  **restricted PodSecurity** admission, least-privilege ServiceAccount/RBAC, and secrets via `secretRef`
+  — the runtime layer atop the `dockerfile-*`/`docker-shared` image-build skills). Both are grounded in
+  the cross-repo security gap analysis and fully genericized (no internal hosts, registries, namespaces,
+  project IDs, or secrets).
+
+Each ships `SKILL.md` + `README.md` + `references/` (the `zap-vapt-scanning` skill also bundles runnable
+`scripts/`; `shannon-ai-pentest` is documentation-only for an external AGPL-3.0 tool). All are free of
+internal service/registry/org names, paths, and secrets, verified by a scrub gate + per-skill
+scrub-verifier (the two security-architecture skills additionally went through an 18-agent adversarial
+verification — leak scrub + technical-accuracy + format — after which fixes were applied for recursive
+log redaction, DNS-over-TCP egress + an explicit `kube-system` selector, and cryptographically secure
+CSRF-token generation). Like the prior stack-specific sets, these are intentionally stack-specific and
+not wired into the catalog/scaffold, so `claude-kit init` output is unchanged. The `docs/stack-skills/`
+index is updated (43 skills).
+
+### Changed
+
+- **Extended 6 existing skills** with new sections + reference files: `fastapi-service-patterns`
+  (API versioning + conditional routes), `python-dao-and-database` (MongoDB aggregation/bulk-upsert/index
+  patterns), `temporal-config-driven` (idempotent schedule registration), `graphql-patterns` (advanced
+  Apollo Client setup), `containerization-and-deployment` (Makefile dev workflow + Kerberos kinit
+  bootstrap), `testing-conventions` (GitHub Actions test orchestration).
+- **Security pass on existing skills** — extended `observability-and-logging` with a PII/secret
+  **redaction structlog processor** (recursive sensitive-key denylist + content masking of emails, card
+  runs, bearer tokens, and DB-URL credentials, plus an audit-event field allowlist) in a new
+  `references/pii-redaction.md`; `testing-conventions` with a **security-regression** section (negative
+  authz, cross-tenant/RLS isolation, IDOR, login lockout, signed-header trust) wired to a dedicated
+  `pytest -m security` CI gate in a new `references/security-regression-tests.md`; `graphql-patterns`
+  with a clarification that Apollo's `apollo-require-preflight` protects the transport but cookie/session
+  auth still needs a CSRF token; and the **core** `security-and-hardening` skill with a CSRF
+  synchronizer/double-submit-token pattern and a ban on disabling outbound TLS verification
+  (`verify=False` / `rejectUnauthorized:false` / `NODE_TLS_REJECT_UNAUTHORIZED=0` / `curl -k`), with
+  private-CA-bundle guidance.
+- **Extended + trimmed `data-engineering-bigquery-gcs`** — added six grounded BigQuery patterns
+  (parameterized queries, streaming inserts, in-memory `load_table_from_dataframe`, dynamic schema
+  evolution via `update_table`, the `TimePartitioning` Python API, and a reusable `BigQueryUtils`
+  wrapper) in a new `references/bigquery-advanced-patterns.md`; removed the unobserved GCS-client and
+  pandas-ETL sections (now delegated to the new `gcs-file-storage-patterns` skill), dropping the stale
+  `references/pandas-pipelines.md`.
+
+### Fixed
+
+- **Genericized an internal reference that escaped the 0.18.0 scrub** — `temporal-config-driven`
+  reference files named an internal e-signature integration; replaced the example identifiers with
+  neutral `Esign*` ones.
+- **Removed a SQL-injection example** in `node-objection-knex` — replaced raw `whereRaw` string
+  interpolation with bound parameters and documented it as an anti-pattern.
+
+## [0.19.0] — 2026-06-20
+
+**Add four granular Docker skills (backend/frontend Dockerfiles, shared building blocks, compose).**
+
+### Added
+
+- **4 granular Docker skills** under `skills/`, complementing the broader `containerization-and-deployment`
+  skill with focused deep-dives derived from real production Python/FastAPI + React services:
+  - **`dockerfile-backend`** — multi-stage Python/FastAPI Dockerfiles: builder/runtime split, slim vs
+    alpine trade-offs, system deps (libpq/librdkafka/krb5), layer-cache ordering, venv copy, non-root
+    user, multi-mode entrypoint, gunicorn+uvicorn, `HEALTHCHECK`.
+  - **`dockerfile-frontend`** — React/Vite multi-stage builds: node(alpine) build → nginx runtime,
+    lockfile-first caching, `VITE_*`/`REACT_APP_*` build args, runtime `envsubst`, nginx SPA history fallback.
+  - **`docker-shared`** — shared base images from a private registry (tag vs `@sha256` digest pinning),
+    `.dockerignore` conventions, shared compose fragments (YAML anchors, `x-` fields, external
+    networks/volumes), and the build-arg-secret anti-pattern + BuildKit `--mount=type=secret` fix.
+  - **`docker-compose`** — local-dev/orchestration: postgres/redis/kafka/temporal healthchecks wired to
+    `depends_on: condition: service_healthy`, one-image-many-roles (MODE), env-specific compose files.
+  Each ships `SKILL.md` + `README.md` + `references/`, cross-links `containerization-and-deployment`,
+  and is fully genericized (no internal service/registry/org names, paths, or secrets) — verified by a
+  scrub gate + adversarial critic. Like the 0.18.0 set, these are intentionally stack-specific and not
+  wired into the catalog/scaffold, so `claude-kit init` output is unchanged. The `docs/stack-skills/`
+  index is updated (22 skills).
+
 ## [0.18.0] — 2026-06-20
 
 **Add a stack-specific skill collection (Python/FastAPI + React) and refine the secret guard.**

{claude_code_kit-0.18.0 → claude_code_kit-0.20.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.18.0
+Version: 0.20.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit

claude_code_kit-0.20.0/docs/stack-skills/README.md

@@ -0,0 +1,111 @@
+# Production Engineering Skills Collection
+
+These forty-three Claude Code skills encode production-proven engineering conventions derived from real-world Python/FastAPI, Node/Express, and React services. Each skill was extracted from analyzing patterns across multiple production backend and frontend services, capturing canonical patterns for FastAPI microservices, async Python, Kafka/Temporal integration, multi-tenancy, database access, layered configuration, Redis caching, GCS file handling, LLM integration (Vertex AI / Langfuse), Node/Express services, React frontends (state, data-fetching, forms, design systems, testing), observability (including Grafana dashboards & unified alerting), authentication, containerization (with granular Dockerfile/compose deep-dives), testing, data pipelines, security scanning (OWASP ZAP VAPT/DAST and autonomous AI pentesting), security architecture (edge-to-service signed-identity trust boundary, Kubernetes workload hardening), and modernization strategies. Use them to align new projects with established patterns, audit existing services, or onboard engineers to modern Python, Node, and React development practices.
+
+> **Where these live in this repo:** the skill folders are under [`skills/`](../../skills/) (auto-discovered by the claude-kit plugin). The links below point there.
+
+## Skills Catalog
+
+| Skill | Purpose | Reference |
+|-------|---------|-----------|
+| **backend-repo-architecture** | Canonical backend repository structure — multi-mode entrypoint (server/consumer/worker), FastAPI factory, ConnectionManager singleton, BaseDao, flat vs versioned domain layouts | [SKILL.md](../../skills/backend-repo-architecture/SKILL.md) |
+| **fastapi-service-patterns** | FastAPI conventions — app factory, lifespan hooks, CustomRequestRoute logging, structured exception handling, ResponseData envelope, dependency injection, middleware stack | [SKILL.md](../../skills/fastapi-service-patterns/SKILL.md) |
+| **python-dao-and-database** | Data access layer patterns — BaseDao abstraction, async SQLAlchemy 1.4 vs 2.0 session lifecycle, pagination, bulk operations, transactions, MongoDB static-class DAO | [SKILL.md](../../skills/python-dao-and-database/SKILL.md) |
+| **pydantic-schema-patterns** | Pydantic v1 and v2 idioms — BaseSettings singleton, request/response schemas, field validation, ORM mode configuration, field aliasing, migration guide | [SKILL.md](../../skills/pydantic-schema-patterns/SKILL.md) |
+| **async-python-patterns** | Async Python best practices — asyncio coordination (gather/wait_for/TaskGroup), cancellation handling, resource lifecycle, connection pool management, structured concurrency | [SKILL.md](../../skills/async-python-patterns/SKILL.md) |
+| **kafka-config-driven** | Config-driven Kafka producer/consumer infrastructure — JSON DSL topic/consumer config, message handling abstraction, aiokafka vs confluent_kafka, GSSAPI/SASL_SSL auth | [SKILL.md](../../skills/kafka-config-driven/SKILL.md) |
+| **temporal-config-driven** | Config-driven Temporal workflow/activity orchestration — JSON DSL workflow registry, worker launcher, schedule/cron management, RetryPolicy patterns | [SKILL.md](../../skills/temporal-config-driven/SKILL.md) |
+| **frontend-repo-architecture** | React + Vite + TypeScript frontend structure — three organizational models (module-scoped, feature-sliced, GraphQL-based), API layer strategies, hand-written types, state management | [SKILL.md](../../skills/frontend-repo-architecture/SKILL.md) |
+| **design-patterns-and-conventions** | Design conventions across repos — naming (classes/files/routes), error handling (ResponseData envelope), config hierarchy, logging structured-log patterns, code organization | [SKILL.md](../../skills/design-patterns-and-conventions/SKILL.md) |
+| **multi-tenancy-patterns** | Multi-tenant isolation strategies — tenant resolution (header/JWT/session), Postgres RLS, multi-pool databases, lazy connectors, data-layer org_id tenancy | [SKILL.md](../../skills/multi-tenancy-patterns/SKILL.md) |
+| **observability-and-logging** | Structured logging, OpenTelemetry tracing, Sentry error tracking, Prometheus metrics, NewRelic, request/correlation IDs, /health and /readiness endpoints | [SKILL.md](../../skills/observability-and-logging/SKILL.md) |
+| **grafana-dashboards-and-alerts** | Grafana dashboards + unified alerting — dashboard JSON model, `$datasource`/cascading `label_values` template variables, RED-metric PromQL (NGINX ingress, OTel span-metrics, pod utilization), multi-stage alert rules with label-based routing (slack_0/pagerduty_0/webhook_0) + dashboard/panel deep-link annotations, Tempo service graphs, and dashboards-as-code provisioning | [SKILL.md](../../skills/grafana-dashboards-and-alerts/SKILL.md) |
+| **auth-and-rbac** | Authentication dependency chain (get_current_client / x-user-data header), JWT verification, RBAC role/permission enforcement, password hashing (argon2), OTP (pyotp), tenant-scoped authorization | [SKILL.md](../../skills/auth-and-rbac/SKILL.md) |
+| **containerization-and-deployment** | Multi-stage Dockerfiles, docker-compose for local infra, one-image-many-roles pattern (entrypoint.py MODE dispatch), cert/keytab writing from env + kinit bootstrap, k8s health/readiness probes, CI pipelines, secrets/env hygiene | [SKILL.md](../../skills/containerization-and-deployment/SKILL.md) |
+| **dockerfile-backend** | Granular multi-stage Python/FastAPI Dockerfile deep-dive — builder/runtime split, slim vs alpine trade-offs, system deps (libpq/librdkafka/krb5), layer-cache ordering, venv copy, non-root user, gunicorn+uvicorn, HEALTHCHECK | [SKILL.md](../../skills/dockerfile-backend/SKILL.md) |
+| **dockerfile-frontend** | Granular React/Vite multi-stage Dockerfile deep-dive — node(alpine) build → nginx runtime, lockfile-first caching, `VITE_*`/`REACT_APP_*` build args, runtime `envsubst`, nginx SPA history fallback, security headers | [SKILL.md](../../skills/dockerfile-frontend/SKILL.md) |
+| **docker-shared** | Shared Docker building blocks — base images from a private registry (tag vs `@sha256` digest pinning), `.dockerignore` conventions, shared compose fragments (YAML anchors, `x-` fields, external networks/volumes), build-arg-secret anti-pattern + BuildKit `--mount=type=secret` | [SKILL.md](../../skills/docker-shared/SKILL.md) |
+| **docker-compose** | docker-compose for local dev + orchestration — postgres/redis/kafka/temporal healthchecks wired to `depends_on: condition: service_healthy`, one-image-many-roles (MODE), env-specific compose files (`.dev`/`.prod-test`/`.override`), profiles, migrator pattern | [SKILL.md](../../skills/docker-compose/SKILL.md) |
+| **testing-conventions** | pytest + pytest-asyncio + conftest fixtures, async test DB setup, mocking external services (Kafka/Temporal/HTTP), Playwright/allure E2E, honest account of coverage gaps with recommended baseline | [SKILL.md](../../skills/testing-conventions/SKILL.md) |
+| **alembic-migrations** | Alembic migration setup for async SQLAlchemy — alembic.ini, env.py (async engine + target_metadata), versions/ naming, autogenerate workflow, multi-tenant/multi-schema migrations | [SKILL.md](../../skills/alembic-migrations/SKILL.md) |
+| **data-engineering-bigquery-gcs** | BigQuery batch data pipelines — medallion (bronze/silver/gold) layering, parameterized queries, streaming inserts, in-memory `load_table_from_dataframe`, dynamic schema evolution, MERGE upserts, `TimePartitioning` API, reusable `BigQueryUtils` wrapper, ETL executed inside Temporal activities (not workflows); GCS blob ops delegated to `gcs-file-storage-patterns` | [SKILL.md](../../skills/data-engineering-bigquery-gcs/SKILL.md) |
+| **graphql-patterns** | Strawberry GraphQL resolvers on the backend and Apollo Client setup on the frontend — used in only a few apps, explicit about limited footprint | [SKILL.md](../../skills/graphql-patterns/SKILL.md) |
+| **modernization-and-migration** | Adapting the audit recommendations — migrate Pydantic v1 to v2 and SQLAlchemy 1.4 to 2.0 (Mapped style), extract copy-pasted BaseDao/ConnectionManager/CustomRequestRoute/connection.py into shared internal library, treat reference service as golden standard, retire divergences | [SKILL.md](../../skills/modernization-and-migration/SKILL.md) |
+| **configargparse-yaml-env-layering** | Three-layer service config — YAML defaults → configargparse CLI/env overrides → Pydantic BaseSettings singleton (`loaded_config`), coupled to MODE dispatch | [SKILL.md](../../skills/configargparse-yaml-env-layering/SKILL.md) |
+| **redis-caching-patterns** | Production Redis caching — multi-tenant key namespacing, TTL strategies, graceful degradation + in-memory fallback, SCAN-based invalidation, None-sentinel, pipelined bulk ops | [SKILL.md](../../skills/redis-caching-patterns/SKILL.md) |
+| **gcs-file-storage-patterns** | Google Cloud Storage blob ops — client + auth refresh, single/bulk upload (transfer_manager), signed URLs via impersonation, read CSV/Excel from GCS, gs:// path parsing | [SKILL.md](../../skills/gcs-file-storage-patterns/SKILL.md) |
+| **file-export-and-reporting** | Excel/CSV report generation + file downloads — pandas `to_excel` (multi-sheet, BytesIO), StreamingResponse CSV generators, base64 responses, Content-Disposition, presigned downloads | [SKILL.md](../../skills/file-export-and-reporting/SKILL.md) |
+| **api-pagination-filtering-sorting** | HTTP query conventions — page/page_size vs limit/offset, multi-value & hierarchical filters, sort_by/order_by, search, response metadata (total_pages/has_next), QueryBuilder layer | [SKILL.md](../../skills/api-pagination-filtering-sorting/SKILL.md) |
+| **gcp-cloud-run-github-actions** | Deploy to Cloud Run via GitHub Actions — auth@v2, manifest-inspect skip, build/push, `gcloud run deploy` flags (cloudsql/vpc-connector/MODE/min-max-instances), multi-job pipelines | [SKILL.md](../../skills/gcp-cloud-run-github-actions/SKILL.md) |
+| **notifications-and-messaging** | Multi-provider email/SMS delivery — provider abstraction + singletons, fallback chains, template-driven messages (OTP/verification/calendar), E.164 formatting, dev-mode logging | [SKILL.md](../../skills/notifications-and-messaging/SKILL.md) |
+| **anthropic-vertex-integration** | Claude on Vertex AI via AnthropicVertex SDK — project-ID fallback chain, ADC lazy client, async `generate_text`/`generate_json_text`, exponential-backoff retry, persona system prompts | [SKILL.md](../../skills/anthropic-vertex-integration/SKILL.md) |
+| **langfuse-llm-tracing** | LLM tracing with Langfuse (Python + TypeScript) — lazy env-gated singleton, `trace_completion()` context manager, latency/metadata capture, graceful no-op when disabled | [SKILL.md](../../skills/langfuse-llm-tracing/SKILL.md) |
+| **node-express-service** | Express backend architecture — app factory, MODE/server-type dispatch, convict config, module-alias, swagger-jsdoc, error middleware, ingress-header parser, request-ID logging, redis sessions | [SKILL.md](../../skills/node-express-service/SKILL.md) |
+| **node-objection-knex** | Objection.js + Knex data layer & Joi validation — BaseModel + AJV, lifecycle hooks, bindKnex, knexfile migrations, `validateReq` middleware, commonRules, standardized error envelope | [SKILL.md](../../skills/node-objection-knex/SKILL.md) |
+| **zustand-state-patterns** | Zustand client state — typed slices, selector exports, async actions, polling-in-store + cleanup, HMR persistence, immutable updates, optimistic updates | [SKILL.md](../../skills/zustand-state-patterns/SKILL.md) |
+| **tanstack-react-query-patterns** | TanStack Query (React Query) — query-key factories, typed hooks, staleTime + placeholderData pagination, invalidation, optimistic `onMutate`, computed selectors | [SKILL.md](../../skills/tanstack-react-query-patterns/SKILL.md) |
+| **react-hook-form-zod-patterns** | Type-safe forms — `useForm` + `zodResolver`, `z.object().strict()` + inferred types, multi-step forms, create/edit modes, schema-driven vs manual validation | [SKILL.md](../../skills/react-hook-form-zod-patterns/SKILL.md) |
+| **radix-tailwind-component-patterns** | Design-system components — Radix headless primitives + custom styling, Tailwind v4 `@theme` tokens, variant-driven API, `cn()` (twMerge+clsx), asChild/Slot, reduced-motion | [SKILL.md](../../skills/radix-tailwind-component-patterns/SKILL.md) |
+| **vitest-rtl-msw-patterns** | Frontend testing — Vitest + React Testing Library + MSW v2 mocking, Zod↔Pydantic contract tests with generated fixtures, jsdom setup | [SKILL.md](../../skills/vitest-rtl-msw-patterns/SKILL.md) |
+| **zap-vapt-scanning** | Automated OWASP ZAP VAPT/DAST — a bundled single-file `zap_vapt.py` that launches ZAP headless, replays endpoints (curl / simple lines / Postman collection), passive- (and gated active-) scans, joins alerts to endpoints, and renders a branded PDF VAPT report whose company/location/logo/sign-off identity is supplied at run time (never hardcoded); `--selftest` self-checks the logic with no ZAP | [SKILL.md](../../skills/zap-vapt-scanning/SKILL.md) |
+| **shannon-ai-pentest** | Drive Shannon (by Keygraph) — an autonomous **white-box** AI pentest that reads an app's source, plans attacks, runs **real proof-of-concept exploits** against the live app, and reports only proven findings. Documents the external **AGPL-3.0** `npx @keygraph/shannon` CLI (setup/start/status/logs/stop/workspaces + flags), AI-provider & model-tier config (Anthropic/Bedrock/Vertex/proxy), the YAML engagement config (auth + login-flows + TOTP, scope avoid/focus rules, report filters), output layout, and safety. Not bundled — installed separately (complements `zap-vapt-scanning`) | [SKILL.md](../../skills/shannon-ai-pentest/SKILL.md) |
+| **edge-to-service-trust-boundary** | The cryptographic trust contract between an API gateway/edge and the services behind it — edge **HMAC-signs** forwarded identity/tenant headers (signature + timestamp), downstream services **verify with constant-time compare and fail closed**, reject replayed/skewed requests, **detect conflicts** across resolution sources, and still enforce their own authz. Anti-patterns: `verify_signature=False`-then-trust, naked-header trust, fail-open. Complements `auth-and-rbac` + `multi-tenancy-patterns` | [SKILL.md](../../skills/edge-to-service-trust-boundary/SKILL.md) |
+| **kubernetes-workload-hardening** | Runtime/manifest-layer Kubernetes hardening — pod/container `securityContext` (runAsNonRoot, drop-ALL caps, `readOnlyRootFilesystem`, seccomp `RuntimeDefault`), **default-deny NetworkPolicy** + explicit allows, **digest-pinned** images, resource requests/limits, **restricted PodSecurity** admission, least-privilege ServiceAccount/RBAC, and secrets via `secretRef`. The runtime layer atop the `dockerfile-*`/`docker-shared` image-build skills | [SKILL.md](../../skills/kubernetes-workload-hardening/SKILL.md) |
+
+> **Existing skills extended (this release):** `fastapi-service-patterns` (API versioning + conditional routes), `python-dao-and-database` (MongoDB advanced — aggregation/bulk-upsert/indexes), `temporal-config-driven` (schedule registration), `graphql-patterns` (advanced Apollo Client setup), `containerization-and-deployment` (Makefile dev workflow + Kerberos kinit bootstrap), and `testing-conventions` (GitHub Actions test orchestration) each gained a new section + reference file. A follow-on **security pass** further extended `observability-and-logging` (PII/secret redaction processor + `references/pii-redaction.md`), `testing-conventions` (security-regression tests — negative authz, cross-tenant/RLS, IDOR, lockout, signed-header trust — + `references/security-regression-tests.md`), `graphql-patterns` (a CSRF-token clarification on the Apollo preflight note), and the **core** `security-and-hardening` skill (a CSRF synchronizer-token pattern + an outbound-TLS-verification ban).
+
+## How to Use
+
+1. **In a project with Claude Code:** Copy the skill folder(s) you need into your project's `.claude/skills/` directory. Claude will auto-discover them and use them when the skill's description triggers match your task.
+
+2. **Point Claude at the skills:** If you don't want to copy files, pass the absolute path to the skill folder in your prompt: `@/path/to/skills/backend-repo-architecture` and Claude will read the SKILL.md.
+
+3. **Trigger phrases (examples):**
+   - "scaffold a new FastAPI backend" → **backend-repo-architecture**, **fastapi-service-patterns**
+   - "set up SQLAlchemy DAO" → **python-dao-and-database**
+   - "implement Kafka consumer" → **kafka-config-driven**
+   - "add Temporal workflow" → **temporal-config-driven**
+   - "build multi-tenant data isolation" → **multi-tenancy-patterns**
+   - "set up React frontend" → **frontend-repo-architecture**
+   - "migrate Pydantic v1 to v2" → **pydantic-schema-patterns**
+   - "add observability / structured logging / tracing" → **observability-and-logging**
+   - "build a Grafana dashboard / write dashboard JSON or PromQL / RED dashboard / Grafana alert rule / contact points / provision dashboards as code" → **grafana-dashboards-and-alerts**
+   - "implement authentication / RBAC / JWT verification" → **auth-and-rbac**
+   - "create Dockerfile / docker-compose / k8s probes" → **containerization-and-deployment**
+   - "write a Python/FastAPI backend Dockerfile / optimize image size / multi-stage build" → **dockerfile-backend**
+   - "write a React/Vite frontend Dockerfile / node build + nginx serve / VITE_* build args" → **dockerfile-frontend**
+   - "set up a shared base image / .dockerignore / private registry auth / compose YAML anchors" → **docker-shared**
+   - "write docker-compose for local dev / healthchecks / postgres+redis+kafka+temporal" → **docker-compose**
+   - "set up pytest fixtures / test DB / E2E tests" → **testing-conventions**
+   - "configure Alembic / autogenerate migrations" → **alembic-migrations**
+   - "build BigQuery ETL / GCS pipeline / medallion architecture" → **data-engineering-bigquery-gcs**
+   - "add GraphQL resolvers / Apollo Client" → **graphql-patterns**
+   - "migrate to SQLAlchemy 2.0 / extract shared library" → **modernization-and-migration**
+   - "layered config / configargparse / YAML + env + BaseSettings" → **configargparse-yaml-env-layering**
+   - "Redis cache / cache-aside / TTL / cache invalidation" → **redis-caching-patterns**
+   - "upload/download from GCS / signed URLs" → **gcs-file-storage-patterns**
+   - "generate an Excel/CSV report / stream a file download" → **file-export-and-reporting**
+   - "paginate / filter / sort an API endpoint" → **api-pagination-filtering-sorting**
+   - "deploy to Cloud Run with GitHub Actions" → **gcp-cloud-run-github-actions**
+   - "send email/SMS notifications / multi-provider fallback" → **notifications-and-messaging**
+   - "call Claude on Vertex AI / AnthropicVertex SDK" → **anthropic-vertex-integration**
+   - "trace LLM calls / Langfuse" → **langfuse-llm-tracing**
+   - "build an Express backend / Node service" → **node-express-service**
+   - "Objection/Knex models / Joi validation / Knex migrations" → **node-objection-knex**
+   - "Zustand store / client state" → **zustand-state-patterns**
+   - "React Query / TanStack Query data fetching" → **tanstack-react-query-patterns**
+   - "react-hook-form + Zod forms" → **react-hook-form-zod-patterns**
+   - "Radix + Tailwind component / design system" → **radix-tailwind-component-patterns**
+   - "Vitest + RTL + MSW tests / contract tests" → **vitest-rtl-msw-patterns**
+   - "run a ZAP scan / VAPT / DAST / security-test an API / scan a Postman collection for vulnerabilities / generate a penetration-test report" → **zap-vapt-scanning**
+   - "run Shannon / autonomous or white-box AI pentest / exploit-test an app from its source / set up @keygraph/shannon / proof-by-exploitation report" → **shannon-ai-pentest**
+   - "sign forwarded identity headers / verify a gateway HMAC signature / trust x-user-data behind a gateway / fail closed on forwarded identity / prevent header spoofing or direct-to-service bypass" → **edge-to-service-trust-boundary**
+   - "harden a Kubernetes Deployment / add securityContext / write a NetworkPolicy / enforce PodSecurity restricted / pin an image digest / least-privilege ServiceAccount + RBAC" → **kubernetes-workload-hardening**
+
+4. **References:** Each skill includes a `references/` subdirectory with detailed evidence files showing the exact file paths, snippets, and patterns from source repositories.
+
+## Scope and Limitations
+
+- **Source:** These skills are derived from real-world production Python/FastAPI and React services as of June 2026. They reflect real-world conventions, including some anti-patterns that are documented for awareness.
+- **Stack coverage:** Python FastAPI + SQLAlchemy (1.4 and 2.0) + Kafka + Temporal + Redis (caching); layered configuration (configargparse + YAML + Pydantic); GCS file ops + Excel/CSV reporting; LLM integration (Claude on Vertex AI via AnthropicVertex + Langfuse tracing); Node/Express + Objection/Knex + Joi; React + Vite + TypeScript (Zustand, TanStack Query, react-hook-form + Zod, Radix + Tailwind, Vitest + RTL + MSW); limited MongoDB (sync pymongo + aggregation/bulk/index patterns); BigQuery/GCS data pipelines; Strawberry GraphQL (backend) + Apollo Client (frontend); Docker + docker-compose + k8s; Cloud Run + GitHub Actions CI/CD; pytest + pytest-asyncio + Playwright; OpenTelemetry + Sentry + Prometheus + NewRelic; Grafana dashboards + unified alerting (Prometheus/Tempo/Pyroscope/managed-cloud datasources); argon2 + JWT + pyotp; Alembic migrations; multi-provider email/SMS notifications; OWASP ZAP VAPT/DAST scanning with automated PDF reporting; Shannon autonomous white-box AI pentesting (an external AGPL-3.0 CLI — documented, not bundled); edge-to-service HMAC-signed forwarded-identity trust boundary; Kubernetes runtime/manifest hardening (securityContext, NetworkPolicy, PodSecurity, RBAC, digest-pinned images).
+- **What's NOT covered:** SQLModel, Tortoise ORM, beanie/motor (async MongoDB), Django, Flask, and non-Express Node frameworks (NestJS, Fastify). These were absent (or single-repo only) in the analyzed codebases and were deliberately not created.

{claude_code_kit-0.18.0 → claude_code_kit-0.20.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.18.0"
+version = "0.20.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

claude_code_kit-0.20.0/skills/anthropic-vertex-integration/README.md

@@ -0,0 +1,43 @@
+# anthropic-vertex-integration
+
+Production patterns for calling Claude on Vertex AI via the AnthropicVertex SDK.
+
+## What this covers
+
+- **Lazy client initialization** with Application Default Credentials (ADC)
+- **Project-ID and region resolution** from env-var fallback chains
+- **Async generate helpers** (`generate_text`, `generate_json_text`) with exponential-backoff retry
+- **System-prompt composition** from personas and task instructions
+- **JSON extraction** helpers for structured output
+- **Optional Langfuse tracing** for observability (latency, input/output, errors)
+- **LazyClient pattern** for SDK singletons with test-reset hooks
+- **Vision and tool-use** support (image input, function calling)
+
+## Origins
+
+This skill derives from production backend services using Claude on Google Cloud Vertex AI. It captures real patterns for:
+
+- Reusing BigQuery project IDs for Vertex AI calls (fallback chains)
+- Graceful degradation when tracing is misconfigured
+- Async wrappers around the sync Anthropic SDK
+- Multi-attempt retry for transient 503/504 errors
+- Persona-driven system prompts for reusable role definitions
+
+All examples are genericized for public use—no internal service names, project IDs, or credentials appear in this skill.
+
+## When to use this skill
+
+Ask Claude to use this skill when:
+
+- Integrating Claude via Vertex AI (not the direct Anthropic API)
+- Building async LLM helpers for one-shot completions or JSON extraction
+- Adding exponential-backoff retry to Claude calls
+- Setting up Langfuse observability for Claude completions
+- Migrating from API-key-based Anthropic SDK to Vertex AI ADC auth
+
+## Files
+
+- `SKILL.md` — the full skill (conventions, examples, anti-patterns)
+- `references/vertex-client-and-auth.md` — client construction, ADC, project/region resolution, LazyClient
+- `references/generate-helpers-and-retry.md` — generate_text/generate_json_text, retry loop, vision, tool-use
+- `references/repo-evidence.md` — genericized snippets from real production services