claude-code-kit 0.23.0__tar.gz → 0.25.0__tar.gz

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.23.0",
+      "version": "0.25.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/CHANGELOG.md

@@ -4,6 +4,72 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.25.0] — 2026-06-24
+
+**PR4 of the phased hardening review: supply-chain provenance, an explicit trust model, and a full
+genericization pass so the public repo carries only neutral examples.**
+
+### Added
+- **PEP 740 build attestations re-enabled** in `publish.yml`. They were temporarily disabled while
+  Sigstore's Rekor transparency log was returning HTTP 502s at upload time; Sigstore has since been
+  healthy (verified via status.sigstore.dev — all services online, no incidents), so releases are
+  signed again for supply-chain provenance.
+- **A "Security & trust model" section** in `README.md` (with a nav link) stating plainly that the
+  guard hooks are convenience, not a hardened boundary; that most quality gates are agent protocols
+  rather than mechanical enforcement; and that MCP servers are third-party code — surfacing
+  `SECURITY.md`'s posture where users decide to rely on the kit.
+
+### Changed
+- **Genericization pass** — removed residual internal / company-specific identifiers so the published
+  repo carries only neutral examples. Genericized the 0.15.0 adoption narrative in `CHANGELOG.md` and
+  `docs/coverage-audit.md`; renamed test functions and replaced an internal-token blocklist with a
+  positive neutralization check in `tests/test_scaffold.py`; and neutralized the skills-collection
+  reference docs (example feature / module / variable names, domain-specific jargon, and a
+  region-specific registry host) into generic equivalents. Examples-only — no behavior change.
+
+## [0.24.0] — 2026-06-24
+
+**PR3 of the phased hardening review: deeper validation, a deterministic pipeline CLI, an MCP
+lockfile, and a CI matrix that brings every distribution channel and quality dimension under test.**
+
+### Added
+
+- **`claude-kit validate --strict`** — beyond the structural checks, strict mode verifies that every
+  `settings.json` hook fires on a known event and runs an **installed, executable** script; that
+  `.mcp.json` has a sane `{mcpServers: {id: {command|url}}}` shape; that the resolved
+  `stack-catalog.snapshot.yaml` agrees with the agents/skills/overlays actually on disk; and that the
+  **bundled catalog is referentially consistent** (`validator.check_catalog`: every profile resolves to
+  existing agents/skills/registered hooks, every stack overlay rule/agent file is present, and the org
+  overlay's new skills/agents/rules/packs exist). `doctor` now runs the strict validate by default.
+- **`claude-kit pipeline` command group** (`src/claude_kit/pipeline.py`) — deterministic,
+  **non-executing** operations on the `/sdlc` state files: `pipeline validate` (snapshot shape +
+  profile/scope/mode/lane/findings coherence, with `last_gate_passed` checked against the installed
+  gate set), `pipeline status` (human-readable run summary), `pipeline close-gate <gate> --evidence
+  <file>` (records a passed gate, requiring the evidence artifact and a gate name the profile defines),
+  and `pipeline abort`. These validate/mutate `.claude/state/pipeline-snapshot.json` — they do **not**
+  run the pipeline.
+- **`.mcp.lock.json`** — when `.mcp.json` is written, a deterministic lockfile captures the resolved
+  package + pinned version (parsed from the `npx -y <pkg>@<ver>` args) or hosted URL per server, so a
+  reviewer can see exactly what would run. It is a kit-owned, derived artifact (refreshed on upgrade,
+  never a user sidecar). **`claude-kit doctor --mcp`** checks each server's command is on PATH, warns on
+  unset `${ENV}` vars, and flags a lockfile that has drifted from `.mcp.json` (warnings only).
+- **Expanded CI** (`.github/workflows/ci.yml`) — new jobs alongside the test matrix: `lint`
+  (`ruff check` + `ruff format --check` + `mypy`), `shell` (`shellcheck -S warning` over all hook + repo
+  scripts), `static` (`gen_hooks.py --check`, the docs-consistency guard, catalog referential
+  integrity, and JSON validity of the plugin manifests + `hooks.json`), and `wheel-smoke` (build → install
+  into a clean venv → `init --defaults` → `validate --strict` → `doctor`). `ruff`/`mypy`/`shellcheck-py`
+  are added to the `dev` extra, with conservative `[tool.ruff.lint]` (no E501) and `[tool.mypy]` config.
+
+### Fixed
+
+- **Latent type/lint bugs surfaced by the new CI** — `upgrader.py` used `ResolvedPlan` in annotations
+  without importing it (harmless under `from __future__ import annotations`, but undefined) and passed
+  `str | Path` to a `Path`-typed `_compare`; `_format_preview` could dereference `None`;
+  `prompts._choose_many` and `__main__` used None-returning calls in value position. All fixed; the
+  codebase is now `ruff` + `mypy --ignore-missing-imports` clean. Two hook scripts had redundant,
+  shellcheck-flagged glob alternatives (`*__tests__*` under `*test*`; `*oauth*`/`*authoriz*` under
+  `*auth*`) — removed with no behavior change.
+
 ## [0.23.0] — 2026-06-23
 
 **PR2 of the phased hardening review: structural single-source-of-truth for hooks, and plugin/CLI
@@ -489,7 +555,7 @@ values (→ `#______` placeholders, matching the existing `design-system-complia
 
 ## [0.15.0] — 2026-06-16
 
-**Adopt the Fynd Agentic Engineering personas & skills** (an internal Claude Code plugin marketplace —
+**Adopt a set of internal engineering personas & skills** (a private Claude Code plugin marketplace —
 11 agents + 29 skills across 7 plugins: engineer, designer, pm, context-gen, staff-em, staff-sdet,
 staff-pm). Those plugins are excellent but heavily **stack-bound** (FastAPI/SQLAlchemy/Pydantic/React/
 Tailwind/Radix/Zod/Temporal/Kafka/Langfuse, against an internal `.ai/` doc convention). Mirroring all
@@ -503,7 +569,7 @@ nothing), **18 extend** (a real delta folded into the nearest existing component
 layer), **1 adopt-core** (genuinely new + stack-agnostic). Net: **2 new core skills, ~10 surgical core
 extends, 1 new React overlay rule + FastAPI/React overlay enrichments, 5 new org components** — zero
 stack leakage into core, zero diluting duplicates. IP boundary: technique-and-structure only, no source
-text copied; every Fynd-internal reference (the `.ai/` naming, internal field/service names, numeric
+text copied; every source-internal reference (internal doc conventions, internal field/service names, numeric
 heuristics) stripped or genericized.
 
 Three deliberate decisions: **(1)** Temporal/Kafka/Langfuse are **not** added as selectable stacks —

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/CLAUDE.md

@@ -28,7 +28,7 @@ distributed two ways from one source of truth:
 | `templates/stacks/<kind>/<id>/` | Per-stack **overlay** content: `rules/` (+ `agents/` for DB stacks). **No application code, no Docker** — the only place stack-specific content lives. |
 | `templates/org/` | **Org overlay** content (scope-gated, organization only): `skills/`, `agents/` (personas), `rules/` (policy/vibe), `packs/<pack>/{pack.yaml,README.md}`, `README.md`. Wired via `catalog/org.yaml`. The only place org-specific content lives. |
 | `scripts/init.sh` | Thin no-pip fallback scaffolder (copies the full payload; no catalog resolution) |
-| `src/claude_kit/` | The pip CLI (Typer): `cli.py`, `catalog.py` (resolver), `prompts.py`, `models.py`, `scaffold.py` (installer), `render.py` (Jinja2), `hooks.py`, `validator.py`, `upgrader.py` |
+| `src/claude_kit/` | The pip CLI (Typer): `cli.py`, `catalog.py` (resolver), `prompts.py`, `models.py`, `scaffold.py` (installer), `render.py` (Jinja2), `hooks.py`, `validator.py` (incl. `validate --strict` + `check_catalog`), `upgrader.py`, `pipeline.py` (deterministic `/sdlc` state-file ops) |
 | `tests/` | pytest suite (catalog, render, scaffold, validator, upgrader, CLI; incl. the profile×stack×scope self-test matrix) |
 | `examples/` | Synthetic end-to-end `/sdlc` worked example (repo reference; **not** bundled into the wheel) |
 | `docs/architecture.md` · `docs/agents.md` · `docs/coverage-audit.md` · `docs/eval-harness.md` | Architecture diagrams · agent guide · the GATED-vs-RULE-vs-SKILL enforcement audit · the with/without eval template |

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/CONTRIBUTING.md

@@ -71,6 +71,13 @@ claude-kit diff /tmp/ck-demo
 # Tests:
 pytest
 
+# Lint / type / shell / drift checks (all run in CI — keep them green locally):
+ruff check src scripts tests && ruff format --check src scripts tests
+mypy
+shellcheck -S warning hooks/scripts/*.sh scripts/*.sh
+python scripts/gen_hooks.py --check
+python scripts/check_docs_consistency.py
+
 # Build + validate the package:
 python3 -m build
 python3 -m twine check dist/*
@@ -88,8 +95,9 @@ a specific stack — `pytest` enforces the no-Docker invariant on a scaffolded p
 
 ## Releasing
 
-1. Bump the version in **all four** places: `pyproject.toml`, `.claude-plugin/plugin.json`, the
-   `.claude-plugin/marketplace.json` entry, and `src/claude_kit/__init__.py`.
+1. Bump the version in **all five** places: `pyproject.toml`, `.claude-plugin/plugin.json`, the
+   `.claude-plugin/marketplace.json` entry, `src/claude_kit/__init__.py`, and `SECURITY.md`
+   (`check_docs_consistency.py` enforces parity across all of them + the latest `CHANGELOG.md` heading).
 2. Add a `CHANGELOG.md` entry, including a **"Not adopted (deliberately)"** block stating what you
    chose *not* to add and why — this is a marketed feature of the changelog (the README links to it),
    so keep it. If those blocks ever grow unwieldy they may later split into `docs/decision-log.md`,

claude_code_kit-0.23.0/README.md → claude_code_kit-0.25.0/PKG-INFO

@@ -1,3 +1,33 @@
+Metadata-Version: 2.4
+Name: claude-code-kit
+Version: 0.25.0
+Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
+Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
+Project-URL: Repository, https://github.com/ajyadav013/claude-kit
+Project-URL: Issues, https://github.com/ajyadav013/claude-kit/issues
+Author: Arjunsingh Yadav
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agentic,agents,automation,claude,claude-code,code-review,cookiecutter,fastapi,generator,orchestration,react,scaffold,sdlc,testing
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.9
+Requires-Dist: jinja2>=3.1
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Requires-Dist: shellcheck-py>=0.10; extra == 'dev'
+Requires-Dist: twine>=5.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
 <div align="center">
 
 # claude-kit
@@ -14,7 +44,7 @@ with a quality gate between every phase. **No application code. No Docker. Confi
 [![CI](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml)
 [![Changelog](https://img.shields.io/badge/changelog-md-blue.svg)](CHANGELOG.md)
 
-✨ [Features](#features) · 🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
+✨ [Features](#features) · 🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 🔒 [Security](#security--trust-model) · 📖 [Agent guide](docs/agents.md)
 
 </div>
 
@@ -586,10 +616,11 @@ everything available.
 | Command | Description |
 |---------|-------------|
 | `init [path] [--defaults] [--config FILE] [--force]` | Scaffold `CLAUDE.md` + `.claude/` (interactive or non-interactive) |
-| `validate [path]` | Structurally validate an installed config |
-| `doctor [path]` | Validate + environment/health checks with fix hints |
+| `validate [path] [--strict]` | Structurally validate an installed config; `--strict` adds hooks→script, `.mcp.json`-shape, snapshot, and catalog-integrity checks |
+| `doctor [path] [--mcp]` | Strict validate + environment/health checks; `--mcp` checks MCP commands, `${ENV}` vars, and lockfile drift |
 | `diff [path]` | Preview what an `upgrade` would change (no writes) |
 | `upgrade [path] [--force]` | Refresh kit/overlay files; protect your edits; prune orphans |
+| `pipeline validate · status · close-gate · abort` | Inspect/mutate the `/sdlc` state files (gate/lane/evidence coherence); **does not run** the pipeline |
 | `list-options` | List available frontend/backend/database/profile/MCP options |
 | `status [path]` | Show what's installed, the selection, and working memory |
 | `version` | Print the version |
@@ -598,6 +629,9 @@ everything available.
 Plugin slash commands: `/claude-kit:init`, `/claude-kit:sdlc <task>`, `/claude-kit:status`; and the
 `/sdlc` skill inside any scaffolded project.
 
+> When MCP servers are selected, `init` also writes a derived **`.mcp.lock.json`** pinning each
+> server's resolved package version — inspect it (or run `doctor --mcp`) to see exactly what would run.
+
 </details>
 
 <details>
@@ -634,6 +668,30 @@ hints.
 
 ---
 
+## Security & trust model
+
+claude-kit installs **configuration only** — no application code, no Docker, nothing that runs as a
+service. It never executes your code; it lays down rules, agents, skills, gates, and hook scripts that
+**Claude Code** then follows. Three honest caveats are worth understanding before you rely on it:
+
+- **The guard hooks are convenience, not a hardened boundary.** Scripts like `guard-secrets`,
+  `guard-destructive-git`, and the `warn-*` advisories raise the cost of a mistake — they do **not**
+  sandbox the agent or guarantee prevention. They need a POSIX shell + `jq` and **silently no-op**
+  without them (e.g. on Windows outside WSL/Git Bash). Treat them as seatbelts, not walls.
+- **Most quality gates are agent protocols, not mechanical enforcement.** The pipeline's gates
+  (`spec-complete`, `code-review`, `security-clear`, …) are disciplines Claude is instructed to follow
+  and self-verify; only the hook scripts are deterministic, host-enforced checks. A capable model can
+  still be wrong or skip a step — keep a human in the loop for anything that matters.
+- **MCP servers are third-party code.** Each fragment runs an external package (pinned to an exact
+  version) or a hosted endpoint that claude-kit references but does **not** vendor or audit. Review a
+  server's source and license before enabling it.
+
+Releases are published to PyPI via OIDC **Trusted Publishing** (no long-lived API token) with **PEP 740
+build attestations** for supply-chain provenance. Report vulnerabilities privately — see
+[`SECURITY.md`](SECURITY.md) for the full scope and reporting process.
+
+---
+
 ## Project structure
 
 <details>

claude_code_kit-0.23.0/PKG-INFO → claude_code_kit-0.25.0/README.md

@@ -1,30 +1,3 @@
-Metadata-Version: 2.4
-Name: claude-code-kit
-Version: 0.23.0
-Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
-Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
-Project-URL: Repository, https://github.com/ajyadav013/claude-kit
-Project-URL: Issues, https://github.com/ajyadav013/claude-kit/issues
-Author: Arjunsingh Yadav
-License-Expression: MIT
-License-File: LICENSE
-Keywords: agentic,agents,automation,claude,claude-code,code-review,cookiecutter,fastapi,generator,orchestration,react,scaffold,sdlc,testing
-Classifier: Development Status :: 4 - Beta
-Classifier: Environment :: Console
-Classifier: Intended Audience :: Developers
-Classifier: Programming Language :: Python :: 3
-Classifier: Topic :: Software Development
-Classifier: Topic :: Software Development :: Quality Assurance
-Requires-Python: >=3.9
-Requires-Dist: jinja2>=3.1
-Requires-Dist: pyyaml>=6.0
-Requires-Dist: typer>=0.12
-Provides-Extra: dev
-Requires-Dist: build>=1.2; extra == 'dev'
-Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: twine>=5.0; extra == 'dev'
-Description-Content-Type: text/markdown
-
 <div align="center">
 
 # claude-kit
@@ -41,7 +14,7 @@ with a quality gate between every phase. **No application code. No Docker. Confi
 [![CI](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml)
 [![Changelog](https://img.shields.io/badge/changelog-md-blue.svg)](CHANGELOG.md)
 
-✨ [Features](#features) · 🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
+✨ [Features](#features) · 🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 🔒 [Security](#security--trust-model) · 📖 [Agent guide](docs/agents.md)
 
 </div>
 
@@ -613,10 +586,11 @@ everything available.
 | Command | Description |
 |---------|-------------|
 | `init [path] [--defaults] [--config FILE] [--force]` | Scaffold `CLAUDE.md` + `.claude/` (interactive or non-interactive) |
-| `validate [path]` | Structurally validate an installed config |
-| `doctor [path]` | Validate + environment/health checks with fix hints |
+| `validate [path] [--strict]` | Structurally validate an installed config; `--strict` adds hooks→script, `.mcp.json`-shape, snapshot, and catalog-integrity checks |
+| `doctor [path] [--mcp]` | Strict validate + environment/health checks; `--mcp` checks MCP commands, `${ENV}` vars, and lockfile drift |
 | `diff [path]` | Preview what an `upgrade` would change (no writes) |
 | `upgrade [path] [--force]` | Refresh kit/overlay files; protect your edits; prune orphans |
+| `pipeline validate · status · close-gate · abort` | Inspect/mutate the `/sdlc` state files (gate/lane/evidence coherence); **does not run** the pipeline |
 | `list-options` | List available frontend/backend/database/profile/MCP options |
 | `status [path]` | Show what's installed, the selection, and working memory |
 | `version` | Print the version |
@@ -625,6 +599,9 @@ everything available.
 Plugin slash commands: `/claude-kit:init`, `/claude-kit:sdlc <task>`, `/claude-kit:status`; and the
 `/sdlc` skill inside any scaffolded project.
 
+> When MCP servers are selected, `init` also writes a derived **`.mcp.lock.json`** pinning each
+> server's resolved package version — inspect it (or run `doctor --mcp`) to see exactly what would run.
+
 </details>
 
 <details>
@@ -661,6 +638,30 @@ hints.
 
 ---
 
+## Security & trust model
+
+claude-kit installs **configuration only** — no application code, no Docker, nothing that runs as a
+service. It never executes your code; it lays down rules, agents, skills, gates, and hook scripts that
+**Claude Code** then follows. Three honest caveats are worth understanding before you rely on it:
+
+- **The guard hooks are convenience, not a hardened boundary.** Scripts like `guard-secrets`,
+  `guard-destructive-git`, and the `warn-*` advisories raise the cost of a mistake — they do **not**
+  sandbox the agent or guarantee prevention. They need a POSIX shell + `jq` and **silently no-op**
+  without them (e.g. on Windows outside WSL/Git Bash). Treat them as seatbelts, not walls.
+- **Most quality gates are agent protocols, not mechanical enforcement.** The pipeline's gates
+  (`spec-complete`, `code-review`, `security-clear`, …) are disciplines Claude is instructed to follow
+  and self-verify; only the hook scripts are deterministic, host-enforced checks. A capable model can
+  still be wrong or skip a step — keep a human in the loop for anything that matters.
+- **MCP servers are third-party code.** Each fragment runs an external package (pinned to an exact
+  version) or a hosted endpoint that claude-kit references but does **not** vendor or audit. Review a
+  server's source and license before enabling it.
+
+Releases are published to PyPI via OIDC **Trusted Publishing** (no long-lived API token) with **PEP 740
+build attestations** for supply-chain provenance. Report vulnerabilities privately — see
+[`SECURITY.md`](SECURITY.md) for the full scope and reporting process.
+
+---
+
 ## Project structure
 
 <details>

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/docs/coverage-audit.md

@@ -51,9 +51,9 @@ The pattern matches the rest of the kit: a *discipline* is a RULE (always-on gui
 spec/EM gate exists at all. P0-2 is the exception that strengthens *every* gate by making a fabricated
 verdict auto-Critical, without adding a token.
 
-## Fynd adoption disciplines (as of 0.15.0)
+## Internal-toolkit adoption disciplines (as of 0.15.0)
 
-The Fynd persona/skill adoption (CHANGELOG 0.15.0) added capabilities reuse-first. Consistent with the
+The internal persona/skill adoption (CHANGELOG 0.15.0) added capabilities reuse-first. Consistent with the
 posture above, it added **no new gate tokens** — the new capabilities are SKILLs, OVERLAY rules, or
 checklists that ride *inside existing* review gates. Enforcement class of each:
 

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/hooks/scripts/warn-missing-tests.sh

@@ -12,7 +12,7 @@ low="$(printf '%s' "$FILE_PATH" | tr '[:upper:]' '[:lower:]')"
 
 # Skip non-source: tests, docs, config, markdown, and the kit's own config.
 case "$low" in
-  *test*|*spec*|*__tests__*|*.md|*.markdown|*.json|*.ya?ml|*.toml|*.ini|*.cfg|*.txt|*.lock|*/.claude/*)
+  *test*|*spec*|*.md|*.markdown|*.json|*.ya?ml|*.toml|*.ini|*.cfg|*.txt|*.lock|*/.claude/*)
     exit 0 ;;
 esac
 

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/hooks/scripts/warn-sensitive-files.sh

@@ -11,7 +11,7 @@ FILE_PATH="$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_response.file
 low="$(printf '%s' "$FILE_PATH" | tr '[:upper:]' '[:lower:]')"
 
 case "$low" in
-  *auth*|*login*|*session*|*oauth*|*jwt*|*password*|*permission*|*rbac*|*authoriz*)
+  *auth*|*login*|*session*|*jwt*|*password*|*permission*|*rbac*)
     echo "WARN: editing an AUTH / authorization surface ($FILE_PATH). High-risk: get review + security check before completion (.claude/rules/risk-classification.md)." >&2 ;;
 esac
 case "$low" in

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.23.0"
+version = "0.25.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -46,6 +46,9 @@ dev = [
   "pytest>=8.0",
   "build>=1.2",
   "twine>=5.0",
+  "ruff>=0.6",
+  "mypy>=1.10",
+  "shellcheck-py>=0.10",
 ]
 
 [project.urls]
@@ -62,6 +65,20 @@ claude-sdlc = "claude_kit.cli:main"
 testpaths = ["tests"]
 pythonpath = ["."]
 
+[tool.ruff]
+target-version = "py39"
+
+[tool.ruff.lint]
+# Deliberately conservative: pyflakes (F) + the actionable pycodestyle subsets (E4/E7/E9, W) +
+# import sorting (I) + bugbear (B). Line length (E501) is intentionally NOT enforced — docstrings and
+# pinned-version comments run long on purpose and `ruff format` owns layout.
+select = ["E4", "E7", "E9", "F", "W", "I", "B"]
+
+[tool.mypy]
+files = ["src/claude_kit"]
+ignore_missing_imports = true
+# typer/yaml ship without type stubs; we check our own code, not third-party signatures.
+
 [tool.hatch.build.targets.wheel]
 packages = ["src/claude_kit"]
 

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/skills/alembic-migrations/references/alembic-setup-and-env.md

@@ -151,7 +151,7 @@ from app.database import Base
 from config.settings import settings
 
 # Import all models (wildcard imports)
-from app.articles.models import *
+from app.items.models import *
 from app.units.models import *
 # ... (40+ wildcard imports)
 
@@ -183,8 +183,8 @@ from app.users.models import User
 from app.organizations.models import Organization
 
 # Wildcard imports (acceptable in env.py, used in multiple production services)
-from myapp.users.models import *
-from myapp.tenants.models import *
+from app.users.models import *
+from app.tenants.models import *
 ```
 
 **Critical**: If a model is not imported in `env.py`, Alembic won't detect it for autogenerate.

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/skills/alembic-migrations/references/repo-evidence.md

@@ -146,9 +146,9 @@ from app.database import Base
 from config.settings import settings
 
 # Wildcard model imports
-from app.articles.models import *
+from app.items.models import *
 from app.units.models import *
-from app.bom.models import *
+from app.catalog.models import *
 # ... 40+ wildcard imports
 
 # target_metadata

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/skills/alembic-migrations/references/writing-migrations.md

@@ -34,10 +34,10 @@ alembic/versions/
 ```
 alembic/versions/
 ├── 202407301751-ad610b2bab70_add_event_log_table.py
-├── 202408011255-e848fe551d9b_add_coe_bom_mapping_tables.py
+├── 202408011255-e848fe551d9b_add_category_mapping_tables.py
 ├── 202408012159-c3f783a32f7c_add_username_to_event_log_table.py
-├── 202408052213-943a94fc4f73_add_is_active_to_mapping_tebles.py
-├── 202409031128-0fc8dde689fe_fabric_source_cluster.py
+├── 202408052213-943a94fc4f73_add_is_active_to_mapping_tables.py
+├── 202409031128-0fc8dde689fe_add_source_cluster.py
 └── ...
 ```
 
@@ -53,10 +53,10 @@ alembic/versions/
 
 ```
 migrations/versions/
-├── 554395de0772_added_planograph_models.py
+├── 554395de0772_added_data_models.py
 ├── 9d07416cb3d0_modified_generated_file_model.py
-├── cb876bd3ff47_added_watermakr_model.py
-└── d5885c4539c2_updated_watermark_table_to_include_.py
+├── cb876bd3ff47_added_watermark_model.py
+└── d5885c4539c2_updated_watermark_table.py
 ```
 
 **Format**: `{auto_hash}_{description}.py` (default Alembic behavior)

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/skills/api-pagination-filtering-sorting/README.md

@@ -18,7 +18,7 @@ This skill covers production-tested conventions for designing paginated, filtere
 
 ## Origin
 
-This skill derives from real production backend services handling inventory, forecasting, replenishment, and range planning data. It distills conventions observed across multiple services with large datasets (10k-1M+ records per tenant) requiring efficient pagination, multi-dimensional filtering, and flexible sorting.
+This skill derives from real production backend services handling inventory, forecasting, and order data. It distills conventions observed across multiple services with large datasets (10k-1M+ records per tenant) requiring efficient pagination, multi-dimensional filtering, and flexible sorting.
 
 ## Relation to other skills
 

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/skills/api-pagination-filtering-sorting/SKILL.md

@@ -26,7 +26,7 @@ Standardize HTTP query parameter conventions and response metadata for paginated
 
 4. **Multi-value filters via FastAPI `Query`**: For filters that accept multiple values (e.g., `status`, `store_ids`, `segment_codes`), use `Optional[List[str]] = Query(None, description="...")`. The client sends `?status=pending&status=approved` or `?status[]=pending&status[]=approved` (FastAPI accepts both). In the query builder, translate to SQL `IN` clause or `ANY(ARRAY[...])`.
 
-5. **Comma-separated multi-value filters**: Some endpoints accept comma-separated values in a single param (e.g., `?articles=SKU-001,SKU-002,SKU-003`). Use `Optional[str] = Query(None)` and split by comma in the service or repository layer before building SQL. This pattern is common for legacy APIs or when the client cannot send array query params.
+5. **Comma-separated multi-value filters**: Some endpoints accept comma-separated values in a single param (e.g., `?items=ITEM-001,ITEM-002,ITEM-003`). Use `Optional[str] = Query(None)` and split by comma in the service or repository layer before building SQL. This pattern is common for legacy APIs or when the client cannot send array query params.
 
 6. **Hierarchical filters**: Product or location hierarchies (e.g., segment → family → class → brick; zone → format → state → region → city → store) use separate query params for each level. Each is optional; when provided, it narrows results to that level. Example: `?segment=BEVERAGES&family=SOFT_DRINKS&class=COLA`. Query builder applies `WHERE` clauses for each non-null filter. Some services support both singular and plural param names (`?store=...` and `?stores=...`); prefer plural for multi-value, singular for single value.
 
@@ -36,9 +36,9 @@ Standardize HTTP query parameter conventions and response metadata for paginated
 
 9. **Repository layer pagination**: The repository fetches two results in parallel—`(records_data, total_count)`—via `asyncio.gather` or sequential calls. It executes the count query to get `total_count`, then executes the data query with `LIMIT/OFFSET`. Service layer constructs the response object with data + pagination metadata. For download endpoints (no pagination), omit `LIMIT/OFFSET` from the query.
 
-10. **Search across multiple fields**: A single `search` query param applies a case-insensitive substring match across multiple columns. In SQL, use `WHERE (LOWER(field1) LIKE LOWER(:search) OR LOWER(field2) LIKE LOWER(:search) OR ...)` with param `%{search}%`. Some implementations use `ILIKE` (PostgreSQL) or full-text search. Common searchable fields: article codes, descriptions, store IDs, order IDs.
+10. **Search across multiple fields**: A single `search` query param applies a case-insensitive substring match across multiple columns. In SQL, use `WHERE (LOWER(field1) LIKE LOWER(:search) OR LOWER(field2) LIKE LOWER(:search) OR ...)` with param `%{search}%`. Some implementations use `ILIKE` (PostgreSQL) or full-text search. Common searchable fields: item codes, descriptions, store IDs, order IDs.
 
-11. **Pydantic models for query params**: Define a `QueryParams` Pydantic model (e.g., `ReplenishmentQueryParams`, `ForecastQuery`) to encapsulate all filters, pagination, sorting, and search params. This separates route handler param extraction from business logic. The model can provide helper methods like `@property def limit(self)` to derive limit from `page_size` or compute `offset` from `page` and `page_size`.
+11. **Pydantic models for query params**: Define a `QueryParams` Pydantic model (e.g., `InventoryQueryParams`, `ForecastQuery`) to encapsulate all filters, pagination, sorting, and search params. This separates route handler param extraction from business logic. The model can provide helper methods like `@property def limit(self)` to derive limit from `page_size` or compute `offset` from `page` and `page_size`.
 
 12. **FastAPI route handler**: Extract query params via `Query()` for primitive types or depend on Pydantic model. Calculate `offset = (page - 1) * page_size` if needed. Call service layer with `query_params` object or individual params. Return response via `ResponseData.ok(data=..., pagination=...)` or a typed response model wrapping data + metadata.
 
@@ -175,8 +175,8 @@ class ItemQueryBuilder:
         search_param = self._add_param(f"%{search}%")
         return f"""
             AND (
-                LOWER(article_id) LIKE LOWER({search_param})
-                OR LOWER(article_description) LIKE LOWER({search_param})
+                LOWER(item_id) LIKE LOWER({search_param})
+                OR LOWER(item_description) LIKE LOWER({search_param})
                 OR LOWER(store_id) LIKE LOWER({search_param})
             )
         """
@@ -186,7 +186,7 @@ class ItemQueryBuilder:
         sort_mapping = {
             "created_at": "created_at",
             "updated_at": "updated_at",
-            "article": "article_id",
+            "item": "item_id",
             "store": "store_id",
         }
         column = sort_mapping.get(sort_by, "created_at")
@@ -284,7 +284,7 @@ async def list_items(
     sort_by: str = Query("created_at", description="Field to sort by"),
     sort_order: str = Query("desc", regex="^(asc|desc)$", description="Sort direction"),
     # Search
-    search: Optional[str] = Query(None, description="Search across article, description, store"),
+    search: Optional[str] = Query(None, description="Search across item, description, store"),
     # Filters
     status: Optional[List[str]] = Query(None, description="Filter by status (multi-value)"),
     store_ids: Optional[List[str]] = Query(None, description="Filter by store IDs"),
@@ -301,7 +301,7 @@ async def list_items(
     - page_size: Records per page (1-100, default: 20)
     
     **Sorting:**
-    - sort_by: Field to sort by (created_at, updated_at, article, store)
+    - sort_by: Field to sort by (created_at, updated_at, item, store)
     - sort_order: asc or desc (default: desc)
     
     **Filters:**
@@ -311,7 +311,7 @@ async def list_items(
     - family: Product family (hierarchical, requires segment)
     
     **Search:**
-    - search: Substring match across article_id, article_description, store_id
+    - search: Substring match across item_id, item_description, store_id
     """
     query_params = QueryParams(
         page=page,
@@ -336,7 +336,7 @@ async def list_items(
 5. **Single-responsibility violation**: Query construction in route handlers; move SQL building to a dedicated QueryBuilder or repository method.
 6. **Zero-indexed `page` in user-facing APIs**: Users expect page 1 to be the first page; use 1-indexed `page` in API and convert to 0-indexed offset internally.
 7. **Hardcoding sort column names**: User sends `sort_by=doh` but SQL uses `days_on_hand`; maintain a sort mapping dict to translate user-facing names to column names.
-8. **Ignoring case-sensitivity in search**: `WHERE article_id LIKE :search` is case-sensitive on some DBs; use `LOWER(...)` or `ILIKE` for case-insensitive search.
+8. **Ignoring case-sensitivity in search**: `WHERE item_id LIKE :search` is case-sensitive on some DBs; use `LOWER(...)` or `ILIKE` for case-insensitive search.
 9. **Fetching full result set then paginating in Python**: Always push `LIMIT/OFFSET` to SQL; paginating in-memory defeats the purpose and exhausts memory on large datasets.
 10. **Not validating `sort_order`**: Accepting arbitrary `sort_order` can inject ASC/DESC into SQL unsafely; use `regex="^(asc|desc)$"` or enum validation.
 11. **Returning inconsistent metadata field names**: `total` vs `total_records`, `limit` vs `page_size`, `next` vs `has_next`; standardize on one naming convention per service.

{claude_code_kit-0.23.0 → claude_code_kit-0.25.0}/skills/api-pagination-filtering-sorting/references/query-params-conventions.md

@@ -86,16 +86,16 @@ WHERE store_id = ANY($2)
 Legacy or client-constrained APIs:
 
 ```python
-articles: Optional[str] = Query(None, description="Comma-separated article codes")
+items: Optional[str] = Query(None, description="Comma-separated item codes")
 ```
 
 Split in service/repository:
 ```python
-article_list = articles.split(',') if articles else []
-# Then use in SQL: WHERE article_id = ANY($1)
+item_list = items.split(',') if items else []
+# Then use in SQL: WHERE item_id = ANY($1)
 ```
 
-Example: `?articles=SKU-001,SKU-002,SKU-003`
+Example: `?items=ITEM-001,ITEM-002,ITEM-003`
 
 ## Hierarchical filters
 
@@ -172,14 +172,14 @@ query = f"ORDER BY {column} {sort_order.upper()}"
 Single search param for multi-field substring matching:
 
 ```python
-search: Optional[str] = Query(None, description="Search text across article, description, store")
+search: Optional[str] = Query(None, description="Search text across item, description, store")
 ```
 
 Translate to case-insensitive SQL:
 ```sql
 WHERE (
-    LOWER(article_id) LIKE LOWER($1)
-    OR LOWER(article_description) LIKE LOWER($1)
+    LOWER(item_id) LIKE LOWER($1)
+    OR LOWER(item_description) LIKE LOWER($1)
     OR LOWER(store_id) LIKE LOWER($1)
 )
 ```
@@ -189,8 +189,8 @@ Param value: `f"%{search}%"`
 Some implementations use PostgreSQL `ILIKE`:
 ```sql
 WHERE (
-    article_id ILIKE $1
-    OR article_description ILIKE $1
+    item_id ILIKE $1
+    OR item_description ILIKE $1
 )
 ```