claude-code-kit 0.24.0__tar.gz → 0.26.0__tar.gz

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.24.0",
+      "version": "0.26.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/CHANGELOG.md

@@ -4,6 +4,64 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.26.0] — 2026-06-24
+
+**Post-hardening follow-up: two correctness/security fixes plus polish, all from a verified review
+punch list.**
+
+### Added
+- **Plugin now guards secret-file reads out of the box.** `protect-secrets` (PreToolUse/Read — blocks
+  reading `.env`/`.pem`/`.key`/`id_rsa`/credentials/…) was installed by the pip CLI (it's in the
+  `standard`/`all` profiles) but missing from the always-on plugin hook set, so plugin-only users had
+  no Read guard until they ran an init. It's now in `PLUGIN_HOOK_IDS`; `hooks/hooks.json` gains a
+  `PreToolUse`/`Read` group.
+- **`.github/dependabot.yml`** for the `github-actions` ecosystem (weekly, grouped) so CI/publish
+  actions are kept current and SHA-pinned by Dependabot's PRs, with auditable tag comments.
+  `pypa/gh-action-pypi-publish` stays on `release/v1` (required for Trusted Publishing + attestations).
+
+### Changed
+- **`pipeline close-gate` enforces the blocking-findings rule.** It now refuses to record a gate as
+  passed while any **critical/high/medium** findings are open (`rules/quality-gates.md`); low/cosmetic
+  still pass. A deliberate override requires `--force` **with** `--override-reason "<why>"`, recorded
+  under `gate_overrides[gate]` for human review.
+- **`pipeline validate` re-checks gate evidence.** When a gate is recorded passed and has a
+  `gate_evidence` path, validate now fails if that file no longer exists on disk, and surfaces any
+  force-closed gate. Lenient on the upgrade path (no evidence map → silent; partial map → warn).
+- **Inline hook guards quiet their `jq` calls** (`2>/dev/null || true`) so malformed/missing hook JSON
+  can't spam stderr — matching the script-backed guards; `guard-secrets.sh` aligned for consistency.
+
+### Fixed
+- **Docs consistency checker catches duplicate gate tables.** `check_docs_consistency.py` previously
+  keyed profile gate rows in a dict, so a second (possibly stale) table could silently overwrite an
+  earlier one; it now collects every occurrence, flags duplicates, and requires each to match
+  `profiles.yaml`.
+- **Stale comments in `scripts/init.sh`** corrected: it's described as the degraded, no-resolution
+  fallback (the pip CLI is the catalog-driven/upgrade-safe installer), and existing files are noted as
+  written to `*.claude-kit` sidecars (not `*.example`).
+
+## [0.25.0] — 2026-06-24
+
+**PR4 of the phased hardening review: supply-chain provenance, an explicit trust model, and a full
+genericization pass so the public repo carries only neutral examples.**
+
+### Added
+- **PEP 740 build attestations re-enabled** in `publish.yml`. They were temporarily disabled while
+  Sigstore's Rekor transparency log was returning HTTP 502s at upload time; Sigstore has since been
+  healthy (verified via status.sigstore.dev — all services online, no incidents), so releases are
+  signed again for supply-chain provenance.
+- **A "Security & trust model" section** in `README.md` (with a nav link) stating plainly that the
+  guard hooks are convenience, not a hardened boundary; that most quality gates are agent protocols
+  rather than mechanical enforcement; and that MCP servers are third-party code — surfacing
+  `SECURITY.md`'s posture where users decide to rely on the kit.
+
+### Changed
+- **Genericization pass** — removed residual internal / company-specific identifiers so the published
+  repo carries only neutral examples. Genericized the 0.15.0 adoption narrative in `CHANGELOG.md` and
+  `docs/coverage-audit.md`; renamed test functions and replaced an internal-token blocklist with a
+  positive neutralization check in `tests/test_scaffold.py`; and neutralized the skills-collection
+  reference docs (example feature / module / variable names, domain-specific jargon, and a
+  region-specific registry host) into generic equivalents. Examples-only — no behavior change.
+
 ## [0.24.0] — 2026-06-24
 
 **PR3 of the phased hardening review: deeper validation, a deterministic pipeline CLI, an MCP
@@ -532,7 +590,7 @@ values (→ `#______` placeholders, matching the existing `design-system-complia
 
 ## [0.15.0] — 2026-06-16
 
-**Adopt the Fynd Agentic Engineering personas & skills** (an internal Claude Code plugin marketplace —
+**Adopt a set of internal engineering personas & skills** (a private Claude Code plugin marketplace —
 11 agents + 29 skills across 7 plugins: engineer, designer, pm, context-gen, staff-em, staff-sdet,
 staff-pm). Those plugins are excellent but heavily **stack-bound** (FastAPI/SQLAlchemy/Pydantic/React/
 Tailwind/Radix/Zod/Temporal/Kafka/Langfuse, against an internal `.ai/` doc convention). Mirroring all
@@ -546,7 +604,7 @@ nothing), **18 extend** (a real delta folded into the nearest existing component
 layer), **1 adopt-core** (genuinely new + stack-agnostic). Net: **2 new core skills, ~10 surgical core
 extends, 1 new React overlay rule + FastAPI/React overlay enrichments, 5 new org components** — zero
 stack leakage into core, zero diluting duplicates. IP boundary: technique-and-structure only, no source
-text copied; every Fynd-internal reference (the `.ai/` naming, internal field/service names, numeric
+text copied; every source-internal reference (internal doc conventions, internal field/service names, numeric
 heuristics) stripped or genericized.
 
 Three deliberate decisions: **(1)** Temporal/Kafka/Langfuse are **not** added as selectable stacks —

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.24.0
+Version: 0.26.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -44,7 +44,7 @@ with a quality gate between every phase. **No application code. No Docker. Confi
 [![CI](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml)
 [![Changelog](https://img.shields.io/badge/changelog-md-blue.svg)](CHANGELOG.md)
 
-✨ [Features](#features) · 🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
+✨ [Features](#features) · 🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 🔒 [Security](#security--trust-model) · 📖 [Agent guide](docs/agents.md)
 
 </div>
 
@@ -668,6 +668,30 @@ hints.
 
 ---
 
+## Security & trust model
+
+claude-kit installs **configuration only** — no application code, no Docker, nothing that runs as a
+service. It never executes your code; it lays down rules, agents, skills, gates, and hook scripts that
+**Claude Code** then follows. Three honest caveats are worth understanding before you rely on it:
+
+- **The guard hooks are convenience, not a hardened boundary.** Scripts like `guard-secrets`,
+  `guard-destructive-git`, and the `warn-*` advisories raise the cost of a mistake — they do **not**
+  sandbox the agent or guarantee prevention. They need a POSIX shell + `jq` and **silently no-op**
+  without them (e.g. on Windows outside WSL/Git Bash). Treat them as seatbelts, not walls.
+- **Most quality gates are agent protocols, not mechanical enforcement.** The pipeline's gates
+  (`spec-complete`, `code-review`, `security-clear`, …) are disciplines Claude is instructed to follow
+  and self-verify; only the hook scripts are deterministic, host-enforced checks. A capable model can
+  still be wrong or skip a step — keep a human in the loop for anything that matters.
+- **MCP servers are third-party code.** Each fragment runs an external package (pinned to an exact
+  version) or a hosted endpoint that claude-kit references but does **not** vendor or audit. Review a
+  server's source and license before enabling it.
+
+Releases are published to PyPI via OIDC **Trusted Publishing** (no long-lived API token) with **PEP 740
+build attestations** for supply-chain provenance. Report vulnerabilities privately — see
+[`SECURITY.md`](SECURITY.md) for the full scope and reporting process.
+
+---
+
 ## Project structure
 
 <details>

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/README.md

@@ -14,7 +14,7 @@ with a quality gate between every phase. **No application code. No Docker. Confi
 [![CI](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/ajyadav013/claude-kit/actions/workflows/ci.yml)
 [![Changelog](https://img.shields.io/badge/changelog-md-blue.svg)](CHANGELOG.md)
 
-✨ [Features](#features) · 🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 📖 [Agent guide](docs/agents.md)
+✨ [Features](#features) · 🚀 [Quick start](#quick-start) · 🧭 [How it works](#how-it-works) · 🔁 [The pipeline](#the-pipeline) · 🧪 [Example](examples/) · 🌱 [What we adopted](#influences--what-we-adopted) · 🤖 [Agents](#the-agents) · 🧩 [Catalog](#catalog--extensibility) · 🛠️ [CLI](#cli-reference) · 🔒 [Security](#security--trust-model) · 📖 [Agent guide](docs/agents.md)
 
 </div>
 
@@ -638,6 +638,30 @@ hints.
 
 ---
 
+## Security & trust model
+
+claude-kit installs **configuration only** — no application code, no Docker, nothing that runs as a
+service. It never executes your code; it lays down rules, agents, skills, gates, and hook scripts that
+**Claude Code** then follows. Three honest caveats are worth understanding before you rely on it:
+
+- **The guard hooks are convenience, not a hardened boundary.** Scripts like `guard-secrets`,
+  `guard-destructive-git`, and the `warn-*` advisories raise the cost of a mistake — they do **not**
+  sandbox the agent or guarantee prevention. They need a POSIX shell + `jq` and **silently no-op**
+  without them (e.g. on Windows outside WSL/Git Bash). Treat them as seatbelts, not walls.
+- **Most quality gates are agent protocols, not mechanical enforcement.** The pipeline's gates
+  (`spec-complete`, `code-review`, `security-clear`, …) are disciplines Claude is instructed to follow
+  and self-verify; only the hook scripts are deterministic, host-enforced checks. A capable model can
+  still be wrong or skip a step — keep a human in the loop for anything that matters.
+- **MCP servers are third-party code.** Each fragment runs an external package (pinned to an exact
+  version) or a hosted endpoint that claude-kit references but does **not** vendor or audit. Review a
+  server's source and license before enabling it.
+
+Releases are published to PyPI via OIDC **Trusted Publishing** (no long-lived API token) with **PEP 740
+build attestations** for supply-chain provenance. Report vulnerabilities privately — see
+[`SECURITY.md`](SECURITY.md) for the full scope and reporting process.
+
+---
+
 ## Project structure
 
 <details>

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/docs/coverage-audit.md

@@ -51,9 +51,9 @@ The pattern matches the rest of the kit: a *discipline* is a RULE (always-on gui
 spec/EM gate exists at all. P0-2 is the exception that strengthens *every* gate by making a fabricated
 verdict auto-Critical, without adding a token.
 
-## Fynd adoption disciplines (as of 0.15.0)
+## Internal-toolkit adoption disciplines (as of 0.15.0)
 
-The Fynd persona/skill adoption (CHANGELOG 0.15.0) added capabilities reuse-first. Consistent with the
+The internal persona/skill adoption (CHANGELOG 0.15.0) added capabilities reuse-first. Consistent with the
 posture above, it added **no new gate tokens** — the new capabilities are SKILLs, OVERLAY rules, or
 checklists that ride *inside existing* review gates. Enforcement class of each:
 

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/hooks/hooks.json

@@ -29,11 +29,11 @@
         "hooks": [
           {
             "type": "command",
-            "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'rm[[:space:]]+-[^[:space:]]*r[^[:space:]]*f'; then echo 'BLOCKED: rm -rf is disabled by claude-kit. Move to trash or delete specific paths explicitly.' >&2; exit 2; fi"
+            "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command' 2>/dev/null || true); if echo \"$CMD\" | grep -qE 'rm[[:space:]]+-[^[:space:]]*r[^[:space:]]*f'; then echo 'BLOCKED: rm -rf is disabled by claude-kit. Move to trash or delete specific paths explicitly.' >&2; exit 2; fi"
           },
           {
             "type": "command",
-            "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command'); if echo \"$CMD\" | grep -qE 'git[[:space:]]+push.*[[:space:]:](main|master)([[:space:]]|$)'; then echo 'BLOCKED: refusing to push to main/master — use a feature branch and a PR.' >&2; exit 2; fi"
+            "command": "command -v jq >/dev/null 2>&1 || exit 0; CMD=$(jq -r '.tool_input.command' 2>/dev/null || true); if echo \"$CMD\" | grep -qE 'git[[:space:]]+push.*[[:space:]:](main|master)([[:space:]]|$)'; then echo 'BLOCKED: refusing to push to main/master — use a feature branch and a PR.' >&2; exit 2; fi"
           },
           {
             "type": "command",
@@ -49,6 +49,15 @@
           }
         ]
       },
+      {
+        "matcher": "Read",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "command -v jq >/dev/null 2>&1 || exit 0; FP=$(jq -r '.tool_input.file_path // empty' 2>/dev/null || true); if echo \"$FP\" | grep -qE '(^|/)\\.env$|\\.pem$|\\.key$|(^|/)id_rsa|(^|/)id_ed25519|(^|/)credentials(\\.json)?$|\\.p12$'; then echo 'BLOCKED: refusing to read a secrets file. Use .env.example or a secret manager.' >&2; exit 2; fi"
+          }
+        ]
+      },
       {
         "matcher": "Edit|Write",
         "hooks": [

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/hooks/scripts/guard-secrets.sh

@@ -3,7 +3,7 @@
 # Pairs with the secret-scanner agent and the protect-secrets read-guard — this is the automatic,
 # every-commit guardrail. Degrades to a no-op when not a git commit or git/jq is unavailable.
 command -v jq >/dev/null 2>&1 || exit 0
-CMD=$(jq -r '.tool_input.command // empty' 2>/dev/null)
+CMD=$(jq -r '.tool_input.command // empty' 2>/dev/null || true)
 echo "$CMD" | grep -qE 'git[[:space:]]+commit' || exit 0
 cd "${CLAUDE_PROJECT_DIR:-.}" 2>/dev/null || exit 0
 command -v git >/dev/null 2>&1 || exit 0

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.24.0"
+version = "0.26.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/rules/continuity.md

@@ -39,10 +39,14 @@ Schema (keep it small and truthful — omit a field rather than guess it):
   "lanes": { "<lane>": "not-started | in-progress | passed | failed" },
   "last_gate_passed": "<gate token, e.g. code-review>",
   "open_findings": { "critical": 0, "high": 0, "medium": 0 },
+  "gate_evidence": { "<gate token>": "<path to the evidence artifact>" },
+  "gate_overrides": { "<gate token>": "<why a blocking gate was force-closed>" },
   "next": "<the immediate next action>"
 }
 ```
 
+A gate is PASS only when zero **critical/high/medium** findings remain open (low/cosmetic may pass with notes). `gate_evidence` records the artifact backing each passed gate; `gate_overrides` is written **only** when a gate is deliberately force-closed despite open blocking findings, so a reviewer (or `claude-kit pipeline validate`) can surface and re-examine it.
+
 **Resume by reloading, not by re-running.** On resume, read the snapshot as *context* to decide where to continue — then continue from there. Do **not** re-run setup that already ran, re-apply edits already committed, or re-open a gate already PASSed. Re-enter at the first gate *after* `last_gate_passed`, re-running only un-passed or defect-affected lanes. The snapshot records what was *true when written*, so the verify-before-trust check still applies (`.claude/rules/agent-memory.md`): if a "passed" gate's artifact is gone, treat it as not passed. If the snapshot is absent or unparseable, fall back to the freeform CONTINUITY state (back-compatible) and proceed.
 
 ## Concurrency

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/scripts/check_docs_consistency.py

@@ -183,13 +183,17 @@ def _effective_gates() -> dict[str, set[str]]:
     return {name: resolve(name) for name in profiles}
 
 
-def _doc_gate_sets(relfile: str) -> dict[str, set[str]]:
-    """Parse the lean/standard/enterprise gate rows from a doc's profile→gate table."""
-    raw: dict[str, str] = {}
+def _doc_gate_sets(relfile: str) -> dict[str, list[set[str]]]:
+    """Parse *every* lean/standard/enterprise gate row from a doc (one entry per table occurrence).
+
+    Returns a list of gate sets per profile rather than a single value, so a second (possibly stale)
+    gate table can't silently overwrite an earlier one — each occurrence is checked independently.
+    """
+    raw: dict[str, list[str]] = {}
     for line in _read(relfile).splitlines():
         m = re.match(r"\|\s*\*\*(lean|standard|enterprise)\*\*\s*\|(.+?)\|\s*$", line)
         if m:
-            raw[m.group(1)] = m.group(2)
+            raw.setdefault(m.group(1), []).append(m.group(2))
 
     def tokens(cell: str) -> set[str]:
         return {
@@ -198,16 +202,18 @@ def _doc_gate_sets(relfile: str) -> dict[str, set[str]]:
             if t.strip().strip("*").strip("\\").strip()
         }
 
-    def expand(profile: str) -> set[str]:
-        cell = raw[profile]
+    def expand(cell: str) -> set[str]:
         if (
             "+" in cell
         ):  # e.g. "standard + pipeline-green · observability-ready · acceptance"
             base, extra = cell.split("+", 1)
-            return expand(base.strip().strip("*").lower()) | tokens(extra)
+            base_name = base.strip().strip("*").lower()
+            base_cells = raw.get(base_name)
+            base_gates = expand(base_cells[0]) if base_cells else set()
+            return base_gates | tokens(extra)
         return tokens(cell)
 
-    return {p: expand(p) for p in raw}
+    return {p: [expand(c) for c in cells] for p, cells in raw.items()}
 
 
 def check_profile_gates() -> list[str]:
@@ -216,21 +222,30 @@ def check_profile_gates() -> list[str]:
     for relfile in ("README.md", "skills/sdlc/SKILL.md"):
         doc = _doc_gate_sets(relfile)
         for profile in ("lean", "standard", "enterprise"):
-            if profile not in doc:
+            occurrences = doc.get(profile) or []
+            if not occurrences:
                 errors.append(f"{relfile}: no gate row found for profile {profile!r}")
                 continue
-            if doc[profile] != effective[profile]:
-                missing = effective[profile] - doc[profile]
-                extra = doc[profile] - effective[profile]
-                detail = []
-                if missing:
-                    detail.append(f"missing {sorted(missing)}")
-                if extra:
-                    detail.append(f"unexpected {sorted(extra)}")
+            if len(occurrences) > 1:
                 errors.append(
-                    f"{relfile}: {profile} gate row disagrees with profiles.yaml — "
-                    + "; ".join(detail)
+                    f"{relfile}: {len(occurrences)} gate rows for profile {profile!r} "
+                    "(duplicate gate table) — keep exactly one so a stale table can't hide "
+                    "behind a correct one"
                 )
+            for idx, gates in enumerate(occurrences):
+                if gates != effective[profile]:
+                    missing = effective[profile] - gates
+                    extra = gates - effective[profile]
+                    detail = []
+                    if missing:
+                        detail.append(f"missing {sorted(missing)}")
+                    if extra:
+                        detail.append(f"unexpected {sorted(extra)}")
+                    where = "" if len(occurrences) == 1 else f" (occurrence {idx + 1})"
+                    errors.append(
+                        f"{relfile}: {profile} gate row{where} disagrees with "
+                        "profiles.yaml — " + "; ".join(detail)
+                    )
     return errors
 
 

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/scripts/init.sh

@@ -5,13 +5,15 @@
 # project's .claude/ directory and drops a generic CLAUDE.md at the project root.
 #
 # Used by the /claude-kit:init slash command (plugin) and runnable directly from a checkout.
-# The pip CLI (`claude-kit init`) performs the same scaffolding in Python.
+# This is a degraded, no-resolution fallback: it copies the full payload as-is. The pip CLI
+# (`claude-kit init`) is the recommended installer — it is catalog-driven (stack/profile/MCP
+# resolution) and upgrade-safe (diff/upgrade), which this script does not do.
 #
 # Usage:  init.sh [TARGET_DIR] [--defaults] [--force] [--minimal] [--no-hooks]
 #   TARGET_DIR  project to scaffold into (default: $CLAUDE_PROJECT_DIR or current dir)
 #   --defaults  accepted for parity with the pip CLI (`claude-kit init --defaults`); a no-op here
 #               because this shell fallback is already non-interactive
-#   --force     overwrite existing CLAUDE.md / settings.json (otherwise written as *.example)
+#   --force     overwrite existing CLAUDE.md / settings.json (otherwise written as *.claude-kit sidecars)
 #   --minimal   only CLAUDE.md + rules/ (skip agents, skills, hooks, memory)
 #   --no-hooks  skip installing hook scripts and settings.json
 set -euo pipefail

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/skills/alembic-migrations/references/alembic-setup-and-env.md

@@ -151,7 +151,7 @@ from app.database import Base
 from config.settings import settings
 
 # Import all models (wildcard imports)
-from app.articles.models import *
+from app.items.models import *
 from app.units.models import *
 # ... (40+ wildcard imports)
 
@@ -183,8 +183,8 @@ from app.users.models import User
 from app.organizations.models import Organization
 
 # Wildcard imports (acceptable in env.py, used in multiple production services)
-from myapp.users.models import *
-from myapp.tenants.models import *
+from app.users.models import *
+from app.tenants.models import *
 ```
 
 **Critical**: If a model is not imported in `env.py`, Alembic won't detect it for autogenerate.

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/skills/alembic-migrations/references/repo-evidence.md

@@ -146,9 +146,9 @@ from app.database import Base
 from config.settings import settings
 
 # Wildcard model imports
-from app.articles.models import *
+from app.items.models import *
 from app.units.models import *
-from app.bom.models import *
+from app.catalog.models import *
 # ... 40+ wildcard imports
 
 # target_metadata

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/skills/alembic-migrations/references/writing-migrations.md

@@ -34,10 +34,10 @@ alembic/versions/
 ```
 alembic/versions/
 ├── 202407301751-ad610b2bab70_add_event_log_table.py
-├── 202408011255-e848fe551d9b_add_coe_bom_mapping_tables.py
+├── 202408011255-e848fe551d9b_add_category_mapping_tables.py
 ├── 202408012159-c3f783a32f7c_add_username_to_event_log_table.py
-├── 202408052213-943a94fc4f73_add_is_active_to_mapping_tebles.py
-├── 202409031128-0fc8dde689fe_fabric_source_cluster.py
+├── 202408052213-943a94fc4f73_add_is_active_to_mapping_tables.py
+├── 202409031128-0fc8dde689fe_add_source_cluster.py
 └── ...
 ```
 
@@ -53,10 +53,10 @@ alembic/versions/
 
 ```
 migrations/versions/
-├── 554395de0772_added_planograph_models.py
+├── 554395de0772_added_data_models.py
 ├── 9d07416cb3d0_modified_generated_file_model.py
-├── cb876bd3ff47_added_watermakr_model.py
-└── d5885c4539c2_updated_watermark_table_to_include_.py
+├── cb876bd3ff47_added_watermark_model.py
+└── d5885c4539c2_updated_watermark_table.py
 ```
 
 **Format**: `{auto_hash}_{description}.py` (default Alembic behavior)

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/skills/api-pagination-filtering-sorting/README.md

@@ -18,7 +18,7 @@ This skill covers production-tested conventions for designing paginated, filtere
 
 ## Origin
 
-This skill derives from real production backend services handling inventory, forecasting, replenishment, and range planning data. It distills conventions observed across multiple services with large datasets (10k-1M+ records per tenant) requiring efficient pagination, multi-dimensional filtering, and flexible sorting.
+This skill derives from real production backend services handling inventory, forecasting, and order data. It distills conventions observed across multiple services with large datasets (10k-1M+ records per tenant) requiring efficient pagination, multi-dimensional filtering, and flexible sorting.
 
 ## Relation to other skills
 

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/skills/api-pagination-filtering-sorting/SKILL.md

@@ -26,7 +26,7 @@ Standardize HTTP query parameter conventions and response metadata for paginated
 
 4. **Multi-value filters via FastAPI `Query`**: For filters that accept multiple values (e.g., `status`, `store_ids`, `segment_codes`), use `Optional[List[str]] = Query(None, description="...")`. The client sends `?status=pending&status=approved` or `?status[]=pending&status[]=approved` (FastAPI accepts both). In the query builder, translate to SQL `IN` clause or `ANY(ARRAY[...])`.
 
-5. **Comma-separated multi-value filters**: Some endpoints accept comma-separated values in a single param (e.g., `?articles=SKU-001,SKU-002,SKU-003`). Use `Optional[str] = Query(None)` and split by comma in the service or repository layer before building SQL. This pattern is common for legacy APIs or when the client cannot send array query params.
+5. **Comma-separated multi-value filters**: Some endpoints accept comma-separated values in a single param (e.g., `?items=ITEM-001,ITEM-002,ITEM-003`). Use `Optional[str] = Query(None)` and split by comma in the service or repository layer before building SQL. This pattern is common for legacy APIs or when the client cannot send array query params.
 
 6. **Hierarchical filters**: Product or location hierarchies (e.g., segment → family → class → brick; zone → format → state → region → city → store) use separate query params for each level. Each is optional; when provided, it narrows results to that level. Example: `?segment=BEVERAGES&family=SOFT_DRINKS&class=COLA`. Query builder applies `WHERE` clauses for each non-null filter. Some services support both singular and plural param names (`?store=...` and `?stores=...`); prefer plural for multi-value, singular for single value.
 
@@ -36,9 +36,9 @@ Standardize HTTP query parameter conventions and response metadata for paginated
 
 9. **Repository layer pagination**: The repository fetches two results in parallel—`(records_data, total_count)`—via `asyncio.gather` or sequential calls. It executes the count query to get `total_count`, then executes the data query with `LIMIT/OFFSET`. Service layer constructs the response object with data + pagination metadata. For download endpoints (no pagination), omit `LIMIT/OFFSET` from the query.
 
-10. **Search across multiple fields**: A single `search` query param applies a case-insensitive substring match across multiple columns. In SQL, use `WHERE (LOWER(field1) LIKE LOWER(:search) OR LOWER(field2) LIKE LOWER(:search) OR ...)` with param `%{search}%`. Some implementations use `ILIKE` (PostgreSQL) or full-text search. Common searchable fields: article codes, descriptions, store IDs, order IDs.
+10. **Search across multiple fields**: A single `search` query param applies a case-insensitive substring match across multiple columns. In SQL, use `WHERE (LOWER(field1) LIKE LOWER(:search) OR LOWER(field2) LIKE LOWER(:search) OR ...)` with param `%{search}%`. Some implementations use `ILIKE` (PostgreSQL) or full-text search. Common searchable fields: item codes, descriptions, store IDs, order IDs.
 
-11. **Pydantic models for query params**: Define a `QueryParams` Pydantic model (e.g., `ReplenishmentQueryParams`, `ForecastQuery`) to encapsulate all filters, pagination, sorting, and search params. This separates route handler param extraction from business logic. The model can provide helper methods like `@property def limit(self)` to derive limit from `page_size` or compute `offset` from `page` and `page_size`.
+11. **Pydantic models for query params**: Define a `QueryParams` Pydantic model (e.g., `InventoryQueryParams`, `ForecastQuery`) to encapsulate all filters, pagination, sorting, and search params. This separates route handler param extraction from business logic. The model can provide helper methods like `@property def limit(self)` to derive limit from `page_size` or compute `offset` from `page` and `page_size`.
 
 12. **FastAPI route handler**: Extract query params via `Query()` for primitive types or depend on Pydantic model. Calculate `offset = (page - 1) * page_size` if needed. Call service layer with `query_params` object or individual params. Return response via `ResponseData.ok(data=..., pagination=...)` or a typed response model wrapping data + metadata.
 
@@ -175,8 +175,8 @@ class ItemQueryBuilder:
         search_param = self._add_param(f"%{search}%")
         return f"""
             AND (
-                LOWER(article_id) LIKE LOWER({search_param})
-                OR LOWER(article_description) LIKE LOWER({search_param})
+                LOWER(item_id) LIKE LOWER({search_param})
+                OR LOWER(item_description) LIKE LOWER({search_param})
                 OR LOWER(store_id) LIKE LOWER({search_param})
             )
         """
@@ -186,7 +186,7 @@ class ItemQueryBuilder:
         sort_mapping = {
             "created_at": "created_at",
             "updated_at": "updated_at",
-            "article": "article_id",
+            "item": "item_id",
             "store": "store_id",
         }
         column = sort_mapping.get(sort_by, "created_at")
@@ -284,7 +284,7 @@ async def list_items(
     sort_by: str = Query("created_at", description="Field to sort by"),
     sort_order: str = Query("desc", regex="^(asc|desc)$", description="Sort direction"),
     # Search
-    search: Optional[str] = Query(None, description="Search across article, description, store"),
+    search: Optional[str] = Query(None, description="Search across item, description, store"),
     # Filters
     status: Optional[List[str]] = Query(None, description="Filter by status (multi-value)"),
     store_ids: Optional[List[str]] = Query(None, description="Filter by store IDs"),
@@ -301,7 +301,7 @@ async def list_items(
     - page_size: Records per page (1-100, default: 20)
     
     **Sorting:**
-    - sort_by: Field to sort by (created_at, updated_at, article, store)
+    - sort_by: Field to sort by (created_at, updated_at, item, store)
     - sort_order: asc or desc (default: desc)
     
     **Filters:**
@@ -311,7 +311,7 @@ async def list_items(
     - family: Product family (hierarchical, requires segment)
     
     **Search:**
-    - search: Substring match across article_id, article_description, store_id
+    - search: Substring match across item_id, item_description, store_id
     """
     query_params = QueryParams(
         page=page,
@@ -336,7 +336,7 @@ async def list_items(
 5. **Single-responsibility violation**: Query construction in route handlers; move SQL building to a dedicated QueryBuilder or repository method.
 6. **Zero-indexed `page` in user-facing APIs**: Users expect page 1 to be the first page; use 1-indexed `page` in API and convert to 0-indexed offset internally.
 7. **Hardcoding sort column names**: User sends `sort_by=doh` but SQL uses `days_on_hand`; maintain a sort mapping dict to translate user-facing names to column names.
-8. **Ignoring case-sensitivity in search**: `WHERE article_id LIKE :search` is case-sensitive on some DBs; use `LOWER(...)` or `ILIKE` for case-insensitive search.
+8. **Ignoring case-sensitivity in search**: `WHERE item_id LIKE :search` is case-sensitive on some DBs; use `LOWER(...)` or `ILIKE` for case-insensitive search.
 9. **Fetching full result set then paginating in Python**: Always push `LIMIT/OFFSET` to SQL; paginating in-memory defeats the purpose and exhausts memory on large datasets.
 10. **Not validating `sort_order`**: Accepting arbitrary `sort_order` can inject ASC/DESC into SQL unsafely; use `regex="^(asc|desc)$"` or enum validation.
 11. **Returning inconsistent metadata field names**: `total` vs `total_records`, `limit` vs `page_size`, `next` vs `has_next`; standardize on one naming convention per service.

{claude_code_kit-0.24.0 → claude_code_kit-0.26.0}/skills/api-pagination-filtering-sorting/references/query-params-conventions.md

@@ -86,16 +86,16 @@ WHERE store_id = ANY($2)
 Legacy or client-constrained APIs:
 
 ```python
-articles: Optional[str] = Query(None, description="Comma-separated article codes")
+items: Optional[str] = Query(None, description="Comma-separated item codes")
 ```
 
 Split in service/repository:
 ```python
-article_list = articles.split(',') if articles else []
-# Then use in SQL: WHERE article_id = ANY($1)
+item_list = items.split(',') if items else []
+# Then use in SQL: WHERE item_id = ANY($1)
 ```
 
-Example: `?articles=SKU-001,SKU-002,SKU-003`
+Example: `?items=ITEM-001,ITEM-002,ITEM-003`
 
 ## Hierarchical filters
 
@@ -172,14 +172,14 @@ query = f"ORDER BY {column} {sort_order.upper()}"
 Single search param for multi-field substring matching:
 
 ```python
-search: Optional[str] = Query(None, description="Search text across article, description, store")
+search: Optional[str] = Query(None, description="Search text across item, description, store")
 ```
 
 Translate to case-insensitive SQL:
 ```sql
 WHERE (
-    LOWER(article_id) LIKE LOWER($1)
-    OR LOWER(article_description) LIKE LOWER($1)
+    LOWER(item_id) LIKE LOWER($1)
+    OR LOWER(item_description) LIKE LOWER($1)
     OR LOWER(store_id) LIKE LOWER($1)
 )
 ```
@@ -189,8 +189,8 @@ Param value: `f"%{search}%"`
 Some implementations use PostgreSQL `ILIKE`:
 ```sql
 WHERE (
-    article_id ILIKE $1
-    OR article_description ILIKE $1
+    item_id ILIKE $1
+    OR item_description ILIKE $1
 )
 ```