claude-code-kit 0.26.1__tar.gz → 0.27.0__tar.gz

{claude_code_kit-0.26.1 → claude_code_kit-0.27.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.26.1",
+      "version": "0.27.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.26.1 → claude_code_kit-0.27.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.26.1",
+  "version": "0.27.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.26.1 → claude_code_kit-0.27.0}/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.27.0] — 2026-06-24
+
+**Objective fixes from a product review: honest skill counts (with a guard), drift-aware
+`doctor`/`validate`, and a distinct corrupt-vs-missing manifest signal.**
+
+### Added
+- **`validate`/`doctor` now surface kit-owned drift.** They already verified that every tracked file
+  is *present*; they now also compare each kit/overlay file's live SHA-256 against the install
+  manifest and emit `N kit-owned file(s) modified since install … run claude-kit diff` (a WARN, never
+  a FAIL — edits to user-editable files are not flagged). The manifest data already existed; only
+  `diff`/`upgrade` consulted it before.
+
+### Changed
+- **Honest skill counts.** The README advertised "51 skills" — the count of *core* skills only, while
+  the repo ships **96** (51 stack-agnostic core + 45 stack-collection). All three occurrences now read
+  "96 … (51 core + 45 stack-collection)", and `check_docs_consistency.py` pins the headline total
+  **and** both halves to the filesystem so the number can't silently drift again.
+- **Corrupt vs missing `init-options.json` are now distinct signals.** A missing manifest stays a WARN
+  ("validate/upgrade limited"); a *corrupt* one is a FAIL ("unreadable … repair the JSON or re-run
+  `claude-kit init --force`") in `validate`, `doctor`, `diff`, and `upgrade` — matching how the kit
+  already reports a malformed `settings.json`/`.mcp.json`.
+
 ## [0.26.1] — 2026-06-24
 
 **A second strict practical review (installed and exercised end-to-end) surfaced seven papercuts on

{claude_code_kit-0.26.1 → claude_code_kit-0.27.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.26.1
+Version: 0.27.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -81,7 +81,7 @@ Quick start) for the full breakdown of any row.
 | 🔁 **Pipeline & quality gates** | Gate-enforced progression (zero open Critical/High/Medium to advance), per-profile gate sets, a fast-track for small changes, and an anti-sycophancy `devils-advocate` pass |
 | 🤖 **Agent roster** | **28** tiered agents + per-database overlays + **6** org personas, led by an Orchestrator that never writes code |
 | 🔍 **Self-verification & review** | RARV green-Verify (real commands, not imagined), blind parallel review, and read-only risk classification |
-| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **51** context-activated skills |
+| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **96** context-activated skills (51 core + 45 stack-collection) |
 | 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
 | 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
 | 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
@@ -258,7 +258,7 @@ need.
 - **23 stack-agnostic core rules** in [`rules/`](rules/) — `mandatory-workflow`, `quality-gates`,
   `rarv-cycle`, `continuity`, plus eight agent-operation rules and `autonomy-levels` +
   `risk-classification` (see [`docs/agentic-patterns.md`](docs/agentic-patterns.md)).
-- **51 on-demand skills** in [`skills/`](skills/) — spec-driven dev, planning, TDD, debugging, code
+- **96 on-demand skills** in [`skills/`](skills/) (51 core + 45 stack-collection) — spec-driven dev, planning, TDD, debugging, code
   review, threat modeling, and more — activated by context and led by the `sdlc` entrypoint.
 - **Profile-subset install** — each profile installs a strict subset of agents, skills, hooks, and
   rules (`lean ⊂ standard ⊂ enterprise`), from fast track to full audit.
@@ -496,7 +496,7 @@ It is **not** a runtime, an orchestration engine, or a code library. That framin
 | **[wshobson/agents](https://github.com/wshobson/agents)** & similar agent collections | Large libraries of individual subagent prompts you pick from | claude-kit ships a **smaller, opinionated set wired into a sequenced pipeline with owned quality gates** — agents aren't a menu, they're stages that hand off and block on each other. Adopt-by-reuse, not by accumulation. |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | A spec-driven workflow (constitution → spec → tasks → analyze) | claude-kit **absorbed spec-kit's coverage-gate idea** (the `story-planner` 1f gate + `task-tracker-sync`) into a **broader** lifecycle that also covers review, security, build, test, release, and observability gates. Complementary, wider scope. |
 | **claude-flow / multi-agent runtimes** | Runtime orchestrators that *execute* swarms of agents | claude-kit produces **portable configuration**, not a running process — the orchestration is described in rules the host (Claude Code) executes. No daemon, no lock-in, no app code. |
-| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 51 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
+| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 96 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
 
 **Choose claude-kit when** you want a consistent, reviewable, **gate-enforced** autonomous-SDLC setup
 that's the same across every repo and stack, installs in seconds, ships nothing you have to run, and

{claude_code_kit-0.26.1 → claude_code_kit-0.27.0}/README.md

@@ -51,7 +51,7 @@ Quick start) for the full breakdown of any row.
 | 🔁 **Pipeline & quality gates** | Gate-enforced progression (zero open Critical/High/Medium to advance), per-profile gate sets, a fast-track for small changes, and an anti-sycophancy `devils-advocate` pass |
 | 🤖 **Agent roster** | **28** tiered agents + per-database overlays + **6** org personas, led by an Orchestrator that never writes code |
 | 🔍 **Self-verification & review** | RARV green-Verify (real commands, not imagined), blind parallel review, and read-only risk classification |
-| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **51** context-activated skills |
+| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **96** context-activated skills (51 core + 45 stack-collection) |
 | 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
 | 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
 | 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
@@ -228,7 +228,7 @@ need.
 - **23 stack-agnostic core rules** in [`rules/`](rules/) — `mandatory-workflow`, `quality-gates`,
   `rarv-cycle`, `continuity`, plus eight agent-operation rules and `autonomy-levels` +
   `risk-classification` (see [`docs/agentic-patterns.md`](docs/agentic-patterns.md)).
-- **51 on-demand skills** in [`skills/`](skills/) — spec-driven dev, planning, TDD, debugging, code
+- **96 on-demand skills** in [`skills/`](skills/) (51 core + 45 stack-collection) — spec-driven dev, planning, TDD, debugging, code
   review, threat modeling, and more — activated by context and led by the `sdlc` entrypoint.
 - **Profile-subset install** — each profile installs a strict subset of agents, skills, hooks, and
   rules (`lean ⊂ standard ⊂ enterprise`), from fast track to full audit.
@@ -466,7 +466,7 @@ It is **not** a runtime, an orchestration engine, or a code library. That framin
 | **[wshobson/agents](https://github.com/wshobson/agents)** & similar agent collections | Large libraries of individual subagent prompts you pick from | claude-kit ships a **smaller, opinionated set wired into a sequenced pipeline with owned quality gates** — agents aren't a menu, they're stages that hand off and block on each other. Adopt-by-reuse, not by accumulation. |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | A spec-driven workflow (constitution → spec → tasks → analyze) | claude-kit **absorbed spec-kit's coverage-gate idea** (the `story-planner` 1f gate + `task-tracker-sync`) into a **broader** lifecycle that also covers review, security, build, test, release, and observability gates. Complementary, wider scope. |
 | **claude-flow / multi-agent runtimes** | Runtime orchestrators that *execute* swarms of agents | claude-kit produces **portable configuration**, not a running process — the orchestration is described in rules the host (Claude Code) executes. No daemon, no lock-in, no app code. |
-| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 51 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
+| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 96 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
 
 **Choose claude-kit when** you want a consistent, reviewable, **gate-enforced** autonomous-SDLC setup
 that's the same across every repo and stack, installs in seconds, ships nothing you have to run, and

{claude_code_kit-0.26.1 → claude_code_kit-0.27.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.26.1"
+version = "0.27.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.26.1 → claude_code_kit-0.27.0}/scripts/check_docs_consistency.py

@@ -100,6 +100,7 @@ def _actuals() -> dict[str, int]:
     return {
         "agents": len(list((ROOT / "agents").glob("*.md"))),
         "rules": len(list((ROOT / "rules").glob("*.md"))),
+        "skills": core + collection,
         "core skills": core,
         "collection skills": collection,
         "hook scripts": len(list((ROOT / "hooks" / "scripts").glob("*.sh"))),
@@ -120,8 +121,12 @@ _ANCHORS: list[tuple[str, str, str]] = [
     ("rules", "README.md", r"(\d+) stack-agnostic core rules"),
     ("rules", "README.md", r"(\d+) stack-agnostic contracts"),
     ("rules", "README.md", r"(\d+) engineering rules"),
-    ("core skills", "README.md", r"\*\*(\d+)\*\* context-activated skills"),
-    ("core skills", "README.md", r"(\d+) on-demand skills"),
+    # The headline skill number is the FULL catalog (core + collection); the breakdown pins each part.
+    ("skills", "README.md", r"\*\*(\d+)\*\* context-activated skills"),
+    ("skills", "README.md", r"(\d+) on-demand skills"),
+    ("skills", "README.md", r"(\d+) skills, gates"),
+    ("core skills", "README.md", r"\((\d+) core \+"),
+    ("collection skills", "README.md", r"\+ (\d+) stack-collection\)"),
     ("hook scripts", "README.md", r"\*\*(\d+)\*\* event hooks"),
     ("hook scripts", "README.md", r"(\d+) event hook scripts"),
     ("mcp servers", "README.md", r"\*\*(\d+)\*\* ready MCP fragments"),

{claude_code_kit-0.26.1 → claude_code_kit-0.27.0}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.26.1"
+__version__ = "0.27.0"

{claude_code_kit-0.26.1 → claude_code_kit-0.27.0}/src/claude_kit/upgrader.py

@@ -29,7 +29,7 @@ from pathlib import Path
 
 from claude_kit import catalog, scaffold
 from claude_kit.models import FileRecord, InitOptions, ResolvedPlan
-from claude_kit.validator import _load_init_options
+from claude_kit.validator import _load_init_options, _read_init_options
 
 #: Sidecar suffix for a new version of a user-modified, protected file.
 _SIDECAR_SUFFIX = ".claude-kit"
@@ -129,9 +129,9 @@ def _compare(src: Path, target: str | Path) -> _Comparison | str:
     claude = target / ".claude"
     if not claude.is_dir():
         return "not-installed"
-    old = _load_init_options(claude)
+    old, err = _read_init_options(claude)
     if old is None:
-        return "no-options"
+        return "corrupt-options" if err and err.startswith("corrupt") else "no-options"
 
     plan = catalog.resolve(src, old.selection)
     # Render the reference under the REAL project name so CLAUDE.md/README don't diff spuriously.
@@ -355,6 +355,11 @@ def _explain_error(code: str, target: str | Path) -> tuple[bool, list[str]]:
         return False, [
             f"FAIL  no .claude/ at {Path(target).expanduser().resolve()} — run `claude-kit init` first"
         ]
+    if code == "corrupt-options":
+        return False, [
+            "FAIL  .claude/config/init-options.json is unreadable (invalid JSON) — repair it "
+            "or re-run `claude-kit init --force` to re-create it"
+        ]
     return False, [
         "FAIL  no .claude/config/init-options.json — this install predates upgrade tracking; "
         "re-run `claude-kit init --force` to start tracking"

{claude_code_kit-0.26.1 → claude_code_kit-0.27.0}/src/claude_kit/validator.py

@@ -12,6 +12,7 @@ report and choose an exit code.
 
 from __future__ import annotations
 
+import hashlib
 import json
 import os
 import platform
@@ -72,15 +73,31 @@ def _parse_frontmatter(text: str) -> dict[str, str] | None:
     return data
 
 
-def _load_init_options(claude_dir: Path) -> InitOptions | None:
-    """Load and parse ``.claude/config/init-options.json`` if present."""
+def _sha256(path: Path) -> str:
+    """Hex SHA-256 of a file's bytes (matches the digest recorded in init-options.json)."""
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def _read_init_options(claude_dir: Path) -> tuple[InitOptions | None, str | None]:
+    """Load ``init-options.json``, distinguishing *missing* from *corrupt*.
+
+    Returns ``(options, None)`` on success; ``(None, "missing")`` when the file is absent; and
+    ``(None, "corrupt: <detail>")`` when it exists but cannot be parsed. Callers can then surface a
+    distinct, louder signal for a corrupt manifest (a real problem worth a FAIL) versus a missing
+    one (an older install that merely predates upgrade tracking — a WARN).
+    """
     path = claude_dir / "config" / "init-options.json"
     if not path.is_file():
-        return None
+        return None, "missing"
     try:
-        return InitOptions.from_dict(json.loads(path.read_text(encoding="utf-8")))
-    except (json.JSONDecodeError, TypeError, ValueError):
-        return None
+        return InitOptions.from_dict(json.loads(path.read_text(encoding="utf-8"))), None
+    except (json.JSONDecodeError, TypeError, ValueError) as exc:
+        return None, f"corrupt: {exc}"
+
+
+def _load_init_options(claude_dir: Path) -> InitOptions | None:
+    """Back-compat: the parsed options, or None for either a missing or corrupt manifest."""
+    return _read_init_options(claude_dir)[0]
 
 
 def validate(target: str | Path, *, strict: bool = False) -> tuple[bool, list[str]]:
@@ -116,19 +133,41 @@ def validate(target: str | Path, *, strict: bool = False) -> tuple[bool, list[st
         fail(f"no .claude/ directory in {target} — run `claude-kit init` here")
         return ok, msgs
 
-    options = _load_init_options(claude)
+    options, opt_err = _read_init_options(claude)
     if options is None:
-        warn(
-            "missing or unreadable .claude/config/init-options.json (validate/upgrade limited)"
-        )
+        if opt_err == "missing":
+            warn(
+                "no .claude/config/init-options.json (validate/upgrade limited — "
+                "re-run `claude-kit init` to start tracking)"
+            )
+        else:
+            fail(
+                f".claude/config/init-options.json is unreadable ({opt_err}) — repair the JSON "
+                "or re-run `claude-kit init --force`"
+            )
     else:
         good(
             f"init-options.json (schema v{options.schema_version}, kit {options.claude_kit_version})"
         )
+        drifted: list[str] = []
         for rec in options.files:
-            if not (target / rec.path).exists():
+            fp = target / rec.path
+            if not fp.exists():
                 fail(f"recorded file missing: {rec.path}")
+            elif (
+                rec.owner in ("kit", "overlay")
+                and fp.is_file()
+                and _sha256(fp) != rec.sha256
+            ):
+                drifted.append(rec.path)
         good(f"tracked files present ({len(options.files)} recorded)")
+        if drifted:
+            preview = ", ".join(sorted(drifted)[:3])
+            more = "" if len(drifted) <= 3 else f" (+{len(drifted) - 3} more)"
+            warn(
+                f"{len(drifted)} kit-owned file(s) modified since install: {preview}{more} "
+                "— run `claude-kit diff` to review (edits to user-editable files are not flagged)"
+            )
 
     settings = claude / "settings.json"
     if settings.is_file():