claude-code-kit 0.26.1__tar.gz → 0.28.0__tar.gz

{claude_code_kit-0.26.1 → claude_code_kit-0.28.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.26.1",
+      "version": "0.28.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.26.1 → claude_code_kit-0.28.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.26.1",
+  "version": "0.28.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.26.1 → claude_code_kit-0.28.0}/CHANGELOG.md

@@ -4,6 +4,51 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.28.0] — 2026-06-24
+
+**Positioning & onboarding pass (docs): surface the anti-fabrication moat, compare against native
+subagents, and ship a real-run capture harness. No behavior change.**
+
+### Added
+- **`scripts/capture-sdlc-run.sh` + [`docs/capture-a-real-run.md`](docs/capture-a-real-run.md).** A
+  read-only helper that bundles one completed `/sdlc` run — the spec (`docs/specs/`), the gitignored
+  gate state (`.claude/state/pipeline-snapshot.json`), the verdict log (`.claude/CONTINUITY.md`), and
+  the diff vs your base branch — into one publishable folder. It runs a generic secret scan (lists
+  matching **file names only**, never values) and writes a manual `REDACTION-CHECKLIST.md`, so a real
+  run can become a worked example without hand-collecting files.
+- **"Native Claude Code subagents / Agent Teams" comparison row** in the README — the alternative
+  every Claude Code user weighs first. Honest framing: native gives you the agents; claude-kit adds
+  the *governance* (sequenced pipeline, owned gates, evidence requirement, `devils-advocate`, resume).
+
+### Changed
+- **The anti-fabrication evidence requirement is now the headline trust idea.** "How it works" leads
+  with *"Evidence or it didn't happen"* — every gate verdict must cite the command + captured output
+  (or `file:line`), and an invented/assumed/partial-output verdict is an auto-Critical finding
+  (`rules/quality-gates.md` §2.5). The top-of-README tagline now states gates pass only on real,
+  cited output. (The rule itself is unchanged; it was previously only implied via RARV.)
+
+## [0.27.0] — 2026-06-24
+
+**Objective fixes from a product review: honest skill counts (with a guard), drift-aware
+`doctor`/`validate`, and a distinct corrupt-vs-missing manifest signal.**
+
+### Added
+- **`validate`/`doctor` now surface kit-owned drift.** They already verified that every tracked file
+  is *present*; they now also compare each kit/overlay file's live SHA-256 against the install
+  manifest and emit `N kit-owned file(s) modified since install … run claude-kit diff` (a WARN, never
+  a FAIL — edits to user-editable files are not flagged). The manifest data already existed; only
+  `diff`/`upgrade` consulted it before.
+
+### Changed
+- **Honest skill counts.** The README advertised "51 skills" — the count of *core* skills only, while
+  the repo ships **96** (51 stack-agnostic core + 45 stack-collection). All three occurrences now read
+  "96 … (51 core + 45 stack-collection)", and `check_docs_consistency.py` pins the headline total
+  **and** both halves to the filesystem so the number can't silently drift again.
+- **Corrupt vs missing `init-options.json` are now distinct signals.** A missing manifest stays a WARN
+  ("validate/upgrade limited"); a *corrupt* one is a FAIL ("unreadable … repair the JSON or re-run
+  `claude-kit init --force`") in `validate`, `doctor`, `diff`, and `upgrade` — matching how the kit
+  already reports a malformed `settings.json`/`.mcp.json`.
+
 ## [0.26.1] — 2026-06-24
 
 **A second strict practical review (installed and exercised end-to-end) surfaced seven papercuts on

{claude_code_kit-0.26.1 → claude_code_kit-0.28.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.26.1
+Version: 0.28.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -34,8 +34,9 @@ Description-Content-Type: text/markdown
 
 **A Cookiecutter-style scaffolder for an autonomous SDLC (software-delivery lifecycle) inside [Claude Code](https://www.claude.com/product/claude-code).**
 
-One command turns a one-line request into reviewed, tested, secured, shippable code —
-with a quality gate between every phase. **No application code. No Docker. Configuration only.**
+One command turns a one-line request into reviewed, tested, secured, shippable code — with a
+quality gate between every phase. Each gate passes only on *real, cited command output* — never an
+assumed or fabricated "it works." **No application code. No Docker. Configuration only.**
 
 [![PyPI](https://img.shields.io/pypi/v/claude-code-kit.svg)](https://pypi.org/project/claude-code-kit/)
 [![Python](https://img.shields.io/pypi/pyversions/claude-code-kit.svg)](https://pypi.org/project/claude-code-kit/)
@@ -81,7 +82,7 @@ Quick start) for the full breakdown of any row.
 | 🔁 **Pipeline & quality gates** | Gate-enforced progression (zero open Critical/High/Medium to advance), per-profile gate sets, a fast-track for small changes, and an anti-sycophancy `devils-advocate` pass |
 | 🤖 **Agent roster** | **28** tiered agents + per-database overlays + **6** org personas, led by an Orchestrator that never writes code |
 | 🔍 **Self-verification & review** | RARV green-Verify (real commands, not imagined), blind parallel review, and read-only risk classification |
-| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **51** context-activated skills |
+| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **96** context-activated skills (51 core + 45 stack-collection) |
 | 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
 | 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
 | 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
@@ -258,7 +259,7 @@ need.
 - **23 stack-agnostic core rules** in [`rules/`](rules/) — `mandatory-workflow`, `quality-gates`,
   `rarv-cycle`, `continuity`, plus eight agent-operation rules and `autonomy-levels` +
   `risk-classification` (see [`docs/agentic-patterns.md`](docs/agentic-patterns.md)).
-- **51 on-demand skills** in [`skills/`](skills/) — spec-driven dev, planning, TDD, debugging, code
+- **96 on-demand skills** in [`skills/`](skills/) (51 core + 45 stack-collection) — spec-driven dev, planning, TDD, debugging, code
   review, threat modeling, and more — activated by context and led by the `sdlc` entrypoint.
 - **Profile-subset install** — each profile installs a strict subset of agents, skills, hooks, and
   rules (`lean ⊂ standard ⊂ enterprise`), from fast track to full audit.
@@ -381,14 +382,19 @@ flowchart LR
     PROJ --> RUN(["/sdlc — autonomous SDLC active"])
 ```
 
-Three ideas do the heavy lifting:
+Four ideas do the heavy lifting:
 
-1. **Quality gates with a shared severity model.** Every finding is classified
+1. **Evidence or it didn't happen.** Every gate verdict — PASS or FAIL — must cite the command that
+   ran and its captured output (or the `file:line` it rests on). A verdict that's invented, assumed,
+   or read off still-running work is an **auto-Critical finding** — the same severity as a hardcoded
+   secret — and it fails every downstream gate that trusted it
+   ([`quality-gates.md` §2.5](rules/quality-gates.md)).
+2. **Quality gates with a shared severity model.** Every finding is classified
    Critical / High / Medium / Low / Cosmetic. A gate passes **only** with zero Critical/High/Medium
    open. No silent advancement.
-2. **RARV self-check.** Every agent runs **R**eason → **A**ct → **R**eflect → **V**erify and must show
+3. **RARV self-check.** Every agent runs **R**eason → **A**ct → **R**eflect → **V**erify and must show
    a *green Verify* (real commands run, not imagined) before handing off.
-3. **Blind review + Devil's Advocate.** Parallel reviewers judge independently; a *unanimous* PASS is
+4. **Blind review + Devil's Advocate.** Parallel reviewers judge independently; a *unanimous* PASS is
    treated as suspicious and triggers an adversarial `devils-advocate` pass before the gate may close —
    an explicit guard against agents rubber-stamping each other.
 
@@ -428,7 +434,8 @@ is inert for non-API projects. Organization scope at `regulated` strictness adds
 Code Reviewer → Tester → PR.
 
 See [`examples/`](examples/) for a synthetic end-to-end walkthrough — request → spec → story breakdown
-→ gate verdicts (with one defect-loop cycle) → sample PR diff.
+→ gate verdicts (with one defect-loop cycle) → sample PR diff. To capture *your own* real run as a
+publishable, redaction-scrubbed bundle, see [`docs/capture-a-real-run.md`](docs/capture-a-real-run.md).
 
 ---
 
@@ -493,10 +500,11 @@ It is **not** a runtime, an orchestration engine, or a code library. That framin
 
 | Project | What it is | How claude-kit differs |
 |---|---|---|
+| **Native Claude Code subagents / Agent Teams** | Spawn parallel agents on demand; you define the workflow, gates, and verification yourself each time | claude-kit is the **opinionated layer on top** of exactly that capability: a fixed, sequenced pipeline with **owned quality gates** (block on any open Critical/High/Medium), an **evidence requirement** (no fabricated verdicts — `quality-gates.md` §2.5), a `devils-advocate` anti-rubber-stamp pass, and **structured resume** from `.claude/state/pipeline-snapshot.json`. Native gives you the agents; claude-kit gives you the governance. |
 | **[wshobson/agents](https://github.com/wshobson/agents)** & similar agent collections | Large libraries of individual subagent prompts you pick from | claude-kit ships a **smaller, opinionated set wired into a sequenced pipeline with owned quality gates** — agents aren't a menu, they're stages that hand off and block on each other. Adopt-by-reuse, not by accumulation. |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | A spec-driven workflow (constitution → spec → tasks → analyze) | claude-kit **absorbed spec-kit's coverage-gate idea** (the `story-planner` 1f gate + `task-tracker-sync`) into a **broader** lifecycle that also covers review, security, build, test, release, and observability gates. Complementary, wider scope. |
 | **claude-flow / multi-agent runtimes** | Runtime orchestrators that *execute* swarms of agents | claude-kit produces **portable configuration**, not a running process — the orchestration is described in rules the host (Claude Code) executes. No daemon, no lock-in, no app code. |
-| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 51 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
+| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 96 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
 
 **Choose claude-kit when** you want a consistent, reviewable, **gate-enforced** autonomous-SDLC setup
 that's the same across every repo and stack, installs in seconds, ships nothing you have to run, and

{claude_code_kit-0.26.1 → claude_code_kit-0.28.0}/README.md

@@ -4,8 +4,9 @@
 
 **A Cookiecutter-style scaffolder for an autonomous SDLC (software-delivery lifecycle) inside [Claude Code](https://www.claude.com/product/claude-code).**
 
-One command turns a one-line request into reviewed, tested, secured, shippable code —
-with a quality gate between every phase. **No application code. No Docker. Configuration only.**
+One command turns a one-line request into reviewed, tested, secured, shippable code — with a
+quality gate between every phase. Each gate passes only on *real, cited command output* — never an
+assumed or fabricated "it works." **No application code. No Docker. Configuration only.**
 
 [![PyPI](https://img.shields.io/pypi/v/claude-code-kit.svg)](https://pypi.org/project/claude-code-kit/)
 [![Python](https://img.shields.io/pypi/pyversions/claude-code-kit.svg)](https://pypi.org/project/claude-code-kit/)
@@ -51,7 +52,7 @@ Quick start) for the full breakdown of any row.
 | 🔁 **Pipeline & quality gates** | Gate-enforced progression (zero open Critical/High/Medium to advance), per-profile gate sets, a fast-track for small changes, and an anti-sycophancy `devils-advocate` pass |
 | 🤖 **Agent roster** | **28** tiered agents + per-database overlays + **6** org personas, led by an Orchestrator that never writes code |
 | 🔍 **Self-verification & review** | RARV green-Verify (real commands, not imagined), blind parallel review, and read-only risk classification |
-| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **51** context-activated skills |
+| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **96** context-activated skills (51 core + 45 stack-collection) |
 | 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
 | 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
 | 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
@@ -228,7 +229,7 @@ need.
 - **23 stack-agnostic core rules** in [`rules/`](rules/) — `mandatory-workflow`, `quality-gates`,
   `rarv-cycle`, `continuity`, plus eight agent-operation rules and `autonomy-levels` +
   `risk-classification` (see [`docs/agentic-patterns.md`](docs/agentic-patterns.md)).
-- **51 on-demand skills** in [`skills/`](skills/) — spec-driven dev, planning, TDD, debugging, code
+- **96 on-demand skills** in [`skills/`](skills/) (51 core + 45 stack-collection) — spec-driven dev, planning, TDD, debugging, code
   review, threat modeling, and more — activated by context and led by the `sdlc` entrypoint.
 - **Profile-subset install** — each profile installs a strict subset of agents, skills, hooks, and
   rules (`lean ⊂ standard ⊂ enterprise`), from fast track to full audit.
@@ -351,14 +352,19 @@ flowchart LR
     PROJ --> RUN(["/sdlc — autonomous SDLC active"])
 ```
 
-Three ideas do the heavy lifting:
+Four ideas do the heavy lifting:
 
-1. **Quality gates with a shared severity model.** Every finding is classified
+1. **Evidence or it didn't happen.** Every gate verdict — PASS or FAIL — must cite the command that
+   ran and its captured output (or the `file:line` it rests on). A verdict that's invented, assumed,
+   or read off still-running work is an **auto-Critical finding** — the same severity as a hardcoded
+   secret — and it fails every downstream gate that trusted it
+   ([`quality-gates.md` §2.5](rules/quality-gates.md)).
+2. **Quality gates with a shared severity model.** Every finding is classified
    Critical / High / Medium / Low / Cosmetic. A gate passes **only** with zero Critical/High/Medium
    open. No silent advancement.
-2. **RARV self-check.** Every agent runs **R**eason → **A**ct → **R**eflect → **V**erify and must show
+3. **RARV self-check.** Every agent runs **R**eason → **A**ct → **R**eflect → **V**erify and must show
    a *green Verify* (real commands run, not imagined) before handing off.
-3. **Blind review + Devil's Advocate.** Parallel reviewers judge independently; a *unanimous* PASS is
+4. **Blind review + Devil's Advocate.** Parallel reviewers judge independently; a *unanimous* PASS is
    treated as suspicious and triggers an adversarial `devils-advocate` pass before the gate may close —
    an explicit guard against agents rubber-stamping each other.
 
@@ -398,7 +404,8 @@ is inert for non-API projects. Organization scope at `regulated` strictness adds
 Code Reviewer → Tester → PR.
 
 See [`examples/`](examples/) for a synthetic end-to-end walkthrough — request → spec → story breakdown
-→ gate verdicts (with one defect-loop cycle) → sample PR diff.
+→ gate verdicts (with one defect-loop cycle) → sample PR diff. To capture *your own* real run as a
+publishable, redaction-scrubbed bundle, see [`docs/capture-a-real-run.md`](docs/capture-a-real-run.md).
 
 ---
 
@@ -463,10 +470,11 @@ It is **not** a runtime, an orchestration engine, or a code library. That framin
 
 | Project | What it is | How claude-kit differs |
 |---|---|---|
+| **Native Claude Code subagents / Agent Teams** | Spawn parallel agents on demand; you define the workflow, gates, and verification yourself each time | claude-kit is the **opinionated layer on top** of exactly that capability: a fixed, sequenced pipeline with **owned quality gates** (block on any open Critical/High/Medium), an **evidence requirement** (no fabricated verdicts — `quality-gates.md` §2.5), a `devils-advocate` anti-rubber-stamp pass, and **structured resume** from `.claude/state/pipeline-snapshot.json`. Native gives you the agents; claude-kit gives you the governance. |
 | **[wshobson/agents](https://github.com/wshobson/agents)** & similar agent collections | Large libraries of individual subagent prompts you pick from | claude-kit ships a **smaller, opinionated set wired into a sequenced pipeline with owned quality gates** — agents aren't a menu, they're stages that hand off and block on each other. Adopt-by-reuse, not by accumulation. |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | A spec-driven workflow (constitution → spec → tasks → analyze) | claude-kit **absorbed spec-kit's coverage-gate idea** (the `story-planner` 1f gate + `task-tracker-sync`) into a **broader** lifecycle that also covers review, security, build, test, release, and observability gates. Complementary, wider scope. |
 | **claude-flow / multi-agent runtimes** | Runtime orchestrators that *execute* swarms of agents | claude-kit produces **portable configuration**, not a running process — the orchestration is described in rules the host (Claude Code) executes. No daemon, no lock-in, no app code. |
-| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 51 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
+| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | claude-kit is a **catalog-driven generator**: it resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 96 skills, gates, and hooks, and keeps them **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
 
 **Choose claude-kit when** you want a consistent, reviewable, **gate-enforced** autonomous-SDLC setup
 that's the same across every repo and stack, installs in seconds, ships nothing you have to run, and

claude_code_kit-0.28.0/docs/capture-a-real-run.md

@@ -0,0 +1,77 @@
+# Capture a real `/sdlc` run
+
+The repo ships a **synthetic** worked example under [`examples/`](../examples/) — useful, but
+hand-written. The most convincing evidence is *your own* run: a real request that flowed through the
+pipeline, with the real spec, real gate verdicts, and the real diff it produced. This guide turns one
+completed run into a publishable, redaction-scrubbed bundle.
+
+> **You run this — not the kit.** `/sdlc` is interactive (it runs inside Claude Code). The script here
+> only *collects and scrubs* what a finished run left behind; it never drives the pipeline and never
+> edits your project.
+
+## Where a run leaves its evidence
+
+A `/sdlc` run scatters its artifacts on purpose — two of the four are gitignored runtime state, so
+they never show up in a normal `git diff`:
+
+| Artifact | Location | Tracked? |
+|---|---|---|
+| Feature spec | `docs/specs/<feature>_spec.md` | committed |
+| Gate state (last gate passed, open findings by severity, evidence, overrides) | `.claude/state/pipeline-snapshot.json` | gitignored runtime state |
+| Verdict log / phase history | `.claude/CONTINUITY.md` | gitignored runtime state |
+| Install snapshot (profile + resolved gate set) | `.claude/config/stack-catalog.snapshot.yaml` | committed |
+| The code itself + the PR | git history (`diff` vs your base branch) | committed |
+
+## Steps
+
+1. **Run a real task to completion** in a project that has claude-kit installed:
+
+   ```text
+   /sdlc Add a CSV export button to the reports page
+   ```
+
+   Let it run through its gates. A small, real feature is more convincing than a toy.
+
+2. **Capture the bundle** from the project root:
+
+   ```bash
+   # from your project (the one with .claude/ in it):
+   bash /path/to/claude-kit/scripts/capture-sdlc-run.sh --base main --slug csv-export
+   ```
+
+   Options: `--project DIR` (capture a different checkout), `--out DIR` (choose the output folder),
+   `--base BRANCH` (what to diff the code against; default `main`), `--slug NAME` (label the folder).
+   Run with `--help` for the full list. The script is read-only against your project.
+
+3. **Review the secret scan.** The script lists any files matching *generic* secret shapes (private
+   keys, AWS/GitHub tokens, `password=`/`token=` assignments, bearer tokens). It prints **file names
+   only**, never the secret values. Inspect each flagged file.
+
+4. **Finish the redaction checklist.** Every bundle gets a `REDACTION-CHECKLIST.md`. The automated
+   scan cannot know *your* internal names — company, team, service, repo, host, cluster, namespace,
+   cloud project, customer/personal data. Replace real identifiers with neutral placeholders
+   (`acme`, `example.com`, `service-a`) rather than deleting them, so the run still reads as a story.
+
+5. **Publish what you want.** Copy the scrubbed files into [`examples/`](../examples/) (mirroring the
+   `01-request.md → 02-feature-spec.md → 03-story-breakdown.md → 04-gate-verdicts.md →
+   05-sample-pr.diff` layout) or into a blog post / PR description. Keep a private, unscrubbed copy if
+   you need the originals.
+
+## What the bundle contains
+
+```text
+claude-kit-run-<timestamp>-<slug>/
+├── specs/                         # docs/specs/*_spec.md
+├── state/
+│   ├── pipeline-snapshot.json     # gate state, findings, evidence, overrides
+│   └── stack-catalog.snapshot.yaml
+├── continuity.md                  # verdict log / phase history
+├── git/
+│   ├── log.txt                    # recent commits
+│   ├── diff.stat.txt              # files changed (summary)
+│   └── changes.diff               # the full diff vs your base branch
+└── REDACTION-CHECKLIST.md         # finish this before publishing
+```
+
+Missing files are reported, not fatal — if you point the script at a checkout where `/sdlc` hasn't run
+yet, it tells you which artifacts it couldn't find.

{claude_code_kit-0.26.1 → claude_code_kit-0.28.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.26.1"
+version = "0.28.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

claude_code_kit-0.28.0/scripts/capture-sdlc-run.sh

@@ -0,0 +1,161 @@
+#!/usr/bin/env bash
+#
+# capture-sdlc-run.sh — bundle ONE completed `/sdlc` run into a publishable, redaction-scrubbed folder.
+#
+# A real `/sdlc` run leaves its evidence scattered across the project: the spec lands in
+# `docs/specs/`, the gate state in gitignored `.claude/state/`, the verdict log in gitignored
+# `.claude/CONTINUITY.md`, and the code in git itself. This script gathers those into one folder,
+# runs a generic secret scan, and prints a manual-redaction checklist — so you can turn a run into
+# a worked example without hand-collecting files.
+#
+# It is READ-ONLY against your project: it copies files out, never edits or deletes anything in place.
+#
+# Usage:
+#   scripts/capture-sdlc-run.sh [--project DIR] [--out DIR] [--base BRANCH] [--slug NAME]
+#
+#   --project DIR   Project root to capture from        (default: current directory)
+#   --out DIR       Where to write the bundle           (default: ./claude-kit-run-<UTC-timestamp>)
+#   --base BRANCH   Base branch to diff the code against (default: main)
+#   --slug NAME     Short label folded into the default --out name
+#   -h, --help      Show this help
+#
+# The bundle is NOT auto-published and NOT auto-committed. Review it, finish the redaction checklist,
+# then copy what you want into `examples/` (or your own docs) yourself.
+
+set -euo pipefail
+
+PROJECT="."
+OUT=""
+BASE="main"
+SLUG=""
+
+die() { printf 'error: %s\n' "$1" >&2; exit 1; }
+
+usage() {
+  sed -n '2,28p' "$0" | sed 's/^# \{0,1\}//'
+  exit "${1:-0}"
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --project) PROJECT="${2:-}"; shift 2 ;;
+    --out)     OUT="${2:-}";     shift 2 ;;
+    --base)    BASE="${2:-}";    shift 2 ;;
+    --slug)    SLUG="${2:-}";    shift 2 ;;
+    -h|--help) usage 0 ;;
+    *) die "unknown argument: $1 (try --help)" ;;
+  esac
+done
+
+[ -d "$PROJECT" ] || die "project directory not found: $PROJECT"
+PROJECT="$(cd "$PROJECT" && pwd)"
+
+if [ -z "$OUT" ]; then
+  stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+  if [ -n "$SLUG" ]; then
+    OUT="./claude-kit-run-${stamp}-${SLUG}"
+  else
+    OUT="./claude-kit-run-${stamp}"
+  fi
+fi
+
+mkdir -p "$OUT"
+OUT="$(cd "$OUT" && pwd)"
+[ "$OUT" = "$PROJECT" ] && die "--out must not be the project root itself"
+
+printf '==> capturing /sdlc run from: %s\n' "$PROJECT"
+printf '==> writing bundle to:       %s\n\n' "$OUT"
+
+missing=0
+
+# copy_one SRC DEST_SUBPATH LABEL — copy a single file if it exists, else note it.
+copy_one() {
+  src="$PROJECT/$1"; dest="$OUT/$2"; label="$3"
+  if [ -f "$src" ]; then
+    mkdir -p "$(dirname "$dest")"
+    cp "$src" "$dest"
+    printf '  [ok]   %s\n' "$label"
+  else
+    printf '  [skip] %s (not found: %s)\n' "$label" "$1"
+    missing=$((missing + 1))
+  fi
+}
+
+# --- 1. The artifacts a run produces -----------------------------------------------------------
+printf 'Collecting run artifacts:\n'
+copy_one ".claude/state/pipeline-snapshot.json"        "state/pipeline-snapshot.json"        "pipeline snapshot (gate state, findings, evidence)"
+copy_one ".claude/config/stack-catalog.snapshot.yaml"  "state/stack-catalog.snapshot.yaml"   "install snapshot (profile + resolved gate set)"
+copy_one ".claude/CONTINUITY.md"                       "continuity.md"                       "working memory / verdict log"
+
+# Specs (docs/specs/*_spec.md) and filled artifacts may be many — copy whatever is present.
+if [ -d "$PROJECT/docs/specs" ]; then
+  spec_count="$(find "$PROJECT/docs/specs" -maxdepth 1 -name '*_spec.md' -type f 2>/dev/null | wc -l | tr -d ' ')"
+  if [ "$spec_count" != "0" ]; then
+    mkdir -p "$OUT/specs"
+    find "$PROJECT/docs/specs" -maxdepth 1 -name '*_spec.md' -type f -exec cp {} "$OUT/specs/" \;
+    printf '  [ok]   %s spec file(s) from docs/specs/\n' "$spec_count"
+  else
+    printf '  [skip] no *_spec.md in docs/specs/\n'; missing=$((missing + 1))
+  fi
+else
+  printf '  [skip] docs/specs/ (not found)\n'; missing=$((missing + 1))
+fi
+
+# --- 2. The code the run produced (git) --------------------------------------------------------
+printf '\nCollecting git evidence (base = %s):\n' "$BASE"
+if git -C "$PROJECT" rev-parse --git-dir >/dev/null 2>&1; then
+  mkdir -p "$OUT/git"
+  git -C "$PROJECT" log --oneline -30 > "$OUT/git/log.txt" 2>/dev/null || true
+  if git -C "$PROJECT" rev-parse --verify --quiet "$BASE" >/dev/null 2>&1; then
+    mb="$(git -C "$PROJECT" merge-base "$BASE" HEAD 2>/dev/null || true)"
+    if [ -n "$mb" ]; then
+      git -C "$PROJECT" diff --stat "$mb"..HEAD > "$OUT/git/diff.stat.txt" 2>/dev/null || true
+      git -C "$PROJECT" diff "$mb"..HEAD        > "$OUT/git/changes.diff"  2>/dev/null || true
+      printf '  [ok]   diff vs %s (stat + full)\n' "$BASE"
+    fi
+  else
+    printf '  [skip] base branch %s not found — captured git log only\n' "$BASE"
+  fi
+else
+  printf '  [skip] not a git repository — no code diff captured\n'; missing=$((missing + 1))
+fi
+
+# --- 3. Generic secret scan (lists matching FILES only, never their contents) -------------------
+printf '\nScanning the bundle for generic secret patterns:\n'
+# Deliberately generic — org-specific names are YOUR job to scrub (see the checklist below).
+patterns='-----BEGIN [A-Z ]*PRIVATE KEY-----|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{30,}|xox[baprs]-[A-Za-z0-9-]{10,}|(secret|token|password|passwd|api[_-]?key)[[:space:]"'\'']*[:=][[:space:]"'\'']*[^[:space:]"'\'']+|Bearer[[:space:]]+[A-Za-z0-9._-]{16,}'
+# `-e` is required: $patterns starts with "-----BEGIN", which grep would otherwise read as options.
+hits="$(grep -rIlE -e "$patterns" "$OUT" 2>/dev/null || true)"
+if [ -n "$hits" ]; then
+  printf '  [WARN] possible secrets in these files — INSPECT and scrub before publishing:\n'
+  printf '%s\n' "$hits" | sed 's/^/         /'
+else
+  printf '  [ok]   no generic secret patterns matched (still do the manual checklist)\n'
+fi
+
+# --- 4. Manual redaction checklist -------------------------------------------------------------
+cat > "$OUT/REDACTION-CHECKLIST.md" <<'EOF'
+# Redaction checklist — finish before publishing this bundle
+
+This bundle was copied verbatim from a real project. The automated scan only catches *generic*
+secret shapes. Before you publish it (e.g. into `examples/` or a blog post), manually confirm:
+
+- [ ] No company / team / internal-service / repo / registry / cluster / namespace / project-id names
+- [ ] No internal hostnames, IPs, URLs, or cloud project identifiers
+- [ ] No customer / personal data in the spec, diff, or verdict log
+- [ ] No secret VALUES (keys, tokens, passwords, connection strings) — the scan flags shapes, not all
+- [ ] `changes.diff` reviewed line-by-line (it contains your actual source)
+- [ ] `continuity.md` reviewed (it may quote commands, paths, and findings verbatim)
+
+Tip: keep a private copy, publish a scrubbed copy. Replace real identifiers with neutral
+placeholders (`acme`, `example.com`, `service-a`) rather than deleting context.
+EOF
+printf '  [ok]   wrote REDACTION-CHECKLIST.md\n'
+
+# --- 5. Summary --------------------------------------------------------------------------------
+printf '\nDone. Bundle at:\n  %s\n' "$OUT"
+if [ "$missing" != "0" ]; then
+  printf '\nNote: %s expected item(s) were not found. If you have not run /sdlc in this project\n' "$missing"
+  printf 'yet, or ran it in a different directory, point --project at the right checkout.\n'
+fi
+printf '\nNext: complete %s/REDACTION-CHECKLIST.md, then copy what you want into examples/.\n' "$OUT"

{claude_code_kit-0.26.1 → claude_code_kit-0.28.0}/scripts/check_docs_consistency.py

@@ -100,6 +100,7 @@ def _actuals() -> dict[str, int]:
     return {
         "agents": len(list((ROOT / "agents").glob("*.md"))),
         "rules": len(list((ROOT / "rules").glob("*.md"))),
+        "skills": core + collection,
         "core skills": core,
         "collection skills": collection,
         "hook scripts": len(list((ROOT / "hooks" / "scripts").glob("*.sh"))),
@@ -120,8 +121,12 @@ _ANCHORS: list[tuple[str, str, str]] = [
     ("rules", "README.md", r"(\d+) stack-agnostic core rules"),
     ("rules", "README.md", r"(\d+) stack-agnostic contracts"),
     ("rules", "README.md", r"(\d+) engineering rules"),
-    ("core skills", "README.md", r"\*\*(\d+)\*\* context-activated skills"),
-    ("core skills", "README.md", r"(\d+) on-demand skills"),
+    # The headline skill number is the FULL catalog (core + collection); the breakdown pins each part.
+    ("skills", "README.md", r"\*\*(\d+)\*\* context-activated skills"),
+    ("skills", "README.md", r"(\d+) on-demand skills"),
+    ("skills", "README.md", r"(\d+) skills, gates"),
+    ("core skills", "README.md", r"\((\d+) core \+"),
+    ("collection skills", "README.md", r"\+ (\d+) stack-collection\)"),
     ("hook scripts", "README.md", r"\*\*(\d+)\*\* event hooks"),
     ("hook scripts", "README.md", r"(\d+) event hook scripts"),
     ("mcp servers", "README.md", r"\*\*(\d+)\*\* ready MCP fragments"),

{claude_code_kit-0.26.1 → claude_code_kit-0.28.0}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.26.1"
+__version__ = "0.28.0"

{claude_code_kit-0.26.1 → claude_code_kit-0.28.0}/src/claude_kit/upgrader.py

@@ -29,7 +29,7 @@ from pathlib import Path
 
 from claude_kit import catalog, scaffold
 from claude_kit.models import FileRecord, InitOptions, ResolvedPlan
-from claude_kit.validator import _load_init_options
+from claude_kit.validator import _load_init_options, _read_init_options
 
 #: Sidecar suffix for a new version of a user-modified, protected file.
 _SIDECAR_SUFFIX = ".claude-kit"
@@ -129,9 +129,9 @@ def _compare(src: Path, target: str | Path) -> _Comparison | str:
     claude = target / ".claude"
     if not claude.is_dir():
         return "not-installed"
-    old = _load_init_options(claude)
+    old, err = _read_init_options(claude)
     if old is None:
-        return "no-options"
+        return "corrupt-options" if err and err.startswith("corrupt") else "no-options"
 
     plan = catalog.resolve(src, old.selection)
     # Render the reference under the REAL project name so CLAUDE.md/README don't diff spuriously.
@@ -355,6 +355,11 @@ def _explain_error(code: str, target: str | Path) -> tuple[bool, list[str]]:
         return False, [
             f"FAIL  no .claude/ at {Path(target).expanduser().resolve()} — run `claude-kit init` first"
         ]
+    if code == "corrupt-options":
+        return False, [
+            "FAIL  .claude/config/init-options.json is unreadable (invalid JSON) — repair it "
+            "or re-run `claude-kit init --force` to re-create it"
+        ]
     return False, [
         "FAIL  no .claude/config/init-options.json — this install predates upgrade tracking; "
         "re-run `claude-kit init --force` to start tracking"