claude-code-kit 0.27.0__tar.gz → 0.28.0__tar.gz

{claude_code_kit-0.27.0 → claude_code_kit-0.28.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.27.0 → claude_code_kit-0.28.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.27.0 → claude_code_kit-0.28.0}/CHANGELOG.md

@@ -4,6 +4,29 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.28.0] — 2026-06-24
+
+**Positioning & onboarding pass (docs): surface the anti-fabrication moat, compare against native
+subagents, and ship a real-run capture harness. No behavior change.**
+
+### Added
+- **`scripts/capture-sdlc-run.sh` + [`docs/capture-a-real-run.md`](docs/capture-a-real-run.md).** A
+  read-only helper that bundles one completed `/sdlc` run — the spec (`docs/specs/`), the gitignored
+  gate state (`.claude/state/pipeline-snapshot.json`), the verdict log (`.claude/CONTINUITY.md`), and
+  the diff vs your base branch — into one publishable folder. It runs a generic secret scan (lists
+  matching **file names only**, never values) and writes a manual `REDACTION-CHECKLIST.md`, so a real
+  run can become a worked example without hand-collecting files.
+- **"Native Claude Code subagents / Agent Teams" comparison row** in the README — the alternative
+  every Claude Code user weighs first. Honest framing: native gives you the agents; claude-kit adds
+  the *governance* (sequenced pipeline, owned gates, evidence requirement, `devils-advocate`, resume).
+
+### Changed
+- **The anti-fabrication evidence requirement is now the headline trust idea.** "How it works" leads
+  with *"Evidence or it didn't happen"* — every gate verdict must cite the command + captured output
+  (or `file:line`), and an invented/assumed/partial-output verdict is an auto-Critical finding
+  (`rules/quality-gates.md` §2.5). The top-of-README tagline now states gates pass only on real,
+  cited output. (The rule itself is unchanged; it was previously only implied via RARV.)
+
 ## [0.27.0] — 2026-06-24
 
 **Objective fixes from a product review: honest skill counts (with a guard), drift-aware

{claude_code_kit-0.27.0 → claude_code_kit-0.28.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.27.0
+Version: 0.28.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -34,8 +34,9 @@ Description-Content-Type: text/markdown
 
 **A Cookiecutter-style scaffolder for an autonomous SDLC (software-delivery lifecycle) inside [Claude Code](https://www.claude.com/product/claude-code).**
 
-One command turns a one-line request into reviewed, tested, secured, shippable code —
-with a quality gate between every phase. **No application code. No Docker. Configuration only.**
+One command turns a one-line request into reviewed, tested, secured, shippable code — with a
+quality gate between every phase. Each gate passes only on *real, cited command output* — never an
+assumed or fabricated "it works." **No application code. No Docker. Configuration only.**
 
 [![PyPI](https://img.shields.io/pypi/v/claude-code-kit.svg)](https://pypi.org/project/claude-code-kit/)
 [![Python](https://img.shields.io/pypi/pyversions/claude-code-kit.svg)](https://pypi.org/project/claude-code-kit/)
@@ -381,14 +382,19 @@ flowchart LR
     PROJ --> RUN(["/sdlc — autonomous SDLC active"])
 ```
 
-Three ideas do the heavy lifting:
+Four ideas do the heavy lifting:
 
-1. **Quality gates with a shared severity model.** Every finding is classified
+1. **Evidence or it didn't happen.** Every gate verdict — PASS or FAIL — must cite the command that
+   ran and its captured output (or the `file:line` it rests on). A verdict that's invented, assumed,
+   or read off still-running work is an **auto-Critical finding** — the same severity as a hardcoded
+   secret — and it fails every downstream gate that trusted it
+   ([`quality-gates.md` §2.5](rules/quality-gates.md)).
+2. **Quality gates with a shared severity model.** Every finding is classified
    Critical / High / Medium / Low / Cosmetic. A gate passes **only** with zero Critical/High/Medium
    open. No silent advancement.
-2. **RARV self-check.** Every agent runs **R**eason → **A**ct → **R**eflect → **V**erify and must show
+3. **RARV self-check.** Every agent runs **R**eason → **A**ct → **R**eflect → **V**erify and must show
    a *green Verify* (real commands run, not imagined) before handing off.
-3. **Blind review + Devil's Advocate.** Parallel reviewers judge independently; a *unanimous* PASS is
+4. **Blind review + Devil's Advocate.** Parallel reviewers judge independently; a *unanimous* PASS is
    treated as suspicious and triggers an adversarial `devils-advocate` pass before the gate may close —
    an explicit guard against agents rubber-stamping each other.
 
@@ -428,7 +434,8 @@ is inert for non-API projects. Organization scope at `regulated` strictness adds
 Code Reviewer → Tester → PR.
 
 See [`examples/`](examples/) for a synthetic end-to-end walkthrough — request → spec → story breakdown
-→ gate verdicts (with one defect-loop cycle) → sample PR diff.
+→ gate verdicts (with one defect-loop cycle) → sample PR diff. To capture *your own* real run as a
+publishable, redaction-scrubbed bundle, see [`docs/capture-a-real-run.md`](docs/capture-a-real-run.md).
 
 ---
 
@@ -493,6 +500,7 @@ It is **not** a runtime, an orchestration engine, or a code library. That framin
 
 | Project | What it is | How claude-kit differs |
 |---|---|---|
+| **Native Claude Code subagents / Agent Teams** | Spawn parallel agents on demand; you define the workflow, gates, and verification yourself each time | claude-kit is the **opinionated layer on top** of exactly that capability: a fixed, sequenced pipeline with **owned quality gates** (block on any open Critical/High/Medium), an **evidence requirement** (no fabricated verdicts — `quality-gates.md` §2.5), a `devils-advocate` anti-rubber-stamp pass, and **structured resume** from `.claude/state/pipeline-snapshot.json`. Native gives you the agents; claude-kit gives you the governance. |
 | **[wshobson/agents](https://github.com/wshobson/agents)** & similar agent collections | Large libraries of individual subagent prompts you pick from | claude-kit ships a **smaller, opinionated set wired into a sequenced pipeline with owned quality gates** — agents aren't a menu, they're stages that hand off and block on each other. Adopt-by-reuse, not by accumulation. |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | A spec-driven workflow (constitution → spec → tasks → analyze) | claude-kit **absorbed spec-kit's coverage-gate idea** (the `story-planner` 1f gate + `task-tracker-sync`) into a **broader** lifecycle that also covers review, security, build, test, release, and observability gates. Complementary, wider scope. |
 | **claude-flow / multi-agent runtimes** | Runtime orchestrators that *execute* swarms of agents | claude-kit produces **portable configuration**, not a running process — the orchestration is described in rules the host (Claude Code) executes. No daemon, no lock-in, no app code. |

{claude_code_kit-0.27.0 → claude_code_kit-0.28.0}/README.md

@@ -4,8 +4,9 @@
 
 **A Cookiecutter-style scaffolder for an autonomous SDLC (software-delivery lifecycle) inside [Claude Code](https://www.claude.com/product/claude-code).**
 
-One command turns a one-line request into reviewed, tested, secured, shippable code —
-with a quality gate between every phase. **No application code. No Docker. Configuration only.**
+One command turns a one-line request into reviewed, tested, secured, shippable code — with a
+quality gate between every phase. Each gate passes only on *real, cited command output* — never an
+assumed or fabricated "it works." **No application code. No Docker. Configuration only.**
 
 [![PyPI](https://img.shields.io/pypi/v/claude-code-kit.svg)](https://pypi.org/project/claude-code-kit/)
 [![Python](https://img.shields.io/pypi/pyversions/claude-code-kit.svg)](https://pypi.org/project/claude-code-kit/)
@@ -351,14 +352,19 @@ flowchart LR
     PROJ --> RUN(["/sdlc — autonomous SDLC active"])
 ```
 
-Three ideas do the heavy lifting:
+Four ideas do the heavy lifting:
 
-1. **Quality gates with a shared severity model.** Every finding is classified
+1. **Evidence or it didn't happen.** Every gate verdict — PASS or FAIL — must cite the command that
+   ran and its captured output (or the `file:line` it rests on). A verdict that's invented, assumed,
+   or read off still-running work is an **auto-Critical finding** — the same severity as a hardcoded
+   secret — and it fails every downstream gate that trusted it
+   ([`quality-gates.md` §2.5](rules/quality-gates.md)).
+2. **Quality gates with a shared severity model.** Every finding is classified
    Critical / High / Medium / Low / Cosmetic. A gate passes **only** with zero Critical/High/Medium
    open. No silent advancement.
-2. **RARV self-check.** Every agent runs **R**eason → **A**ct → **R**eflect → **V**erify and must show
+3. **RARV self-check.** Every agent runs **R**eason → **A**ct → **R**eflect → **V**erify and must show
    a *green Verify* (real commands run, not imagined) before handing off.
-3. **Blind review + Devil's Advocate.** Parallel reviewers judge independently; a *unanimous* PASS is
+4. **Blind review + Devil's Advocate.** Parallel reviewers judge independently; a *unanimous* PASS is
    treated as suspicious and triggers an adversarial `devils-advocate` pass before the gate may close —
    an explicit guard against agents rubber-stamping each other.
 
@@ -398,7 +404,8 @@ is inert for non-API projects. Organization scope at `regulated` strictness adds
 Code Reviewer → Tester → PR.
 
 See [`examples/`](examples/) for a synthetic end-to-end walkthrough — request → spec → story breakdown
-→ gate verdicts (with one defect-loop cycle) → sample PR diff.
+→ gate verdicts (with one defect-loop cycle) → sample PR diff. To capture *your own* real run as a
+publishable, redaction-scrubbed bundle, see [`docs/capture-a-real-run.md`](docs/capture-a-real-run.md).
 
 ---
 
@@ -463,6 +470,7 @@ It is **not** a runtime, an orchestration engine, or a code library. That framin
 
 | Project | What it is | How claude-kit differs |
 |---|---|---|
+| **Native Claude Code subagents / Agent Teams** | Spawn parallel agents on demand; you define the workflow, gates, and verification yourself each time | claude-kit is the **opinionated layer on top** of exactly that capability: a fixed, sequenced pipeline with **owned quality gates** (block on any open Critical/High/Medium), an **evidence requirement** (no fabricated verdicts — `quality-gates.md` §2.5), a `devils-advocate` anti-rubber-stamp pass, and **structured resume** from `.claude/state/pipeline-snapshot.json`. Native gives you the agents; claude-kit gives you the governance. |
 | **[wshobson/agents](https://github.com/wshobson/agents)** & similar agent collections | Large libraries of individual subagent prompts you pick from | claude-kit ships a **smaller, opinionated set wired into a sequenced pipeline with owned quality gates** — agents aren't a menu, they're stages that hand off and block on each other. Adopt-by-reuse, not by accumulation. |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | A spec-driven workflow (constitution → spec → tasks → analyze) | claude-kit **absorbed spec-kit's coverage-gate idea** (the `story-planner` 1f gate + `task-tracker-sync`) into a **broader** lifecycle that also covers review, security, build, test, release, and observability gates. Complementary, wider scope. |
 | **claude-flow / multi-agent runtimes** | Runtime orchestrators that *execute* swarms of agents | claude-kit produces **portable configuration**, not a running process — the orchestration is described in rules the host (Claude Code) executes. No daemon, no lock-in, no app code. |

claude_code_kit-0.28.0/docs/capture-a-real-run.md

@@ -0,0 +1,77 @@
+# Capture a real `/sdlc` run
+
+The repo ships a **synthetic** worked example under [`examples/`](../examples/) — useful, but
+hand-written. The most convincing evidence is *your own* run: a real request that flowed through the
+pipeline, with the real spec, real gate verdicts, and the real diff it produced. This guide turns one
+completed run into a publishable, redaction-scrubbed bundle.
+
+> **You run this — not the kit.** `/sdlc` is interactive (it runs inside Claude Code). The script here
+> only *collects and scrubs* what a finished run left behind; it never drives the pipeline and never
+> edits your project.
+
+## Where a run leaves its evidence
+
+A `/sdlc` run scatters its artifacts on purpose — two of the four are gitignored runtime state, so
+they never show up in a normal `git diff`:
+
+| Artifact | Location | Tracked? |
+|---|---|---|
+| Feature spec | `docs/specs/<feature>_spec.md` | committed |
+| Gate state (last gate passed, open findings by severity, evidence, overrides) | `.claude/state/pipeline-snapshot.json` | gitignored runtime state |
+| Verdict log / phase history | `.claude/CONTINUITY.md` | gitignored runtime state |
+| Install snapshot (profile + resolved gate set) | `.claude/config/stack-catalog.snapshot.yaml` | committed |
+| The code itself + the PR | git history (`diff` vs your base branch) | committed |
+
+## Steps
+
+1. **Run a real task to completion** in a project that has claude-kit installed:
+
+   ```text
+   /sdlc Add a CSV export button to the reports page
+   ```
+
+   Let it run through its gates. A small, real feature is more convincing than a toy.
+
+2. **Capture the bundle** from the project root:
+
+   ```bash
+   # from your project (the one with .claude/ in it):
+   bash /path/to/claude-kit/scripts/capture-sdlc-run.sh --base main --slug csv-export
+   ```
+
+   Options: `--project DIR` (capture a different checkout), `--out DIR` (choose the output folder),
+   `--base BRANCH` (what to diff the code against; default `main`), `--slug NAME` (label the folder).
+   Run with `--help` for the full list. The script is read-only against your project.
+
+3. **Review the secret scan.** The script lists any files matching *generic* secret shapes (private
+   keys, AWS/GitHub tokens, `password=`/`token=` assignments, bearer tokens). It prints **file names
+   only**, never the secret values. Inspect each flagged file.
+
+4. **Finish the redaction checklist.** Every bundle gets a `REDACTION-CHECKLIST.md`. The automated
+   scan cannot know *your* internal names — company, team, service, repo, host, cluster, namespace,
+   cloud project, customer/personal data. Replace real identifiers with neutral placeholders
+   (`acme`, `example.com`, `service-a`) rather than deleting them, so the run still reads as a story.
+
+5. **Publish what you want.** Copy the scrubbed files into [`examples/`](../examples/) (mirroring the
+   `01-request.md → 02-feature-spec.md → 03-story-breakdown.md → 04-gate-verdicts.md →
+   05-sample-pr.diff` layout) or into a blog post / PR description. Keep a private, unscrubbed copy if
+   you need the originals.
+
+## What the bundle contains
+
+```text
+claude-kit-run-<timestamp>-<slug>/
+├── specs/                         # docs/specs/*_spec.md
+├── state/
+│   ├── pipeline-snapshot.json     # gate state, findings, evidence, overrides
+│   └── stack-catalog.snapshot.yaml
+├── continuity.md                  # verdict log / phase history
+├── git/
+│   ├── log.txt                    # recent commits
+│   ├── diff.stat.txt              # files changed (summary)
+│   └── changes.diff               # the full diff vs your base branch
+└── REDACTION-CHECKLIST.md         # finish this before publishing
+```
+
+Missing files are reported, not fatal — if you point the script at a checkout where `/sdlc` hasn't run
+yet, it tells you which artifacts it couldn't find.

{claude_code_kit-0.27.0 → claude_code_kit-0.28.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.27.0"
+version = "0.28.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

claude_code_kit-0.28.0/scripts/capture-sdlc-run.sh

@@ -0,0 +1,161 @@
+#!/usr/bin/env bash
+#
+# capture-sdlc-run.sh — bundle ONE completed `/sdlc` run into a publishable, redaction-scrubbed folder.
+#
+# A real `/sdlc` run leaves its evidence scattered across the project: the spec lands in
+# `docs/specs/`, the gate state in gitignored `.claude/state/`, the verdict log in gitignored
+# `.claude/CONTINUITY.md`, and the code in git itself. This script gathers those into one folder,
+# runs a generic secret scan, and prints a manual-redaction checklist — so you can turn a run into
+# a worked example without hand-collecting files.
+#
+# It is READ-ONLY against your project: it copies files out, never edits or deletes anything in place.
+#
+# Usage:
+#   scripts/capture-sdlc-run.sh [--project DIR] [--out DIR] [--base BRANCH] [--slug NAME]
+#
+#   --project DIR   Project root to capture from        (default: current directory)
+#   --out DIR       Where to write the bundle           (default: ./claude-kit-run-<UTC-timestamp>)
+#   --base BRANCH   Base branch to diff the code against (default: main)
+#   --slug NAME     Short label folded into the default --out name
+#   -h, --help      Show this help
+#
+# The bundle is NOT auto-published and NOT auto-committed. Review it, finish the redaction checklist,
+# then copy what you want into `examples/` (or your own docs) yourself.
+
+set -euo pipefail
+
+PROJECT="."
+OUT=""
+BASE="main"
+SLUG=""
+
+die() { printf 'error: %s\n' "$1" >&2; exit 1; }
+
+usage() {
+  sed -n '2,28p' "$0" | sed 's/^# \{0,1\}//'
+  exit "${1:-0}"
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --project) PROJECT="${2:-}"; shift 2 ;;
+    --out)     OUT="${2:-}";     shift 2 ;;
+    --base)    BASE="${2:-}";    shift 2 ;;
+    --slug)    SLUG="${2:-}";    shift 2 ;;
+    -h|--help) usage 0 ;;
+    *) die "unknown argument: $1 (try --help)" ;;
+  esac
+done
+
+[ -d "$PROJECT" ] || die "project directory not found: $PROJECT"
+PROJECT="$(cd "$PROJECT" && pwd)"
+
+if [ -z "$OUT" ]; then
+  stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+  if [ -n "$SLUG" ]; then
+    OUT="./claude-kit-run-${stamp}-${SLUG}"
+  else
+    OUT="./claude-kit-run-${stamp}"
+  fi
+fi
+
+mkdir -p "$OUT"
+OUT="$(cd "$OUT" && pwd)"
+[ "$OUT" = "$PROJECT" ] && die "--out must not be the project root itself"
+
+printf '==> capturing /sdlc run from: %s\n' "$PROJECT"
+printf '==> writing bundle to:       %s\n\n' "$OUT"
+
+missing=0
+
+# copy_one SRC DEST_SUBPATH LABEL — copy a single file if it exists, else note it.
+copy_one() {
+  src="$PROJECT/$1"; dest="$OUT/$2"; label="$3"
+  if [ -f "$src" ]; then
+    mkdir -p "$(dirname "$dest")"
+    cp "$src" "$dest"
+    printf '  [ok]   %s\n' "$label"
+  else
+    printf '  [skip] %s (not found: %s)\n' "$label" "$1"
+    missing=$((missing + 1))
+  fi
+}
+
+# --- 1. The artifacts a run produces -----------------------------------------------------------
+printf 'Collecting run artifacts:\n'
+copy_one ".claude/state/pipeline-snapshot.json"        "state/pipeline-snapshot.json"        "pipeline snapshot (gate state, findings, evidence)"
+copy_one ".claude/config/stack-catalog.snapshot.yaml"  "state/stack-catalog.snapshot.yaml"   "install snapshot (profile + resolved gate set)"
+copy_one ".claude/CONTINUITY.md"                       "continuity.md"                       "working memory / verdict log"
+
+# Specs (docs/specs/*_spec.md) and filled artifacts may be many — copy whatever is present.
+if [ -d "$PROJECT/docs/specs" ]; then
+  spec_count="$(find "$PROJECT/docs/specs" -maxdepth 1 -name '*_spec.md' -type f 2>/dev/null | wc -l | tr -d ' ')"
+  if [ "$spec_count" != "0" ]; then
+    mkdir -p "$OUT/specs"
+    find "$PROJECT/docs/specs" -maxdepth 1 -name '*_spec.md' -type f -exec cp {} "$OUT/specs/" \;
+    printf '  [ok]   %s spec file(s) from docs/specs/\n' "$spec_count"
+  else
+    printf '  [skip] no *_spec.md in docs/specs/\n'; missing=$((missing + 1))
+  fi
+else
+  printf '  [skip] docs/specs/ (not found)\n'; missing=$((missing + 1))
+fi
+
+# --- 2. The code the run produced (git) --------------------------------------------------------
+printf '\nCollecting git evidence (base = %s):\n' "$BASE"
+if git -C "$PROJECT" rev-parse --git-dir >/dev/null 2>&1; then
+  mkdir -p "$OUT/git"
+  git -C "$PROJECT" log --oneline -30 > "$OUT/git/log.txt" 2>/dev/null || true
+  if git -C "$PROJECT" rev-parse --verify --quiet "$BASE" >/dev/null 2>&1; then
+    mb="$(git -C "$PROJECT" merge-base "$BASE" HEAD 2>/dev/null || true)"
+    if [ -n "$mb" ]; then
+      git -C "$PROJECT" diff --stat "$mb"..HEAD > "$OUT/git/diff.stat.txt" 2>/dev/null || true
+      git -C "$PROJECT" diff "$mb"..HEAD        > "$OUT/git/changes.diff"  2>/dev/null || true
+      printf '  [ok]   diff vs %s (stat + full)\n' "$BASE"
+    fi
+  else
+    printf '  [skip] base branch %s not found — captured git log only\n' "$BASE"
+  fi
+else
+  printf '  [skip] not a git repository — no code diff captured\n'; missing=$((missing + 1))
+fi
+
+# --- 3. Generic secret scan (lists matching FILES only, never their contents) -------------------
+printf '\nScanning the bundle for generic secret patterns:\n'
+# Deliberately generic — org-specific names are YOUR job to scrub (see the checklist below).
+patterns='-----BEGIN [A-Z ]*PRIVATE KEY-----|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{30,}|xox[baprs]-[A-Za-z0-9-]{10,}|(secret|token|password|passwd|api[_-]?key)[[:space:]"'\'']*[:=][[:space:]"'\'']*[^[:space:]"'\'']+|Bearer[[:space:]]+[A-Za-z0-9._-]{16,}'
+# `-e` is required: $patterns starts with "-----BEGIN", which grep would otherwise read as options.
+hits="$(grep -rIlE -e "$patterns" "$OUT" 2>/dev/null || true)"
+if [ -n "$hits" ]; then
+  printf '  [WARN] possible secrets in these files — INSPECT and scrub before publishing:\n'
+  printf '%s\n' "$hits" | sed 's/^/         /'
+else
+  printf '  [ok]   no generic secret patterns matched (still do the manual checklist)\n'
+fi
+
+# --- 4. Manual redaction checklist -------------------------------------------------------------
+cat > "$OUT/REDACTION-CHECKLIST.md" <<'EOF'
+# Redaction checklist — finish before publishing this bundle
+
+This bundle was copied verbatim from a real project. The automated scan only catches *generic*
+secret shapes. Before you publish it (e.g. into `examples/` or a blog post), manually confirm:
+
+- [ ] No company / team / internal-service / repo / registry / cluster / namespace / project-id names
+- [ ] No internal hostnames, IPs, URLs, or cloud project identifiers
+- [ ] No customer / personal data in the spec, diff, or verdict log
+- [ ] No secret VALUES (keys, tokens, passwords, connection strings) — the scan flags shapes, not all
+- [ ] `changes.diff` reviewed line-by-line (it contains your actual source)
+- [ ] `continuity.md` reviewed (it may quote commands, paths, and findings verbatim)
+
+Tip: keep a private copy, publish a scrubbed copy. Replace real identifiers with neutral
+placeholders (`acme`, `example.com`, `service-a`) rather than deleting context.
+EOF
+printf '  [ok]   wrote REDACTION-CHECKLIST.md\n'
+
+# --- 5. Summary --------------------------------------------------------------------------------
+printf '\nDone. Bundle at:\n  %s\n' "$OUT"
+if [ "$missing" != "0" ]; then
+  printf '\nNote: %s expected item(s) were not found. If you have not run /sdlc in this project\n' "$missing"
+  printf 'yet, or ran it in a different directory, point --project at the right checkout.\n'
+fi
+printf '\nNext: complete %s/REDACTION-CHECKLIST.md, then copy what you want into examples/.\n' "$OUT"

{claude_code_kit-0.27.0 → claude_code_kit-0.28.0}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.27.0"
+__version__ = "0.28.0"