claude-code-kit 0.29.0__tar.gz → 0.30.0__tar.gz

{claude_code_kit-0.29.0 → claude_code_kit-0.30.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.29.0",
+      "version": "0.30.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.29.0 → claude_code_kit-0.30.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.29.0 → claude_code_kit-0.30.0}/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.30.0] — 2026-06-24
+
+**The flagship example is now a *real, harness-captured* `/sdlc` run — closing the credibility gap that
+the prior flagship was synthetic. Plus a harness improvement found by running it. Docs/example +
+`capture-sdlc-run.sh` only; no payload or pipeline behavior change.**
+
+### Added
+- **`examples/real-run/`** — a genuine run, produced by the kit's own
+  [`scripts/capture-sdlc-run.sh`](scripts/capture-sdlc-run.sh) harness. A real `DELETE /tasks/{id}`
+  feature was driven through every standard-profile gate on a freshly-scaffolded **Go / net-http**
+  project; the folder holds the **verbatim harness bundle** (`captured-bundle/`: the spec, the
+  deterministic `pipeline-snapshot.json` with per-gate evidence, the `stack-catalog.snapshot.yaml`, the
+  `continuity.md` verdict log, the gate evidence, and the real `git/changes.diff`), the agent verdicts
+  the harness's gate model doesn't collect (`run-artifacts/`), the reproducible Go source
+  (`sample-app/`, 7 tests / 85.2% coverage), and a **genuine terminal recording** of the gate checks
+  (`cast/`: an asciicast `.cast` + static `.svg`, recorded via a stdlib `pty` recorder).
+- **The headline:** four reviewers returned a unanimous PASS; the `devils-advocate` (spawned *because*
+  of the unanimity) attacked the id-parsing seam over a raw socket and found + **reproduced** a real
+  **Medium** — `strconv.Atoi` aliased `01`/`+1`/`%2B1` onto task `1` and deleted it. The deterministic
+  pipeline then **refused to close the next gate** while the Medium was open; a fix + a mux-level
+  regression test closed it and the devil's advocate re-verified **UPHELD**.
+
+### Changed
+- **`scripts/capture-sdlc-run.sh` now produces a self-contained bundle** (improvement surfaced by
+  actually running it): it copies the gate-evidence files the snapshot references into the bundle's
+  `evidence/` and rewrites the snapshot's `gate_evidence` paths to bundle-relative, so a published
+  bundle resolves its own pointers and leaks no local absolute filesystem paths. Degrades gracefully
+  (with a note) when `python3` is absent.
+- **The README and `examples/` index now lead with the real captured run**; the
+  `react-fastapi-postgres-feature/` walkthrough is reframed as the explicitly *synthetic* map alongside
+  it, and `docs/capture-a-real-run.md` points at the shipped real bundle as a worked reference.
+
 ## [0.29.0] — 2026-06-24
 
 **Positioning v2 (docs): lead with the trust moat, promote the comparison to a top-level block, and

{claude_code_kit-0.29.0 → claude_code_kit-0.30.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.29.0
+Version: 0.30.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -377,8 +377,9 @@ need.
   [what we adopted](#influences--what-we-adopted)).
 - **Opt-in LLM/AI security** — `security-and-hardening` covers the OWASP LLM Top 10 (input/output
   guardrails, PII vault) as bypassable guidance, distinct from the mandatory appsec gate.
-- **A worked example + self-test matrix** — [`examples/`](examples/) shows an end-to-end run, and a
-  profile×stack×scope test matrix backs the stack-agnostic claim.
+- **A real captured run + self-test matrix** — [`examples/real-run/`](examples/real-run/) is a genuine
+  run captured by the `capture-sdlc-run.sh` harness, where the `devils-advocate` found and reproduced a
+  Medium bug a unanimous review missed; a profile×stack×scope test matrix backs the stack-agnostic claim.
 
 </details>
 
@@ -477,9 +478,13 @@ is inert for non-API projects. Organization scope at `regulated` strictness adds
 (WCAG-AA on changed UI). A **fast-track** mode collapses small changes (< 5 files) to Developer →
 Code Reviewer → Tester → PR.
 
-See [`examples/`](examples/) for a synthetic end-to-end walkthrough — request → spec → story breakdown
-→ gate verdicts (with one defect-loop cycle) → sample PR diff. To capture *your own* real run as a
-publishable, redaction-scrubbed bundle, see [`docs/capture-a-real-run.md`](docs/capture-a-real-run.md).
+See [`examples/real-run/`](examples/real-run/) for a **real**, harness-captured run — a `DELETE
+/tasks/{id}` feature driven through every gate on a Go/net-http project, where the `devils-advocate`
+caught and reproduced a Medium bug a unanimous review missed and the deterministic gate refused to
+advance until it was fixed (verbatim `pipeline-snapshot.json`, agent verdicts, diff, and an asciicast of
+the green checks). A [synthetic walkthrough](examples/react-fastapi-postgres-feature/) also maps the
+default-stack flow. To capture *your own* run as a publishable, redaction-scrubbed bundle, see
+[`docs/capture-a-real-run.md`](docs/capture-a-real-run.md).
 
 ---
 

{claude_code_kit-0.29.0 → claude_code_kit-0.30.0}/README.md

@@ -347,8 +347,9 @@ need.
   [what we adopted](#influences--what-we-adopted)).
 - **Opt-in LLM/AI security** — `security-and-hardening` covers the OWASP LLM Top 10 (input/output
   guardrails, PII vault) as bypassable guidance, distinct from the mandatory appsec gate.
-- **A worked example + self-test matrix** — [`examples/`](examples/) shows an end-to-end run, and a
-  profile×stack×scope test matrix backs the stack-agnostic claim.
+- **A real captured run + self-test matrix** — [`examples/real-run/`](examples/real-run/) is a genuine
+  run captured by the `capture-sdlc-run.sh` harness, where the `devils-advocate` found and reproduced a
+  Medium bug a unanimous review missed; a profile×stack×scope test matrix backs the stack-agnostic claim.
 
 </details>
 
@@ -447,9 +448,13 @@ is inert for non-API projects. Organization scope at `regulated` strictness adds
 (WCAG-AA on changed UI). A **fast-track** mode collapses small changes (< 5 files) to Developer →
 Code Reviewer → Tester → PR.
 
-See [`examples/`](examples/) for a synthetic end-to-end walkthrough — request → spec → story breakdown
-→ gate verdicts (with one defect-loop cycle) → sample PR diff. To capture *your own* real run as a
-publishable, redaction-scrubbed bundle, see [`docs/capture-a-real-run.md`](docs/capture-a-real-run.md).
+See [`examples/real-run/`](examples/real-run/) for a **real**, harness-captured run — a `DELETE
+/tasks/{id}` feature driven through every gate on a Go/net-http project, where the `devils-advocate`
+caught and reproduced a Medium bug a unanimous review missed and the deterministic gate refused to
+advance until it was fixed (verbatim `pipeline-snapshot.json`, agent verdicts, diff, and an asciicast of
+the green checks). A [synthetic walkthrough](examples/react-fastapi-postgres-feature/) also maps the
+default-stack flow. To capture *your own* run as a publishable, redaction-scrubbed bundle, see
+[`docs/capture-a-real-run.md`](docs/capture-a-real-run.md).
 
 ---
 

{claude_code_kit-0.29.0 → claude_code_kit-0.30.0}/docs/capture-a-real-run.md

@@ -1,9 +1,10 @@
 # Capture a real `/sdlc` run
 
-The repo ships a **synthetic** worked example under [`examples/`](../examples/) — useful, but
-hand-written. The most convincing evidence is *your own* run: a real request that flowed through the
-pipeline, with the real spec, real gate verdicts, and the real diff it produced. This guide turns one
-completed run into a publishable, redaction-scrubbed bundle.
+The repo ships a **real, harness-captured** run under [`examples/real-run/`](../examples/real-run/)
+(produced exactly the way this guide describes) alongside a hand-written **synthetic** walkthrough. The
+most convincing evidence, though, is *your own* run: a real request that flowed through the pipeline,
+with the real spec, real gate verdicts, and the real diff it produced. This guide turns one completed
+run into a publishable, redaction-scrubbed bundle.
 
 > **You run this — not the kit.** `/sdlc` is interactive (it runs inside Claude Code). The script here
 > only *collects and scrubs* what a finished run left behind; it never drives the pipeline and never

{claude_code_kit-0.29.0 → claude_code_kit-0.30.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.29.0"
+version = "0.30.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.29.0 → claude_code_kit-0.30.0}/scripts/capture-sdlc-run.sh

@@ -101,6 +101,59 @@ else
   printf '  [skip] docs/specs/ (not found)\n'; missing=$((missing + 1))
 fi
 
+# --- 1b. Evidence files the snapshot points at -------------------------------------------------
+# The pipeline snapshot records a `gate_evidence` map of absolute paths. Pull those artifacts into
+# the bundle and rewrite the snapshot to point at the copied, bundle-relative files — so the bundle
+# is self-contained and leaks no local filesystem paths. Needs python3 (json); skipped with a note
+# if it is absent, leaving the snapshot untouched.
+snap_copy="$OUT/state/pipeline-snapshot.json"
+if [ -f "$snap_copy" ]; then
+  if command -v python3 >/dev/null 2>&1; then
+    printf '\nCollecting gate-evidence referenced by the snapshot:\n'
+    CK_PROJECT="$PROJECT" CK_OUT="$OUT" CK_SNAP="$snap_copy" python3 - <<'PY' || printf '  [skip] could not process gate_evidence (snapshot left as-is)\n'
+import json, os, pathlib, shutil
+
+project = pathlib.Path(os.environ["CK_PROJECT"]).resolve()
+out = pathlib.Path(os.environ["CK_OUT"])
+snap = pathlib.Path(os.environ["CK_SNAP"])
+data = json.loads(snap.read_text())
+ev = data.get("gate_evidence")
+if not isinstance(ev, dict):
+    raise SystemExit(0)
+changed = False
+for gate, p in list(ev.items()):
+    if not isinstance(p, str):
+        continue
+    src = pathlib.Path(p)
+    if not src.is_file():
+        print(f"  [skip] {gate}: evidence not found ({p})")
+        continue
+    resolved = src.resolve()
+    try:
+        resolved.relative_to(project)
+    except ValueError:
+        print(f"  [skip] {gate}: evidence outside the project ({p})")
+        continue
+    # the spec already lives under specs/; point there instead of duplicating it.
+    if resolved.suffix == ".md" and "specs" in resolved.parts:
+        ev[gate] = f"specs/{resolved.name}"
+        changed = True
+        print(f"  [ok]   {gate} -> specs/{resolved.name}")
+        continue
+    (out / "evidence").mkdir(parents=True, exist_ok=True)
+    dest_name = f"{gate}{resolved.suffix or '.txt'}"
+    shutil.copyfile(resolved, out / "evidence" / dest_name)
+    ev[gate] = f"evidence/{dest_name}"
+    changed = True
+    print(f"  [ok]   {gate} -> evidence/{dest_name}")
+if changed:
+    snap.write_text(json.dumps(data, indent=2) + "\n")
+PY
+  else
+    printf '\n  [skip] python3 not found — snapshot keeps absolute gate_evidence paths\n'
+  fi
+fi
+
 # --- 2. The code the run produced (git) --------------------------------------------------------
 printf '\nCollecting git evidence (base = %s):\n' "$BASE"
 if git -C "$PROJECT" rev-parse --git-dir >/dev/null 2>&1; then

{claude_code_kit-0.29.0 → claude_code_kit-0.30.0}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.29.0"
+__version__ = "0.30.0"