claude-code-kit 0.39.0__tar.gz → 0.40.0__tar.gz

{claude_code_kit-0.39.0 → claude_code_kit-0.40.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.39.0",
+      "version": "0.40.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.39.0 → claude_code_kit-0.40.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.39.0",
+  "version": "0.40.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.39.0 → claude_code_kit-0.40.0}/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.40.0] — 2026-06-26
+
+**Review grounding + addition scrutiny** (PR 2 of 4 from the MIT `athola/claude-night-market` audit;
+re-derived stack-agnostic, count-neutral — both are edits to existing skills).
+
+- **`skills/code-review-and-quality`** — Step 4 now requires every finding to be **grounded**: a
+  `file:line` Location + a verbatim Anchor snippet, re-verified before reporting; a finding whose
+  location/anchor doesn't resolve is dropped or labelled `UNVERIFIED`. Stops AI reviewers from
+  hallucinating locations/issues; the review-level form of the §2.5 evidence rule in `quality-gates.md`.
+- **`skills/over-engineering-review`** — new **Burden-of-Proof Scrutiny** section that inverts the
+  default for *additions* in diff mode: 5 scrutiny questions (priority/criticality/simplicity/evidence/
+  consequence), 6 AI-additive anti-patterns (wheel reinvention, hallucinated issue, test manipulation,
+  complexity creep, priority deviation, gold plating), a justified/needs-evidence/unjustified verdict,
+  and the subtractive question. Collapses the upstream additive-bias-defense + justify + bloat-detector
+  ideas into the kit's existing complexity-review skill.
+
 ## [0.39.0] — 2026-06-26
 
 **Supply-chain defense** (first of four adoptions from the MIT [`athola/claude-night-market`](https://github.com/athola/claude-night-market);

{claude_code_kit-0.39.0 → claude_code_kit-0.40.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.39.0
+Version: 0.40.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit

{claude_code_kit-0.39.0 → claude_code_kit-0.40.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.39.0"
+version = "0.40.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.39.0 → claude_code_kit-0.40.0}/skills/code-review-and-quality/SKILL.md

@@ -181,6 +181,23 @@ Label every comment with its severity so the author knows what's required vs opt
 
 This prevents authors from treating all feedback as mandatory and wasting time on optional suggestions.
 
+#### Every finding must be grounded
+
+A review finding is a **claim about a specific place in the code**, so it must be falsifiable — a
+citation a second pass (human or agent) can mechanically re-read and confirm. AI reviewers in
+particular hallucinate locations and issues; grounding is what stops that.
+
+Every finding carries:
+
+- **Location** — `file:line` (a concrete, current line, not "somewhere in the auth module").
+- **Anchor** — a short *verbatim* snippet copied from that line, so the citation can be re-verified by
+  matching text even if line numbers shift.
+
+Verify before reporting: re-read each cited `file:line` and confirm the anchor text is actually
+present. A finding whose location or anchor doesn't resolve is **dropped or labelled `UNVERIFIED`** —
+it never enters the verdict. This is the review-level form of the evidence rule in
+`.claude/rules/quality-gates.md` (§2.5): an uncited finding is a TODO, not a finding.
+
 ### Step 5: Verify the Verification
 
 Check the author's verification story:

{claude_code_kit-0.39.0 → claude_code_kit-0.40.0}/skills/over-engineering-review/SKILL.md

@@ -55,6 +55,37 @@ Dependencies the stdlib or platform already ships · single-implementation inter
 one product · wrappers that only delegate · modules exporting one thing · dead flags and config ·
 hand-rolled stdlib · speculative "for later" scaffolding.
 
+## Burden of proof — scrutinize each addition
+
+The five tags catch complexity that already exists. In **diff mode**, also invert the burden of proof
+on what the change *adds* — LLM-written code is additive by default (it reinvents wheels, gilds error
+handling, and abstracts for a single caller). **The default answer to "should we add this?" is no;
+the addition must earn its place.** For each added file / function / abstraction / config / dependency,
+ask:
+
+1. **Priority** — does this serve the current task/spec, or is it a detour?
+2. **Criticality** — is it needed *now*, or speculative "for later"?
+3. **Simplicity** — does a simpler or subtractive solution exist?
+4. **Evidence** — what proves it's needed (a failing test, a real requirement) rather than assumed?
+5. **Consequence** — what concretely breaks if it's omitted?
+
+If 4 and 5 can't be answered with evidence, the addition is unjustified. Watch for these **AI-additive
+anti-patterns**:
+
+| Anti-pattern | Signal | Challenge |
+|---|---|---|
+| Wheel reinvention | New helper overlapping existing code/stdlib | "Does X already do this?" |
+| Hallucinated issue | A fix for a bug with no reproduction | "Show the failing test before the fix." |
+| Test manipulation | Test changed to match new behavior, not the spec | "Did the spec change, or did you change the test?" |
+| Complexity creep | Abstraction for a single use case | "Is this the 3rd use, or the 1st?" |
+| Priority deviation | Work not traceable to the task/spec | "Which requirement does this serve?" |
+| Gold plating | Error handling / flexibility beyond need | "What breaks without this?" |
+
+Give each scrutinized addition a one-word verdict — **justified** (evidence supports it → keep),
+**needs-evidence** (plausible but unproven → prove or cut), **unjustified** (no evidence, likely
+additive bias → cut) — and fold the cuts into the delete-list below. Before accepting any addition,
+ask the subtractive question: *could this be achieved by removing code instead of adding it?*
+
 ## Output format
 
 One line per finding. Diff mode:

{claude_code_kit-0.39.0 → claude_code_kit-0.40.0}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.39.0"
+__version__ = "0.40.0"