claude-code-kit 0.40.0__tar.gz → 0.42.0__tar.gz

{claude_code_kit-0.40.0 → claude_code_kit-0.42.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.40.0",
+      "version": "0.42.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.40.0 → claude_code_kit-0.42.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.40.0",
+  "version": "0.42.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.40.0 → claude_code_kit-0.42.0}/CHANGELOG.md

@@ -4,6 +4,65 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.42.0] — 2026-06-26
+
+**Doc hygiene + workflow polish** (PR 4 of 4 — the final adoption from the MIT
+`athola/claude-night-market` audit; re-derived stack-agnostic, nothing vendored).
+
+- **`skills/documentation-and-adrs`** gains a **generated-doc quality gate** — run on any doc an agent
+  wrote/rewrote before commit. Hard fails: identity/voice leaks ("As a large language model", "Great
+  question!", self-narration), **hallucinated references** (every backticked identifier/path/config
+  key must exist; every install command must resolve — ties to `dependency-verification`), and
+  **unverified quality claims** ("production-ready"/"fast" with no in-repo evidence — the prose form of
+  the `code-review-and-quality` grounding rule). Plus human-quality principles: slop is a *density*
+  problem not a banned-word list, thesis-first, earn every sentence, prose over bullet waterfalls, drop
+  the machine tells. (From `slop-detector`/`doc-generator`.)
+- **`skills/doc-consolidation/`** (new core skill) — harvest the ephemeral `*_REPORT.md`/`*_ANALYSIS.md`
+  that runs leave behind into canonical docs (ADRs, plans, CHANGELOG, existing docs), then delete the
+  sources. Two-phase: read-only triage → **approval gate** → merge → verified delete (deleting files
+  you didn't author is confirm-tier, `human-in-the-loop.md`). Routes durable *lessons* to
+  `agent-memory/`, not docs. (From `sanctum:doc-consolidation`.)
+- **`rules/continuity.md`** gains a **dual-probe summary check** — before any handoff/pre-compaction,
+  test the summary with a *progress probe* ("what's done + exact state?") and a *gap probe* ("what's
+  still needed?"); a hedged progress answer or an open-ended gap answer means rewrite it now. Catches
+  the confident-but-wrong summary the gap probe alone misses. (From `memory-clarity-probe`.)
+- **`rules/tool-design.md`** gains **§7 "Spend the resource in proportion to its value"** — Brooks's
+  law for agents (more parallel agents ≠ more throughput), source only high-value/changing claims, and
+  keep output dense. (Folds the genuinely-additive kernel of the `conserve` skills.)
+- **`rules/evals.md`** — the LLM-as-judge grader note now recommends an explicit **weighted rubric**
+  for multi-dimensional grading (kept for *grading*; the pass/fail gate stays binary). (Minimal ADAPT
+  of `leyline:evaluation-framework`.)
+- *Deliberately skipped* (reuse-first, no duplicates): `conserve:decisive-action` (already covered by
+  the 0.41.0 `human-in-the-loop` reversibility gate + `agent-guardrails` confirm/allow tiers);
+  `evaluation-framework` as a standalone skill (its weighted-scoring kernel folded into `evals.md`
+  instead, per the audit critic).
+- Counts: **101 → 102** total skills (**55 → 56** core; collection unchanged at 46).
+
+## [0.41.0] — 2026-06-26
+
+**Escalation discipline + safety/shell review lenses** (PR 3 of 4 from the MIT
+`athola/claude-night-market` audit; re-derived stack-agnostic).
+
+- **`rules/model-tiers.md`** gains a **"When to escalate a tier"** section: the Iron Law
+  (no escalation without investigation first), a 4-question gate (understood? investigated? right lever?
+  worth it?), legitimate triggers, and an **anti-rationalization table** that catches "maybe a smarter
+  model will figure it out." Ties into the agent-resilience 3-strike rule + quality-gates escalation.
+- **`rules/human-in-the-loop.md`** gains a **reversibility gate**: classify a decision as one-way vs
+  two-way door across undo-cost/blast-radius/data/externalization/commitment, and scale review
+  proportionally (proceed → adversarial pass → stop-and-ask + premortem/watch-points/reversal-plan).
+  Also flags *false irreversibility*. (Adapted from war-room's reversibility scoring; the multi-LLM
+  panel was dropped — it overlaps the orchestrator/`devils-advocate`.)
+- **`skills/safety-critical-patterns/`** (new core skill) — NASA Power-of-10 high-reliability lens
+  adapted language-neutral, **gated by "match rigor to consequence"** (full for money/medical/
+  data-integrity/auth/irreversible; light for scripts) so it never over-applies to CRUD. Composes with
+  `risk-classification`.
+- **`skills/shell-review/`** (new core skill) — audits CI/hook/build/wrapper shell for exit-code
+  propagation (`set -euo pipefail`, capture-output-and-status), POSIX-vs-bash portability, safety
+  (quote/brace vars, `:?` required vars, `cd` in a subshell, `mktemp`+`trap`), and library/executable
+  structure; `shellcheck` as the backstop. (Re-derived without the upstream's bespoke logging/guard
+  conventions.)
+- Counts: **99 → 101** total skills (**53 → 55** core; collection unchanged at 46).
+
 ## [0.40.0] — 2026-06-26
 
 **Review grounding + addition scrutiny** (PR 2 of 4 from the MIT `athola/claude-night-market` audit;

{claude_code_kit-0.40.0 → claude_code_kit-0.42.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.40.0
+Version: 0.42.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -84,7 +84,7 @@ Quick start) for the full breakdown of any row.
 | 🔁 **Pipeline & quality gates** | Gate-enforced progression (zero open Critical/High/Medium to advance), per-profile gate sets, a fast-track for small changes, and an anti-sycophancy `devils-advocate` pass |
 | 🤖 **Agent roster** | **28** tiered agents + per-database overlays + **6** org personas, led by an Orchestrator that never writes code |
 | 🔍 **Self-verification & review** | RARV green-Verify (real commands, not imagined), blind parallel review, and read-only risk classification |
-| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **99** context-activated skills (53 core + 46 stack-collection) |
+| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **102** context-activated skills (56 core + 46 stack-collection) |
 | 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
 | 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
 | 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
@@ -281,7 +281,7 @@ need.
 - **23 stack-agnostic core rules** in [`rules/`](rules/) — `mandatory-workflow`, `quality-gates`,
   `rarv-cycle`, `continuity`, plus eight agent-operation rules and `autonomy-levels` +
   `risk-classification` (see [`docs/agentic-patterns.md`](docs/agentic-patterns.md)).
-- **99 on-demand skills** in [`skills/`](skills/) (53 core + 46 stack-collection) — spec-driven dev, planning, TDD, debugging, code
+- **102 on-demand skills** in [`skills/`](skills/) (56 core + 46 stack-collection) — spec-driven dev, planning, TDD, debugging, code
   review, threat modeling, and more — activated by context and led by the `sdlc` entrypoint.
 - **Profile-subset install** — each profile installs a strict subset of agents, skills, hooks, and
   rules (`lean ⊂ standard ⊂ enterprise`), from fast track to full audit.
@@ -437,7 +437,7 @@ owned gates, and the rule that **no gate passes on an unproven verdict**.
 | **[wshobson/agents](https://github.com/wshobson/agents)** & similar agent collections | Large libraries of individual subagent prompts you pick from | A **smaller, opinionated set wired into a sequenced pipeline with owned quality gates** — agents aren't a menu, they're stages that hand off and block on each other. Adopt-by-reuse, not by accumulation. |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | A spec-driven workflow (constitution → spec → tasks → analyze) | The same coverage-gate idea (the `story-planner` 1f gate + `task-tracker-sync`) **absorbed into a broader** lifecycle that also covers review, security, build, test, release, and observability gates. Complementary, wider scope. |
 | **claude-flow / multi-agent runtimes** | Runtime orchestrators that *execute* swarms of agents | **Portable configuration**, not a running process — the orchestration is described in rules the host (Claude Code) executes. No daemon, no lock-in, no app code. |
-| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | A **catalog-driven generator**: resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 99 skills, gates, and hooks, kept **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
+| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | A **catalog-driven generator**: resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 102 skills, gates, and hooks, kept **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
 
 **Choose claude-kit when** you want a consistent, reviewable, **gate-enforced** autonomous-SDLC setup
 that's the same across every repo and stack, installs in seconds, ships nothing you have to run, and

{claude_code_kit-0.40.0 → claude_code_kit-0.42.0}/README.md

@@ -54,7 +54,7 @@ Quick start) for the full breakdown of any row.
 | 🔁 **Pipeline & quality gates** | Gate-enforced progression (zero open Critical/High/Medium to advance), per-profile gate sets, a fast-track for small changes, and an anti-sycophancy `devils-advocate` pass |
 | 🤖 **Agent roster** | **28** tiered agents + per-database overlays + **6** org personas, led by an Orchestrator that never writes code |
 | 🔍 **Self-verification & review** | RARV green-Verify (real commands, not imagined), blind parallel review, and read-only risk classification |
-| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **99** context-activated skills (53 core + 46 stack-collection) |
+| 📐 **Rules & skills** | **23** stack-agnostic core rules (incl. 8 agent-operation rules) + **102** context-activated skills (56 core + 46 stack-collection) |
 | 🧱 **Stacks & overlays** | Stack-agnostic core + **10** overlay rule sets (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands, incl. a full React design system |
 | 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
 | 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
@@ -251,7 +251,7 @@ need.
 - **23 stack-agnostic core rules** in [`rules/`](rules/) — `mandatory-workflow`, `quality-gates`,
   `rarv-cycle`, `continuity`, plus eight agent-operation rules and `autonomy-levels` +
   `risk-classification` (see [`docs/agentic-patterns.md`](docs/agentic-patterns.md)).
-- **99 on-demand skills** in [`skills/`](skills/) (53 core + 46 stack-collection) — spec-driven dev, planning, TDD, debugging, code
+- **102 on-demand skills** in [`skills/`](skills/) (56 core + 46 stack-collection) — spec-driven dev, planning, TDD, debugging, code
   review, threat modeling, and more — activated by context and led by the `sdlc` entrypoint.
 - **Profile-subset install** — each profile installs a strict subset of agents, skills, hooks, and
   rules (`lean ⊂ standard ⊂ enterprise`), from fast track to full audit.
@@ -407,7 +407,7 @@ owned gates, and the rule that **no gate passes on an unproven verdict**.
 | **[wshobson/agents](https://github.com/wshobson/agents)** & similar agent collections | Large libraries of individual subagent prompts you pick from | A **smaller, opinionated set wired into a sequenced pipeline with owned quality gates** — agents aren't a menu, they're stages that hand off and block on each other. Adopt-by-reuse, not by accumulation. |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | A spec-driven workflow (constitution → spec → tasks → analyze) | The same coverage-gate idea (the `story-planner` 1f gate + `task-tracker-sync`) **absorbed into a broader** lifecycle that also covers review, security, build, test, release, and observability gates. Complementary, wider scope. |
 | **claude-flow / multi-agent runtimes** | Runtime orchestrators that *execute* swarms of agents | **Portable configuration**, not a running process — the orchestration is described in rules the host (Claude Code) executes. No daemon, no lock-in, no app code. |
-| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | A **catalog-driven generator**: resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 99 skills, gates, and hooks, kept **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
+| **dotfiles / `CLAUDE.md` starters** | A single rules file or settings snippet | A **catalog-driven generator**: resolves your stack/profile/scope into the right subset of 23 rules, 28 agents, 102 skills, gates, and hooks, kept **upgradeable** (`claude-kit upgrade` preserves your edits via owner + checksum). |
 
 **Choose claude-kit when** you want a consistent, reviewable, **gate-enforced** autonomous-SDLC setup
 that's the same across every repo and stack, installs in seconds, ships nothing you have to run, and

{claude_code_kit-0.40.0 → claude_code_kit-0.42.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.40.0"
+version = "0.42.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.40.0 → claude_code_kit-0.42.0}/rules/continuity.md

@@ -109,6 +109,33 @@ A gate is PASS only when zero **critical/high/medium** findings remain open (low
 - [linter/formatter status]   [type checker status]   [test runner status]   [build status]
 ```
 
+## Probe the summary before you rely on it
+
+A CONTINUITY entry is only worth what the *next* turn can reconstruct from it. Before you hand off — at
+the end of a turn, before spawning/awaiting subagents, and especially as pre-compaction insurance —
+test the summary against two anchor questions, reading **only** what you wrote:
+
+1. **Progress probe** — "From this alone, what is done and what is the task's exact current state?"
+2. **Gap probe** — "From this alone, what specific information is still needed to finish?"
+
+A summary passes when the progress answer is **specific and verifiable** (named files/gates/decisions,
+no hedging like "some work was done") and the gap answer is a **bounded, concrete list** of named
+unknowns. It fails when the progress answer hedges or the gap answer expands into open-ended
+categories — that means the summary won't survive the next turn and must be sharpened *now*, while you
+still hold the context.
+
+| Progress answer | Gap answer | Verdict |
+|-----------------|-----------|---------|
+| Specific | Bounded | **Ready** — hand off |
+| Specific | "nothing needed" but task is unfinished | **Suspect** — re-read the task; the memory has drifted |
+| Hedged / vague | anything | **Rewrite** — expand with explicit answers to both probes before handing off |
+
+The two probes catch different failures: the gap probe alone misses a *confident-but-wrong* belief
+about state; the progress probe catches it. This is the same standard as Rule 2 below — truthful state
+— applied *before* the handoff rather than after. (Dual-probe pattern adapted, stack-agnostic, from
+the MIT-licensed [`athola/claude-night-market`](https://github.com/athola/claude-night-market)
+`memory-clarity-probe` skill, © 2025 athola.)
+
 ## Rules
 
 1. **Keep it short.** Working memory, not a transcript. Overwrite stale content; do not append endlessly.

{claude_code_kit-0.40.0 → claude_code_kit-0.42.0}/rules/evals.md

@@ -30,6 +30,10 @@ strategies. (Mirror of the RARV "verify the result" stance in `.claude/rules/rar
 - **Code / exact** graders for deterministic outputs (a value, a file state, a passing build).
 - **LLM-as-judge** for open-ended outputs — but **calibrate the judge against human labels** on a
   sample first. An uncalibrated judge confidently mis-scores and you optimize toward the wrong thing.
+  For multi-dimensional quality, give the judge an explicit **weighted rubric** (named criteria whose
+  weights sum to 1, each with a score band → meaning) rather than a vague "rate this 1–10": a
+  documented rubric scores consistently across runs and makes a low score *explainable*. Keep the
+  rubric for *grading*; the pipeline's pass/fail **gate** stays binary (§6, `quality-gates.md`).
 - **Human** grading for the highest-stakes or subjective cases; use it to keep the automated graders honest.
 
 ## 4. Report non-determinism honestly

{claude_code_kit-0.40.0 → claude_code_kit-0.42.0}/rules/human-in-the-loop.md

@@ -40,6 +40,30 @@ When you stop, give the human enough to decide in one read — don't make them d
 Use the `interview-me` skill when an ask is underspecified and you need to extract true intent one
 question at a time, rather than firing a wall of questions.
 
+## Gate the depth of review to reversibility
+
+Not every stop deserves the same ceremony. Before a consequential decision, classify it by how hard it
+is to undo — the **one-way-door vs two-way-door** distinction — and spend review effort proportionally.
+
+Score reversibility across a few dimensions (each: easy → hard to reverse):
+
+- **Undo cost** — can it be reverted with a commit/flag, or does it need a migration/manual cleanup?
+- **Blast radius** — local change vs shared contract, data, or many consumers?
+- **Data effect** — none, or does it mutate/migrate/delete persistent or customer data?
+- **Externalization** — internal only, or published/deployed/sent outside (cacheable, indexable, shipped)?
+- **Commitment** — private, or a public/contractual promise others now depend on?
+
+| Reversibility | Door | Proportional response |
+|---------------|------|-----------------------|
+| **High** (easy to undo, local) | Two-way | Proceed on a stated default; normal review. Don't over-deliberate. |
+| **Medium** | — | Adversarial pass before committing — `doubt-driven-development` or the `devils-advocate` agent (`.claude/rules/quality-gates.md`). |
+| **Low** (hard/irreversible) | One-way | **Stop and ask a human** (this rule), and add a **premortem** (how could this go wrong?), **watch-points** (what to monitor after), and a **reversal plan** before acting. |
+
+Challenge **false irreversibility** too — "we can't change this later" asserted without evidence is
+often a two-way door dressed up as a one-way door; verify before paying one-way-door cost. The point is
+to match scrutiny to stakes, not to gate everything: a clearly-reversible change shouldn't pay for a
+council it doesn't need.
+
 ## Rules
 
 1. **When in doubt, ask.** A cheap question now beats an expensive wrong-direction unwind later. This

{claude_code_kit-0.40.0 → claude_code_kit-0.42.0}/rules/model-tiers.md

@@ -33,6 +33,43 @@ tier — they are focused specialists/personas, not deep-reasoning orchestrators
 - **Re-map when names/prices change.** Keep the tier *intent* (Critical / Default / Fast); swap the
   concrete alias if Anthropic's model lineup shifts.
 
+## When to escalate a tier
+
+The table above is the *default* assignment. Mid-task, an agent may want to **escalate** to a more
+capable model (or a human asks "should we move this to opus?"). Escalation trades cost for reasoning
+depth, so it must be **justified, not reflexive**.
+
+> **The Iron Law: no escalation without investigation first.** Escalation is never a shortcut for
+> "maybe a smarter model will figure it out." If you can't articulate *why* the current tier is
+> insufficient, escalating is premature — investigate the root cause first.
+
+**Four questions to answer before escalating:**
+
+1. **Understood?** Can I state specifically what reasoning the current tier is missing — is this a
+   *capability* gap or just a *knowledge* gap? (A knowledge gap → gather information, don't escalate.)
+2. **Investigated?** Have I done the systematic work (read the code, traced the data, reproduced the
+   failure) — see `.claude/rules/reasoning-techniques.md` — rather than guessing?
+3. **Right lever?** Is more model capability actually the fix, or is the real problem a wrong approach,
+   a missing requirement (`.claude/rules/human-in-the-loop.md`), or insufficient context?
+4. **Worth it?** Does the stakes/consequence justify the added cost (`.claude/rules/risk-classification.md`)?
+
+**Legitimate triggers:** genuine nuance/judgment (security trade-offs), multi-step reasoning under
+uncertainty (architecture), novel patterns with no precedent, high stakes (production/irreversible),
+or weighing several valid interpretations.
+
+**Anti-rationalizations — these mean STOP and investigate, not escalate:**
+
+| Rationalization | Reality |
+|---|---|
+| "Maybe a smarter model will figure it out" | Thrashing — find the root cause first |
+| "Several attempts already failed" | Suggests a wrong approach, not insufficient capability — question your assumptions |
+| "We're under time pressure" | Urgency doesn't change task complexity; systematic investigation is faster than guess-and-escalate |
+| "Just to be safe / just in case" | False safety — assess the *actual* complexity before spending the capability |
+
+The same discipline governs the **fix-attempt** loop in `.claude/rules/agent-resilience.md` (3-strike
+rule) and the budget-exhaustion escalations in `.claude/rules/quality-gates.md`: investigate, then
+escalate to a tier *or a human* deliberately.
+
 ## Profile cost expectations
 
 Token cost scales with the **profile** (the agent / skill / hook set it installs — see

{claude_code_kit-0.40.0 → claude_code_kit-0.42.0}/rules/tool-design.md

@@ -50,6 +50,34 @@ A tool is a **privilege boundary** (`.claude/rules/agent-guardrails.md`): grant
 validate inputs, make repeated calls safe to retry (idempotent), and gate destructive or
 outward-facing actions behind `.claude/rules/human-in-the-loop.md`.
 
+## 7. Spend the resource in proportion to its value
+
+The same token-awareness that shapes a tool's *output* (§4) governs how an agent spends its other
+finite resources — parallel dispatch, sourcing calls, and its own response length. Each costs context;
+spend each only where it returns value.
+
+> Resource-proportionality heuristics adapted (stack-agnostic) from the MIT-licensed
+> [`athola/claude-night-market`](https://github.com/athola/claude-night-market) `conserve` skills
+> (`agent-expenditure`, `smart-sourcing`, `response-compression`; © 2025 athola). Not vendored.
+
+- **More agents is not more throughput (Brooks's law for agents).** Coordination overhead grows with
+  the parallel count — shared-file conflicts, duplicated reads, reconciliation. Rough guide: 1–3
+  agents negligible overhead, 4–5 plan the split first, 6–8 watch closely, 9+ usually
+  counterproductive. After a fan-out, ask: did each agent produce *unique* value, was total
+  expenditure proportional to it, would fewer have reached the same result? If not, dispatch fewer
+  next time. (The parallel-lane model lives in `.claude/rules/mandatory-workflow.md`.)
+- **Source only what's worth sourcing.** Verifying a claim costs real tokens — spend them where being
+  wrong causes harm *and* the fact changes: versions, performance numbers, security advice, API
+  specs, pricing, deprecations. Don't source foundational/common knowledge, syntax, or clearly-framed
+  suggestions. When verification isn't cost-effective, mark the uncertainty rather than asserting
+  (ties to the `source-driven-development` skill and the "scope the source" guardrail in
+  `.claude/rules/agent-guardrails.md`).
+- **Keep output dense.** You pay for every byte you emit. Cut filler, hedging-without-reason, hype
+  words, and conversational ceremony ("Great question!", "Let me know if…"). Preserve what carries
+  signal: status indicators, exact error text, safety warnings, and the context the reader actually
+  needs. Density, not coldness — and never at the cost of truthful status
+  (`.claude/rules/agent-guardrails.md` §2).
+
 ## Rules
 
 1. **Design for the agent, not a human dashboard** — text-first, token-aware, self-describing.
@@ -57,10 +85,13 @@ outward-facing actions behind `.claude/rules/human-in-the-loop.md`.
    state/events/auth.
 3. **Sparse output + single-line errors + structured results** are the default, not a nicety.
 4. **Eval your tools too** — a tool's effect on agent success is measurable; see `.claude/rules/evals.md`.
+5. **Spend in proportion to value** — agents, sourcing calls, and output length are finite context;
+   over-dispatching and over-sourcing burn budget without returning it (§7).
 
 ## Relationship to other rules
 
 - **`.claude/rules/agent-guardrails.md`** — tools as privilege boundary; least privilege; gating.
+- **`.claude/rules/mandatory-workflow.md`** — the parallel-lane model that §7's Brooks's-law caution applies to.
 - **`.claude/rules/reasoning-techniques.md`** / **`model-tiers.md`** — tool use is part of how an agent reasons.
 - **`.claude/rules/evals.md`** — measure whether a tool change actually helps.
 - **`catalog/mcp.yaml`** (kit authors) — where MCP servers are declared and wired into a project.

claude_code_kit-0.42.0/skills/doc-consolidation/SKILL.md

@@ -0,0 +1,104 @@
+---
+name: doc-consolidation
+description: Harvest the ephemeral report/analysis markdown that agent runs leave behind (REPORT/ANALYSIS/AUDIT/SUMMARY files, untracked scratch notes) into canonical, committed documentation — then delete the sources. Triage candidates → extract the durable knowledge → route each chunk to the right home (ADR, plan, changelog, existing doc) → get approval → merge → remove the originals. Stack-agnostic; operates on markdown, not code. Use when working-tree markdown artifacts have piled up, before raising a PR, or to preserve insights from a review/audit before they rot. Do NOT use to author a doc from scratch or write an ADR (use documentation-and-adrs), to judge prose quality (use documentation-and-adrs' generated-doc quality gate), or to consolidate code/config (this is markdown-only).
+---
+
+# Doc Consolidation (ephemeral reports → canonical docs)
+
+> Re-derived (stack-agnostic) from the MIT-licensed
+> [`athola/claude-night-market`](https://github.com/athola/claude-night-market) `doc-consolidation`
+> skill (© 2025 athola). Re-cast around this kit's `docs/decisions/` ADR layout, CHANGELOG, and the
+> confirm-before-delete posture of `.claude/rules/human-in-the-loop.md`. Not vendored.
+
+## What this is (and is not)
+
+An autonomous run generates markdown as a by-product — `*_REPORT.md`, `*_ANALYSIS.md`, `AUDIT.md`,
+review write-ups, scratch plans. Each holds a little durable knowledge wrapped in a lot of one-time
+framing, and it tends to sit **untracked** in the working tree until it either gets committed by
+accident or deleted with its insight unsaved. This skill is the **cleanup pass that rescues the
+signal and removes the noise**: it pulls the keepable knowledge into permanent, committed docs and
+then deletes the source artifacts.
+
+It is *not* doc authoring. Writing a fresh guide, a README, or a net-new ADR — and judging whether
+the prose is human-quality — is `documentation-and-adrs` (and its generated-doc quality gate). This
+skill **moves and merges knowledge that already exists** in throwaway files. Run the quality gate on
+the result if the merged prose was itself agent-generated.
+
+## When to use
+
+- Untracked `*_REPORT.md` / `*_ANALYSIS.md` / `AUDIT.md` / `*_SUMMARY.md` have accumulated from runs
+- Preparing a PR and the working tree shows analysis files that should not be committed as-is
+- You want to preserve findings from a code review, refactor, or audit before they're lost
+- A long run's CONTINUITY / scratch notes contain a decision worth promoting to an ADR
+
+**When NOT to use:** files already live in a proper home (`docs/`, `skills/`); they're intentional
+short-lived scratch the user wants kept verbatim; or they hold no extractable value (pure log/tool
+dumps) — in which case just propose deleting them.
+
+## Two-phase workflow (triage is read-only; execution is approval-gated)
+
+Deleting files you did not author is a **confirm-tier action** (`.claude/rules/human-in-the-loop.md`,
+`.claude/rules/agent-guardrails.md`): present the plan and get a yes before any merge-and-delete.
+
+### Phase 1 — Triage (read-only, propose a plan)
+
+1. **Detect candidates.** Untracked markdown (`git status --porcelain`) outside the standard doc
+   dirs, with non-canonical names (ALL-CAPS, `_REPORT`/`_ANALYSIS` suffixes) or LLM-output markers
+   (an "Executive Summary", "Findings", "Action Items" heading).
+2. **Extract & categorize** each file's sections into chunks, tagging each by category (below) and a
+   value score (high / medium / low). Low-value generic boilerplate is dropped, not merged.
+3. **Route** each keepable chunk to a destination + a merge strategy.
+4. **Present the plan** as a table and stop for approval. This is the gate — nothing is written or
+   deleted yet.
+
+A cheaper model tier can do the read-only triage (`.claude/rules/model-tiers.md`); keep the merge
+itself on the working tier where judgement matters.
+
+### Phase 2 — Execute (after the user approves)
+
+1. **Merge** each chunk into its destination using the chosen strategy.
+2. **Verify** the merge: destination frontmatter intact, structure preserved, nothing clobbered.
+3. **Delete the sources** only after their content is confirmed merged.
+4. **Report** what was created / updated / deleted so the diff is reviewable before commit.
+
+## Routing — where each kind of knowledge belongs
+
+| Content category | Canonical home |
+|------------------|----------------|
+| Decisions / architecture choices | a new ADR in `docs/decisions/` (via `documentation-and-adrs`) |
+| Actionable items / next steps | a dated plan under `docs/plans/` (or the issue tracker) |
+| Findings / insights / audit results | weave into the best-matching existing doc |
+| Metrics / before-after baselines | the benchmarks/eval doc (`.claude/rules/evals.md` artifacts) |
+| API / breaking changes / deprecations | `CHANGELOG.md` and the API docs |
+| A durable lesson, not a doc | promote to `agent-memory/` via `remember`, don't make a doc |
+
+## Merge strategies
+
+- **Weave** — insert into a matching existing section, preserving its voice. *When:* the destination
+  has a relevant section and the content is additive.
+- **Replace** — swap a stale section for the more detailed/newer content. *When:* new content is
+  materially more complete or supersedes the old.
+- **Append** — add a dated, source-referenced section. *When:* no matching section exists.
+- **Create** — a standalone new doc. *When:* no suitable destination exists and it warrants its own
+  file (a new ADR is the common case — hand off to `documentation-and-adrs`).
+
+## Cardinal rules
+
+1. **No deletion before the merge is verified.** Confirm the knowledge landed in its destination
+   *before* removing the source. A lost insight is worse than a stray file.
+2. **Approval gates the whole execution phase.** Triage freely (read-only); never merge-and-delete
+   without the user's yes on the plan.
+3. **Deletion beats dilution.** Drop low-value/generic chunks rather than padding canonical docs with
+   them — over-merging is how good docs rot.
+4. **Promote, don't hoard.** A durable lesson goes to `agent-memory/` (`remember`), not into a doc;
+   keep this aligned with the promote-don't-hoard rule in `.claude/rules/continuity.md`.
+
+## Related
+
+- `documentation-and-adrs` — authoring the canonical docs/ADRs this skill routes into; its
+  generated-doc quality gate vets the merged prose
+- `.claude/rules/human-in-the-loop.md` / `.claude/rules/agent-guardrails.md` — deleting files you
+  didn't create is confirm-tier; this skill obeys that gate
+- `.claude/rules/continuity.md` — promote-don't-hoard; durable lessons go to `agent-memory/`, not docs
+- `.claude/rules/model-tiers.md` — run the read-only triage on a cheaper tier
+- `remember` skill — where a durable lesson goes instead of a doc

{claude_code_kit-0.40.0 → claude_code_kit-0.42.0}/skills/documentation-and-adrs/SKILL.md

@@ -18,7 +18,7 @@ Document decisions, not just code. The most valuable documentation captures the
 - Onboarding new team members (or agents) to the project
 - When you find yourself explaining the same thing repeatedly
 
-**When NOT to use:** Don't document obvious code. Don't add comments that restate what the code already says. Don't write docs for throwaway prototypes.
+**When NOT to use:** Don't document obvious code. Don't add comments that restate what the code already says. Don't write docs for throwaway prototypes. To *consolidate* ephemeral `*_REPORT.md` / `*_ANALYSIS.md` artifacts into canonical docs (rather than author new ones), use `doc-consolidation`.
 
 ## Architecture Decision Records (ADRs)
 
@@ -267,6 +267,57 @@ Special consideration for AI agent context:
 - **ADRs** — Help agents understand why past decisions were made (prevents re-deciding)
 - **Inline gotchas** — Prevent agents from falling into known traps
 
+## Generated-doc quality gate
+
+When an agent *writes* the docs, the docs inherit the agent's tics: filler, unearned claims, and the
+tells of machine prose. The "why over what" principle above governs *what to say*; this gate governs
+*how it reads*. Run it on any doc an agent generated or rewrote (README, guide, ADR prose, API docs,
+changelog text) before commit — the prose counterpart to the code-review grounding discipline in
+`code-review-and-quality`.
+
+> Detection heuristics re-derived (stack-agnostic) from the MIT-licensed
+> [`athola/claude-night-market`](https://github.com/athola/claude-night-market) `slop-detector` /
+> `doc-generator` skills (© 2025 athola). Not vendored.
+
+### Hard fails — a single hit fails the doc, independent of any other quality
+
+1. **Identity & voice leaks.** Generated-assistant register that leaked into a published artifact:
+   "As a large language model", "as of my training cutoff", "I cannot provide"; conversational
+   openers ("Great question!", "Hope this helps!", "Sure!"); self-narration of structure ("In this
+   section we will…", "Let's dive into…", "By the end of this guide…"). Delete on sight.
+2. **Hallucinated references.** Every backticked identifier, function, path, and config key named in
+   the prose must actually exist in the codebase; every install command the doc tells the reader to
+   run must resolve on its registry (the typosquat/existence check in `dependency-verification`);
+   cited URLs should resolve. A confident reference to something that doesn't exist is wrongness, not
+   style.
+3. **Unverified quality claims.** "Production-ready", "fast", "secure", "scalable", "battle-tested"
+   each must point to evidence *in the same repo* (a CI workflow, a benchmark, a test, an audit). No
+   evidence → delete the claim. This is the grounded-findings rule (`code-review-and-quality`) applied
+   to marketing prose.
+
+### Human-quality writing principles
+
+- **Slop is a density problem, not a word list.** One "comprehensive" is fine; a paragraph of
+  "comprehensive / robust / seamless / leverage" is generated text. Don't maintain a banned-words
+  list — flag *concentrations* and register mismatch, and prefer the plain word ("use" over
+  "leverage", "thorough" over "comprehensive").
+- **Thesis-first.** The lead states the single takeaway; a reader who stops after the first paragraph
+  still leaves with the message. Echo the thesis at the close; cut every other repetition.
+- **Earn every sentence.** A document costs the sum of its readers' time. Each sentence should carry,
+  instance, bound, or repeat the thesis — delete the ones that don't. One example is proof; two is
+  emphasis; three is filler.
+- **Active voice with reasoning.** Explain *why this choice* (which database, which pattern), not
+  neutral boilerplate. Don't humanize constructs ("the code wants", "the function speaks to").
+- **Prose over bullet waterfalls.** Bullets are for short, parallel lists. Multi-line bullet cascades
+  bury the reasoning — convert them to prose so the *why* survives.
+- **Drop the machine tells.** Em-dash overuse as a rhetorical pause, tricolons ("fast, reliable, and
+  scalable"), contrastive negation ("not just X, but Y" / "it's not X, it's Y"), vapid openers ("In
+  today's fast-paced world"), and sycophantic framing. No emojis unless requested. Use the imperative
+  mood for docstrings ("Validate input", not "Validates input").
+
+When cleaning an existing doc, change *how* it reads, never *what* it says — if the meaning is
+unclear, ask rather than guess. After editing, re-check against the hard fails.
+
 ## Common Rationalizations
 
 | Rationalization | Reality |

claude_code_kit-0.42.0/skills/safety-critical-patterns/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: safety-critical-patterns
+description: High-reliability coding lens adapted from NASA's Power of 10 — bounded loops & recursion, assertion density at boundaries/invariants, minimal variable scope, check every return value, restrained metaprogramming, strictest warnings — applied with rigor MATCHED TO CONSEQUENCE (full for money movement, medical, data-integrity, auth, irreversible actions; selective for core business logic; light for scripts/prototypes). Use when writing or reviewing code whose failure is expensive. Do NOT use as a general style/quality pass (use code-review-and-quality) or to scan for complexity to delete (use over-engineering-review) — this is the reliability lens, gated by consequence so it never over-applies to ordinary CRUD.
+---
+
+# Safety-Critical Coding Patterns
+
+> A high-reliability review/authoring lens adapted (stack-agnostic) from NASA JPL's **Power of 10**
+> rules, via the MIT-licensed [`athola/claude-night-market`](https://github.com/athola/claude-night-market)
+> `safety-critical-patterns` skill. The rules are language-neutral *intent*, not C-specific mandates.
+
+## Match rigor to consequence (the gate)
+
+This is the most important rule — apply the rest **proportional to what a failure costs**, never
+uniformly. Use `.claude/rules/risk-classification.md` to place the change:
+
+| Rigor | Apply to |
+|-------|----------|
+| **Full** | Money movement, medical/clinical, data-integrity, authn/authz, anything irreversible |
+| **Selective** | Core business logic, public API handlers, core algorithms |
+| **Light** | Scripts, prototypes, non-critical utilities, throwaway tooling |
+
+Forcing all ten rules onto a CRUD endpoint is itself an over-engineering smell
+(`over-engineering-review`). The point is reliability where reliability is worth paying for.
+
+## The 10 rules (adapted, language-neutral)
+
+1. **Restrict control flow.** Avoid arbitrary jumps; **bound recursion**. Recursion is fine with a
+   provable termination (tail call, bounded depth, tree of known size).
+2. **Fixed loop bounds.** Every loop has a verifiable upper bound. Give a potentially-unbounded loop a
+   safety limit and a reason it terminates.
+   ```python
+   for i in range(min(len(items), MAX_ITEMS)):   # bound is explicit
+       process(items[i])
+   # vs.  while not done:  ...                    # when does this end?
+   ```
+3. **Bound resource acquisition.** Don't allocate without limit on a hot/critical path; pre-size and
+   reuse where allocation failure mid-operation would be unrecoverable (GC languages relax this).
+4. **Keep functions short (~60 lines / one screen).** Cognitive limits are real; long functions hide
+   bugs. Flexible for declarative/config, strict for complex logic.
+5. **Assert boundaries and invariants.** Add defensive assertions for preconditions, postconditions,
+   and the things that "can't happen." Focus on real invariants, not a quota.
+   ```python
+   def transfer(src, dst, amount):
+       assert src != dst, "cannot transfer to same account"
+       assert amount > 0, "amount must be positive"
+       assert src.balance >= amount, "insufficient funds"
+   ```
+6. **Minimal variable scope.** Declare at the narrowest scope; don't hoist state into a wider scope
+   than its use.
+7. **Check every return value and validate every input.** Never ignore a result that can signal
+   failure; never trust an unvalidated parameter. (This is the reliability-side of
+   `agent-guardrails.md`'s "validate inputs.")
+   ```python
+   cfg = parse_config(path)
+   if cfg is None:
+       raise ConfigError(f"failed to parse {path}")   # not: parse_config(path)  # result dropped
+   ```
+8. **Restrain metaprogramming.** Limit macros/decorators/codegen/reflection; they defeat static
+   analysis and obscure control flow. Prefer explicit over magic; document any metaprogramming.
+9. **Discipline indirection & ownership.** Limit levels of indirection; be explicit about who owns and
+   mutates state. Prefer immutable data and clear types over deep optional/pointer chains.
+10. **Compile/lint at the strictest setting from day one.** Turn on all warnings and treat them as
+    errors. (e.g. `ruff --select=ALL` + `mypy --strict`; `tsc --strict`; `-Wall -Werror`; `clippy`.)
+
+## Rules that may not apply
+
+| Rule | Relax when |
+|------|-----------|
+| Bounded recursion | Tree traversal / parser combinators with provably bounded depth |
+| Bounded allocation | GC languages, short-lived processes |
+| ~60-line functions | Declarative config, exhaustive state machines |
+| Restrained indirection | Callbacks, event handlers, strategy patterns are legitimate |
+
+## Reporting violations
+
+Each finding is **grounded** (per `code-review-and-quality`): cite `Rule N`, a `file:line` Location,
+and a verbatim Anchor from that line, plus the issue and a concrete fix. Re-verify the citation before
+reporting.
+
+## Related
+
+- `.claude/rules/risk-classification.md` — sets the consequence tier that gates how much of this to apply
+- `code-review-and-quality` — the general multi-axis review; this is the reliability lens layered on top for high-consequence code
+- `over-engineering-review` — the opposite guard: don't apply full rigor where consequence doesn't warrant it
+- `.claude/rules/testing.md` — assertions complement, never replace, the runnable test for non-trivial logic