claude-code-kit 0.47.0__tar.gz → 0.49.0__tar.gz

{claude_code_kit-0.47.0 → claude_code_kit-0.49.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.47.0",
+      "version": "0.49.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.47.0 → claude_code_kit-0.49.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.47.0",
+  "version": "0.49.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.47.0 → claude_code_kit-0.49.0}/CHANGELOG.md

@@ -4,6 +4,46 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.49.0] — 2026-06-27
+
+**Docs: bring the README "Influences & what we adopted" table current.** The table had drifted —
+it stopped at `0.13.0` while the kit shipped ~13 more external-source adoptions. Since the README is
+the package's PyPI long-description, this republishes so the public page reflects the full ledger.
+
+- Added rows for every external-source adoption since `0.13.0`: repowise (`0.11.0`, backfilled),
+  OpenSpec (`0.34.0`), gstack + superpowers `systematic-debugging` (`0.35.0`), Karpathy-skills ·
+  addyosmani · shanraisshan presentation polish (`0.36.0`), temporalio/skill-temporal-developer
+  (`0.37.0`), wdm0006/python-skills (`0.38.0`), the athola/claude-night-market 4-part audit
+  (`0.39.0`–`0.42.0`), OpenTelemetry · W3C Trace Context · Grafana Tempo (`0.43.0`), Claude Code docs
+  (`0.44.0`), library-skills (`0.45.0`), murphytrueman/design-system-ops (`0.46.0`), the alibaba org
+  review (`0.47.0`), and alibaba/open-code-review (`0.48.0`).
+- Folded ponytail's second adoption (the pre-code Reuse/YAGNI gate, `0.33.0`) into its existing row.
+- Refreshed the "latest three reviews, in a bit more depth" details block (was `0.8`–`0.10`) to the
+  actual latest three: design-system-ops, the alibaba org review, and open-code-review.
+
+Docs-only (README is the sole content change); no payload/count/anchor changes. Version 0.48.0 → 0.49.0.
+
+## [0.48.0] — 2026-06-27
+
+**Adopt the partition-for-coverage review methodology from `alibaba/open-code-review`** (Apache-2.0,
+re-derived in prose — not vendored). A detailed read of open-code-review showed most of its methodology
+(multi-axis dimensions, line-level grounding + re-verify, severity, multi-model review) was already in
+the kit; the one genuine gap was **complete file coverage on large changesets**, where AI reviewers
+silently skip files. The kit's existing guidance covered *depth allocation* (hotspots) but not
+*coverage guarantee*.
+
+- **`skills/code-review-and-quality`** — new "Cover Every Changed File: Partition, Plan, Then Weight
+  Depth" section: enumerate changed files deterministically (the diff is the checklist of record),
+  bundle related files into one review unit, review each bundle in isolated context concurrently,
+  plan-before-deep-pass on big diffs, and reconcile so every file gets a verdict. The existing hotspot
+  section is reframed as the *depth* step that follows coverage. New coverage item in the review
+  checklist.
+- **`agents/sdlc-code-reviewer`** — "Cover Before You Score" note + a Coverage checklist category
+  (every changed file accounted for; related files reviewed as bundles).
+
+Coverage = every file accounted for; depth = how hard you looked, allocated next. No count/anchor
+changes (skill + agent extended, none added). Version 0.47.0 → 0.48.0.
+
 ## [0.47.0] — 2026-06-27
 
 **Adopt 5 verified agentic-engineering patterns from an exhaustive review of the Alibaba GitHub org**

{claude_code_kit-0.47.0 → claude_code_kit-0.49.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.47.0
+Version: 0.49.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -499,11 +499,24 @@ non-duplicative gaps**, minimally and catalog-wired.
 | Source | What we learned | What we shipped | Since |
 |---|---|---|:--:|
 | **Agentic Design Patterns** — A. Gulli ([coverage map](docs/agentic-patterns.md)) | Reasoning, guardrails, resilience, human-in-the-loop, evals, and tool design as first-class agent disciplines | 8 agent-operation rules + [`docs/agentic-patterns.md`](docs/agentic-patterns.md) | `0.4.0` |
-| **[ponytail](https://github.com/DietrichGebert/ponytail)** | YAGNI / anti-over-engineering as an explicit recurring pass; deferral-debt tracking; surfacing the active autonomy level | `over-engineering-review` & `simplification-debt` skills, the `load-autonomy` hook, median-of-N in `evals` | `0.8.0` |
+| **[ponytail](https://github.com/DietrichGebert/ponytail)** | YAGNI / anti-over-engineering as an explicit recurring pass; deferral-debt tracking; surfacing the active autonomy level; a pre-code reuse gate | `over-engineering-review` & `simplification-debt` skills, the `load-autonomy` hook, median-of-N in `evals`; later the pre-code **Reuse/YAGNI gate** (`mandatory-workflow` §2a.5) | `0.8.0`, `0.33.0` |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | Spec → tasks → **analyze** coverage gate; tasks → tracker issues; stable requirement IDs + assumptions in specs | Wired the (previously orphaned) `story-planner` as the **coverage gate (1f)**, a tracker-agnostic `task-tracker-sync` skill, and enriched the feature-spec template | `0.9.0` |
 | **[protectai/llm-guard](https://github.com/protectai/llm-guard)** | Input→model→output guardrails for LLM features — prompt injection, PII vault, treating model output as untrusted | **Opt-in** "LLM / AI Feature Security" guidance in `security-and-hardening` + the advisory `warn-llm-io` hook (warns, **never blocks**) | `0.10.0` |
+| **[repowise](https://github.com/repowise-dev/repowise)** | Runtime codebase-intelligence — hotspot (churn × complexity), co-change coupling, and change-risk as *advisory* review input | Hotspot/coupling/bus-factor guidance in `code-review-and-quality` (derivable from `git log` alone) + an **optional** `repowise` MCP fragment in the catalog (advisory, never a gate) | `0.11.0` |
 | **Improvement brief** (external self-review) | API backward-compat as a gate; load-against-SLO as a release criterion; supply-chain maintenance cadence; pipeline resumability, clean abort, and worktree lifecycle; pipeline cost/concurrency/cross-platform transparency | The enterprise **`contract-clear`** gate (owned by `merge-reviewer`) + `api-change-report` template; a load-vs-SLO criterion in Observability Ready; dependency **Cadence Mode**; `/sdlc` resume-vs-restart, `/claude-kit:abort`, worktree teardown; cost/concurrency/Windows notes — **9 surgical extensions, 0 new agents/skills/rules** | `0.12.0` |
 | **Improvement brief #2** (external self-review) | The covered-vs-**gated** distinction (a skill ≠ a gate); enforce API breaking-changes by default; expand/contract migration safety; back the stack-agnostic claim with a compiled backend; WCAG as a regulated gate; reconcile the PyPI story; ship a worked example + a self-test matrix | [`docs/coverage-audit.md`](docs/coverage-audit.md); **`contract-clear` promoted to `standard`**; a live **Go/net-http** backend; the **`accessibility-clear`** regulated gate; explicit migration-drop rules; a synthetic [`examples/`](examples/) run; an eval-harness template; a profile×stack×scope self-test matrix — **2 gates wired + 1 stack, 0 new agents/skills/rules** | `0.13.0` |
+| **[OpenSpec](https://github.com/Fission-AI/OpenSpec)** | Delta-specs — change-scoped artifacts describing only what a change adds / modifies / removes | A `change-proposal.md` delta-spec template (keyed to stable `R#` ids) + a "full vs delta spec" decision in `spec-driven-development` | `0.34.0` |
+| **gstack "Iron Law" + [superpowers](https://github.com/obra/superpowers)** `systematic-debugging` | Bounding blind fix attempts on a single bug | The **3-strike fix-attempt rule** in `agent-resilience` (each attempt a distinct hypothesis; at the 3rd, stop → re-derive root cause → escalate) | `0.35.0` |
+| **Karpathy-skills · addyosmani/agent-skills · shanraisshan/claude-code-best-practice** | Rule presentation & context hygiene — quotable taglines, embedded self-checks, quantitative context guardrails | Presentation polish on 6 rules + quantitative guardrails in `context-engineering` (presentation only, count-neutral) | `0.36.0` |
+| **[temporalio/skill-temporal-developer](https://github.com/temporalio/skill-temporal-developer)** | Temporal *fundamentals* — durable execution, determinism/replay, versioning, testing | `temporal-developer` collection skill (complements, not duplicates, `temporal-config-driven`) | `0.37.0` |
+| **[wdm0006/python-skills](https://github.com/wdm0006/python-skills)** | Pre-add dependency evaluation; property-based testing | `library-review` core skill + a Property-Based Testing section in `test-driven-development` (rest skipped as redundant) | `0.38.0` |
+| **[athola/claude-night-market](https://github.com/athola/claude-night-market)** (4-part audit) | Supply-chain defense; review grounding; escalation/safety/shell lenses; doc hygiene & resource-proportionality | `dependency-verification` · `safety-critical-patterns` · `shell-review` · `doc-consolidation` skills; finding-grounding in `code-review-and-quality`; tier-escalation + reversibility gates; `tool-design` §7 | `0.39.0`–`0.42.0` |
+| **OpenTelemetry · W3C Trace Context · [Grafana Tempo](https://github.com/grafana/tempo)** | Vendor-neutral distributed tracing & trace↔log correlation | `otel-tracing` collection skill | `0.43.0` |
+| **[Claude Code docs](https://code.claude.com)** | Verified token-economy settings | `autoCompactEnabled` / `maxSkillDescriptionChars` / terminal-title env in the generated settings, bounded SessionStart context hooks, and a leaner `templates/CLAUDE.md` | `0.44.0` |
+| **[library-skills](https://library-skills.io)** | A dependency's *author-shipped, version-synced* skills as the defense against stale-API generation | Documented as the no-MCP companion to Context7 in `catalog/mcp.yaml`; referenced from `dependency-verification` & `library-review` | `0.45.0` |
+| **[murphytrueman/design-system-ops](https://github.com/murphytrueman/design-system-ops)** | Operating a design system *over time* — token architecture, drift, health/maturity, governance, adoption, AI-readiness | `design-system-ops` collection skill (the operations layer, distinct from the build-time UI skills) | `0.46.0` |
+| **[alibaba](https://github.com/alibaba) org review** (all 542 repos) | Staged leak-resistant evals; agent-operation authorization; tool-set orchestration + atomic state; agent-run span-tree instrumentation; live-attach debugging | `evals` §7, `agent-guardrails` §5, `tool-design` §8, `goal-setting-and-monitoring` §4, and live-attach debugging in `debugging-and-error-recovery` (from atrex-bench · open-agent-auth · app-controller · loongsuite-js · arthas) | `0.47.0` |
+| **[alibaba/open-code-review](https://github.com/alibaba/open-code-review)** | Partition-for-coverage review — deterministic full-file coverage on large changesets, related-file bundling, plan-before-deep-pass | The "Cover Every Changed File" section in `code-review-and-quality` + a Coverage category in `sdlc-code-reviewer` | `0.48.0` |
 
 > Each adoption is detailed in the [CHANGELOG](CHANGELOG.md) — including, for every review, what we
 > deliberately **did not** add because the kit already covered it.
@@ -513,28 +526,30 @@ non-duplicative gaps**, minimally and catalog-wired.
 
 <br>
 
-**🪶 ponytail → minimalism layer (0.8.0).** Most of ponytail's philosophy (YAGNI, stdlib-first,
-surgical diffs) was already enforced by `CLAUDE.md` "Simplicity First" + `code-simplification`, so we
-added only the missing *mechanisms*: `over-engineering-review` (a complexity-only, report-only
-delete-list), `simplification-debt` (harvests `TODO`/`FIXME`/inline `shortcut:` markers into a ledger
-and flags ones that name no upgrade path), and the `load-autonomy` SessionStart hook (surfaces the
-active autonomy level each session).
-
-**🧭 GitHub spec-kit → coverage gate + tracker sync (0.9.0).** The headline was *reuse*: the kit
-already had a `story-planner` agent that verifies every acceptance criterion maps to a story, but it
-was **never wired into the pipeline**. We made it **stage 1f** (between EM approval and the developer),
-so implementation can't start until coverage is proven. We also added `task-tracker-sync` (mirrors a
-plan into GitHub / Linear / Jira issues, dependencies preserved) and gave the feature-spec template
-stable requirement IDs + an Assumptions section. We **skipped** spec-kit's `/constitution`,
-`/clarify`, and `/checklist` — all already covered.
-
-**🛡️ protectai/llm-guard → opt-in LLM security (0.10.0).** The kit secured the *agent itself* and
-*traditional* web appsec, but nothing covered **the LLM features you build into your product** (the
-OWASP LLM Top 10). Per request, the new layer is **opt-in, bypassable, and states the risk of
-bypassing**: an "LLM / AI Feature Security" section in `security-and-hardening` (input/output
-guardrails, PII vault, untrusted-output handling, a security-implications-of-bypassing table) plus a
-non-blocking `warn-llm-io` hook. We deliberately did **not** add a new rule or fold it into the
-mandatory security gate — that would have made it mandatory.
+**🎨 murphytrueman/design-system-ops → operations layer (0.46.0).** The kit already covered *building*
+components (`component-design`, `radix-tailwind-component-patterns`) and *verifying one screen*
+(`ui-ux-design`); the gap was operating the system **over time**. The new `design-system-ops`
+collection skill adds the operations lifecycle (audit → govern → document → validate → communicate)
+with five references — three-tier token architecture, seven-dimension health & five maturity stages,
+the drift taxonomy, governance & adoption measurement, and AI-readiness / Component Challenge Rating —
+re-derived stack-agnostic with attribution.
+
+**🧭 alibaba org review → 5 agentic patterns (0.47.0).** We reviewed **all 542 repos** in the Alibaba
+org (survey every repo → deep-dive every candidate → adversarially verify). The overwhelming majority —
+Java middleware, ML/inference, mobile, frontend frameworks — carried nothing transferable to a config
+scaffolder, and the verify pass *dropped* a sixth candidate (`p3c`) as unsubstantiated and already
+covered. Five survived: staged leak-resistant evals (`evals` §7), agent-operation authorization
+(`agent-guardrails` §5), tool-set orchestration + atomic state (`tool-design` §8), agent-run span-tree
+instrumentation (`goal-setting-and-monitoring` §4), and live-attach debugging
+(`debugging-and-error-recovery`).
+
+**🔍 alibaba/open-code-review → coverage-partition review (0.48.0).** A detailed read showed most of its
+methodology (multi-axis review, line-level grounding + re-verify, severity, multi-model) was *already*
+in `code-review-and-quality`. The one genuine gap: **complete file coverage on large changesets** —
+where AI reviewers silently skip files. We added "Cover Every Changed File: Partition, Plan, Then
+Weight Depth" (enumerate from the diff as the checklist of record → bundle related files →
+isolated-context concurrent review → reconcile every file to a verdict), reframing the existing hotspot
+guidance as the *depth* step that follows coverage.
 
 </details>
 

{claude_code_kit-0.47.0 → claude_code_kit-0.49.0}/README.md

@@ -469,11 +469,24 @@ non-duplicative gaps**, minimally and catalog-wired.
 | Source | What we learned | What we shipped | Since |
 |---|---|---|:--:|
 | **Agentic Design Patterns** — A. Gulli ([coverage map](docs/agentic-patterns.md)) | Reasoning, guardrails, resilience, human-in-the-loop, evals, and tool design as first-class agent disciplines | 8 agent-operation rules + [`docs/agentic-patterns.md`](docs/agentic-patterns.md) | `0.4.0` |
-| **[ponytail](https://github.com/DietrichGebert/ponytail)** | YAGNI / anti-over-engineering as an explicit recurring pass; deferral-debt tracking; surfacing the active autonomy level | `over-engineering-review` & `simplification-debt` skills, the `load-autonomy` hook, median-of-N in `evals` | `0.8.0` |
+| **[ponytail](https://github.com/DietrichGebert/ponytail)** | YAGNI / anti-over-engineering as an explicit recurring pass; deferral-debt tracking; surfacing the active autonomy level; a pre-code reuse gate | `over-engineering-review` & `simplification-debt` skills, the `load-autonomy` hook, median-of-N in `evals`; later the pre-code **Reuse/YAGNI gate** (`mandatory-workflow` §2a.5) | `0.8.0`, `0.33.0` |
 | **[GitHub spec-kit](https://github.com/github/spec-kit)** | Spec → tasks → **analyze** coverage gate; tasks → tracker issues; stable requirement IDs + assumptions in specs | Wired the (previously orphaned) `story-planner` as the **coverage gate (1f)**, a tracker-agnostic `task-tracker-sync` skill, and enriched the feature-spec template | `0.9.0` |
 | **[protectai/llm-guard](https://github.com/protectai/llm-guard)** | Input→model→output guardrails for LLM features — prompt injection, PII vault, treating model output as untrusted | **Opt-in** "LLM / AI Feature Security" guidance in `security-and-hardening` + the advisory `warn-llm-io` hook (warns, **never blocks**) | `0.10.0` |
+| **[repowise](https://github.com/repowise-dev/repowise)** | Runtime codebase-intelligence — hotspot (churn × complexity), co-change coupling, and change-risk as *advisory* review input | Hotspot/coupling/bus-factor guidance in `code-review-and-quality` (derivable from `git log` alone) + an **optional** `repowise` MCP fragment in the catalog (advisory, never a gate) | `0.11.0` |
 | **Improvement brief** (external self-review) | API backward-compat as a gate; load-against-SLO as a release criterion; supply-chain maintenance cadence; pipeline resumability, clean abort, and worktree lifecycle; pipeline cost/concurrency/cross-platform transparency | The enterprise **`contract-clear`** gate (owned by `merge-reviewer`) + `api-change-report` template; a load-vs-SLO criterion in Observability Ready; dependency **Cadence Mode**; `/sdlc` resume-vs-restart, `/claude-kit:abort`, worktree teardown; cost/concurrency/Windows notes — **9 surgical extensions, 0 new agents/skills/rules** | `0.12.0` |
 | **Improvement brief #2** (external self-review) | The covered-vs-**gated** distinction (a skill ≠ a gate); enforce API breaking-changes by default; expand/contract migration safety; back the stack-agnostic claim with a compiled backend; WCAG as a regulated gate; reconcile the PyPI story; ship a worked example + a self-test matrix | [`docs/coverage-audit.md`](docs/coverage-audit.md); **`contract-clear` promoted to `standard`**; a live **Go/net-http** backend; the **`accessibility-clear`** regulated gate; explicit migration-drop rules; a synthetic [`examples/`](examples/) run; an eval-harness template; a profile×stack×scope self-test matrix — **2 gates wired + 1 stack, 0 new agents/skills/rules** | `0.13.0` |
+| **[OpenSpec](https://github.com/Fission-AI/OpenSpec)** | Delta-specs — change-scoped artifacts describing only what a change adds / modifies / removes | A `change-proposal.md` delta-spec template (keyed to stable `R#` ids) + a "full vs delta spec" decision in `spec-driven-development` | `0.34.0` |
+| **gstack "Iron Law" + [superpowers](https://github.com/obra/superpowers)** `systematic-debugging` | Bounding blind fix attempts on a single bug | The **3-strike fix-attempt rule** in `agent-resilience` (each attempt a distinct hypothesis; at the 3rd, stop → re-derive root cause → escalate) | `0.35.0` |
+| **Karpathy-skills · addyosmani/agent-skills · shanraisshan/claude-code-best-practice** | Rule presentation & context hygiene — quotable taglines, embedded self-checks, quantitative context guardrails | Presentation polish on 6 rules + quantitative guardrails in `context-engineering` (presentation only, count-neutral) | `0.36.0` |
+| **[temporalio/skill-temporal-developer](https://github.com/temporalio/skill-temporal-developer)** | Temporal *fundamentals* — durable execution, determinism/replay, versioning, testing | `temporal-developer` collection skill (complements, not duplicates, `temporal-config-driven`) | `0.37.0` |
+| **[wdm0006/python-skills](https://github.com/wdm0006/python-skills)** | Pre-add dependency evaluation; property-based testing | `library-review` core skill + a Property-Based Testing section in `test-driven-development` (rest skipped as redundant) | `0.38.0` |
+| **[athola/claude-night-market](https://github.com/athola/claude-night-market)** (4-part audit) | Supply-chain defense; review grounding; escalation/safety/shell lenses; doc hygiene & resource-proportionality | `dependency-verification` · `safety-critical-patterns` · `shell-review` · `doc-consolidation` skills; finding-grounding in `code-review-and-quality`; tier-escalation + reversibility gates; `tool-design` §7 | `0.39.0`–`0.42.0` |
+| **OpenTelemetry · W3C Trace Context · [Grafana Tempo](https://github.com/grafana/tempo)** | Vendor-neutral distributed tracing & trace↔log correlation | `otel-tracing` collection skill | `0.43.0` |
+| **[Claude Code docs](https://code.claude.com)** | Verified token-economy settings | `autoCompactEnabled` / `maxSkillDescriptionChars` / terminal-title env in the generated settings, bounded SessionStart context hooks, and a leaner `templates/CLAUDE.md` | `0.44.0` |
+| **[library-skills](https://library-skills.io)** | A dependency's *author-shipped, version-synced* skills as the defense against stale-API generation | Documented as the no-MCP companion to Context7 in `catalog/mcp.yaml`; referenced from `dependency-verification` & `library-review` | `0.45.0` |
+| **[murphytrueman/design-system-ops](https://github.com/murphytrueman/design-system-ops)** | Operating a design system *over time* — token architecture, drift, health/maturity, governance, adoption, AI-readiness | `design-system-ops` collection skill (the operations layer, distinct from the build-time UI skills) | `0.46.0` |
+| **[alibaba](https://github.com/alibaba) org review** (all 542 repos) | Staged leak-resistant evals; agent-operation authorization; tool-set orchestration + atomic state; agent-run span-tree instrumentation; live-attach debugging | `evals` §7, `agent-guardrails` §5, `tool-design` §8, `goal-setting-and-monitoring` §4, and live-attach debugging in `debugging-and-error-recovery` (from atrex-bench · open-agent-auth · app-controller · loongsuite-js · arthas) | `0.47.0` |
+| **[alibaba/open-code-review](https://github.com/alibaba/open-code-review)** | Partition-for-coverage review — deterministic full-file coverage on large changesets, related-file bundling, plan-before-deep-pass | The "Cover Every Changed File" section in `code-review-and-quality` + a Coverage category in `sdlc-code-reviewer` | `0.48.0` |
 
 > Each adoption is detailed in the [CHANGELOG](CHANGELOG.md) — including, for every review, what we
 > deliberately **did not** add because the kit already covered it.
@@ -483,28 +496,30 @@ non-duplicative gaps**, minimally and catalog-wired.
 
 <br>
 
-**🪶 ponytail → minimalism layer (0.8.0).** Most of ponytail's philosophy (YAGNI, stdlib-first,
-surgical diffs) was already enforced by `CLAUDE.md` "Simplicity First" + `code-simplification`, so we
-added only the missing *mechanisms*: `over-engineering-review` (a complexity-only, report-only
-delete-list), `simplification-debt` (harvests `TODO`/`FIXME`/inline `shortcut:` markers into a ledger
-and flags ones that name no upgrade path), and the `load-autonomy` SessionStart hook (surfaces the
-active autonomy level each session).
-
-**🧭 GitHub spec-kit → coverage gate + tracker sync (0.9.0).** The headline was *reuse*: the kit
-already had a `story-planner` agent that verifies every acceptance criterion maps to a story, but it
-was **never wired into the pipeline**. We made it **stage 1f** (between EM approval and the developer),
-so implementation can't start until coverage is proven. We also added `task-tracker-sync` (mirrors a
-plan into GitHub / Linear / Jira issues, dependencies preserved) and gave the feature-spec template
-stable requirement IDs + an Assumptions section. We **skipped** spec-kit's `/constitution`,
-`/clarify`, and `/checklist` — all already covered.
-
-**🛡️ protectai/llm-guard → opt-in LLM security (0.10.0).** The kit secured the *agent itself* and
-*traditional* web appsec, but nothing covered **the LLM features you build into your product** (the
-OWASP LLM Top 10). Per request, the new layer is **opt-in, bypassable, and states the risk of
-bypassing**: an "LLM / AI Feature Security" section in `security-and-hardening` (input/output
-guardrails, PII vault, untrusted-output handling, a security-implications-of-bypassing table) plus a
-non-blocking `warn-llm-io` hook. We deliberately did **not** add a new rule or fold it into the
-mandatory security gate — that would have made it mandatory.
+**🎨 murphytrueman/design-system-ops → operations layer (0.46.0).** The kit already covered *building*
+components (`component-design`, `radix-tailwind-component-patterns`) and *verifying one screen*
+(`ui-ux-design`); the gap was operating the system **over time**. The new `design-system-ops`
+collection skill adds the operations lifecycle (audit → govern → document → validate → communicate)
+with five references — three-tier token architecture, seven-dimension health & five maturity stages,
+the drift taxonomy, governance & adoption measurement, and AI-readiness / Component Challenge Rating —
+re-derived stack-agnostic with attribution.
+
+**🧭 alibaba org review → 5 agentic patterns (0.47.0).** We reviewed **all 542 repos** in the Alibaba
+org (survey every repo → deep-dive every candidate → adversarially verify). The overwhelming majority —
+Java middleware, ML/inference, mobile, frontend frameworks — carried nothing transferable to a config
+scaffolder, and the verify pass *dropped* a sixth candidate (`p3c`) as unsubstantiated and already
+covered. Five survived: staged leak-resistant evals (`evals` §7), agent-operation authorization
+(`agent-guardrails` §5), tool-set orchestration + atomic state (`tool-design` §8), agent-run span-tree
+instrumentation (`goal-setting-and-monitoring` §4), and live-attach debugging
+(`debugging-and-error-recovery`).
+
+**🔍 alibaba/open-code-review → coverage-partition review (0.48.0).** A detailed read showed most of its
+methodology (multi-axis review, line-level grounding + re-verify, severity, multi-model) was *already*
+in `code-review-and-quality`. The one genuine gap: **complete file coverage on large changesets** —
+where AI reviewers silently skip files. We added "Cover Every Changed File: Partition, Plan, Then
+Weight Depth" (enumerate from the diff as the checklist of record → bundle related files →
+isolated-context concurrent review → reconcile every file to a verdict), reframing the existing hotspot
+guidance as the *depth* step that follows coverage.
 
 </details>
 

{claude_code_kit-0.47.0 → claude_code_kit-0.49.0}/agents/sdlc-code-reviewer.md

@@ -38,8 +38,22 @@ Apply every applicable rule from these documents when reviewing code. Reference
 
 Review all code changes produced by the Developer (Agent 4). Check for correctness, security, performance, and adherence to standards. Gate the pipeline — **testing CANNOT start without your approval** (CLAUDE.md §2).
 
+## Cover Before You Score (large changesets)
+
+Before weighting depth, guarantee coverage. Take the changed-file list from the diff
+(`git diff --name-only`) as the **checklist of record** — every file is reviewed or explicitly marked
+out-of-scope with a reason; the model never decides which files "seem worth" looking at. Review related
+files as **bundles in isolated context** (use parallel lanes for very large changesets per
+`.claude/rules/mandatory-workflow.md`), then reconcile so no file is silently skipped. Allocate extra
+depth to hotspots/coupled files **after** coverage is assured. This is the partition-for-coverage
+discipline in the `code-review-and-quality` skill.
+
 ## Review Checklist
 
+### Coverage
+- [ ] Every changed file is accounted for — reviewed or explicitly marked out-of-scope (no silent skips)
+- [ ] Related files reviewed together as bundles (function+tests, schema+migration, paired config/i18n)
+
 ### Correctness
 - [ ] Logic matches the spec exactly
 - [ ] All acceptance criteria from the spec are implemented

{claude_code_kit-0.47.0 → claude_code_kit-0.49.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.47.0"
+version = "0.49.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.47.0 → claude_code_kit-0.49.0}/skills/code-review-and-quality/SKILL.md

@@ -80,9 +80,45 @@ For detailed profiling and optimization, see `performance-optimization`. Does th
 - Any missing pagination on list endpoints?
 - Any large objects created in hot paths?
 
+## Cover Every Changed File: Partition, Plan, Then Weight Depth
+
+On a large changeset the signature failure of an AI reviewer is **silently skipping files** —
+reviewing a plausible subset while implying the whole. Coverage is a *mechanical* property: guarantee
+it with engineering, not model discretion, **before** deciding where to spend depth (next section).
+
+- **Enumerate deterministically.** Take the changed-file list from the diff itself and treat it as the
+  checklist of record — every file is reviewed or explicitly marked out-of-scope with a reason. The
+  model never decides which files "seem worth" looking at.
+  ```bash
+  git diff --name-only <base>...<head>   # the coverage checklist — nothing falls off it
+  ```
+- **Bundle related files into one review unit.** Group files that must be understood together — a
+  function and its tests, an interface and its implementations, paired translation/config files
+  (`messages.en.json` + `messages.zh.json`), a schema and its migration. A bundle reviewed as a unit
+  catches cross-file contract breaks that a one-file-at-a-time pass misses.
+- **Review each bundle in isolated context, concurrently.** Give each bundle its own focused context
+  (its own sub-agent/lane) instead of streaming the whole changeset through one window —
+  divide-and-conquer keeps quality stable on very large changes and parallelizes naturally (the
+  `.claude/rules/mandatory-workflow.md` lane model, within the Brooks's-law caution in
+  `.claude/rules/tool-design.md` §7). Context gathered for one bundle is for *understanding only* — a
+  discovery in file B doesn't become a comment on the unrelated file A.
+- **Plan before the deep pass on a big diff.** For a large change, first emit a one-paragraph change
+  summary plus risk points ranked high→low and the context each needs, then review against that plan.
+  A cheap planning pass beats diving in file-by-file blind.
+- **Reconcile at the end.** Merge the per-bundle findings and confirm every file on the enumerated list
+  got a verdict. **Coverage = every file accounted for; depth = how hard you looked, allocated next.**
+
+> Partition-for-coverage (deterministic file selection, related-file bundling, isolated-context
+> concurrent review, plan-phase for large diffs) is a stack-agnostic adaptation of the hybrid
+> architecture in the Apache-2.0
+> [`alibaba/open-code-review`](https://github.com/alibaba/open-code-review) — engineering guarantees
+> coverage, the model supplies judgment. Re-derived in prose; not vendored.
+
 ## Where to Focus: Change Hotspots & Coupling
 
-You can't give every line equal attention — on a large change or an unfamiliar codebase, spend the most scrutiny where defects actually cluster. The project's own git history surfaces this for free, no special tooling required:
+Once every changed file is accounted for (above), allocate *depth* — you can't give every line equal
+attention; on a large change or an unfamiliar codebase, spend the most scrutiny where defects actually
+cluster. The project's own git history surfaces this for free, no special tooling required:
 
 - **Hotspots (churn × complexity).** Files that change *often* **and** are *large/complex* carry the most risk. List the frequently-changed files and weight review toward the complex ones among them — a rarely-touched file is usually stable, while a hotspot edited in *this* change deserves extra correctness and test scrutiny.
   ```bash
@@ -306,6 +342,7 @@ For a full pre-add evaluation of a specific candidate (maintenance/bus-factor, l
 
 ### Context
 - [ ] I understand what this change does and why
+- [ ] Every changed file is accounted for — reviewed or explicitly marked out-of-scope (no silent skips)
 - [ ] For a large/unfamiliar change, I focused review on the riskiest files (hotspots, coupled files)
 
 ### Correctness

{claude_code_kit-0.47.0 → claude_code_kit-0.49.0}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.47.0"
+__version__ = "0.49.0"