claude-code-kit 0.50.0__tar.gz → 0.52.0__tar.gz

{claude_code_kit-0.50.0 → claude_code_kit-0.52.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.50.0",
+      "version": "0.52.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.50.0 → claude_code_kit-0.52.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.50.0",
+  "version": "0.52.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.50.0 → claude_code_kit-0.52.0}/CHANGELOG.md

@@ -4,6 +4,113 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.52.0] — 2026-06-28
+
+**Adopt the verified wins from an exhaustive review of the entire `facebook` (Meta) GitHub org** (all
+**168** repos — Meta long ago spun React, PyTorch, Jest, etc. into dedicated orgs, so the `facebook` org
+itself is small). Every repo was surveyed (7 agents over every page — no repo skipped), candidates
+deep-read for license + transferable practice, and the shortlist **adversarially verified** against the
+live source. The org is almost entirely libraries/frameworks/language-tooling with nothing transferable
+to a config scaffolder, and several famous repos were **already covered** (`infer` by the 0.51
+compile-time-logic-bug lint layer; React by the kit's React overlay; testing by an already-deep
+`testing.md`). The verify pass *dropped* the weak picks — `DNE-TaaC` (datacenter network-device testing,
+1★, overlaps the config-driven skills) and `mbt` (a 0★ Meta-service-specific binary-transparency client;
+that practice belongs to Sigstore/Certificate-Transparency, not this org). **3 adoptions, all extensions
+to existing rules — 0 new agents/skills/rules** (skill counts unchanged at 104/56/48; MCP fragments
+unchanged at 17). All sources MIT / Apache-2.0.
+
+Rules:
+
+- **`linting-and-formatting.md`** — a new **Interprocedural Taint / Data-Flow Analysis** layer: declare
+  untrusted **sources**, dangerous **sinks**, and **sanitizers**, then trace data flow *across function
+  boundaries* and flag any unsanitized source→sink path — distinct from the single-line Security-Lint
+  layer and the Compile-Time Logic-Bug layer, and the automated codebase-wide complement to
+  `security-and-hardening`'s secure-by-construction wrappers (from the MIT `facebook/pyre-check`/Pysa and
+  `facebook/mariana-trench`; engines: Pysa/Mariana Trench/CodeQL/Semgrep).
+- **`devops-observability.md`** — a **continuous performance-regression CI gate**: run the baseline
+  (control) and the PR commit (treatment) **concurrently on the same machine** to cancel environmental
+  variance, and gate on the **relative delta** (with a tolerance band) rather than an absolute number —
+  catching the gradual regressions the one-shot Load-vs-SLO gate misses (from the Apache-2.0
+  `facebook/FAI-PEP`).
+- **`agent-guardrails.md`** — extended §4's sandbox **policy** with **defense-in-depth enforcement**:
+  L1 policy decision (existing) + L2 argument validation at the boundary (path canonicalization,
+  injection screening, response sanitization) + L3 OS-level runtime backstop (eBPF-LSM/seccomp
+  intercepting `open`/`connect`/`exec`) so a tool that ignores the declarative policy still cannot escape
+  scope (from the MIT `facebook/mcpguard-dynamic`).
+
+What we **did not** add (already covered, or fails the bar): `infer`/`mariana-trench`-as-a-tool and
+`sapp` (the kit's compile-time-logic-bug + new taint layer cover the discipline); `fbt` i18n (JS-specific,
+archived); `memlab` (JS-only heap analysis); `Ax` (ML hyperparameter optimization, a library);
+`chef-cookbooks`/`IT-CPE`/`taste-tester` (Chef IaC / IT fleet management); `ThreatExchange`/`threat-research`
+(content-moderation / CTI data, out of SDLC scope); `akd`/`private_processing` (domain-specific crypto
+libraries); plus the dropped `DNE-TaaC` and `mbt`.
+
+## [0.51.0] — 2026-06-28
+
+**Adopt the verified wins from an exhaustive review of the entire `google` GitHub org** (all **2,881**
+repos). Every repo was surveyed (60 agents over every page — no repo skipped), the top ~300 candidates
+deep-read for license + transferable practice, and the shortlist **adversarially verified** against the
+live source. The verify pass *dropped a third* of the shortlist: `deps.dev` (a REST/gRPC API, **not** an
+MCP server), `licensecheck` (license *classification*, not the claimed compatibility gate), the
+Go/Rust/C++-locked tools `capslock` · `rust-crate-audits` · `fuzztest` · `libprotobuf-mutator` (not
+re-derivable stack-agnostic), `sqlcommenter` (archived → donated to OpenTelemetry), and `ax` (too early —
+"major breaking changes prior to stable"). Everything is re-derived **in prose, never vendored**; all
+sources Apache-2.0 / BSD-3-Clause / MIT except one CC-BY-4.0 book (concept-only). **21 adoptions, all
+extensions to existing files — 0 new agents/skills/rules** (skill counts unchanged at 104/56/48); only the
+**MCP fragment count rises 13 → 17**.
+
+Rules:
+
+- **`human-in-the-loop.md`** — a new **multi-party authorization** section: the two-person rule for the
+  highest-stakes actions, context-bound (multi-factor) approval, and **breakglass-with-auditing** (loud
+  emergency override + mandatory after-the-fact review), extending the simple approval gate beyond a
+  single approver (concept-only from the CC-BY-4.0 *Building Secure & Reliable Systems*,
+  `google/building-secure-and-reliable-systems`).
+- **`testing.md`** — four techniques beyond example-based tests: **parameterized/table-driven** tests
+  (`google/patrick`); **semantic-equality & structured-diff** assertions, float tolerance over brittle
+  deep-equality (`google/go-cmp`); a **Fuzzing** section — coverage-guided + structure-aware + **continuous
+  fuzzing as a CI gate** (`google/atheris` · `google/honggfuzz` · `google/clusterfuzzlite`); and
+  **parallel execution + repeated-run flakiness detection** (`google/gtest-parallel`).
+- **`linting-and-formatting.md`** — a **compile-time logic-bug analysis** layer (find bugs the type
+  checker accepts — `google/error-prone`), **license-header enforcement** as a check-mode CI gate
+  (`google/addlicense`), and **deterministic block sorting** via marker comments to cut merge conflicts
+  (`google/keep-sorted`).
+- **`devops-observability.md`** — **multi-window burn-rate alerting** (alert on error-budget burn across
+  paired short/long windows, not raw error rate — `google/prometheus-slo-burn-example`) and **high-volume
+  logging** patterns (call-site rate-limiting + lazy argument evaluation — `google/flogger`).
+- **`reasoning-techniques.md`** — **prompt-as-code**: treat a reusable prompt as a versioned, schema-validated,
+  testable artifact (`google/dotprompt`).
+- **`tool-design.md`** — the §8 atomic-state note gains the **atomicity-vs-durability** nuance
+  (fsync-before-rename, same-filesystem, temp cleanup — `google/renameio`).
+
+Skills:
+
+- **`security-and-hardening`** — **reproducible-build verification** (independent rebuild → normalize
+  benign differences → attest equivalence — `google/oss-rebuild`); **source-level missing-patch detection**
+  for vendored/forked code via OSV-derived signatures (`google/vanir`); **secure-by-construction injection
+  defense** (compile-time-constant query text + typed trusted/untrusted wrappers — `google/safe-active-record`
+  · `google/mug`); **archive-extraction safety** (zip-slip / symlink — `google/safearchive`); and **ReDoS
+  defense** for untrusted regex input (`google/re2`).
+- **`context-engineering`** — a **Long-Document Extraction** section: overlapping chunks → parallel
+  schema-constrained passes → source-interval grounding → multi-pass recall (`google/langextract`).
+- **`performance-optimization`** — a **statistical browser benchmarking** discipline: interleaved repeated
+  sampling, 95 % confidence intervals, auto-sample-until-significance (`google/tachometer`).
+- **`api-integration`** — a **record-replay** pattern for deterministic external-API tests (record real
+  responses with secrets redacted → replay offline → re-record on drift — `google/test-server`).
+
+Catalog:
+
+- **`catalog/mcp.yaml`** — **4 first-party Google Security Operations MCP fragments** (one upstream repo,
+  `google/mcp-security`, Apache-2.0): **secops** (Chronicle SIEM), **gti** (Google Threat Intelligence /
+  VirusTotal), **scc** (Security Command Center / cloud posture), **secops_soar** (SecOps SOAR) — the
+  SOC/operational-security capability domain the catalog had no entry for. Run via pinned `uvx`; each needs
+  a paid Google SecOps backend + ADC and is **referenced, never bundled** (like `sentry`/`repowise`).
+
+What we **did not** add (already covered, or fails the bar): property-based testing (already in
+`test-driven-development` §property-based, 0.38) — the new Fuzzing section builds on it; pre-add dependency
+evaluation (already `library-review` + `dependency-verification`); SBOM/CVE supply-chain (already
+`security-and-hardening`, 0.39/0.50); the dropped shortlist items above.
+
 ## [0.50.0] — 2026-06-28
 
 **Adopt the verified wins from an exhaustive review of the entire `microsoft` GitHub org** (all **8,147**

{claude_code_kit-0.50.0 → claude_code_kit-0.52.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.50.0
+Version: 0.52.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -89,7 +89,7 @@ Quick start) for the full breakdown of any row.
 | 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
 | 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
 | 🛠️ **Hooks & guards** | **17** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
-| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **13** ready MCP fragments, and edit-preserving `upgrade` |
+| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **17** ready MCP fragments, and edit-preserving `upgrade` |
 | ♻️ **Reuse-first by design** | Adopt-only-the-new reviews, opt-in LLM/AI security (OWASP LLM Top 10), a worked example + self-test matrix |
 
 ---
@@ -196,7 +196,7 @@ config — nothing else:
 3. **Backend language** (default: Python) → **backend framework** (default: FastAPI)
 4. **Database** (PostgreSQL · MongoDB)
 5. **SDLC profile** (`lean` · `standard` · `enterprise`)
-6. **Optional MCP integrations** (GitHub · Jira/Linear · Azure DevOps · Postgres/Mongo · Playwright · Docs/MS Learn · Azure · Wassette) — a
+6. **Optional MCP integrations** (GitHub · Jira/Linear · Azure DevOps · Postgres/Mongo · Playwright · Docs/MS Learn · Azure · Wassette · Google SecOps) — a
    project-root `.mcp.json` is written **only** if you select any (env placeholders, never secrets)
 
 Non-interactive equivalents: `--defaults`, or `--config init.yaml` (flat or nested YAML). What lands:
@@ -356,7 +356,7 @@ need.
 - **Two channels, one source** — a first-class Claude Code **plugin** *and* a `pip` scaffolder
   (`claude-kit` / `ckit` / `claude-sdlc`) generate identical config.
 - **Catalog-driven extensibility** — adding a stack, framework, database, profile, MCP server, or org
-  pack is a [`catalog/`](catalog/) YAML edit, never a code change; 13 MCP server fragments ship ready.
+  pack is a [`catalog/`](catalog/) YAML edit, never a code change; 17 MCP server fragments ship ready.
 - **MCP servers are third-party** — each fragment runs an external package or hosted endpoint that
   claude-kit references but does not vendor or audit; the `npx` commands are **pinned to an exact
   version** (not `@latest`) for reproducible, supply-chain-aware installs. Review a server's source and
@@ -518,6 +518,8 @@ non-duplicative gaps**, minimally and catalog-wired.
 | **[alibaba](https://github.com/alibaba) org review** (all 542 repos) | Staged leak-resistant evals; agent-operation authorization; tool-set orchestration + atomic state; agent-run span-tree instrumentation; live-attach debugging | `evals` §7, `agent-guardrails` §5, `tool-design` §8, `goal-setting-and-monitoring` §4, and live-attach debugging in `debugging-and-error-recovery` (from atrex-bench · open-agent-auth · app-controller · loongsuite-js · arthas) | `0.47.0` |
 | **[alibaba/open-code-review](https://github.com/alibaba/open-code-review)** | Partition-for-coverage review — deterministic full-file coverage on large changesets, related-file bundling, plan-before-deep-pass | The "Cover Every Changed File" section in `code-review-and-quality` + a Coverage category in `sdlc-code-reviewer` | `0.48.0` |
 | **[microsoft](https://github.com/microsoft) org review** (all 8,147 repos) | OWASP Agentic Top-10 (ASI01–ASI10) agent threats; agent-aware evals (multi-judge panels, multi-turn degradation, tool-vs-response grading); validator-in-the-loop + Medprompt prompting; sandbox policy schema & layered prompt-injection defense; approval-gate implementation; security-lint layer & SBOM; operationalized GenAI red-teaming; priority-based prompt pruning; quantified-lines PR sizing; first-party MCP servers | Extensions across `agent-guardrails` (ASI01–ASI10 + sandbox policy + injection layers), `evals` (§3 panels, §8 multi-turn), `reasoning-techniques`, `human-in-the-loop`, `linting-and-formatting`, `threat-model`, `security-and-hardening` (SBOM), `context-engineering`, `code-review-and-quality` + 4 MCP fragments (Azure · Azure DevOps · MS Learn · Wassette) — **0 new agents/skills/rules** (from agent-governance-toolkit · mxc · llmail-inject-challenge · lost_in_conversation · llm-as-judge · EvalsforAgentsInterop · promptbase · dsl-copilot · agents-humanoversight · PyRIT · eslint-plugin-sdl · sbom-tool · vscode-prompt-tsx · PullRequestQuantifier) | `0.50.0` |
+| **[google](https://github.com/google) org review** (all 2,881 repos) | Reproducible-build verification & source-level missing-patch detection; secure-by-construction injection defense; archive-extraction & ReDoS hardening; multi-party authorization / breakglass; coverage-guided & continuous fuzzing; parameterized + semantic-equality + parallel/flaky testing; compile-time logic-bug & license-header lint layers + deterministic block sorting; multi-window burn-rate alerting & log rate-limiting; long-document extraction; prompt-as-code; statistical browser benchmarking; durable atomic writes; record-replay API testing; first-party SecOps MCP servers | Prose extensions across `security-and-hardening` (reproducible-build · missing-patch · secure-by-construction · archive · ReDoS), `human-in-the-loop` (MPA/breakglass), `testing` (fuzzing · parameterized · semantic-equality · parallel/flaky), `linting-and-formatting` (logic-bug + license-header layers · block sorting), `devops-observability` (burn-rate · log rate-limit), `context-engineering` (long-doc extraction), `reasoning-techniques` (prompt-as-code), `performance-optimization` (statistical benchmarking), `tool-design` (durable atomic writes), `api-integration` (record-replay) + **4 first-party SecOps MCP fragments** (Chronicle SIEM · GTI · SCC · SOAR) — **0 new agents/skills/rules** (from oss-rebuild · vanir · safe-active-record/mug · safearchive · re2 · building-secure-and-reliable-systems · patrick · go-cmp · atheris/honggfuzz/clusterfuzzlite · gtest-parallel · error-prone · addlicense · keep-sorted · prometheus-slo-burn · flogger · langextract · dotprompt · tachometer · renameio · test-server · mcp-security) | `0.51.0` |
+| **[facebook](https://github.com/facebook) (Meta) org review** (all 168 repos) | Interprocedural taint / data-flow security analysis (source→sink across functions); continuous A/B performance-regression CI gate; defense-in-depth agent-sandbox enforcement (argument validation + OS-level backstop) | Prose extensions to `linting-and-formatting` (taint/data-flow layer), `devops-observability` (perf-regression gate), `agent-guardrails` (§4 layered sandbox enforcement) — **0 new agents/skills/rules** (from pyre-check/Pysa · mariana-trench · FAI-PEP · mcpguard-dynamic; the org is mostly libraries/frameworks, so the verify pass *dropped* the rest — `DNE-TaaC`, `mbt`, plus already-covered `infer`/`mariana-trench`-as-tool, `fbt`, `memlab`, …) | `0.52.0` |
 
 > Each adoption is detailed in the [CHANGELOG](CHANGELOG.md) — including, for every review, what we
 > deliberately **did not** add because the kit already covered it.
@@ -527,23 +529,6 @@ non-duplicative gaps**, minimally and catalog-wired.
 
 <br>
 
-**🧭 alibaba org review → 5 agentic patterns (0.47.0).** We reviewed **all 542 repos** in the Alibaba
-org (survey every repo → deep-dive every candidate → adversarially verify). The overwhelming majority —
-Java middleware, ML/inference, mobile, frontend frameworks — carried nothing transferable to a config
-scaffolder, and the verify pass *dropped* a sixth candidate (`p3c`) as unsubstantiated and already
-covered. Five survived: staged leak-resistant evals (`evals` §7), agent-operation authorization
-(`agent-guardrails` §5), tool-set orchestration + atomic state (`tool-design` §8), agent-run span-tree
-instrumentation (`goal-setting-and-monitoring` §4), and live-attach debugging
-(`debugging-and-error-recovery`).
-
-**🔍 alibaba/open-code-review → coverage-partition review (0.48.0).** A detailed read showed most of its
-methodology (multi-axis review, line-level grounding + re-verify, severity, multi-model) was *already*
-in `code-review-and-quality`. The one genuine gap: **complete file coverage on large changesets** —
-where AI reviewers silently skip files. We added "Cover Every Changed File: Partition, Plan, Then
-Weight Depth" (enumerate from the diff as the checklist of record → bundle related files →
-isolated-context concurrent review → reconcile every file to a verdict), reframing the existing hotspot
-guidance as the *depth* step that follows coverage.
-
 **🟦 microsoft org review → agentic-AI hardening (0.50.0).** We reviewed **all 8,147 repos** in the
 Microsoft org (165 survey agents over every page → deep-dive the top candidates → adversarially verify
 the shortlist). The vast majority — SDKs, samples, Azure-product code, ML infra, OS/editor — carried
@@ -559,6 +544,42 @@ panels in §3, multi-turn degradation in §8) in `evals`; validator-in-the-loop
 sizing in `code-review-and-quality`; and **4 first-party MCP fragments** (Azure · Azure DevOps · MS
 Learn · Wassette).
 
+**🔴 google org review → 21 hardening & testing patterns (0.51.0).** We reviewed **all 2,881 repos** in
+the Google org (60 survey agents over every page → deep-dive the top ~300 candidates → adversarially
+verify the shortlist). The vast majority — Android/Kotlin, C++ libraries, ML frameworks, language
+runtimes, GCP product code — carried nothing transferable, and the verify pass *dropped* a third of the
+shortlist: `deps.dev` (a REST/gRPC API, **not** an MCP server, despite the claim), `licensecheck`
+(license *classification*, not the claimed compatibility gate), the Go/Rust/C++-locked tools
+(`capslock`, `rust-crate-audits`, `fuzztest`, `libprotobuf-mutator` — can't be re-derived stack-agnostic),
+`sqlcommenter` (archived → donated to OpenTelemetry), and `ax` (too early — "major breaking changes
+prior to stable"). The survivors are **all prose extensions to existing files, zero new
+agents/skills/rules**: reproducible-build verification, source-level missing-patch detection,
+secure-by-construction injection defense, archive-extraction & ReDoS hardening in `security-and-hardening`;
+multi-party authorization / breakglass in `human-in-the-loop`; coverage-guided & continuous fuzzing,
+parameterized, semantic-equality, and parallel/flaky testing in `testing`; compile-time logic-bug &
+license-header lint layers plus deterministic block sorting in `linting-and-formatting`; multi-window
+burn-rate alerting & log rate-limiting in `devops-observability`; long-document extraction in
+`context-engineering`; prompt-as-code in `reasoning-techniques`; statistical browser benchmarking in
+`performance-optimization`; durable atomic writes in `tool-design`; record-replay API testing in
+`api-integration`; and **4 first-party Google Security Operations MCP fragments** (Chronicle SIEM · GTI ·
+SCC · SOAR).
+
+**🔵 facebook (Meta) org review → 3 hardening & reliability patterns (0.52.0).** We reviewed **all 168
+repos** in the Meta org (Meta long ago spun React, PyTorch, Jest, etc. into their own orgs, so the
+`facebook` org is small). The org is almost entirely libraries, frameworks, and language tooling with
+nothing transferable to a config scaffolder — and several famous repos were **already covered** (e.g.
+`infer` by the 0.51 compile-time-logic-bug lint layer; React by the kit's React overlay; testing by an
+already-deep `testing.md`). The verify pass *dropped* the weak picks: `DNE-TaaC` (datacenter
+network-device testing, 1★, overlaps the config-driven skills) and `mbt` (a 0★ Meta-service-specific
+binary-transparency client — that practice belongs to Sigstore/Certificate-Transparency, not this org).
+Three genuine, stack-agnostic survivors, all **prose extensions, zero new agents/skills/rules**:
+**interprocedural taint / data-flow analysis** (declare sources/sinks/sanitizers, trace untrusted data
+across functions — distinct from single-line lint) in `linting-and-formatting` (from Pysa/`pyre-check` +
+`mariana-trench`); a **continuous A/B performance-regression CI gate** (concurrent control vs treatment
+to cancel environment noise, gate on the relative delta) in `devops-observability` (from `FAI-PEP`); and
+**defense-in-depth agent-sandbox enforcement** (argument-validation layer + OS-level eBPF/seccomp backstop
+*below* the existing declarative policy) in `agent-guardrails` §4 (from `mcpguard-dynamic`).
+
 </details>
 
 > **Comparing claude-kit to native subagents / Agent Teams, agent collections, spec-kit, or

{claude_code_kit-0.50.0 → claude_code_kit-0.52.0}/README.md

@@ -59,7 +59,7 @@ Quick start) for the full breakdown of any row.
 | 🎚️ **Profiles, scopes & org** | **3** rigor profiles · **3** scopes · **5** autonomy levels · **7** org packs + **10** policy rules |
 | 🧠 **Memory & learning** | Working memory across context compaction + a cost-aware learnings loop (`capture_mode`) so the same mistake isn't repeated |
 | 🛠️ **Hooks & guards** | **17** event hooks — blocking safety guards vs. advisory warnings — that no-op gracefully without `jq` |
-| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **13** ready MCP fragments, and edit-preserving `upgrade` |
+| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **17** ready MCP fragments, and edit-preserving `upgrade` |
 | ♻️ **Reuse-first by design** | Adopt-only-the-new reviews, opt-in LLM/AI security (OWASP LLM Top 10), a worked example + self-test matrix |
 
 ---
@@ -166,7 +166,7 @@ config — nothing else:
 3. **Backend language** (default: Python) → **backend framework** (default: FastAPI)
 4. **Database** (PostgreSQL · MongoDB)
 5. **SDLC profile** (`lean` · `standard` · `enterprise`)
-6. **Optional MCP integrations** (GitHub · Jira/Linear · Azure DevOps · Postgres/Mongo · Playwright · Docs/MS Learn · Azure · Wassette) — a
+6. **Optional MCP integrations** (GitHub · Jira/Linear · Azure DevOps · Postgres/Mongo · Playwright · Docs/MS Learn · Azure · Wassette · Google SecOps) — a
    project-root `.mcp.json` is written **only** if you select any (env placeholders, never secrets)
 
 Non-interactive equivalents: `--defaults`, or `--config init.yaml` (flat or nested YAML). What lands:
@@ -326,7 +326,7 @@ need.
 - **Two channels, one source** — a first-class Claude Code **plugin** *and* a `pip` scaffolder
   (`claude-kit` / `ckit` / `claude-sdlc`) generate identical config.
 - **Catalog-driven extensibility** — adding a stack, framework, database, profile, MCP server, or org
-  pack is a [`catalog/`](catalog/) YAML edit, never a code change; 13 MCP server fragments ship ready.
+  pack is a [`catalog/`](catalog/) YAML edit, never a code change; 17 MCP server fragments ship ready.
 - **MCP servers are third-party** — each fragment runs an external package or hosted endpoint that
   claude-kit references but does not vendor or audit; the `npx` commands are **pinned to an exact
   version** (not `@latest`) for reproducible, supply-chain-aware installs. Review a server's source and
@@ -488,6 +488,8 @@ non-duplicative gaps**, minimally and catalog-wired.
 | **[alibaba](https://github.com/alibaba) org review** (all 542 repos) | Staged leak-resistant evals; agent-operation authorization; tool-set orchestration + atomic state; agent-run span-tree instrumentation; live-attach debugging | `evals` §7, `agent-guardrails` §5, `tool-design` §8, `goal-setting-and-monitoring` §4, and live-attach debugging in `debugging-and-error-recovery` (from atrex-bench · open-agent-auth · app-controller · loongsuite-js · arthas) | `0.47.0` |
 | **[alibaba/open-code-review](https://github.com/alibaba/open-code-review)** | Partition-for-coverage review — deterministic full-file coverage on large changesets, related-file bundling, plan-before-deep-pass | The "Cover Every Changed File" section in `code-review-and-quality` + a Coverage category in `sdlc-code-reviewer` | `0.48.0` |
 | **[microsoft](https://github.com/microsoft) org review** (all 8,147 repos) | OWASP Agentic Top-10 (ASI01–ASI10) agent threats; agent-aware evals (multi-judge panels, multi-turn degradation, tool-vs-response grading); validator-in-the-loop + Medprompt prompting; sandbox policy schema & layered prompt-injection defense; approval-gate implementation; security-lint layer & SBOM; operationalized GenAI red-teaming; priority-based prompt pruning; quantified-lines PR sizing; first-party MCP servers | Extensions across `agent-guardrails` (ASI01–ASI10 + sandbox policy + injection layers), `evals` (§3 panels, §8 multi-turn), `reasoning-techniques`, `human-in-the-loop`, `linting-and-formatting`, `threat-model`, `security-and-hardening` (SBOM), `context-engineering`, `code-review-and-quality` + 4 MCP fragments (Azure · Azure DevOps · MS Learn · Wassette) — **0 new agents/skills/rules** (from agent-governance-toolkit · mxc · llmail-inject-challenge · lost_in_conversation · llm-as-judge · EvalsforAgentsInterop · promptbase · dsl-copilot · agents-humanoversight · PyRIT · eslint-plugin-sdl · sbom-tool · vscode-prompt-tsx · PullRequestQuantifier) | `0.50.0` |
+| **[google](https://github.com/google) org review** (all 2,881 repos) | Reproducible-build verification & source-level missing-patch detection; secure-by-construction injection defense; archive-extraction & ReDoS hardening; multi-party authorization / breakglass; coverage-guided & continuous fuzzing; parameterized + semantic-equality + parallel/flaky testing; compile-time logic-bug & license-header lint layers + deterministic block sorting; multi-window burn-rate alerting & log rate-limiting; long-document extraction; prompt-as-code; statistical browser benchmarking; durable atomic writes; record-replay API testing; first-party SecOps MCP servers | Prose extensions across `security-and-hardening` (reproducible-build · missing-patch · secure-by-construction · archive · ReDoS), `human-in-the-loop` (MPA/breakglass), `testing` (fuzzing · parameterized · semantic-equality · parallel/flaky), `linting-and-formatting` (logic-bug + license-header layers · block sorting), `devops-observability` (burn-rate · log rate-limit), `context-engineering` (long-doc extraction), `reasoning-techniques` (prompt-as-code), `performance-optimization` (statistical benchmarking), `tool-design` (durable atomic writes), `api-integration` (record-replay) + **4 first-party SecOps MCP fragments** (Chronicle SIEM · GTI · SCC · SOAR) — **0 new agents/skills/rules** (from oss-rebuild · vanir · safe-active-record/mug · safearchive · re2 · building-secure-and-reliable-systems · patrick · go-cmp · atheris/honggfuzz/clusterfuzzlite · gtest-parallel · error-prone · addlicense · keep-sorted · prometheus-slo-burn · flogger · langextract · dotprompt · tachometer · renameio · test-server · mcp-security) | `0.51.0` |
+| **[facebook](https://github.com/facebook) (Meta) org review** (all 168 repos) | Interprocedural taint / data-flow security analysis (source→sink across functions); continuous A/B performance-regression CI gate; defense-in-depth agent-sandbox enforcement (argument validation + OS-level backstop) | Prose extensions to `linting-and-formatting` (taint/data-flow layer), `devops-observability` (perf-regression gate), `agent-guardrails` (§4 layered sandbox enforcement) — **0 new agents/skills/rules** (from pyre-check/Pysa · mariana-trench · FAI-PEP · mcpguard-dynamic; the org is mostly libraries/frameworks, so the verify pass *dropped* the rest — `DNE-TaaC`, `mbt`, plus already-covered `infer`/`mariana-trench`-as-tool, `fbt`, `memlab`, …) | `0.52.0` |
 
 > Each adoption is detailed in the [CHANGELOG](CHANGELOG.md) — including, for every review, what we
 > deliberately **did not** add because the kit already covered it.
@@ -497,23 +499,6 @@ non-duplicative gaps**, minimally and catalog-wired.
 
 <br>
 
-**🧭 alibaba org review → 5 agentic patterns (0.47.0).** We reviewed **all 542 repos** in the Alibaba
-org (survey every repo → deep-dive every candidate → adversarially verify). The overwhelming majority —
-Java middleware, ML/inference, mobile, frontend frameworks — carried nothing transferable to a config
-scaffolder, and the verify pass *dropped* a sixth candidate (`p3c`) as unsubstantiated and already
-covered. Five survived: staged leak-resistant evals (`evals` §7), agent-operation authorization
-(`agent-guardrails` §5), tool-set orchestration + atomic state (`tool-design` §8), agent-run span-tree
-instrumentation (`goal-setting-and-monitoring` §4), and live-attach debugging
-(`debugging-and-error-recovery`).
-
-**🔍 alibaba/open-code-review → coverage-partition review (0.48.0).** A detailed read showed most of its
-methodology (multi-axis review, line-level grounding + re-verify, severity, multi-model) was *already*
-in `code-review-and-quality`. The one genuine gap: **complete file coverage on large changesets** —
-where AI reviewers silently skip files. We added "Cover Every Changed File: Partition, Plan, Then
-Weight Depth" (enumerate from the diff as the checklist of record → bundle related files →
-isolated-context concurrent review → reconcile every file to a verdict), reframing the existing hotspot
-guidance as the *depth* step that follows coverage.
-
 **🟦 microsoft org review → agentic-AI hardening (0.50.0).** We reviewed **all 8,147 repos** in the
 Microsoft org (165 survey agents over every page → deep-dive the top candidates → adversarially verify
 the shortlist). The vast majority — SDKs, samples, Azure-product code, ML infra, OS/editor — carried
@@ -529,6 +514,42 @@ panels in §3, multi-turn degradation in §8) in `evals`; validator-in-the-loop
 sizing in `code-review-and-quality`; and **4 first-party MCP fragments** (Azure · Azure DevOps · MS
 Learn · Wassette).
 
+**🔴 google org review → 21 hardening & testing patterns (0.51.0).** We reviewed **all 2,881 repos** in
+the Google org (60 survey agents over every page → deep-dive the top ~300 candidates → adversarially
+verify the shortlist). The vast majority — Android/Kotlin, C++ libraries, ML frameworks, language
+runtimes, GCP product code — carried nothing transferable, and the verify pass *dropped* a third of the
+shortlist: `deps.dev` (a REST/gRPC API, **not** an MCP server, despite the claim), `licensecheck`
+(license *classification*, not the claimed compatibility gate), the Go/Rust/C++-locked tools
+(`capslock`, `rust-crate-audits`, `fuzztest`, `libprotobuf-mutator` — can't be re-derived stack-agnostic),
+`sqlcommenter` (archived → donated to OpenTelemetry), and `ax` (too early — "major breaking changes
+prior to stable"). The survivors are **all prose extensions to existing files, zero new
+agents/skills/rules**: reproducible-build verification, source-level missing-patch detection,
+secure-by-construction injection defense, archive-extraction & ReDoS hardening in `security-and-hardening`;
+multi-party authorization / breakglass in `human-in-the-loop`; coverage-guided & continuous fuzzing,
+parameterized, semantic-equality, and parallel/flaky testing in `testing`; compile-time logic-bug &
+license-header lint layers plus deterministic block sorting in `linting-and-formatting`; multi-window
+burn-rate alerting & log rate-limiting in `devops-observability`; long-document extraction in
+`context-engineering`; prompt-as-code in `reasoning-techniques`; statistical browser benchmarking in
+`performance-optimization`; durable atomic writes in `tool-design`; record-replay API testing in
+`api-integration`; and **4 first-party Google Security Operations MCP fragments** (Chronicle SIEM · GTI ·
+SCC · SOAR).
+
+**🔵 facebook (Meta) org review → 3 hardening & reliability patterns (0.52.0).** We reviewed **all 168
+repos** in the Meta org (Meta long ago spun React, PyTorch, Jest, etc. into their own orgs, so the
+`facebook` org is small). The org is almost entirely libraries, frameworks, and language tooling with
+nothing transferable to a config scaffolder — and several famous repos were **already covered** (e.g.
+`infer` by the 0.51 compile-time-logic-bug lint layer; React by the kit's React overlay; testing by an
+already-deep `testing.md`). The verify pass *dropped* the weak picks: `DNE-TaaC` (datacenter
+network-device testing, 1★, overlaps the config-driven skills) and `mbt` (a 0★ Meta-service-specific
+binary-transparency client — that practice belongs to Sigstore/Certificate-Transparency, not this org).
+Three genuine, stack-agnostic survivors, all **prose extensions, zero new agents/skills/rules**:
+**interprocedural taint / data-flow analysis** (declare sources/sinks/sanitizers, trace untrusted data
+across functions — distinct from single-line lint) in `linting-and-formatting` (from Pysa/`pyre-check` +
+`mariana-trench`); a **continuous A/B performance-regression CI gate** (concurrent control vs treatment
+to cancel environment noise, gate on the relative delta) in `devops-observability` (from `FAI-PEP`); and
+**defense-in-depth agent-sandbox enforcement** (argument-validation layer + OS-level eBPF/seccomp backstop
+*below* the existing declarative policy) in `agent-guardrails` §4 (from `mcpguard-dynamic`).
+
 </details>
 
 > **Comparing claude-kit to native subagents / Agent Teams, agent collections, spec-kit, or

{claude_code_kit-0.50.0 → claude_code_kit-0.52.0}/catalog/mcp.yaml

@@ -138,3 +138,49 @@ servers:
       type: stdio
       command: repowise
       args: ["mcp", "${REPOWISE_PROJECT_ROOT}", "--transport", "stdio"]
+  # Google Security Operations cluster (github.com/google/mcp-security, Apache-2.0) — four first-party
+  # Google MCP servers covering the SOC/operational-security domain the catalog otherwise has no entry
+  # for (Sentry above is error-monitoring, not threat-intel/SIEM/SOAR/CSPM):
+  #   • secops      — Chronicle SIEM: search/UDM events, detections, IoC matches, case context
+  #   • gti         — Google Threat Intelligence (VirusTotal): file/URL/domain/IP reputation & relationships
+  #   • scc         — Security Command Center: cloud-security posture, findings, asset risk
+  #   • secops_soar — SecOps SOAR (Siemplify): cases, playbooks, response actions
+  # These are Python servers run with `uvx` (install `uv` first: https://docs.astral.sh/uv/), pinned to
+  # exact PyPI versions (snapshot 2026-06-28; do not float). NOT bundled — claude-kit only references
+  # them. Each needs a PAID Google SecOps/Chronicle (or VirusTotal) backend and its own credentials —
+  # auth is via Application Default Credentials (`gcloud auth application-default login`, or a
+  # GOOGLE_APPLICATION_CREDENTIALS service-account file) plus the per-server env vars below; no
+  # credentials are generated here. Enable only the server(s) whose backend you actually have.
+  secops:
+    label: "Google SecOps / Chronicle SIEM (paid Chronicle backend + ADC required)"
+    config:
+      type: stdio
+      command: uvx
+      args: ["--from", "google-secops-mcp==0.7.0", "secops_mcp"]
+      env:
+        CHRONICLE_PROJECT_ID: "${CHRONICLE_PROJECT_ID}"
+        CHRONICLE_CUSTOMER_ID: "${CHRONICLE_CUSTOMER_ID}"
+        CHRONICLE_REGION: "${CHRONICLE_REGION}"
+  gti:
+    label: "Google Threat Intelligence / VirusTotal (needs VT_APIKEY)"
+    config:
+      type: stdio
+      command: uvx
+      args: ["--from", "gti-mcp==0.1.2", "gti_mcp"]
+      env:
+        VT_APIKEY: "${VT_APIKEY}"
+  scc:
+    label: "Security Command Center — cloud security posture (ADC required)"
+    config:
+      type: stdio
+      command: uvx
+      args: ["--from", "scc-mcp==0.1.0", "scc_mcp"]
+  secops_soar:
+    label: "Google SecOps SOAR / Siemplify (paid SOAR backend; needs SOAR_URL + SOAR_APP_KEY)"
+    config:
+      type: stdio
+      command: uvx
+      args: ["--from", "secops-soar-mcp==0.1.1", "secops_soar_mcp"]
+      env:
+        SOAR_URL: "${SOAR_URL}"
+        SOAR_APP_KEY: "${SOAR_APP_KEY}"

{claude_code_kit-0.50.0 → claude_code_kit-0.52.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.50.0"
+version = "0.52.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.50.0 → claude_code_kit-0.52.0}/rules/agent-guardrails.md

@@ -125,6 +125,28 @@ agent on a broken foundation.* Before worrying about prompt injection, enforce t
 
   A ready WASM-sandboxed execution runtime ships as the optional `wassette` MCP server in
   `catalog/mcp.yaml` for projects that want an off-the-shelf containment backend.
+- **Enforce the policy in independent layers (defense in depth).** A declarative policy is necessary but
+  not sufficient: a misbehaving or compromised tool/MCP server can ignore an *advisory* policy, or smuggle
+  a forbidden action past it. So a high-risk tool call (especially one invoking an untrusted MCP server)
+  should pass **three independent checks**, each of which fails closed on its own:
+  - **L1 — policy decision.** The declarative policy above decides *is this call allowed at all* (which
+    tool, which scopes) before it runs.
+  - **L2 — argument validation at the boundary.** Validate the call's *arguments* against the policy:
+    **canonicalize** paths and resolve symlinks before the allow-check (so `../` and a symlinked path
+    can't escape an allowed prefix — mirrors the archive/path-traversal rule in `security-and-hardening`),
+    screen arguments for injection, and sanitize the tool's *response* before it re-enters the model
+    (it is untrusted content — §1).
+  - **L3 — runtime enforcement backstop.** Enforce the same scopes at the OS/runtime level —
+    seccomp / eBPF-LSM / container or microVM limits that intercept the actual `open`/`connect`/`exec`
+    syscalls — so a tool that ignored or hardcoded around L1/L2 *still* cannot touch a denied path,
+    host, or process. The backstop assumes the layers above it can be bypassed.
+
+  Log every denial to the §5 audit trail; an operator override is itself a scoped, audited action.
+
+  > Stack-agnostic adaptation of layered (defense-in-depth) MCP/agent tool-call sandboxing — declarative
+  > capability policy + argument-level validation + OS-level (eBPF-LSM/seccomp) enforcement backstop —
+  > from the MIT [`facebook/mcpguard-dynamic`](https://github.com/facebook/mcpguard-dynamic). Re-derived
+  > in prose; not vendored.
 - **Audit dependencies; don't auto-trust the ecosystem.** Treat third-party packages, MCP servers, and
   marketplace plugins as untrusted until reviewed — installing one grants it your agent's privileges.
 

claude_code_kit-0.52.0/rules/devops-observability.md

@@ -0,0 +1,123 @@
+# DevOps & Observability Phases
+
+Two delivery-side phases that run **after** the test-coverage merge gate (MR3 VERIFIED) and **before** the PR Raiser, so that pipeline and observability artifacts ship *inside* the same PR as the code. They are owned by dedicated agents and each has its own quality gate.
+
+```
+... MR3 (test coverage VERIFIED)
+      -> [DevOps]        devops-engineer        -> Gate: Pipeline Green
+      -> [Observability] observability-engineer -> Gate: Observability Ready
+      -> PR Raiser
+```
+
+## When these phases run (conditional)
+
+Run them when the change touches a **deployable or observable surface**:
+- a new/changed endpoint, service, container, dependency, env var, port, or migration;
+- anything that adds a user-facing critical path worth an SLO or an alert.
+
+**Skip (note in CONTINUITY.md why)** for pure-internal changes with no deployment or observability surface — a refactor behind an unchanged interface, a copy tweak, a test-only change. Fast-track (Mode D) skips both unless infra/observability is the actual subject of the fix.
+
+---
+
+## Phase: DevOps  ·  Agent: `devops-engineer`  ·  Gate: **Pipeline Green**
+
+Owns the infra seam (containerization, orchestration, migrations-at-boot, ports, CORS, env). For a feature, it ensures the change is **buildable and deployable**, not just runnable on the author's machine.
+
+**Pipeline Green passes when:**
+- [ ] CI config is valid and includes lint + type-check + unit tests for the changed stack(s) (CI pipeline config files — editing those requires user approval per CLAUDE.md).
+- [ ] Container orchestration config resolves; a clean rebuild and restart brings all services up **healthy**.
+- [ ] New env vars are in the project's settings/config, orchestration config, `.env.example`, and the README table.
+- [ ] Migrations (if applicable) apply cleanly at boot and have a working rollback/downgrade.
+- [ ] A short **runbook** entry exists for anything operationally new (how to deploy it, how to roll it back).
+- [ ] No secrets committed; ports/CORS changes reflected in README.
+
+Findings classified by `.claude/rules/quality-gates.md` severity; Critical/High/Medium block.
+
+---
+
+## Phase: Observability  ·  Agent: `observability-engineer`  ·  Gate: **Observability Ready**
+
+Ensures the feature is **operable in production**: you can tell when it breaks and why. Builds on the project's existing health endpoints and structured logging.
+
+**Observability Ready passes when:**
+- [ ] **SLOs/SLIs** defined for each critical user journey the feature adds (e.g., "p95 endpoint latency < 200ms", "login success rate ≥ 99.5%").
+- [ ] **Load verified against the SLO** — for a change to a hot / SLO-bearing backend path, an empirical load run (drive `.claude/skills/load-testing`) was executed against the defined SLO and **met** its p95/p99 latency + error-rate + throughput budgets; record it under `docs/performance/` and link it from the feature SLO doc. *Skip (note why in `CONTINUITY.md`) for changes with no concurrency-sensitive surface.* A budget breach is **High** (`.claude/rules/quality-gates.md`).
+- [ ] **Health/readiness** — any new external dependency (database, cache, third-party service) is reflected in the readiness check; liveness stays dependency-free.
+- [ ] **Structured logging** — new state changes log via the project's structured logger as JSON key-values, semantic event names, **no secrets/PII**; error paths log at `error`/`exception` level.
+- [ ] **Alerts** — alert rules defined for the feature's failure modes (error-rate spike, latency breach, dependency down) with a severity and an owner.
+- [ ] **Traceability** — correlation/request id flows through new code paths where the stack supports it.
+
+Findings classified by `.claude/rules/quality-gates.md` severity; Critical/High/Medium block.
+
+### Multi-window burn-rate alerting (alert on the error budget, not raw error rate)
+
+A static "error rate > X%" alert forces a bad trade-off: tight enough to catch a real outage means it
+pages on every transient blip; loose enough to be quiet means slow burns go unnoticed until the budget
+is gone. The SRE pattern is to alert on **how fast the SLO's error budget is burning**, across
+**multiple time windows** at once:
+
+- **Burn rate = (observed error ratio) ÷ (1 − SLO target).** A burn rate of 1 exactly exhausts the
+  budget over the SLO window; 14.4 exhausts it in ~2 % of the window.
+- **Fast-burn (page):** a high burn rate confirmed over a **short *and* a medium** window (e.g. 14.4×
+  over 1h **and** 5m) — catches acute outages fast while the second window suppresses single-spike
+  false positives.
+- **Slow-burn (ticket, not page):** a lower burn rate over **longer** windows (e.g. 6× over 6h/30m,
+  3× over 24h/2h, 1× over 3d/6h) — catches a steady leak that would otherwise quietly drain the budget.
+- Require **both** windows of a tier to fire (the long window detects, the short window confirms it's
+  still happening) so an alert clears quickly once the issue stops. Tie each tier's severity/owner to
+  the "Alerts" gate item above.
+
+> Stack-agnostic adaptation of multi-window, multi-burn-rate SLO alerting (per the Google SRE Workbook)
+> from the Apache-2.0
+> [`google/prometheus-slo-burn-example`](https://github.com/google/prometheus-slo-burn-example).
+> Re-derived in prose; not vendored — the windows/multipliers are a starting point to tune per SLO.
+
+### High-volume logging: rate-limit and defer
+
+Logging on a hot path or in an error burst can become its own incident — the log call dominates CPU, or
+a flood of identical lines buries the signal and runs up ingestion cost. Two patterns keep logging cheap
+under load:
+
+- **Rate-limit repetitive log statements at the call site** — emit "at most every N seconds" or "1 in
+  every N" for a given line, rather than once per iteration, so a tight loop or a sustained error
+  doesn't flood. (Aggregate the suppressed count so you still know the true volume.)
+- **Defer the cost of expensive log arguments** until logging is *known to be enabled* at that level —
+  pass a lazily-evaluated value (a thunk/lambda), not an eagerly-built expensive string, so a disabled
+  `debug` log costs nothing. This pairs with the "no secrets/PII" structured-logging gate item above.
+
+> Stack-agnostic adaptation of log rate-limiting (`atMostEvery`) and lazy argument evaluation from the
+> Apache-2.0 [`google/flogger`](https://github.com/google/flogger). Re-derived in prose; not vendored —
+> the patterns apply to any logging framework.
+
+### Continuous performance-regression gate (A/B, not absolute thresholds)
+
+The Load-vs-SLO gate above is a *one-shot, pre-launch* check against an absolute budget. It won't catch a
+**gradual** regression — a change that quietly adds 15 ms per release until the SLO is blown six PRs
+later. For a hot / SLO-bearing path, add a **continuous** check that compares *this commit to a baseline*
+on every change:
+
+- **A/B the two commits to cancel environmental noise.** A single absolute number ("p95 = 210 ms") is
+  dominated by CI-runner variance, thermal throttling, and noisy neighbors — comparing today's run to
+  last week's run measures the *environment*, not the *code*. Instead run **control (baseline commit) and
+  treatment (the PR's commit) on the same machine, interleaved/concurrently**, and report the **relative
+  delta** (latency ratio, throughput delta), which cancels the shared environmental component.
+- **Gate on the delta, with a tolerance band.** Fail the check when the treatment is worse than control
+  by more than a stated margin (e.g. ">5 % p95 latency"); a band absorbs residual noise so the gate
+  isn't flaky. A breach is **High** (`.claude/rules/quality-gates.md`) — same severity as a Load-vs-SLO
+  breach — and routes the fix back to the dev lane.
+- **Scope it.** Run it for changes to a concurrency-sensitive or SLO-bearing path; *skip (note why in
+  `CONTINUITY.md`)* for changes with no performance surface. It complements, not replaces, the one-shot
+  Load-vs-SLO gate (absolute budget at launch) and frontend statistical benchmarking
+  (`.claude/skills/performance-optimization`).
+
+> Stack-agnostic adaptation of A/B continuous performance-regression detection (concurrent
+> control/treatment runs to isolate code from environment; gate on the relative delta) from the
+> Apache-2.0 [`facebook/FAI-PEP`](https://github.com/facebook/FAI-PEP). Re-derived in prose; not vendored.
+
+---
+
+## Notes
+
+- Both agents follow the **RARV cycle** (`.claude/rules/rarv-cycle.md`) and update `CONTINUITY.md` at handoff.
+- Neither agent writes application business logic — they own infra and operability only. Logic gaps go back to the relevant dev lane.
+- Editing CI pipeline config, package manifests, or other project-wide files still requires explicit user approval (CLAUDE.md §"Files that require user approval").

{claude_code_kit-0.50.0 → claude_code_kit-0.52.0}/rules/human-in-the-loop.md

@@ -65,6 +65,38 @@ pause for a human — so the pause is enforced by the system, not left to the ag
 > [`microsoft/agents-humanoversight`](https://github.com/microsoft/agents-humanoversight). Re-derived in
 > prose; not vendored.
 
+## Multi-party authorization for the highest-stakes actions (MPA · breakglass)
+
+For most stops a *single* human approval is right. But the most dangerous actions — deleting production
+data, changing access control, deploying to a regulated system, rotating root credentials — should not
+be unlockable by **one** person (or one person + a coerced/compromised agent). Raise the bar past a
+single gate:
+
+- **Multi-party authorization (MPA): require two.** A high-stakes action needs a *second independent
+  approver* who is not the requester — the "two-person rule." Beyond stopping a single bad actor, it
+  forces the requester to articulate the action clearly enough that a peer will sign it, which catches
+  honest mistakes. Make the second approval a real review (the approver sees *what* will run), not a
+  rubber stamp.
+- **Bind approval to context, not just identity.** Stronger still: tie sensitive operations to a
+  trusted device/role/environment, so an approval also proves *where* and *how* it was given — not only
+  *who* gave it. (The principle behind "multi-factor / multi-channel" authorization: don't let one
+  stolen credential be sufficient.)
+- **Breakglass, with auditing.** Keep a deliberate emergency override for when the normal path is down
+  (the on-call can't reach a second approver during an incident) — but make it *loud*: it requires a
+  written justification, it is heavily logged, and it triggers a **mandatory after-the-fact review**.
+  Breakglass is an exception that must be accounted for, never a quiet bypass.
+- **Least privilege + separation of duties make MPA affordable.** The fewer actions that *need* two
+  approvers, the more meaningful each one is. Reserve MPA for genuinely irreversible / high-blast-radius
+  operations (see reversibility below); don't dilute it across routine changes.
+
+These map onto the gate mechanics above: MPA is "the declarative gate, but the policy requires N≥2
+distinct approvals," and breakglass is "the timeout/absence path, made auditable instead of fail-open."
+
+> Stack-agnostic adaptation of multi-party / multi-factor authorization, breakglass-with-auditing, and
+> separation-of-duties from *Building Secure & Reliable Systems* (Google/O'Reilly, CC-BY-4.0;
+> [`google/building-secure-and-reliable-systems`](https://github.com/google/building-secure-and-reliable-systems)),
+> Ch. 5 ("Design for Least Privilege") & Ch. 21. Concept-only (CC-BY); re-derived in prose, not vendored.
+
 ## Gate the depth of review to reversibility
 
 Not every stop deserves the same ceremony. Before a consequential decision, classify it by how hard it