claude-code-kit 0.51.0__tar.gz → 0.52.0__tar.gz

{claude_code_kit-0.51.0 → claude_code_kit-0.52.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.51.0",
+      "version": "0.52.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.51.0 → claude_code_kit-0.52.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.51.0",
+  "version": "0.52.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.51.0 → claude_code_kit-0.52.0}/CHANGELOG.md

@@ -4,6 +4,47 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.52.0] — 2026-06-28
+
+**Adopt the verified wins from an exhaustive review of the entire `facebook` (Meta) GitHub org** (all
+**168** repos — Meta long ago spun React, PyTorch, Jest, etc. into dedicated orgs, so the `facebook` org
+itself is small). Every repo was surveyed (7 agents over every page — no repo skipped), candidates
+deep-read for license + transferable practice, and the shortlist **adversarially verified** against the
+live source. The org is almost entirely libraries/frameworks/language-tooling with nothing transferable
+to a config scaffolder, and several famous repos were **already covered** (`infer` by the 0.51
+compile-time-logic-bug lint layer; React by the kit's React overlay; testing by an already-deep
+`testing.md`). The verify pass *dropped* the weak picks — `DNE-TaaC` (datacenter network-device testing,
+1★, overlaps the config-driven skills) and `mbt` (a 0★ Meta-service-specific binary-transparency client;
+that practice belongs to Sigstore/Certificate-Transparency, not this org). **3 adoptions, all extensions
+to existing rules — 0 new agents/skills/rules** (skill counts unchanged at 104/56/48; MCP fragments
+unchanged at 17). All sources MIT / Apache-2.0.
+
+Rules:
+
+- **`linting-and-formatting.md`** — a new **Interprocedural Taint / Data-Flow Analysis** layer: declare
+  untrusted **sources**, dangerous **sinks**, and **sanitizers**, then trace data flow *across function
+  boundaries* and flag any unsanitized source→sink path — distinct from the single-line Security-Lint
+  layer and the Compile-Time Logic-Bug layer, and the automated codebase-wide complement to
+  `security-and-hardening`'s secure-by-construction wrappers (from the MIT `facebook/pyre-check`/Pysa and
+  `facebook/mariana-trench`; engines: Pysa/Mariana Trench/CodeQL/Semgrep).
+- **`devops-observability.md`** — a **continuous performance-regression CI gate**: run the baseline
+  (control) and the PR commit (treatment) **concurrently on the same machine** to cancel environmental
+  variance, and gate on the **relative delta** (with a tolerance band) rather than an absolute number —
+  catching the gradual regressions the one-shot Load-vs-SLO gate misses (from the Apache-2.0
+  `facebook/FAI-PEP`).
+- **`agent-guardrails.md`** — extended §4's sandbox **policy** with **defense-in-depth enforcement**:
+  L1 policy decision (existing) + L2 argument validation at the boundary (path canonicalization,
+  injection screening, response sanitization) + L3 OS-level runtime backstop (eBPF-LSM/seccomp
+  intercepting `open`/`connect`/`exec`) so a tool that ignores the declarative policy still cannot escape
+  scope (from the MIT `facebook/mcpguard-dynamic`).
+
+What we **did not** add (already covered, or fails the bar): `infer`/`mariana-trench`-as-a-tool and
+`sapp` (the kit's compile-time-logic-bug + new taint layer cover the discipline); `fbt` i18n (JS-specific,
+archived); `memlab` (JS-only heap analysis); `Ax` (ML hyperparameter optimization, a library);
+`chef-cookbooks`/`IT-CPE`/`taste-tester` (Chef IaC / IT fleet management); `ThreatExchange`/`threat-research`
+(content-moderation / CTI data, out of SDLC scope); `akd`/`private_processing` (domain-specific crypto
+libraries); plus the dropped `DNE-TaaC` and `mbt`.
+
 ## [0.51.0] — 2026-06-28
 
 **Adopt the verified wins from an exhaustive review of the entire `google` GitHub org** (all **2,881**

{claude_code_kit-0.51.0 → claude_code_kit-0.52.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.51.0
+Version: 0.52.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -519,6 +519,7 @@ non-duplicative gaps**, minimally and catalog-wired.
 | **[alibaba/open-code-review](https://github.com/alibaba/open-code-review)** | Partition-for-coverage review — deterministic full-file coverage on large changesets, related-file bundling, plan-before-deep-pass | The "Cover Every Changed File" section in `code-review-and-quality` + a Coverage category in `sdlc-code-reviewer` | `0.48.0` |
 | **[microsoft](https://github.com/microsoft) org review** (all 8,147 repos) | OWASP Agentic Top-10 (ASI01–ASI10) agent threats; agent-aware evals (multi-judge panels, multi-turn degradation, tool-vs-response grading); validator-in-the-loop + Medprompt prompting; sandbox policy schema & layered prompt-injection defense; approval-gate implementation; security-lint layer & SBOM; operationalized GenAI red-teaming; priority-based prompt pruning; quantified-lines PR sizing; first-party MCP servers | Extensions across `agent-guardrails` (ASI01–ASI10 + sandbox policy + injection layers), `evals` (§3 panels, §8 multi-turn), `reasoning-techniques`, `human-in-the-loop`, `linting-and-formatting`, `threat-model`, `security-and-hardening` (SBOM), `context-engineering`, `code-review-and-quality` + 4 MCP fragments (Azure · Azure DevOps · MS Learn · Wassette) — **0 new agents/skills/rules** (from agent-governance-toolkit · mxc · llmail-inject-challenge · lost_in_conversation · llm-as-judge · EvalsforAgentsInterop · promptbase · dsl-copilot · agents-humanoversight · PyRIT · eslint-plugin-sdl · sbom-tool · vscode-prompt-tsx · PullRequestQuantifier) | `0.50.0` |
 | **[google](https://github.com/google) org review** (all 2,881 repos) | Reproducible-build verification & source-level missing-patch detection; secure-by-construction injection defense; archive-extraction & ReDoS hardening; multi-party authorization / breakglass; coverage-guided & continuous fuzzing; parameterized + semantic-equality + parallel/flaky testing; compile-time logic-bug & license-header lint layers + deterministic block sorting; multi-window burn-rate alerting & log rate-limiting; long-document extraction; prompt-as-code; statistical browser benchmarking; durable atomic writes; record-replay API testing; first-party SecOps MCP servers | Prose extensions across `security-and-hardening` (reproducible-build · missing-patch · secure-by-construction · archive · ReDoS), `human-in-the-loop` (MPA/breakglass), `testing` (fuzzing · parameterized · semantic-equality · parallel/flaky), `linting-and-formatting` (logic-bug + license-header layers · block sorting), `devops-observability` (burn-rate · log rate-limit), `context-engineering` (long-doc extraction), `reasoning-techniques` (prompt-as-code), `performance-optimization` (statistical benchmarking), `tool-design` (durable atomic writes), `api-integration` (record-replay) + **4 first-party SecOps MCP fragments** (Chronicle SIEM · GTI · SCC · SOAR) — **0 new agents/skills/rules** (from oss-rebuild · vanir · safe-active-record/mug · safearchive · re2 · building-secure-and-reliable-systems · patrick · go-cmp · atheris/honggfuzz/clusterfuzzlite · gtest-parallel · error-prone · addlicense · keep-sorted · prometheus-slo-burn · flogger · langextract · dotprompt · tachometer · renameio · test-server · mcp-security) | `0.51.0` |
+| **[facebook](https://github.com/facebook) (Meta) org review** (all 168 repos) | Interprocedural taint / data-flow security analysis (source→sink across functions); continuous A/B performance-regression CI gate; defense-in-depth agent-sandbox enforcement (argument validation + OS-level backstop) | Prose extensions to `linting-and-formatting` (taint/data-flow layer), `devops-observability` (perf-regression gate), `agent-guardrails` (§4 layered sandbox enforcement) — **0 new agents/skills/rules** (from pyre-check/Pysa · mariana-trench · FAI-PEP · mcpguard-dynamic; the org is mostly libraries/frameworks, so the verify pass *dropped* the rest — `DNE-TaaC`, `mbt`, plus already-covered `infer`/`mariana-trench`-as-tool, `fbt`, `memlab`, …) | `0.52.0` |
 
 > Each adoption is detailed in the [CHANGELOG](CHANGELOG.md) — including, for every review, what we
 > deliberately **did not** add because the kit already covered it.
@@ -528,14 +529,6 @@ non-duplicative gaps**, minimally and catalog-wired.
 
 <br>
 
-**🔍 alibaba/open-code-review → coverage-partition review (0.48.0).** A detailed read showed most of its
-methodology (multi-axis review, line-level grounding + re-verify, severity, multi-model) was *already*
-in `code-review-and-quality`. The one genuine gap: **complete file coverage on large changesets** —
-where AI reviewers silently skip files. We added "Cover Every Changed File: Partition, Plan, Then
-Weight Depth" (enumerate from the diff as the checklist of record → bundle related files →
-isolated-context concurrent review → reconcile every file to a verdict), reframing the existing hotspot
-guidance as the *depth* step that follows coverage.
-
 **🟦 microsoft org review → agentic-AI hardening (0.50.0).** We reviewed **all 8,147 repos** in the
 Microsoft org (165 survey agents over every page → deep-dive the top candidates → adversarially verify
 the shortlist). The vast majority — SDKs, samples, Azure-product code, ML infra, OS/editor — carried
@@ -571,6 +564,22 @@ burn-rate alerting & log rate-limiting in `devops-observability`; long-document
 `api-integration`; and **4 first-party Google Security Operations MCP fragments** (Chronicle SIEM · GTI ·
 SCC · SOAR).
 
+**🔵 facebook (Meta) org review → 3 hardening & reliability patterns (0.52.0).** We reviewed **all 168
+repos** in the Meta org (Meta long ago spun React, PyTorch, Jest, etc. into their own orgs, so the
+`facebook` org is small). The org is almost entirely libraries, frameworks, and language tooling with
+nothing transferable to a config scaffolder — and several famous repos were **already covered** (e.g.
+`infer` by the 0.51 compile-time-logic-bug lint layer; React by the kit's React overlay; testing by an
+already-deep `testing.md`). The verify pass *dropped* the weak picks: `DNE-TaaC` (datacenter
+network-device testing, 1★, overlaps the config-driven skills) and `mbt` (a 0★ Meta-service-specific
+binary-transparency client — that practice belongs to Sigstore/Certificate-Transparency, not this org).
+Three genuine, stack-agnostic survivors, all **prose extensions, zero new agents/skills/rules**:
+**interprocedural taint / data-flow analysis** (declare sources/sinks/sanitizers, trace untrusted data
+across functions — distinct from single-line lint) in `linting-and-formatting` (from Pysa/`pyre-check` +
+`mariana-trench`); a **continuous A/B performance-regression CI gate** (concurrent control vs treatment
+to cancel environment noise, gate on the relative delta) in `devops-observability` (from `FAI-PEP`); and
+**defense-in-depth agent-sandbox enforcement** (argument-validation layer + OS-level eBPF/seccomp backstop
+*below* the existing declarative policy) in `agent-guardrails` §4 (from `mcpguard-dynamic`).
+
 </details>
 
 > **Comparing claude-kit to native subagents / Agent Teams, agent collections, spec-kit, or

{claude_code_kit-0.51.0 → claude_code_kit-0.52.0}/README.md

@@ -489,6 +489,7 @@ non-duplicative gaps**, minimally and catalog-wired.
 | **[alibaba/open-code-review](https://github.com/alibaba/open-code-review)** | Partition-for-coverage review — deterministic full-file coverage on large changesets, related-file bundling, plan-before-deep-pass | The "Cover Every Changed File" section in `code-review-and-quality` + a Coverage category in `sdlc-code-reviewer` | `0.48.0` |
 | **[microsoft](https://github.com/microsoft) org review** (all 8,147 repos) | OWASP Agentic Top-10 (ASI01–ASI10) agent threats; agent-aware evals (multi-judge panels, multi-turn degradation, tool-vs-response grading); validator-in-the-loop + Medprompt prompting; sandbox policy schema & layered prompt-injection defense; approval-gate implementation; security-lint layer & SBOM; operationalized GenAI red-teaming; priority-based prompt pruning; quantified-lines PR sizing; first-party MCP servers | Extensions across `agent-guardrails` (ASI01–ASI10 + sandbox policy + injection layers), `evals` (§3 panels, §8 multi-turn), `reasoning-techniques`, `human-in-the-loop`, `linting-and-formatting`, `threat-model`, `security-and-hardening` (SBOM), `context-engineering`, `code-review-and-quality` + 4 MCP fragments (Azure · Azure DevOps · MS Learn · Wassette) — **0 new agents/skills/rules** (from agent-governance-toolkit · mxc · llmail-inject-challenge · lost_in_conversation · llm-as-judge · EvalsforAgentsInterop · promptbase · dsl-copilot · agents-humanoversight · PyRIT · eslint-plugin-sdl · sbom-tool · vscode-prompt-tsx · PullRequestQuantifier) | `0.50.0` |
 | **[google](https://github.com/google) org review** (all 2,881 repos) | Reproducible-build verification & source-level missing-patch detection; secure-by-construction injection defense; archive-extraction & ReDoS hardening; multi-party authorization / breakglass; coverage-guided & continuous fuzzing; parameterized + semantic-equality + parallel/flaky testing; compile-time logic-bug & license-header lint layers + deterministic block sorting; multi-window burn-rate alerting & log rate-limiting; long-document extraction; prompt-as-code; statistical browser benchmarking; durable atomic writes; record-replay API testing; first-party SecOps MCP servers | Prose extensions across `security-and-hardening` (reproducible-build · missing-patch · secure-by-construction · archive · ReDoS), `human-in-the-loop` (MPA/breakglass), `testing` (fuzzing · parameterized · semantic-equality · parallel/flaky), `linting-and-formatting` (logic-bug + license-header layers · block sorting), `devops-observability` (burn-rate · log rate-limit), `context-engineering` (long-doc extraction), `reasoning-techniques` (prompt-as-code), `performance-optimization` (statistical benchmarking), `tool-design` (durable atomic writes), `api-integration` (record-replay) + **4 first-party SecOps MCP fragments** (Chronicle SIEM · GTI · SCC · SOAR) — **0 new agents/skills/rules** (from oss-rebuild · vanir · safe-active-record/mug · safearchive · re2 · building-secure-and-reliable-systems · patrick · go-cmp · atheris/honggfuzz/clusterfuzzlite · gtest-parallel · error-prone · addlicense · keep-sorted · prometheus-slo-burn · flogger · langextract · dotprompt · tachometer · renameio · test-server · mcp-security) | `0.51.0` |
+| **[facebook](https://github.com/facebook) (Meta) org review** (all 168 repos) | Interprocedural taint / data-flow security analysis (source→sink across functions); continuous A/B performance-regression CI gate; defense-in-depth agent-sandbox enforcement (argument validation + OS-level backstop) | Prose extensions to `linting-and-formatting` (taint/data-flow layer), `devops-observability` (perf-regression gate), `agent-guardrails` (§4 layered sandbox enforcement) — **0 new agents/skills/rules** (from pyre-check/Pysa · mariana-trench · FAI-PEP · mcpguard-dynamic; the org is mostly libraries/frameworks, so the verify pass *dropped* the rest — `DNE-TaaC`, `mbt`, plus already-covered `infer`/`mariana-trench`-as-tool, `fbt`, `memlab`, …) | `0.52.0` |
 
 > Each adoption is detailed in the [CHANGELOG](CHANGELOG.md) — including, for every review, what we
 > deliberately **did not** add because the kit already covered it.
@@ -498,14 +499,6 @@ non-duplicative gaps**, minimally and catalog-wired.
 
 <br>
 
-**🔍 alibaba/open-code-review → coverage-partition review (0.48.0).** A detailed read showed most of its
-methodology (multi-axis review, line-level grounding + re-verify, severity, multi-model) was *already*
-in `code-review-and-quality`. The one genuine gap: **complete file coverage on large changesets** —
-where AI reviewers silently skip files. We added "Cover Every Changed File: Partition, Plan, Then
-Weight Depth" (enumerate from the diff as the checklist of record → bundle related files →
-isolated-context concurrent review → reconcile every file to a verdict), reframing the existing hotspot
-guidance as the *depth* step that follows coverage.
-
 **🟦 microsoft org review → agentic-AI hardening (0.50.0).** We reviewed **all 8,147 repos** in the
 Microsoft org (165 survey agents over every page → deep-dive the top candidates → adversarially verify
 the shortlist). The vast majority — SDKs, samples, Azure-product code, ML infra, OS/editor — carried
@@ -541,6 +534,22 @@ burn-rate alerting & log rate-limiting in `devops-observability`; long-document
 `api-integration`; and **4 first-party Google Security Operations MCP fragments** (Chronicle SIEM · GTI ·
 SCC · SOAR).
 
+**🔵 facebook (Meta) org review → 3 hardening & reliability patterns (0.52.0).** We reviewed **all 168
+repos** in the Meta org (Meta long ago spun React, PyTorch, Jest, etc. into their own orgs, so the
+`facebook` org is small). The org is almost entirely libraries, frameworks, and language tooling with
+nothing transferable to a config scaffolder — and several famous repos were **already covered** (e.g.
+`infer` by the 0.51 compile-time-logic-bug lint layer; React by the kit's React overlay; testing by an
+already-deep `testing.md`). The verify pass *dropped* the weak picks: `DNE-TaaC` (datacenter
+network-device testing, 1★, overlaps the config-driven skills) and `mbt` (a 0★ Meta-service-specific
+binary-transparency client — that practice belongs to Sigstore/Certificate-Transparency, not this org).
+Three genuine, stack-agnostic survivors, all **prose extensions, zero new agents/skills/rules**:
+**interprocedural taint / data-flow analysis** (declare sources/sinks/sanitizers, trace untrusted data
+across functions — distinct from single-line lint) in `linting-and-formatting` (from Pysa/`pyre-check` +
+`mariana-trench`); a **continuous A/B performance-regression CI gate** (concurrent control vs treatment
+to cancel environment noise, gate on the relative delta) in `devops-observability` (from `FAI-PEP`); and
+**defense-in-depth agent-sandbox enforcement** (argument-validation layer + OS-level eBPF/seccomp backstop
+*below* the existing declarative policy) in `agent-guardrails` §4 (from `mcpguard-dynamic`).
+
 </details>
 
 > **Comparing claude-kit to native subagents / Agent Teams, agent collections, spec-kit, or

{claude_code_kit-0.51.0 → claude_code_kit-0.52.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.51.0"
+version = "0.52.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.51.0 → claude_code_kit-0.52.0}/rules/agent-guardrails.md

@@ -125,6 +125,28 @@ agent on a broken foundation.* Before worrying about prompt injection, enforce t
 
   A ready WASM-sandboxed execution runtime ships as the optional `wassette` MCP server in
   `catalog/mcp.yaml` for projects that want an off-the-shelf containment backend.
+- **Enforce the policy in independent layers (defense in depth).** A declarative policy is necessary but
+  not sufficient: a misbehaving or compromised tool/MCP server can ignore an *advisory* policy, or smuggle
+  a forbidden action past it. So a high-risk tool call (especially one invoking an untrusted MCP server)
+  should pass **three independent checks**, each of which fails closed on its own:
+  - **L1 — policy decision.** The declarative policy above decides *is this call allowed at all* (which
+    tool, which scopes) before it runs.
+  - **L2 — argument validation at the boundary.** Validate the call's *arguments* against the policy:
+    **canonicalize** paths and resolve symlinks before the allow-check (so `../` and a symlinked path
+    can't escape an allowed prefix — mirrors the archive/path-traversal rule in `security-and-hardening`),
+    screen arguments for injection, and sanitize the tool's *response* before it re-enters the model
+    (it is untrusted content — §1).
+  - **L3 — runtime enforcement backstop.** Enforce the same scopes at the OS/runtime level —
+    seccomp / eBPF-LSM / container or microVM limits that intercept the actual `open`/`connect`/`exec`
+    syscalls — so a tool that ignored or hardcoded around L1/L2 *still* cannot touch a denied path,
+    host, or process. The backstop assumes the layers above it can be bypassed.
+
+  Log every denial to the §5 audit trail; an operator override is itself a scoped, audited action.
+
+  > Stack-agnostic adaptation of layered (defense-in-depth) MCP/agent tool-call sandboxing — declarative
+  > capability policy + argument-level validation + OS-level (eBPF-LSM/seccomp) enforcement backstop —
+  > from the MIT [`facebook/mcpguard-dynamic`](https://github.com/facebook/mcpguard-dynamic). Re-derived
+  > in prose; not vendored.
 - **Audit dependencies; don't auto-trust the ecosystem.** Treat third-party packages, MCP servers, and
   marketplace plugins as untrusted until reviewed — installing one grants it your agent's privileges.
 

{claude_code_kit-0.51.0 → claude_code_kit-0.52.0}/rules/devops-observability.md

@@ -89,6 +89,31 @@ under load:
 > Apache-2.0 [`google/flogger`](https://github.com/google/flogger). Re-derived in prose; not vendored —
 > the patterns apply to any logging framework.
 
+### Continuous performance-regression gate (A/B, not absolute thresholds)
+
+The Load-vs-SLO gate above is a *one-shot, pre-launch* check against an absolute budget. It won't catch a
+**gradual** regression — a change that quietly adds 15 ms per release until the SLO is blown six PRs
+later. For a hot / SLO-bearing path, add a **continuous** check that compares *this commit to a baseline*
+on every change:
+
+- **A/B the two commits to cancel environmental noise.** A single absolute number ("p95 = 210 ms") is
+  dominated by CI-runner variance, thermal throttling, and noisy neighbors — comparing today's run to
+  last week's run measures the *environment*, not the *code*. Instead run **control (baseline commit) and
+  treatment (the PR's commit) on the same machine, interleaved/concurrently**, and report the **relative
+  delta** (latency ratio, throughput delta), which cancels the shared environmental component.
+- **Gate on the delta, with a tolerance band.** Fail the check when the treatment is worse than control
+  by more than a stated margin (e.g. ">5 % p95 latency"); a band absorbs residual noise so the gate
+  isn't flaky. A breach is **High** (`.claude/rules/quality-gates.md`) — same severity as a Load-vs-SLO
+  breach — and routes the fix back to the dev lane.
+- **Scope it.** Run it for changes to a concurrency-sensitive or SLO-bearing path; *skip (note why in
+  `CONTINUITY.md`)* for changes with no performance surface. It complements, not replaces, the one-shot
+  Load-vs-SLO gate (absolute budget at launch) and frontend statistical benchmarking
+  (`.claude/skills/performance-optimization`).
+
+> Stack-agnostic adaptation of A/B continuous performance-regression detection (concurrent
+> control/treatment runs to isolate code from environment; gate on the relative delta) from the
+> Apache-2.0 [`facebook/FAI-PEP`](https://github.com/facebook/FAI-PEP). Re-derived in prose; not vendored.
+
 ---
 
 ## Notes

{claude_code_kit-0.51.0 → claude_code_kit-0.52.0}/rules/linting-and-formatting.md

@@ -130,6 +130,35 @@ not style" — not any one tool.
 > style + type checking) from the Apache-2.0 [`google/error-prone`](https://github.com/google/error-prone).
 > Re-derived in prose; not vendored — every major ecosystem has an equivalent analyzer.
 
+### Interprocedural Taint / Data-Flow Analysis (error, for security)
+
+The security-lint layer above catches *single-line* sink patterns (a literal `eval`, a raw `innerHTML`).
+It cannot see the dangerous case where untrusted data enters in one function and reaches a sink **several
+calls away** — request param → service method → repository → string-built SQL. **Taint analysis** closes
+that gap: it tracks data *flow* across function boundaries and flags any path from an untrusted **source**
+to a dangerous **sink** that isn't cleaned by a declared **sanitizer**.
+
+- **Model the three roles, then let the tool find the paths.** Declare **sources** (request bodies/params,
+  headers, env, file/network/queue input, deserialized data), **sinks** (SQL/NoSQL, shell/`exec`, `eval`,
+  file paths, outbound URLs, HTML/templates, log lines for sensitive data), and **sanitizers** (the
+  validator/escaper/parameterizer that makes tainted data safe). The analyzer then reports every
+  source→sink path with no sanitizer on it — interprocedurally, which point-in-code lint and the
+  type checker cannot do.
+- **Where it sits in the layers:** *security-lint* (mechanical single-line bans) → *compile-time
+  logic-bug* (correctness) → **taint/data-flow** (does untrusted input reach a sink?) → human security
+  review (`security-and-hardening` skill / `security-reviewer`). It is the automated, codebase-wide
+  complement to the **secure-by-construction typed wrappers** in `security-and-hardening` (which enforce
+  the same source/sink discipline *in the type system* at one boundary; taint analysis *discovers* the
+  unguarded flows across the whole tree).
+- **Run it in CI on a real engine**, treat a new unsanitized flow as build-breaking, and curate the
+  source/sink/sanitizer model over time (the model is the high-value artifact). Every ecosystem has an
+  engine: Pysa (Python), Mariana Trench (Java/Android), CodeQL or Semgrep (polyglot), and others.
+
+> Stack-agnostic adaptation of interprocedural taint / data-flow analysis (the source → sanitizer → sink
+> model) from the MIT [`facebook/pyre-check`](https://github.com/facebook/pyre-check) (Pysa) and
+> [`facebook/mariana-trench`](https://github.com/facebook/mariana-trench). Re-derived in prose; not
+> vendored — the model generalizes across taint engines.
+
 ### License-Header Enforcement (error)
 
 Where the project (or its org) requires source files to carry a copyright + SPDX license header, make

{claude_code_kit-0.51.0 → claude_code_kit-0.52.0}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.51.0"
+__version__ = "0.52.0"