claude-code-kit 0.59.0__tar.gz → 0.61.0__tar.gz

{claude_code_kit-0.59.0 → claude_code_kit-0.61.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.59.0",
+      "version": "0.61.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.59.0 → claude_code_kit-0.61.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.59.0",
+  "version": "0.61.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.59.0 → claude_code_kit-0.61.0}/CHANGELOG.md

@@ -4,6 +4,144 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.61.0] — 2026-07-15
+
+**OSS-adoption wave 2 — nine more items from the 1,345-repo scan backlog** (wave 1 = 0.60.0 below).
+Same discipline: everything re-derived as stack-agnostic prose/data; nothing vendored.
+
+### Added
+
+- **`agent-guardrails` hardening pass** (completes the three guardrails items begun in 0.60.0):
+  the unfamiliar-CLI protocol (`--help` on the *exact leaf command* before first use — validation
+  is not transitive from parent groups; single-item schema discovery before unconstrained list
+  queries), cloud control-plane categories added to the §3 Block tier (IAM/role-binding, billing,
+  org governance, KMS-class key ops, enabling paid APIs, autonomous IaC apply — dry-run/preview
+  mandatory where offered), and a graceful-degradation token ladder in the §4 resource bounds
+  (warn fraction → wrap-up, hard-stop fraction → final answer, ceiling coupled to compaction).
+- **Evals upgrade** (`rules/evals.md` §9–10 + `docs/eval-harness.md`): evals as one versioned
+  declarative config gated in CI (path filters, parsed JSON/JUnit pass-rate, prompt-set-hash
+  response cache, SHA + run-id lineage); colocate a skill's evals beside its `SKILL.md` with
+  with/without-skill A/B judged on the skill's own claims. The harness doc gains the
+  skill-activation eval (trigger F1 + Wilson/Clopper-Pearson/bootstrap certification — the
+  routing-layer failure mode neither arm measured), the falsifiability discipline (assertions must
+  fail in baseline; Signal/Baseline/Unreachable/Regression quadrants; labeled delta bands;
+  path-scoped isolation caveat), and fixed-overhead accounting (always-injected prose is a
+  per-turn flat tax; billing A/B is the only honest end-to-end number).
+- **Pre-run budget declarations**: `goal-setting-and-monitoring` §4 budgets the run from its
+  orchestration shape (>2× single-agent needs written justification; estimate-vs-actual recorded;
+  on-exceed action declared up front) and `wave-orchestration`'s manifest extends
+  announce-the-spend to a full per-wave envelope (hard spawn cap, per-worker max turns, wall-clock
+  timeout, token ceiling) declared as data.
+- **Org governance**: `autonomy-levels` precedence — repo/user overrides may only **tighten**
+  (autonomy = min, allow = intersect, deny = union); `docs/org-capabilities.md` gains the **bypass
+  contract** — every legitimate bypass surface named in one table with its guardrail
+  (`upgrade --force`, sidecar take-ownership, breakglass, `bypassPermissions` + its org disable).
+- **Evidence-based `warn-missing-tests` hook**: convention-named test-file search (same dir +
+  `tests//test//__tests__` walking up) silences the old blanket nag when a test exists; specific
+  messages otherwise ("no test file for X" vs "no RED test recorded — write it first" via
+  `.pytest_cache`); curated skip list for generated/infra trees. Still advisory; still no-ops
+  without `jq`.
+- **`/claude-kit:init` self-install loop**: a missing CLI now offers "Install claude-code-kit now
+  (Recommended)" (pipx, else pip) with re-detection before proceeding; skip/failure/no-installer
+  keep the stop-with-instructions behavior.
+- **Doc-skill upgrades**: `refresh-docs` diffs the documented surface against the code surface and
+  classifies each divergence (`missing_in_docs` / `missing_in_code` / `signature_mismatch` /
+  `description_mismatch`, severity-guided); `documentation-and-adrs` gains the derived-artifact
+  discipline (edit the structured source, regenerate the deliverable, label source-vs-derived,
+  drift-check in CI).
+- **Design intent capture** (`frontend-ui-engineering`): one concrete world-reference over
+  adjective lists; short intentional Do's/Don'ts; tokens are context serving the reference, not
+  rendering instructions.
+- **Directory-review self-audit** (`docs/launch/directory-submission.md`): the reviewer's pass/fail
+  criteria plus the audit run against the kit's own registry — all 21 hooks tabulated (event,
+  gated/advisory, network, plugin-vs-starter); finding: zero direct network calls, one disclosed
+  indirect family (learning capture's background `claude` job, opt-out
+  `CLAUDE_KIT_NO_AUTOCAPTURE=1`).
+
+### Fixed
+
+- `refresh-docs` shipped another project's literal doc paths and a nonexistent `frontend-dev`
+  agent name in its examples — now marked as example shapes / corrected to general-purpose
+  subagents.
+
+### Not adopted (deliberately)
+
+- **The two L-sized scan items** — the `context-engineering` consolidation (8 merged proposals)
+  and the `tool-design` expansion (7 merged proposals) — are deferred to their own focused wave:
+  they overlap each other on the same two files and deserve a single coherent editing pass, not a
+  tail-end squeeze.
+- **The 10 user-gated items** remain gated (list in the 0.60.0 block below) — unchanged, awaiting
+  owner decisions.
+
+## [0.60.0] — 2026-07-15
+
+**OSS-adoption wave 1 — the first tranche from a 1,345-repo scan.** 39 provenance-tagged GitHub
+searches gathered 1,345 unique AI/Claude/MCP/context-engineering repositories; batch triage,
+48 deep-dives, and an adversarial verification pass confirmed 76 adoption ideas, merged into a
+30-item backlog. This release ships the six highest value-per-effort items — everything
+re-derived as stack-agnostic prose/data per the reuse-first discipline; nothing vendored.
+
+### Added
+
+- **Agent-config supply-chain vetting canon** (`dependency-verification` skill). Third-party
+  skills/agents/MCP entries/hooks are dependencies whose payload is *instructions executed with
+  your agent's privileges*. New canonical intake: threat taxonomy, provenance pinning to
+  repo + SHA, structural read, ONE deterministic hidden-content grep (zero-width · bidi ·
+  Unicode Tags · instruction-keyword HTML comments · data-URIs · long base64), the
+  credential-ownership routing test, **never load-to-inspect** (a stdio MCP entry executes on
+  config load), and a pre-vendoring license check. Scanner pointers referenced, not bundled
+  (snyk-agent-scan, NVIDIA SkillSpector, Invariant mcp-scan). Cross-linked from
+  `using-agent-skills` (Skill Rule 5), `security-and-hardening`'s supply-chain reference (two
+  new subsections), and `agent-guardrails` §4 + the ASI04 row.
+- **5 new MCP fragments** (17 → **22**), pins verified live: `aws_knowledge` (first-party AWS
+  docs, hosted), `aws_api` (awslabs control plane, shipped read-only + mutation-consent, with
+  the honesty notes that the flag is an API-classification allowlist and secondary to IAM),
+  `skillspector` (NVIDIA skill scanner), `serena` (semantic code navigation), `semble` (local
+  codebase index).
+- **Toxic-flow legs taxonomy across the MCP catalog.** Every fragment now carries a
+  `# toxic-flow legs:` note naming which of {untrusted-content · private-data · destructive ·
+  egress} it introduces; the catalog header documents the RESTRICTIVE-BY-DEFAULT policy and
+  `agent-guardrails` §4 gains the joint-coverage rule (untrusted + private + egress ⇒ drop a
+  leg or apply the fail-closed sandbox), §3 the restrictive-mode-on-by-default bullet.
+- **Hidden-Unicode scan in `validate --strict` / `doctor`.** Deployed prose (`.claude/**/*.md`
+  + root `CLAUDE.md`) is scanned for invisible-instruction characters, tiered: critical
+  (Unicode tags, bidi overrides/isolates, variation selectors 17-256) FAILs strict validation;
+  warning (zero-width, bidi marks, mid-file BOM, non-UTF-8) WARNs; NBSP surfaces via a new
+  INFO channel. Output capped per tier; the shipped payload is pinned clean by test. 6 new tests.
+- **Cross-reference gardener** (`scripts/check_cross_references.py`, wired into CI warn-only
+  with `--strict` available). Extracts every `.claude/{rules,skills,agents}/...` reference from
+  shipped prose and checks the target ships in core, a stack overlay, or the org overlay. Its
+  first run found and this release fixes two real defects: `sprint` and the FastAPI overlay
+  both pointed at `.claude/rules/` paths for content that ships as *skills*
+  (`context-engineering`, `deprecation-and-migration`).
+
+### Changed
+
+- **Orchestrator: independent VALIDATE step.** After each developer lane (parallel FE/BE,
+  single-stack, and fast-track alike) the orchestrator now re-runs the project's test +
+  build/lint commands itself and compares `git diff --name-only` against the story's declared
+  file scope before code review — a structural form of the evidence rule; out-of-scope changes
+  are a defect.
+- **`consolidate-learnings`: new Promote step (§6).** 3+ same-domain procedure learnings (or one
+  applied 3+ times) graduate into a project-local skill (`.claude/skills/<domain>/`) or
+  user-owned rule — upgrade-safe non-kit files — with a pointer left in MEMORY.md and an
+  update-vs-create decision tree (fewer rich skills beat many thin ones). `agent-memory`'s
+  Procedural row documents the graduation path.
+
+### Not adopted (deliberately)
+
+- **10 scan items are user-gated, not silently shipped** — each changes surface the owner
+  should decide: an `/sdlc` Stop-hook completion guard (enforcement-tier choice), two new hook
+  surfaces (warn-context-flood; detect-correction on UserPromptSubmit), a DESIGN.md template +
+  a visual-report core skill (both move CI-anchored counts/conventions), a core/stack-skills
+  marketplace split (distribution shape), a `.agents/skills` export target, a React performance
+  overlay, an org-scope skill-governance rule, and a consolidate-learnings compression pass
+  (it would reverse that skill's stated no-information-loss policy).
+- **The remaining 14 implement-now backlog items** are queued for later waves — deferred, not
+  dropped.
+- **Vendoring any scanner or example code** from the scanned repos — the kit ships prose/data
+  only; scanners stay referenced with their licenses noted.
+
 ## [0.59.0] — 2026-07-08
 
 **The kit gains a deploy-execution skill — the lifecycle's last mile.** Until now the pipeline

{claude_code_kit-0.59.0 → claude_code_kit-0.61.0}/CLAUDE.md

@@ -137,6 +137,7 @@ root are read directly by the plugin **and** bundled into the wheel (mapped to
   shellcheck -S warning hooks/scripts/*.sh scripts/*.sh
   python scripts/gen_hooks.py --check          # hooks.json + settings.json drift
   python scripts/check_docs_consistency.py     # version parity + CHANGELOG heading
+  python scripts/check_cross_references.py     # rule/skill/agent refs in prose exist (warn-only)
   ```
 - **Stack-leakage guard:** `grep -rInE 'fastapi|sqlalchemy|alembic|docker' rules agents skills` — should
   be clean (balanced multi-framework *example* lists are acceptable; a real leak is agnostic logic

{claude_code_kit-0.59.0 → claude_code_kit-0.61.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.59.0
+Version: 0.61.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -149,7 +149,7 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 | 📐 **Rules & skills** | **25** stack-agnostic core rules + **105** context-activated skills (57 core + 48 stack-collection), pulled into context on demand |
 | 🧱 **Stacks & overlays** | A stack-agnostic core + **13** overlay rule files (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands and path-scoped to load only when you touch matching files |
 | 🛠️ **Hooks & guards** | **18** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
-| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **17** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
+| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **22** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
 
 Profiles (`lean` · `standard` · `enterprise`), team scopes, autonomy levels, and org capability
 packs decide how much of this actually installs — see

{claude_code_kit-0.59.0 → claude_code_kit-0.61.0}/README.md

@@ -116,7 +116,7 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 | 📐 **Rules & skills** | **25** stack-agnostic core rules + **105** context-activated skills (57 core + 48 stack-collection), pulled into context on demand |
 | 🧱 **Stacks & overlays** | A stack-agnostic core + **13** overlay rule files (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands and path-scoped to load only when you touch matching files |
 | 🛠️ **Hooks & guards** | **18** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
-| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **17** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
+| 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **22** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
 
 Profiles (`lean` · `standard` · `enterprise`), team scopes, autonomy levels, and org capability
 packs decide how much of this actually installs — see

{claude_code_kit-0.59.0 → claude_code_kit-0.61.0}/agents/orchestrator.md

@@ -108,6 +108,9 @@ Human PRD
 │  [4a-FE] Developer (FE mode)        [4a-BE] Developer (BE)   │
 │    implements in worktree A           implements in worktree B│
 │                                                              │
+│  [4v-FE] Orchestrator VALIDATE      [4v-BE] Orchestrator     │
+│    re-runs checks + scope diff        VALIDATE (same)         │
+│                                                              │
 │  [4b-FE] SDLC Code Reviewer        [4b-BE] SDLC Code        │
 │    reviews frontend code              Reviewer reviews        │
 │    ↕ fix loop (max 5)                 backend code            │
@@ -166,7 +169,7 @@ Done
 Spec-Doc Writer → [UI Designer if UI]
   → Senior Dev → Technical Architect → EM
   → Story Planner (coverage gate)
-  → Developer → SDLC Code Reviewer → Unit Tests
+  → Developer → orchestrator VALIDATE (re-run checks + scope diff) → SDLC Code Reviewer → Unit Tests
   → Tester (full) → Senior Tester (full)
   → PR Raiser
 ```
@@ -174,7 +177,7 @@ No fork/join needed. No merge reviewer needed. Single tester + single senior tes
 
 ### Fast-Track (Mode D) — bug fixes, small changes (< 5 files)
 ```
-Developer → SDLC Code Reviewer → Tester (full) → PR Raiser
+Developer → orchestrator VALIDATE → SDLC Code Reviewer → Tester (full) → PR Raiser
 ```
 Skips: spec, design, senior dev review, tech architect, EM, merge reviewer, senior tester.
 Use when: bug fix, typo, single-component change, config update, docs-only change.
@@ -193,7 +196,7 @@ Parallel pipeline — fork into backend and frontend lanes after spec/design are
 If the PRD contains **multiple independent features**, decompose into separate pipelines that run in parallel, each following Mode A or B. Join all at PR stage.
 
 ### Mode D: Fast-Track (bug fixes, small changes)
-Minimal pipeline for changes touching < 5 files or bug fixes. Skips spec, design, review chain. Goes straight to: Developer → Code Reviewer → Tester → PR Raiser.
+Minimal pipeline for changes touching < 5 files or bug fixes. Skips spec, design, review chain. Goes straight to: Developer → orchestrator VALIDATE → Code Reviewer → Tester → PR Raiser.
 
 ### Mode E: Program / Wave Mode (migrations, repo-wide refactors, irreversible steps)
 For **program-scale** work — many files across multiple subsystems (> ~20 files or > 2 independent
@@ -343,6 +346,15 @@ code is written.
 - **Spawn**: `developer` in **frontend mode** with `isolation: "worktree"`.
 - **Input**: Approved spec + design spec.
 
+**[4v-FE] Independent VALIDATE (you — not a sub-agent):**
+- When the Developer reports done, do **not** take the self-report at face value. In the lane's
+  worktree, re-run the project's test + build/lint commands yourself, and compare
+  `git diff --name-only` against the story's declared file scope.
+- A red check is a defect. **Out-of-scope changes are a defect** — route back to the Developer
+  with the offending file list. The lane does not reach the Code Reviewer until *your own* run
+  is green. (Structural form of the evidence rule: a verdict must be backed by output you
+  captured — `.claude/rules/quality-gates.md` §2.5.)
+
 **[4b-FE] SDLC Code Reviewer:**
 - **Spawn**: `sdlc-code-reviewer` for the frontend diff.
 - **Feedback loop**: Code Reviewer ↔ Developer. Max **5 iterations**.
@@ -361,6 +373,11 @@ code is written.
 - **Spawn**: `developer` in **backend mode** with `isolation: "worktree"`.
 - **Input**: Approved backend spec.
 
+**[4v-BE] Independent VALIDATE (you — not a sub-agent):** same contract as [4v-FE] — re-run the
+backend test + lint commands yourself in the lane's worktree, diff `git diff --name-only` against
+the story's file scope; red checks and out-of-scope files are defects that return to the
+Developer before any reviewer spawns.
+
 **[4b-BE] SDLC Code Reviewer:**
 - **Spawn**: `sdlc-code-reviewer` for the backend diff.
 - **Feedback loop**: Code Reviewer ↔ Developer. Max **5 iterations**.

{claude_code_kit-0.59.0 → claude_code_kit-0.61.0}/catalog/mcp.yaml

@@ -8,12 +8,19 @@
 # rather than a moving `@latest`, so an install is reproducible and a fresh upstream release can't
 # silently change what runs. Bump these deliberately (and review the changelog) — do not switch back
 # to `@latest`. See SECURITY.md and the README "MCP integrations" note.
+#
+# RESTRICTIVE-BY-DEFAULT: where a server supports a restrictive mode, its fragment ships in that mode
+# (read-only flags on, mutation consent on) — loosen deliberately, never by default. Every entry
+# carries a `toxic-flow legs:` note naming which of {untrusted-content · private-data · destructive ·
+# egress} it introduces; when your enabled servers JOINTLY cover untrusted content + private data +
+# egress, the fail-closed sandbox policy applies (`.claude/rules/agent-guardrails.md` §4).
 
 version: 1
 
 servers:
   github:
     label: "GitHub (issues, PRs, repos)"
+    # toxic-flow legs: untrusted-content (issue/PR text from strangers) · private-data (private repos) · destructive (writes) · egress (API)
     # NOTE: the official @modelcontextprotocol/server-github npm package is archived/deprecated upstream
     # (GitHub now ships a Go `github-mcp-server`). Pinned to its last published version for a stable
     # install; switch to the maintained server in a future kit release if you need newer features.
@@ -25,11 +32,13 @@ servers:
         GITHUB_PERSONAL_ACCESS_TOKEN: "${GITHUB_PERSONAL_ACCESS_TOKEN}"
   linear:
     label: "Linear (issues)"
+    # toxic-flow legs: untrusted-content (ticket text) · private-data · destructive (edits issues) · egress (hosted)
     config:
       type: http
       url: "https://mcp.linear.app/mcp"
   jira:
     label: "Jira (issues)"
+    # toxic-flow legs: untrusted-content (ticket text) · private-data · destructive (edits issues) · egress (API)
     config:
       type: stdio
       command: npx
@@ -39,6 +48,7 @@ servers:
         JIRA_API_TOKEN: "${JIRA_API_TOKEN}"
   postgres:
     label: "PostgreSQL (query the database)"
+    # toxic-flow legs: private-data (DB rows) · untrusted-content (user-generated rows); read-only server — no destructive leg
     # NOTE: @modelcontextprotocol/server-postgres is archived/deprecated upstream; pinned to its last
     # published version for a stable install. Consider a maintained Postgres MCP server going forward.
     config:
@@ -48,6 +58,7 @@ servers:
         ["-y", "@modelcontextprotocol/server-postgres@0.6.2", "${DATABASE_URL}"]
   mongodb:
     label: "MongoDB (query the database)"
+    # toxic-flow legs: private-data (DB contents) · untrusted-content (stored docs) · destructive (supports writes)
     config:
       type: stdio
       command: npx
@@ -56,12 +67,14 @@ servers:
         MDB_MCP_CONNECTION_STRING: "${MONGODB_URI}"
   playwright:
     label: "Playwright (browser automation / E2E)"
+    # toxic-flow legs: untrusted-content (ANY web page) · destructive (clicks/submits) · egress (arbitrary sites) — the widest combination in this catalog
     config:
       type: stdio
       command: npx
       args: ["-y", "@playwright/mcp@0.0.77"]
   docs:
     label: "Docs / Context7 (live library docs)"
+    # toxic-flow legs: untrusted-content (fetched pages) · egress (hosted endpoint)
     config:
       type: http
       url: "https://mcp.context7.com/mcp"
@@ -73,6 +86,7 @@ servers:
     # `dependency-verification` and `library-review` skills for where this sits in the dependency lifecycle.
   ms_learn:
     label: "Microsoft Learn Docs (official learn.microsoft.com docs search/fetch)"
+    # toxic-flow legs: egress (hosted) · untrusted-content (low — official docs)
     # First-party Microsoft-hosted MCP (github.com/MicrosoftDocs/mcp) exposing fresh official docs
     # (microsoft_docs_search / _fetch / code-sample search) over a hosted HTTP endpoint — no auth, no
     # credentials generated. Complements the Context7 `docs` entry (general libraries) with
@@ -81,8 +95,18 @@ servers:
     config:
       type: http
       url: "https://learn.microsoft.com/api/mcp"
+  aws_knowledge:
+    label: "AWS Knowledge (official AWS docs, API refs, Well-Architected — search/fetch)"
+    # First-party AWS-hosted MCP (github.com/awslabs/mcp) — the AWS counterpart to `ms_learn` above:
+    # fresh official docs over a hosted HTTP endpoint, no auth, no credentials generated.
+    # toxic-flow legs: egress (hosted endpoint) · untrusted-content (low — official docs).
+    # Snapshot 2026-07-15.
+    config:
+      type: http
+      url: "https://knowledge-mcp.global.api.aws"
   azure:
     label: "Azure (cloud resource management — 200+ tools across Azure services)"
+    # toxic-flow legs: private-data (cloud resources) · destructive (200+ management tools) · egress
     # First-party Azure MCP Server (github.com/microsoft/mcp, @azure/mcp, MIT). Authenticates via
     # DefaultAzureCredential — run `az login` first; no token is stored in this config. Pinned to an
     # exact version (the package's current `latest` is a 3.0 beta — review the changelog before bumping;
@@ -91,8 +115,27 @@ servers:
       type: stdio
       command: npx
       args: ["-y", "@azure/mcp@3.0.0-beta.23", "server", "start"]
+  aws_api:
+    label: "AWS API (control-plane access across AWS services; read-only by default)"
+    # First-party awslabs server (github.com/awslabs/mcp, Apache-2.0) — the AWS counterpart to the
+    # `azure` entry above. Ships in its most-restrictive mode: READ_OPERATIONS_ONLY=true is an
+    # API-classification allowlist (NOT a filesystem guarantee) and REQUIRE_MUTATION_CONSENT=true
+    # gates every mutating call — and BOTH are secondary to your real IAM grants, which remain the
+    # actual authorization boundary. Loosen deliberately, never by default. HONESTY NOTE: awslabs is
+    # consolidating standalone servers into its AWS Agent Toolkit; this package still ships and is
+    # pinned exactly — revisit at the next MCP freshness pass. Auth rides your AWS CLI credential
+    # chain (`aws configure` / SSO); no credentials generated here. Snapshot 2026-07-15.
+    # toxic-flow legs: private-data (cloud resources) · destructive (mutations, consent-gated) · egress.
+    config:
+      type: stdio
+      command: uvx
+      args: ["awslabs.aws-api-mcp-server==1.3.46"]
+      env:
+        READ_OPERATIONS_ONLY: "true"
+        REQUIRE_MUTATION_CONSENT: "true"
   azure_devops:
     label: "Azure DevOps (work items, repos, pipelines, wikis, test plans)"
+    # toxic-flow legs: untrusted-content (work-item text) · private-data · destructive (writes) · egress
     # First-party Azure DevOps MCP Server (github.com/microsoft/azure-devops-mcp, @azure-devops/mcp,
     # MIT) — the Azure-DevOps counterpart to the github/jira/linear issue trackers above. The first arg
     # is your ADO organization name; authenticates via the Azure CLI (`az login`). Snapshot 2026-06-28.
@@ -108,10 +151,25 @@ servers:
   # or Homebrew/Nix/Docker/Windows per the repo's installation guide), then it runs over stdio.
   wassette:
     label: "Wassette (WASM-sandboxed tool execution; needs the `wassette` binary installed)"
+    # toxic-flow legs: untrusted-content (third-party WASM tools) — destructive/egress bounded per-component by the sandbox policy
     config:
       type: stdio
       command: wassette
       args: ["run"]
+  # SkillSpector (github.com/NVIDIA/SkillSpector) — static skill/agent-config scanner: 68
+  # vulnerability patterns across 17 categories (prompt injection, data exfiltration, tool
+  # poisoning, MCP least-privilege, memory poisoning, ...). The optional scan backend for the
+  # third-party vetting canon in the `dependency-verification` skill. NOT an npx/PyPI package —
+  # install from git first (`uv tool install 'skillspector[mcp] @
+  # git+https://github.com/NVIDIA/skillspector.git'`), then it runs over stdio. Referenced only,
+  # never bundled (the wassette precedent). Snapshot 2026-07-15.
+  # toxic-flow legs: untrusted-content (the artifact under scan is hostile by assumption); local-only.
+  skillspector:
+    label: "SkillSpector skill/plugin scanner (needs `uv tool install` from git)"
+    config:
+      type: stdio
+      command: skillspector
+      args: ["mcp"]
   # Sentry (github.com/getsentry/sentry-mcp) — official, vendor-maintained MCP for production error
   # monitoring / issue triage: top unresolved issues, stacktraces, performance & trace data, and Seer
   # root-cause analysis. Fills the error-monitoring gap the `incident-responder` + `observability-engineer`
@@ -124,6 +182,7 @@ servers:
   #   command: npx, args: ["-y", "@sentry/mcp-server@0.36.0"], env: SENTRY_ACCESS_TOKEN: "${SENTRY_ACCESS_TOKEN}".
   sentry:
     label: "Sentry (error monitoring / issue triage; source-available FSL-1.1)"
+    # toxic-flow legs: private-data (stacktraces can carry PII) · untrusted-content (error payloads) · egress (hosted)
     config:
       type: http
       url: "https://mcp.sentry.dev/mcp"
@@ -134,10 +193,36 @@ servers:
   # first use. Point it at the repo via the env var below (e.g. `export REPOWISE_PROJECT_ROOT=$(pwd)`).
   repowise:
     label: "Repowise codebase intelligence (AGPL-3.0; needs `pip install repowise` + `repowise init`)"
+    # toxic-flow legs: private-data (whole-codebase index); local-only — no egress leg
     config:
       type: stdio
       command: repowise
       args: ["mcp", "${REPOWISE_PROJECT_ROOT}", "--transport", "stdio"]
+  # Serena (github.com/oraios/serena, MIT) — free, local, LSP-backed semantic code toolkit:
+  # symbol-level find/reference/edit tools that give precise retrieval instead of whole-file reads.
+  # Install via uv first: `uv tool install serena-agent==1.5.3` (pinned; snapshot 2026-07-15). Two
+  # notes from its docs: raise the MCP client timeout (e.g. MCP_TIMEOUT=60000) — first launch
+  # downloads language servers; and in the `claude-code` context Serena auto-disables its own
+  # file/shell tools (Claude Code's are better there) — it contributes the symbolic layer only.
+  # toxic-flow legs: private-data (whole-codebase symbol index); local-only — no egress leg.
+  serena:
+    label: "Serena semantic code toolkit (LSP symbols; needs `uv tool install serena-agent`)"
+    config:
+      type: stdio
+      command: serena
+      args: ["start-mcp-server", "--context", "claude-code"]
+  semble:
+    label: "Semble semantic code search (local embeddings, CPU-only; runs via uvx)"
+    # (github.com/MinishLab/semble, MIT) — local semantic code search: natural-language queries
+    # return exact snippets at a fraction of grep+read token cost; indexes a repo in ~seconds on
+    # CPU, no API keys or external services. The lightweight complement to `repowise` above
+    # (repowise = churn/risk analytics; semble = meaning search) and to Serena's symbolic tools.
+    # Respects `.sembleignore` for excluding paths from the index. Pinned exactly (snapshot
+    # 2026-07-15). toxic-flow legs: private-data (local code index); local-only — no egress leg.
+    config:
+      type: stdio
+      command: uvx
+      args: ["--from", "semble[mcp]==0.5.1", "semble"]
   # Google Security Operations cluster (github.com/google/mcp-security, Apache-2.0) — four first-party
   # Google MCP servers covering the SOC/operational-security domain the catalog otherwise has no entry
   # for (Sentry above is error-monitoring, not threat-intel/SIEM/SOAR/CSPM):
@@ -153,6 +238,7 @@ servers:
   # credentials are generated here. Enable only the server(s) whose backend you actually have.
   secops:
     label: "Google SecOps / Chronicle SIEM (paid Chronicle backend + ADC required)"
+    # toxic-flow legs: private-data (SIEM events) · untrusted-content (attacker-controlled log data) · egress
     config:
       type: stdio
       command: uvx
@@ -163,6 +249,7 @@ servers:
         CHRONICLE_REGION: "${CHRONICLE_REGION}"
   gti:
     label: "Google Threat Intelligence / VirusTotal (needs VT_APIKEY)"
+    # toxic-flow legs: egress (lookups can reveal your indicators/incident) · private-data (query context)
     config:
       type: stdio
       command: uvx
@@ -171,12 +258,14 @@ servers:
         VT_APIKEY: "${VT_APIKEY}"
   scc:
     label: "Security Command Center — cloud security posture (ADC required)"
+    # toxic-flow legs: private-data (security posture & findings) · egress
     config:
       type: stdio
       command: uvx
       args: ["--from", "scc-mcp==0.1.0", "scc_mcp"]
   secops_soar:
     label: "Google SecOps SOAR / Siemplify (paid SOAR backend; needs SOAR_URL + SOAR_APP_KEY)"
+    # toxic-flow legs: private-data · destructive (response actions / playbooks) · egress
     config:
       type: stdio
       command: uvx

{claude_code_kit-0.59.0 → claude_code_kit-0.61.0}/commands/init.md

@@ -17,9 +17,19 @@ command -v claude-kit >/dev/null 2>&1 && echo "CKIT_CLI=claude-kit" \
   || echo "CKIT_CLI_MISSING"; }; }
 ```
 
-**If the output is `CKIT_CLI_MISSING`, STOP — do not scaffold anything.** The CLI is not installed
-under any of its names. Tell the user it is required and how to install it, then have them re-run
-`/claude-kit:init`. Do **not** silently fall back to a partial install:
+**If the output is `CKIT_CLI_MISSING`, offer to install it — never scaffold without it.** The CLI
+is not installed under any of its names. When an installer is available on PATH (`pipx`, else
+`pip`/`pip3`), ask ONE AskUserQuestion with the install option first:
+
+- **"Install claude-code-kit now (Recommended)"** — on accept, run `pipx install claude-code-kit`
+  (fall back to `pip install claude-code-kit` when pipx is absent), then **re-run the detection
+  block above** and proceed only if a CLI name now resolves.
+- **"Skip"** — or if the install fails, or no installer is on PATH: STOP — do not scaffold
+  anything. Tell the user the CLI is required, show both install commands below, and have them
+  re-run `/claude-kit:init`. Do not silently fall back to a partial install.
+
+Never ask when the CLI is already present, and never ask when no installer exists on PATH (nothing
+to offer — go straight to the stop-with-instructions):
 
 - Recommended: `pipx install claude-code-kit`
 - Or: `pip install claude-code-kit`

{claude_code_kit-0.59.0 → claude_code_kit-0.61.0}/docs/eval-harness.md

@@ -48,6 +48,50 @@ class Y, Z% of the time."
 > The pipeline costs more per task by design (more agents, more gates). The question this harness
 > answers is whether the **defects caught** (and their severity) justify that delta **for your task mix**.
 
+## Skill-activation eval (the routing layer)
+
+The arms above grade what happens *after* a skill or rule fires. A separate failure mode sits in
+front of both: does the skill **activate when it should — and stay quiet when it shouldn't**?
+Neither arm measures routing; add it as its own small suite.
+
+- **Trigger F1.** Build two prompt lists per skill: *should-activate* (phrasings a real user would
+  use) and *should-not-activate* (near-misses from neighboring domains). Run both, score activation
+  as binary, report **precision / recall / F1**. A skill with great content and 40% recall is a
+  great document nobody reads; one that fires on near-misses taxes every unrelated task.
+- **Monte Carlo certification for any number you publish.** Activation is stochastic — run each list
+  repeatedly and report the **Wilson confidence interval** on the activation rate, a
+  **Clopper-Pearson bound** on the should-activate failure rate (the conservative "at worst" claim),
+  and a **bootstrap consistency** check across resamples. "Activates 19/20, 95% CI [86%, 99%]" is a
+  claim; "it seems to trigger" is not.
+
+## Falsifiability discipline (before you trust any delta)
+
+- **The falsifiability gate.** Every assertion must **fail in the baseline arm** at least sometimes —
+  an assertion that passes in both arms measures the model, not the pipeline, and supports no claim.
+  Drop it or sharpen it.
+- **Quadrant-classify each row before averaging anything:** **Signal** (fails A, passes B — the
+  pipeline earned it) · **Baseline** (passes both — too easy, doesn't count) · **Unreachable**
+  (fails both — can't discriminate at this model tier) · **Regression** (passes A, fails B — the
+  pipeline *hurt*; investigate before shipping). Only Signal rows support a value claim; every
+  Regression row is a finding in its own right.
+- **Label delta bands.** Report deltas with a qualitative band (noise / weak / strong at your N)
+  rather than celebrating a 3% move the confidence interval can't distinguish from zero.
+- **Path-scoped isolation caveat.** If a rule/overlay is path-scoped (loads only when matching files
+  are touched), confirm both arms actually touch those paths — otherwise the comparison silently
+  measures *activation*, not content.
+
+## Fixed-overhead accounting
+
+Always-injected prose is a **flat tax on every turn**, paid whether or not the content helps that
+turn (measure your own install — see `docs/rules-context-budget.md`; even a single always-on rule
+file costs on the order of 1–1.5k tokens per turn, and a full rule set far more). So the eval
+question is not "does the pipeline help" but "does the help **beat the tax** for your task mix":
+
+- Put the per-turn injected overhead in the Cost table, not only per-task totals.
+- The only honest end-to-end number is a **billing A/B** — the same task mix with and without,
+  compared on what you were actually charged. Token figures extrapolated from a single run are
+  estimates: label them **est.**
+
 ## Honesty rules
 
 - **Never publish numbers you did not run.** A "90%" from one run and from twenty runs are not the same

{claude_code_kit-0.59.0 → claude_code_kit-0.61.0}/docs/launch/directory-submission.md

@@ -68,10 +68,64 @@ Before submitting, **re-check the live documentation** at the URLs below. Plugin
 - Plugin marketplaces: [code.claude.com/docs/en/plugin-marketplaces](https://code.claude.com/docs/en/plugin-marketplaces)
 - Plugin reference: [code.claude.com/docs/en/plugins-reference](https://code.claude.com/docs/en/plugins-reference)
 
+## Directory Review Self-Audit
+
+Directory reviewers apply pass/fail criteria a submitter can run against themselves first. Three
+that decide outcomes:
+
+1. **Description-matches-behavior (the surprise test).** For every hook, command, and skill: would
+   a user who read only its description be *surprised* by anything it actually does? Any surprise
+   is a fix-before-submitting.
+2. **Undisclosed outbound calls = automatic fail.** Every network touch (direct or via a spawned
+   tool) must be disclosed in the component's description *and* have an opt-out.
+3. **The whole shipped payload is in scope — including directories the plugin doesn't load.**
+   A git-source install clones everything (`scripts/`, `templates/`, `catalog/`, `examples/`), so
+   the audit covers the full tree, not just auto-discovered components.
+
+### First-party hook audit (run against this kit's own registry)
+
+All hooks in the shipped registry, in the reviewer's format — `EVENT:hook — gated|advisory —
+network`. **gated** = can block the action (exit 2 / deny); **advisory** = warn-or-context only,
+always exits 0. Every script degrades to a no-op without `jq`. Regenerate this table when the
+registry changes (`src/claude_kit/hooks.py` is the source of truth; `gen_hooks.py --check` pins the
+generated configs).
+
+| Hook | Event | Mode | Network | In plugin hooks.json |
+|------|-------|------|---------|----------------------|
+| load-continuity | SessionStart | advisory | no | yes |
+| load-learnings | SessionStart | advisory | no | yes |
+| load-autonomy | SessionStart | advisory | no | yes |
+| capture-learnings-catchup | SessionStart | advisory | **indirect** — spawns a background `claude` job (model API); disclosed, opt-out `CLAUDE_KIT_NO_AUTOCAPTURE=1` | yes |
+| guard-rm-rf | PreToolUse | **gated** (inline) | no | yes |
+| guard-push-main | PreToolUse | **gated** | no | yes |
+| guard-destructive-git | PreToolUse | **gated** | no | yes |
+| protect-secrets | PreToolUse | **gated** (inline) | no | yes |
+| guard-commit-secrets | PreToolUse | **gated** | no | yes |
+| validate-settings | PreToolUse | **gated** | no | yes |
+| warn-shared-modules | PreToolUse | advisory | no | yes |
+| warn-llm-io | PreToolUse | advisory | no | yes |
+| warn-sensitive-files | PreToolUse | advisory | no | yes |
+| warn-large-edits | PreToolUse | advisory | no | starter only |
+| validate-frontmatter | PreToolUse | advisory | no | starter only |
+| warn-missing-tests | PostToolUse | advisory | no | starter only |
+| audit-log | PostToolUse | advisory | no | starter only |
+| lint-fix | Stop | advisory (runs the project's linter) | no | yes |
+| type-check | Stop | advisory (runs the project's type-checker) | no | yes |
+| capture-learnings-stop | Stop | advisory | indirect — same `claude` job + opt-out as above | starter only |
+| capture-learnings | SessionEnd | advisory | indirect — same `claude` job + opt-out as above | yes |
+
+**Audit result:** 21 registry hooks (16 ride the plugin's `hooks.json`; the rest install via the
+scaffolded starter `settings.json`). One behavior family touches the network, *indirectly*, via a
+spawned `claude` background job (learning capture) — disclosed in the init interview, surfaced by
+`doctor`, and opt-out via `CLAUDE_KIT_NO_AUTOCAPTURE=1`. No hook makes a direct outbound call. All
+gated hooks are deterministic string/path guards with no data egress. This passes criteria 1–3
+above as of the audit date; re-run after any hook change.
+
 ## Owner Submission Checklist
 
 - [ ] Run `claude plugin validate .` and `claude plugin validate . --strict`
 - [ ] Fix any validation errors (warnings are optional)
+- [ ] Re-run the Directory Review Self-Audit above (hook table current, no undisclosed network, no description surprises)
 - [ ] Verify the live submission form and documentation links above
 - [ ] Consider the optional manifest hygiene items (not required)
 - [ ] Choose submission path: solo (platform.claude.com) or organization (claude.ai)