claude-code-kit 0.7.0__tar.gz

claude_code_kit-0.7.0/.claude-plugin/marketplace.json

@@ -0,0 +1,18 @@
+{
+  "name": "claude-kit",
+  "description": "claude-kit — an autonomous, stack-agnostic SDLC for Claude Code, delivered as a plugin.",
+  "owner": {
+    "name": "Arjunsingh Yadav",
+    "url": "https://github.com/ajyadav013"
+  },
+  "plugins": [
+    {
+      "name": "claude-kit",
+      "source": "./",
+      "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
+      "version": "0.7.0",
+      "license": "MIT",
+      "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
+    }
+  ]
+}

claude_code_kit-0.7.0/.claude-plugin/plugin.json

@@ -0,0 +1,25 @@
+{
+  "name": "claude-kit",
+  "version": "0.7.0",
+  "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
+  "author": {
+    "name": "Arjunsingh Yadav",
+    "url": "https://github.com/ajyadav013"
+  },
+  "homepage": "https://github.com/ajyadav013/claude-kit",
+  "repository": "https://github.com/ajyadav013/claude-kit",
+  "license": "MIT",
+  "keywords": [
+    "sdlc",
+    "agents",
+    "orchestration",
+    "code-review",
+    "testing",
+    "quality-gates",
+    "workflow",
+    "automation",
+    "scaffold",
+    "cookiecutter"
+  ],
+  "hooks": "./hooks/hooks.json"
+}

claude_code_kit-0.7.0/.gitignore

@@ -0,0 +1,25 @@
+# Python build artifacts
+dist/
+build/
+*.egg-info/
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+
+# OS / editor cruft
+.DS_Store
+
+# Stray MCP tool artifacts (e.g. Playwright MCP session logs) — never part of the kit.
+.playwright-mcp/
+
+# Reference material kept locally only — never distributed (copyrighted source book whose
+# concepts were paraphrased into rules/, never its text). Keep the binary out of the repo.
+Agentic_Design_Patterns.pdf
+
+# Local Claude Code working state (this repo's own; not part of the distributable kit).
+# This already covers the live working-memory file at .claude/CONTINUITY.md.
+# Do NOT add a bare `CONTINUITY.md` here: with no leading slash it matches at every
+# depth, and on case-insensitive filesystems (macOS default) it also swallows
+# rules/continuity.md — the tracked rule file.
+.claude/

claude_code_kit-0.7.0/CHANGELOG.md

@@ -0,0 +1,305 @@
+# Changelog
+
+All notable changes to claude-kit are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/), and the project uses
+[semantic versioning](https://semver.org/).
+
+## [Unreleased]
+
+### Changed
+
+- **PyPI distribution name is now `claude-code-kit`** (was `claude-kit`). The name `claude-kit`
+  is blocked on PyPI by its typosquat guard (too similar to the existing `claudekit`), so the
+  package is published as `claude-code-kit`: `pip install claude-code-kit`. The CLI commands
+  (`claude-kit` / `ckit` / `claude-sdlc`), the import package (`claude_kit`), the GitHub repo, and
+  the Claude Code plugin name all remain `claude-kit` — only the PyPI project name changed.
+
+## [0.7.0] — 2026-06-09
+
+Adopts durable AI-engineering practices mined from a curated knowledge base of industry articles
+(Anthropic & Cursor engineering blogs, agent-harness write-ups, a security post-mortem, and
+context-engineering essays) into the stack-agnostic core. Only **genuine gaps** were filled; existing
+coverage was left intact to preserve description-based agent selection (golden rule #1). Still
+config-only, stack-agnostic, no app code, no Docker; `resolve()` is unchanged — the two new rules are
+always-on core (not catalog-gated).
+
+### Added
+- **`rules/evals.md`** — eval-driven development for AI/agent features: build a graded set before
+  iterating, **grade outcomes not paths**, calibrate LLM-as-judge against human labels, report
+  **pass@k vs pass^k**, keep regression + capability suites, re-eval before a model swap.
+  *(Source: Anthropic "Demystifying evals for AI agents"; Cursor "Bench".)*
+- **`rules/tool-design.md`** — designing tools/MCP for an agent consumer: composable CLI/code over
+  always-loaded servers, progressive disclosure, single-line grep-friendly errors, print-sparsely /
+  log-to-file, structured output for machine consumption, least-privilege + idempotency.
+  *(Source: "What if you don't need MCP at all?"; "Building a C compiler with parallel Claudes"; "The
+  Anatomy of an Agent Harness".)*
+- The core rule set is now **23 files** (was 21); both new rules ship in every profile.
+
+### Changed
+- **`rules/agent-guardrails.md`** — added a **secure-defaults baseline** (localhost binding, no
+  plaintext credentials, sandboxed execution, dependency/marketplace distrust) + an OWASP Top-10 for
+  Agentic Apps (ASI01–ASI10) reference. *(Source: "From Clawdbot to OpenClaw".)*
+- **`rules/agent-memory.md`** — **record the *why***, not just the *what* (decision traces: decision,
+  reasoning, rejected alternatives, refs). *(Source: "Context Graphs".)*
+- **`skills/_references/orchestration-patterns.md`** — the **three failure modes** the patterns counter
+  (agentic laziness, self-preferential bias, goal drift) + a **programmatic fan-out** layer
+  (fan-out-and-synthesize, generate-and-filter, tournament, loop-until-done).
+  *(Source: "A harness for every task: dynamic workflows in Claude Code".)*
+- **`skills/context-engineering/SKILL.md`** — a **context-degradation taxonomy** (poisoning,
+  distraction, clash, lost-in-the-middle) + progressive disclosure / compaction / tool-output offloading.
+- **`docs/agentic-patterns.md`** — coverage map updated; new "Digest-sourced additions" section records
+  provenance for all of the above.
+- Version bumped to **0.7.0**; `tests/test_scaffold.py` now asserts `evals.md` + `tool-design.md` ship
+  in every profile.
+
+### Fixed
+Surfaced by a full install-readiness audit of both distribution paths (plugin + pip):
+- **`git push` guard no longer over-blocks.** The PreToolUse guard matched the bare substrings
+  `main`/`master` anywhere after `git push`, blocking legitimate branches (`maintenance`,
+  `mainframe-fix`, `remaster-ui`, `domain-model`). It now anchors to the *target* ref token. Fixed in
+  all three copies — `hooks/hooks.json`, `templates/settings.json`, and `src/claude_kit/hooks.py`.
+- **Agent frontmatter uses the correct key.** Renamed the invalid `mode:` field to **`permissionMode:`**
+  across all 26 agents (core + DB overlays); Claude Code silently ignores `mode:`, so the read-only
+  `plan` / `acceptEdits` intent was dead config in scaffolded projects.
+- **pip-CLI installs `skills/_references/`.** `claude-kit init` now copies the shared deep-dive
+  references, so the "See Also" links in scaffolded `SKILL.md` files resolve (previously only the
+  plugin / `init.sh` path shipped them); the `validate` skill count now requires a `SKILL.md` so the
+  shared dir is not counted as a skill.
+- **`rules/quality-gates.md`** scopes the Devil's Advocate pass to the profiles that install the agent
+  (standard, enterprise); the **lean** fast track no longer carries a dangling `devils-advocate` ref.
+- **Doc rule counts corrected** to **23** in `README.md` and `docs/architecture.md` (were 21); the
+  README rule list now includes `evals` and `tool-design`.
+
+## [0.6.0] — 2026-06-09
+
+Adds an **Organization Vibe-Coding Capability Layer** so the kit serves whole organizations —
+engineers, PMs, designers, QA, DevOps, security, data, support, and founders — driving work in natural
+language *safely and consistently*. The design follows "reuse, don't duplicate": capability **packs**
+map roles to the components the kit already ships, and only genuinely-new content (the vibe-coding /
+non-engineer layer, safety & compliance policies, risk classification, and a few deterministic hooks)
+is created. A new **org** install dimension joins `profile` (subset) and `stack` (overlay); it is
+**scope-gated** and activates only when `scope == organization`, so existing team/individual installs
+are unchanged except for two new always-on core rules. Still config-only, stack-agnostic, no app code,
+no Docker; `resolve()` stays branch-free (the org layer is pure `catalog/org.yaml` data +
+`templates/org/` content).
+
+### Added
+- **`catalog/org.yaml`** — the org data contract: `scopes` (individual/team/**organization**, default
+  team), `teams`, an **autonomy** model (advisory → assisted → autonomous-local → autonomous-pr →
+  enterprise-controlled, default **assisted**) where each level lists the hooks it enables, a
+  **strictness** axis (light/standard/regulated) with extra gates, and the **7 packs** mapping roles to
+  components. Read the same branch-free way as `profiles.yaml` / `mcp.yaml`.
+- **`templates/org/`** — the org overlay payload, installed only in organization scope: 5 non-engineer
+  **skills** (`feature-from-idea`, `prototype-to-production`, `customer-issue-to-fix`,
+  `prompt-to-safe-task`, `repo-onboarding`), 5 persona **agents** (`pm-copilot`,
+  `founder-prototype-agent`, `support-ticket-engineer`, `data-workflow-agent`, `internal-tools-builder`),
+  10 policy/vibe **rules** (`ai-working-agreement`, `prompt-to-task-conversion`,
+  `non-engineer-safe-coding`, `prototype-boundaries`, `ambiguity-resolution`, `secrets-policy`,
+  `production-data-policy`, `pii-policy`, `branch-and-pr-policy`, `compliance-policy`), and **7 pack
+  manifests + READMEs** (`engineering-core`, `product-to-code`, `quality-and-review`,
+  `security-and-compliance`, `devops-and-release`, `onboarding-and-docs`, `non-engineer-builder`).
+  Skills/agents/rules install into the auto-discovered `.claude/{skills,agents,rules}`; packs +
+  governance index land under `.claude/org-packs/`.
+- **Two core rules** (`rules/`, ship in every profile/scope): `autonomy-levels.md` (the 5 levels and
+  what each permits, default assisted) and `risk-classification.md` (low/medium/high/restricted tiers
+  + the high-risk protocol: plan · approval · security review · test review · rollback notes ·
+  residual-risk summary). Rule set is now **21 files** (was 19).
+- **Two core skills** (`skills/`, activated in `standard`+): `threat-model` and `accessibility-review`
+  — two general gaps with no prior dedicated skill. Core skills are now **46** (was 44).
+- **`agents/risk-classifier.md`** — a read-only `plan`-mode agent that classifies work into the risk
+  tiers; activated in the `enterprise` profile and in org mode. SDLC agents are now **28** (was 27).
+- **Six deterministic hooks** (`hooks/scripts/` + `HOOK_REGISTRY`), enabled by autonomy level via
+  `org.yaml` (kept out of the default profiles): `warn-sensitive-files`, `warn-large-edits`,
+  `warn-missing-tests`, `validate-frontmatter`, `validate-settings`, and `audit-log` (appends
+  `ts·tool·target` to `.claude/state/audit.log` — **local only**, never external, never file bodies).
+  All degrade to no-ops without `jq`.
+- **`docs/org-capabilities.md`** — the requested→existing **coverage map** (the "reuse, not duplicate"
+  evidence): every requested agent/skill/rule mapped to an existing component or a new file.
+
+### Changed
+- **CLI / resolver / installer** (`src/claude_kit/`): `Selection` gains org fields
+  (`scope`/`teams`/`autonomy`/`review_strictness`/`org_packs`, all defaulted → back-compatible);
+  `interactive()` asks scope first and (in organization scope) teams/autonomy/strictness/packs;
+  `from_config()` parses the same keys; `catalog.resolve()` builds an `OrgPlan`, unioning pack
+  components + autonomy hooks + strictness gates into the plan; `scaffold._install_org()` writes the
+  overlay only when `plan.org` is set.
+- **`catalog/profiles.yaml`** — `standard` gains `threat-model` + `accessibility-review`; `enterprise`
+  gains `risk-classifier`.
+- **`rules/model-tiers.md`** — records `risk-classifier` (sonnet) and the org persona agents.
+- **CLI stubs** — `claude-sdlc package-org-pack` / `install-org-pack` print a "planned" message
+  (mirroring the existing `research import-sources` stub).
+- The generated per-project README gains an **"Organization-wide vibe-coding capabilities"** section
+  (capability matrix, autonomy model, risk classification, distribution model, governance, metrics, and
+  five worked examples across PM / engineer / QA / support / founder).
+- Docs now reference **28** SDLC agents, **46** skills, and a **21-file** rule set — `README.md`,
+  `CLAUDE.md`, `docs/architecture.md`, `docs/agents.md`.
+
+### Notes
+- ~70% of the requested org components already existed and were **mapped**, not recreated (e.g.
+  `code-reviewer`→`sdlc-code-reviewer`, `security-engineer`→`security-reviewer`,
+  `system-architect`→`technical-architect`, the requested stack rules → existing `templates/stacks/`
+  overlays). See `docs/org-capabilities.md` for the full map.
+
+## [0.5.0] — 2026-06-09
+
+Imports a curated set of components that were proven in a downstream project and generalized back
+into the kit: two SDLC skills, an incident-response agent, a model-tier reference rule, a commit-time
+secret guard, and PostgreSQL performance overlays. Everything was neutralized of app/stack specifics
+before landing — the agnostic core stays stack-free; PostgreSQL detail lives only in the db overlay.
+No application code, no Docker.
+
+### Added
+- **Two SDLC skills** (`skills/`, activated in `standard` and up):
+  - `incident-postmortem` — blameless postmortem: timeline, 5-whys, contributing factors, and tracked
+    action items. Reads the project's structured logs / error-tracking and monitoring tooling.
+  - `load-testing` — tool-agnostic performance/throughput testing (k6, Locust, etc. as examples).
+    Distinct from the frontend `performance-optimization` skill.
+- **`agents/incident-responder.md`** — a `plan`-mode stage-lead that triages live incidents (health/
+  readiness checks, recent service logs, common suspects) and hands off to the `incident-postmortem`
+  skill. Activated in the `enterprise` profile.
+- **`rules/model-tiers.md`** — a core reference mapping each agent to a model tier
+  (critical → opus, default → sonnet, fast → haiku), so model selection is explicit and auditable.
+  Cross-linked from `reasoning-techniques.md`. Rule set is now **19 files** (was 18).
+- **`hooks/scripts/guard-secrets.sh`** + the `guard-commit-secrets` hook (`PreToolUse`/`Bash`,
+  `standard`+) — blocks `git commit` when staged files or staged content look like secrets. Complements
+  the existing read-time `protect-secrets` guard.
+- **PostgreSQL overlays** (`templates/stacks/db/postgres/`, installed only when PostgreSQL is chosen):
+  - `rules/database-performance.md` — N+1 avoidance, composite/tenant indexes, keyset pagination,
+    async connection-pool tuning.
+  - `agents/db-performance-reviewer.md` — a `plan`-mode reviewer for query/index/pooling regressions.
+
+### Changed
+- `catalog/profiles.yaml` — `standard` gains the two skills + the commit-secret hook; `enterprise`
+  gains `incident-responder`.
+- `catalog/stacks.yaml` — the PostgreSQL stack wires the new overlay rule + overlay agent.
+- Docs now reference **27** SDLC agents (was 26) and a **19-file** rule set (was 18) — `README.md`,
+  `CLAUDE.md`, `docs/architecture.md`, `docs/agents.md`, `docs/agentic-patterns.md`.
+
+### Notes
+- Four other candidate skills from the source project were evaluated and **not** imported — already
+  covered by existing kit skills (e.g. security hardening, debugging/error recovery, planning).
+
+## [0.4.0] — 2026-06-09
+
+Adds the **agent-operation layer** distilled from *Agentic Design Patterns* (A. Gulli). A full
+cross-map of the book's 21 patterns against the kit found most already covered by existing rules,
+agents, skills, and the orchestration model; the genuine gap was how the **agents themselves** reason,
+stay safe, and recover (as opposed to how the **product** they build is secured and tested). Five new
+always-on, stack-agnostic rules fill it. No application code, no Docker, no catalog change — core
+rules ship to every profile.
+
+### Added
+- **Five agent-operation rules** (`rules/`, installed in every profile):
+  - `reasoning-techniques.md` — Chain-of-Thought, ReAct (reason→act→observe), Tree-of-Thought /
+    self-consistency, step-back, extended-thinking effort budget, and resource-aware model-tier
+    selection.
+  - `agent-guardrails.md` — treat fetched/tool/file content as untrusted (prompt-injection defense),
+    validate own output before handoff, and tool least-privilege. Distinct from the product-security
+    agents/skills.
+  - `agent-resilience.md` — bounded retries with backoff, fallback, circuit-breaker, graceful
+    degradation, idempotency, and checkpointing via CONTINUITY.
+  - `goal-setting-and-monitoring.md` — measurable/verifiable success criteria, progress monitoring,
+    and prioritization (urgency · importance · dependencies) with dynamic re-prioritization.
+  - `human-in-the-loop.md` — the consolidated set of decision points where the pipeline must pause for
+    a human, plus the escalation protocol.
+- **`docs/agentic-patterns.md`** — a coverage map of all 21 patterns + Appendix A onto the kit, and a
+  record of what was deliberately left out (vector RAG, exploration/discovery, redundant rules) and why.
+
+### Changed
+- `rules/agent-memory.md` — added the **working / episodic / semantic / procedural** memory taxonomy,
+  mapped onto the existing CONTINUITY + `agent-memory/` split.
+- `rules/mandatory-workflow.md` — added an "Agent operating disciplines" pointer to the five new rules
+  and linked the "When to STOP and ask the user" section to `human-in-the-loop.md`.
+- Docs now reference an **18-file** rule set (was 13) — `README.md`, `CLAUDE.md`, `docs/architecture.md`.
+
+## [0.3.0] — 2026-06-08
+
+Reshapes claude-kit into a **Cookiecutter-style scaffolder for the Claude Code _configuration_
+only** — catalog-driven, profile-aware, and with no application code or Docker anywhere. The
+`claude-kit new` app generator from 0.2.0 is **removed**; the FastAPI/React knowledge it carried is
+preserved as catalog **overlay rules**.
+
+### Added
+- **Catalog-driven extensibility** (`catalog/{stacks,profiles,mcp}.yaml`) — adding a frontend
+  framework, backend language/framework, database, profile, or MCP server is a **data change** plus a
+  `templates/stacks/<dir>/` folder, never a code change. Live: React · Python/FastAPI ·
+  PostgreSQL/MongoDB; Vue/Svelte/Django/Express are listed as `planned`.
+- **Ordered `init` prompts** — target path, frontend framework + language, backend language +
+  framework, database, SDLC profile, and optional MCP integrations; with existing-`.claude/` handling
+  (**merge / overwrite / backup / abort**).
+- **SDLC profiles** — `lean ⊊ standard ⊊ enterprise` select which agents, skills, hooks, and quality
+  gates are activated (composed via `inherit:` + an `all` token).
+- **`/sdlc` skill** — the single, profile-aware pipeline entrypoint; it reads the resolved gate set
+  from `.claude/config/stack-catalog.snapshot.yaml` and delegates to the `orchestrator`.
+- **Lifecycle commands** — `validate`, `doctor`, `diff`, `upgrade [--force]`, `list-options`, plus a
+  `claude-sdlc` alias entry point. Upgrades are checksum-tracked via
+  `.claude/config/init-options.json` (per-file `owner`: kit / overlay / user-editable), so kit files
+  refresh while user edits are protected with `.claude-kit` sidecars and changed/removed files are
+  backed up.
+- **Optional MCP** — selecting integrations writes a project-root `.mcp.json` (env-placeholder
+  config only, never credentials); nothing is written if none are selected.
+- **New core agents** — `story-planner` (spec → ordered, parallelizable stories) and
+  `acceptance-reviewer` (delivery vs. acceptance criteria before the human gate). A lightweight
+  `tier:` field (orchestrator / stage-lead / specialist / review) is recorded on every agent.
+- **Database overlay agents** — `postgres-specialist`, `mongodb-specialist`, and a per-database
+  `migration-specialist`, installed only for the selected database.
+- **Artifact templates** in `.claude/templates/` (feature-spec, ADR, test-plan, security-review,
+  release-plan, runbook) and a generated `README.claude-sdlc.md`.
+
+### Changed
+- **No Docker, no app code** — the kit installs configuration only. `devops-engineer` is rewritten to
+  be **container-optional** (CI/build/release/migrations/health for any runtime) and Docker is
+  scrubbed from the agnostic core.
+- Tooling adopted: **Typer** (CLI), **Jinja2** (`StrictUndefined`, `.tmpl`-gated rendering, `dot__`
+  dotfile convention), and **PyYAML** (catalog).
+- `/claude-kit:init` now prefers the pip CLI when on PATH and falls back to a thin `scripts/init.sh`;
+  `/claude-kit:sdlc` delegates to the `sdlc` skill.
+
+### Removed
+- **`claude-kit new`** app generator, the `/claude-kit:new` command, `scripts/new.py`, and all
+  generated application source + Docker assets under `templates/stacks/*/files/`.
+
+## [0.2.0] — 2026-06-08
+
+Adds a cookiecutter-style **project generator** alongside the existing config scaffolder.
+
+### Added
+- **`claude-kit new`** (and the **`/claude-kit:new`** plugin command) — generate a batteries-included
+  monorepo with the SDLC config baked in. Interactive prompts (or `--no-input`) for the stack;
+  `--backend`, `--frontend`, `--db`, `--here`, `--force` flags.
+- **Stack registry** under `templates/stacks/` — each stack is a folder with a `stack.json`; adding a
+  stack is a data change, not a code change. Ships **`python-fastapi`** (async SQLAlchemy 2.0 +
+  Alembic + Postgres, layered router→service→repository→model, pytest-asyncio) and **`react`**
+  (TypeScript + Vite + Vitest/RTL, typed Axios client, feature folders).
+- **Generated app is batteries-included**: `docker compose up` (db + backend + frontend, zero local
+  installs) *and* a `Makefile` for native dev; a worked **items** vertical slice with tests on both
+  sides; an initial Alembic migration so `alembic upgrade head` works out of the box.
+- **Stack overlay rules** — `fastapi-patterns.md` and `react-patterns.md` are installed into
+  `.claude/rules/` only for the chosen stacks, and the generated `CLAUDE.md` "Project-specific rules"
+  section is filled with the concrete commands and layout, so the agents follow the stack.
+- **`docs/agents.md`** — a dedicated guide to using the agents.
+- Zero-dependency template renderer (`*.tmpl` substitution; `dot__`-prefixed dotfiles) and a
+  source-checkout fallback so the CLI runs from a clone.
+
+## [0.1.0] — 2026-06-08
+
+Initial release.
+
+### Added
+- **Autonomous SDLC pipeline** — 24 specialized agents (`orchestrator`, spec/dev-doc writer,
+  UI designer, senior developers, technical architect, EM reviewer, merge reviewer, developer,
+  code reviewer, unit/e2e/integration testers, senior tester, auditor, devil's advocate,
+  security reviewer + 4 sub-scanners, devops & observability engineers, PR raiser).
+- **13 stack-agnostic rules** — workflow, quality gates, RARV self-check, working memory,
+  agent memory, documentation, design patterns, code organization, linting/formatting, testing,
+  frontend best practices, responsive/accessibility, and devops/observability.
+- **42 on-demand skills** spanning planning, implementation, testing, review, security, and ops.
+- **Two install channels from one source of truth**:
+  - Claude Code **plugin** (`.claude-plugin/plugin.json` + `marketplace.json`, root-level
+    component auto-discovery, portable hooks via `${CLAUDE_PLUGIN_ROOT}`).
+  - **pip package** `claude-kit` (CLI `claude-kit` / `ckit`) that scaffolds the payload into any
+    project's `.claude/` and root `CLAUDE.md`.
+- **Slash commands** `/claude-kit:init`, `/claude-kit:sdlc`, `/claude-kit:status`.
+- **Working memory** (`CONTINUITY.md`) and a **self-improving learnings loop** (`agent-memory/`)
+  wired through SessionStart hooks.
+- **Architecture documentation** with diagrams (`docs/architecture.md`).

claude_code_kit-0.7.0/CLAUDE.md

@@ -0,0 +1,80 @@
+# Developing claude-kit
+
+This repository **is** claude-kit — a Cookiecutter-style scaffolder that installs a stack-agnostic,
+autonomous-SDLC **configuration** (no application code, no Docker) into a Claude Code project. It is
+distributed two ways from one source of truth:
+
+1. **As a Claude Code plugin** — components are auto-discovered from the repo root.
+2. **As a pip package** — `claude-kit` (CLI: `claude-kit` / `ckit` / `claude-sdlc`) scaffolds the
+   same content into any project's `.claude/`, driven by the `catalog/` (stacks · profiles · MCP).
+
+> Note: the files in this repo are the **kit's payload**, not rules for this repo itself. The
+> generic engineering ruleset that gets installed into user projects lives in
+> `templates/CLAUDE.md`, **not** this file.
+
+## Repository layout
+
+| Path | Purpose |
+|------|---------|
+| `.claude-plugin/plugin.json` | Plugin manifest (name, version, hooks path) |
+| `.claude-plugin/marketplace.json` | Marketplace entry so `/plugin marketplace add` works |
+| `agents/` | SDLC pipeline subagents (auto-discovered by the plugin); each carries a `tier:` field |
+| `skills/` | Agent skills (auto-discovered by the plugin); `skills/sdlc/` is the `/sdlc` entrypoint |
+| `commands/` | Slash commands: `/claude-kit:init`, `:sdlc`, `:status` (init prefers the pip CLI, falls back to `init.sh`; sdlc delegates to the `sdlc` skill) |
+| `hooks/hooks.json` + `hooks/scripts/` | Event hooks (paths via `${CLAUDE_PLUGIN_ROOT}`) |
+| `rules/` | The 23-file stack-agnostic engineering rule set (scaffolded into `.claude/rules/`), including the agent-operation rules (reasoning, guardrails, resilience, goal-setting, human-in-the-loop, model-tiers, evals, tool-design — see `docs/agentic-patterns.md`) and the org-core rules `autonomy-levels` + `risk-classification` (see `docs/org-capabilities.md`) |
+| `catalog/` | **Data-driven registry** — `stacks.yaml` · `profiles.yaml` · `mcp.yaml` · `org.yaml`. The only thing that decides what `resolve()` installs. Adding a stack/profile/server/pack is a data change here. |
+| `templates/` | `CLAUDE.md`, `CLAUDE.stack.md.tmpl`, `README.claude-sdlc.md.tmpl`, `CONTINUITY.template.md`, `settings.json`, `artifacts/`, `agent-memory/` seed |
+| `templates/stacks/<kind>/<id>/` | Per-stack **overlay** content: `rules/` (+ `agents/` for DB stacks). **No application code, no Docker** — the only place stack-specific content lives. |
+| `templates/org/` | **Org overlay** content (scope-gated, organization only): `skills/`, `agents/` (personas), `rules/` (policy/vibe), `packs/<pack>/{pack.yaml,README.md}`, `README.md`. Wired via `catalog/org.yaml`. The only place org-specific content lives. |
+| `scripts/init.sh` | Thin no-pip fallback scaffolder (copies the full payload; no catalog resolution) |
+| `src/claude_kit/` | The pip CLI (Typer): `cli.py`, `catalog.py` (resolver), `prompts.py`, `models.py`, `scaffold.py` (installer), `render.py` (Jinja2), `hooks.py`, `validator.py`, `upgrader.py` |
+| `tests/` | pytest suite (catalog, render, scaffold, validator, upgrader, CLI) |
+| `docs/architecture.md` · `docs/agents.md` | Architecture diagrams · agent guide |
+| `pyproject.toml` | Packaging (deps: typer/jinja2/pyyaml); `[tool.hatch...force-include]` bundles the payload into the wheel |
+
+**One source of truth:** `agents/ skills/ commands/ hooks/ rules/ templates/ catalog/` at the repo
+root are read directly by the plugin **and** bundled into the wheel (mapped to
+`claude_kit/_payload/`) for the pip CLI. Never duplicate this content.
+
+## Golden rules for changes here
+
+1. **Keep the core payload stack-agnostic.** No FastAPI/React/Python/TypeScript/Docker/etc.
+   specifics in `rules/`, `agents/`, or `skills/`. Use neutral phrasing ("the project's linter /
+   test runner / build"); the `devops-engineer` is **container-optional**, never Docker-required.
+   The backend/frontend split may appear only as the canonical example of two independent parallel
+   lanes. **All** stack-specific content (overlay rules like `fastapi-patterns.md`, DB overlay agents
+   like `postgres-specialist`, exact commands) lives **only** under `templates/stacks/<kind>/<id>/`
+   and is wired up via `catalog/stacks.yaml` — never leak it into the agnostic core, and never add
+   application code or Docker anywhere.
+2. **Reference rules by their canonical filename** under `.claude/rules/…` (that's where they
+   land in a user project). The current core rule set is the 23 files in `rules/` (org policy/vibe
+   rules under `templates/org/rules/` install only in organization scope).
+3. **Plugin components live at the repo root**, never inside `.claude-plugin/` (only the
+   manifest goes there).
+4. **Hook scripts use `${CLAUDE_PLUGIN_ROOT}`** for plugin context and degrade to no-ops when
+   a tool isn't present (stack detection, never hard failure).
+5. **Bump the version** in all four places together for a release — `pyproject.toml`,
+   `.claude-plugin/plugin.json`, the `.claude-plugin/marketplace.json` entry, and
+   `src/claude_kit/__init__.py` (`__version__`, what the CLI prints) — and add a `CHANGELOG.md` entry.
+6. **Extend via the catalog, not code.** A new framework/database/profile/MCP server is a
+   `catalog/*.yaml` edit plus a `templates/stacks/<dir>/` folder; a new org pack/team/autonomy level
+   is a `catalog/org.yaml` edit plus content under `templates/org/`. `catalog.resolve()` must not grow
+   stack- or org-specific branches (the org layer is the same scope-gated lookup/union as profiles/mcp).
+   Mark not-yet-shipped entries `status: planned`.
+7. **Keep the org layer scope-gated and reuse-first.** Org content installs **only** when
+   `scope == organization`; packs MAP roles to existing components (`existing: true`) and create only
+   genuinely-new content (`existing: false`) — never a competing duplicate of an existing
+   agent/skill/rule. Org rules/skills/agents are stack-agnostic too. See `docs/org-capabilities.md`.
+
+## Dogfooding / local testing
+
+- **Plugin:** `claude` → `/plugin marketplace add .` → `/plugin install claude-kit` (loads the
+  agents/skills/commands/hooks from this checkout).
+- **CLI:** `pip install -e '.[dev]'` then `claude-kit init /tmp/demo --defaults` (or interactive),
+  `claude-kit validate /tmp/demo`, `claude-kit diff /tmp/demo`, and inspect the result.
+- **Tests:** `pytest` (the suite installs into temp dirs and asserts the no-Docker, profile-subset,
+  MCP-gating, and upgrade-safety invariants).
+- **Build:** `python3 -m build && python3 -m twine check dist/*`.
+
+See `CONTRIBUTING.md` for the full contributor workflow.

claude_code_kit-0.7.0/CONTRIBUTING.md

@@ -0,0 +1,93 @@
+# Contributing to claude-kit
+
+Thanks for helping improve claude-kit! This guide covers the repo conventions, how to test
+locally, and how to release.
+
+## Mental model
+
+- The directories at the repo root — `agents/`, `skills/`, `commands/`, `hooks/`, `rules/`,
+  `templates/`, `catalog/` — are the **kit payload** and the **single source of truth**.
+- The plugin reads them directly from the root; the pip wheel bundles them under
+  `claude_kit/_payload/` via `force-include` in `pyproject.toml`. **Never duplicate this content.**
+- `src/claude_kit/` is the pip CLI (the canonical scaffolder). `scripts/init.sh` is a **thin no-pip
+  fallback** for the `/claude-kit:init` plugin command — it copies the full payload with no catalog
+  resolution; don't reimplement the resolver in bash.
+- claude-kit installs **configuration only** — never application code, never Docker.
+
+## Golden rules
+
+1. **Keep the payload stack-agnostic.** No language/framework/Docker assumptions in `rules/`,
+   `agents/`, or `skills/`. Use neutral phrasing ("the project's linter / test runner / build"); the
+   `devops-engineer` is container-optional. The backend/frontend split may appear only as the
+   canonical example of two independent parallel work streams.
+2. **All stack-specific content lives under `templates/stacks/<kind>/<id>/`** and is wired via
+   `catalog/stacks.yaml` — overlay rules, and DB overlay agents. Nothing stack-specific in the core.
+3. **Reference rules by their canonical filename** under `.claude/rules/…` — that's where they land.
+4. **Plugin components live at the repo root**, never inside `.claude-plugin/` (only the two
+   manifests go there).
+5. **Hook scripts** use `${CLAUDE_PLUGIN_ROOT}` for plugin context and **degrade to no-ops** when a
+   tool isn't present — detect, never hard-fail.
+
+## Adding components
+
+- **Agent** → add `agents/<name>.md` with YAML frontmatter (`name`, `description`, `tools`, optional
+  `model`, `color`, and a `tier:` of orchestrator/stage-lead/specialist/review). The `description`
+  drives selection — make it accurate and trigger-friendly. Add the name to the relevant profile(s)
+  in `catalog/profiles.yaml` so it gets installed.
+- **Skill** → add `skills/<name>/SKILL.md` (uppercase `SKILL.md`). Keep the `description` focused on
+  *when* to use it. Add it to the relevant profile(s) in `catalog/profiles.yaml`.
+- **Rule** → add `rules/<name>.md`; cross-reference siblings as `.claude/rules/<name>.md`.
+- **Hook** → add a script to `hooks/scripts/`, register it in the `HOOK_REGISTRY` in
+  `src/claude_kit/hooks.py`, wire it in `hooks/hooks.json` (plugin), and list its id in the relevant
+  profile's `hooks:`.
+- **Stack** (framework / database) → a **data change**: add an entry to `catalog/stacks.yaml`
+  (`label`, `overlay_rules`, optional `overlay_agents`, `skills`, `stack_dir`, `commands`) and create
+  `templates/stacks/<stack_dir>/rules/<name>.md` (+ `agents/` for a database). Mark not-yet-ready
+  entries `status: planned`. No Python change is needed — `catalog.resolve()` must stay branch-free.
+- **Profile** → add an entry to `catalog/profiles.yaml` (compose with `inherit:`; `all` selects
+  everything). **MCP server** → add an entry to `catalog/mcp.yaml` with a `config` fragment using
+  `${ENV}` placeholders (never real credentials).
+
+## Local testing
+
+```bash
+# Plugin (dogfood this checkout):
+#   in Claude Code:  /plugin marketplace add .   then   /plugin install claude-kit
+
+# CLI:
+pip install -e '.[dev]'
+claude-kit list-options
+claude-kit init /tmp/ck-demo --defaults && ls -R /tmp/ck-demo/.claude
+claude-kit validate /tmp/ck-demo
+claude-kit diff /tmp/ck-demo
+
+# Tests:
+pytest
+
+# Build + validate the package:
+python3 -m build
+python3 -m twine check dist/*
+```
+
+Verify there's no stack/Docker leakage in the **core** payload before opening a PR (stack specifics
+belong under `templates/stacks/`, which is intentionally excluded here):
+
+```bash
+grep -rInE 'fastapi|sqlalchemy|alembic|docker' rules agents skills && echo "REVIEW these" || echo "clean"
+```
+
+(Balanced multi-framework *example* lists are acceptable; a real leak is agnostic logic branching on
+a specific stack — `pytest` enforces the no-Docker invariant on a scaffolded project.)
+
+## Releasing
+
+1. Bump the version in **all four** places: `pyproject.toml`, `.claude-plugin/plugin.json`, the
+   `.claude-plugin/marketplace.json` entry, and `src/claude_kit/__init__.py`.
+2. Add a `CHANGELOG.md` entry.
+3. `pytest` green, then `python3 -m build && python3 -m twine check dist/*`.
+4. `python3 -m twine upload dist/*` (PyPI).
+5. Tag the release and push so plugin users get the update.
+
+## License
+
+By contributing you agree your contributions are licensed under the project's [MIT License](LICENSE).

claude_code_kit-0.7.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Arjunsingh Yadav
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.