claude-code-kit 0.72.0__tar.gz → 0.73.0__tar.gz

{claude_code_kit-0.72.0 → claude_code_kit-0.73.0}/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "claude-kit",
       "source": "./",
       "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.",
-      "version": "0.72.0",
+      "version": "0.73.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.72.0 → claude_code_kit-0.73.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-kit",
-  "version": "0.72.0",
+  "version": "0.73.0",
   "description": "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC config (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with working memory and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.72.0 → claude_code_kit-0.73.0}/CHANGELOG.md

@@ -4,6 +4,83 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.73.0] — 2026-07-28
+
+**A runtime ticket chart — `claude-kit tickets` shows which ticket is in flight and what it cost**
+(user request: *"a chart to show which ticket is in progress and its details — how many tokens were
+used, which model, time, status, agent used … runtime and not a pic or screenshot"*). 0.72.0 recorded
+what changed and why; this answers what the work cost, live.
+
+### Added
+
+- **`claude-kit tickets`** — a text board, one row per ticket: ID · TITLE · STATUS · AGENT · MODEL ·
+  TOKENS · CACHE · TIME · COMMITS, ordered in-progress first. Variants: `--graph` (ticket dependency
+  graph), `--graph-git` (commit graph annotated with each commit's ticket), `PROJ-12` (detail view with
+  the per-ticket work log and full telemetry), `--watch N` (re-render every N seconds), `--json`.
+- **`claude-kit tickets --html`** — the same data as a **browser Kanban board**
+  (IN PROGRESS · IN REVIEW · ACTIONABLE · BLOCKED · DONE), written to the gitignored
+  `.claude/state/ticket-board.html`. It is a *file, not a server*: a `<meta refresh>` tag plus the Stop
+  hook rewriting the file gives live progress with no daemon and no port. Fully self-contained — inline
+  CSS, no JavaScript, no fonts, no images, no CDN — so opening it makes zero network requests and
+  ticket titles never leave the machine. Respects OS light/dark preference; `--refresh N` tunes the
+  reload (`0` = static snapshot). Every interpolated value is HTML-escaped.
+- **`src/claude_kit/telemetry.py`** — read-only, metadata-only aggregation of Claude Code session
+  transcripts, attributed to tickets by `gitBranch`. Deduplicates by `requestId`: streaming repeats each
+  usage block, so a naive sum overstated output tokens **3.3×** (622 raw records → 219 real requests on
+  the session this was measured against). Cache reads get their own counter rather than being folded
+  into input, because they routinely exceed fresh input by three orders of magnitude.
+- **`src/claude_kit/tickets.py`** — ticket store loader and renderers. Relation model adopted from
+  [quazardous/aiball](https://github.com/quazardous/aiball) (MIT, © 2026 David Berlioz — concepts
+  re-expressed, no code copied): `depends_on`/`blocks` **gate** whether a ticket is actionable, while
+  `child_of`/`parent_of` lineage deliberately does not. Adds a derived **BLOCKED** display status, and
+  the board header always prints the open count beside actionable so a fully-gated backlog can never
+  read as "nothing to do".
+- **`capture-ticket-telemetry.sh`** (Stop hook, standard profile) — persists the figures into the
+  gitignored `.claude/state/ticket-telemetry.json` so history survives transcript pruning, and
+  refreshes the HTML board **only if that file already exists**, so its presence is the opt-in and
+  terminal-only users never pay to render a page they don't look at. Detached,
+  throttled to once per 60s (`CLAUDE_KIT_TELEMETRY_INTERVAL`), no-ops without `jq`, without the
+  `claude-kit` CLI, or before a ticket store exists; opt out with `CLAUDE_KIT_NO_TELEMETRY=1`. It shells
+  out to `tickets --json` rather than re-deriving totals in `jq`, so the dedupe rule has exactly one
+  tested implementation instead of two that can drift.
+
+### Changed
+
+- Hook scripts 18 → **19**. Rules (25), agents (29), and skills (111) are unchanged — this release adds
+  no skill, no agent, and no rule.
+- **README gains a "Parallel lanes and the live ticket board" section** — how the orchestrator forks
+  independent stories into concurrent lanes, joins them at the merge-reviewer gate, fans out to the
+  testing agents, and how the board makes that visible — with a screenshot of the rendered board
+  (`docs/images/ticket-board.png`; `docs/` is not bundled into the wheel).
+- **`agentName` is now read from records that carry no usage block.** It never co-occurs with
+  `requestId` + `usage` in a transcript, so reading it only from billed turns left the AGENT column
+  structurally unfillable. Each agent is credited strictly to the branch its own record names —
+  inferring across a file smears them (one sampled transcript held 18 agent names against 54 branches).
+- Telemetry is **branch-scoped**, since `gitBranch` is the only ticket-shaped key a transcript carries.
+  Tickets sharing a branch therefore show that branch's totals, and both the board and the detail view
+  say so explicitly rather than implying the figure belongs to one ticket.
+- **`BLOCKED` only overrides `OPEN`.** A ticket that is already IN PROGRESS or IN REVIEW has someone on
+  it, so reporting it as "blocked" would replace the more useful fact with a less useful one; the unmet
+  dependency is still named on the graph, the detail view, and the HTML card. Relatedly, a **closed
+  ticket now reports no blockers at all** — a DONE card previously rendered the contradiction
+  "DONE · blocked by X".
+
+### Not adopted (deliberately)
+
+- **aiball's daemon and PTY proxy**, and a long-running server for the board. The kit ships
+  configuration, not a running service — so the browser view is a generated file plus a meta-refresh,
+  which needs no port, no process, and no lifecycle to manage. (A `--serve` mode remains possible
+  later if polling ever proves insufficient.)
+- **Hardcoded model pricing.** A cost column would need a price table that silently rots; tokens and
+  model id are reported instead, and any rate table stays the user's to supply.
+- **Message content.** Only usage counters, model ids, agent names, timestamps, and the branch are read
+  — never prompt or response text, matching the learning-capture posture in `SECURITY.md`.
+- **A per-turn full rescan.** Re-reading every transcript on each Stop was measured at ~0.9s over
+  200 MB; the hook throttles instead.
+- **`--graph=git` as an optional-value flag.** `--graph` with an inline value depends on Click's
+  `flag_value`, which is deprecated in the Click that typer 0.26 vendors and errors on a bare `--graph`.
+  Two plain booleans (`--graph` / `--graph-git`) behave identically across the supported typer range.
+
 ## [0.72.0] — 2026-07-27
 
 **Ticket-first traceability — a local git-native ticket store, per-change work-log, project wiki, and

{claude_code_kit-0.72.0 → claude_code_kit-0.73.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.72.0
+Version: 0.73.0
 Summary: Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -148,7 +148,8 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 | 🤖 **Agent roster** | **29** tiered agents led by an Orchestrator that never writes code, plus per-database overlay agents and 6 org personas ([full roster](docs/agents.md)) |
 | 📐 **Rules & skills** | **25** stack-agnostic core rules + **111** context-activated skills (58 core + 53 stack-collection), pulled into context on demand |
 | 🧱 **Stacks & overlays** | A stack-agnostic core + **13** overlay rule files (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands and path-scoped to load only when you touch matching files |
-| 🛠️ **Hooks & guards** | **18** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
+| 🛠️ **Hooks & guards** | **19** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
+| 📊 **Traceability & live board** | A git-native ticket per story with a work-log and commit linkage, plus `claude-kit tickets` — a terminal chart and a browser Kanban board showing each lane's status, agent, model, tokens and elapsed time ([below](#parallel-lanes-and-the-live-ticket-board)) |
 | 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **24** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
 
 Profiles (`lean` · `standard` · `enterprise`), team scopes, autonomy levels, and org capability
@@ -216,6 +217,64 @@ capture your own publishable run: [`docs/capture-a-real-run.md`](docs/capture-a-
 
 ---
 
+## Parallel lanes and the live ticket board
+
+The orchestrator never writes code — it splits work, spawns agents, and refuses to advance a gate.
+Once the spec clears the EM gate, `story-planner` produces stories and marks which ones are
+**independent**. Each independent story becomes a **lane**: its own ticket, its own branch, its own
+implement → review → test loop, running at the same time as the others.
+
+```mermaid
+flowchart LR
+    STORY["story-planner<br/>(marks independents)"] --> TK["One OPEN ticket per story"]
+    TK --> L1["Lane A — backend<br/>senior-backend-dev → code-review"]
+    TK --> L2["Lane B — frontend<br/>senior-frontend-dev → code-review"]
+    TK --> L3["Lane C — …"]
+    L1 --> MR{{"Gate: Merge Reviewer<br/>(the join)"}}
+    L2 --> MR
+    L3 --> MR
+    MR --> T1["unit-tester"]
+    MR --> T2["e2e-tester"]
+    MR --> T3["senior-tester<br/>(independent verification)"]
+    T1 --> TCG{{"Gate: Test coverage<br/>+ Devil's Advocate"}}
+    T2 --> TCG
+    T3 --> TCG
+    TCG --> DONE["Tickets → DONE,<br/>commits linked"]
+```
+
+Two things make this observable rather than a black box:
+
+- **A ticket is opened before any lane starts** and accumulates a work-log entry per meaningful step —
+  what changed, why, which files, what was decided (`ticketing-and-traceability`). Commits carry the
+  ticket id, so `git log --grep=` walks it in either direction.
+- **Lanes are branches, and telemetry is keyed on the branch.** `claude-kit tickets` reads the Claude
+  Code session transcripts (metadata only — usage counters, model id, agent name, timestamp) and
+  attributes tokens, cache, elapsed time, and the agent that ran to whichever ticket names that branch.
+
+### The board
+
+```bash
+claude-kit tickets                # board: one row per ticket, in-progress first
+claude-kit tickets --watch 5      # re-render every 5s while a run is in flight
+claude-kit tickets --graph        # dependency DAG — what is blocked by what
+claude-kit tickets --graph-git    # the commit graph with each commit's ticket attached
+claude-kit tickets CKIT-74        # one ticket: full work log + per-lane telemetry
+claude-kit tickets --html         # a Kanban board in your browser
+```
+
+`--html` writes a self-contained page to `.claude/state/ticket-board.html` and prints a `file://` URL.
+It is a **file, not a server** — the page refreshes itself and the `capture-ticket-telemetry` Stop hook
+rewrites it after each turn, so an open tab tracks a running pipeline live with nothing daemonised:
+
+![The claude-kit ticket board — Kanban columns for in progress, in review, actionable, blocked and done, each card showing model, tokens, cache, elapsed time and commit](docs/images/ticket-board.png)
+
+Token counts are **deduplicated by request id** — streaming rewrites the same usage block many times,
+and a naive sum overstates output by ~3× — and cache reads are counted separately from fresh input
+because they routinely differ by three orders of magnitude. Full reference:
+[`docs/cli.md`](docs/cli.md#the-ticket-chart-claude-kit-tickets).
+
+---
+
 ## Profiles & what lands in your project
 
 The profile you pick decides how much lands in `.claude/`. Measured on a React + FastAPI +

{claude_code_kit-0.72.0 → claude_code_kit-0.73.0}/README.md

@@ -115,7 +115,8 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 | 🤖 **Agent roster** | **29** tiered agents led by an Orchestrator that never writes code, plus per-database overlay agents and 6 org personas ([full roster](docs/agents.md)) |
 | 📐 **Rules & skills** | **25** stack-agnostic core rules + **111** context-activated skills (58 core + 53 stack-collection), pulled into context on demand |
 | 🧱 **Stacks & overlays** | A stack-agnostic core + **13** overlay rule files (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands and path-scoped to load only when you touch matching files |
-| 🛠️ **Hooks & guards** | **18** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
+| 🛠️ **Hooks & guards** | **19** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
+| 📊 **Traceability & live board** | A git-native ticket per story with a work-log and commit linkage, plus `claude-kit tickets` — a terminal chart and a browser Kanban board showing each lane's status, agent, model, tokens and elapsed time ([below](#parallel-lanes-and-the-live-ticket-board)) |
 | 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **24** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
 
 Profiles (`lean` · `standard` · `enterprise`), team scopes, autonomy levels, and org capability
@@ -183,6 +184,64 @@ capture your own publishable run: [`docs/capture-a-real-run.md`](docs/capture-a-
 
 ---
 
+## Parallel lanes and the live ticket board
+
+The orchestrator never writes code — it splits work, spawns agents, and refuses to advance a gate.
+Once the spec clears the EM gate, `story-planner` produces stories and marks which ones are
+**independent**. Each independent story becomes a **lane**: its own ticket, its own branch, its own
+implement → review → test loop, running at the same time as the others.
+
+```mermaid
+flowchart LR
+    STORY["story-planner<br/>(marks independents)"] --> TK["One OPEN ticket per story"]
+    TK --> L1["Lane A — backend<br/>senior-backend-dev → code-review"]
+    TK --> L2["Lane B — frontend<br/>senior-frontend-dev → code-review"]
+    TK --> L3["Lane C — …"]
+    L1 --> MR{{"Gate: Merge Reviewer<br/>(the join)"}}
+    L2 --> MR
+    L3 --> MR
+    MR --> T1["unit-tester"]
+    MR --> T2["e2e-tester"]
+    MR --> T3["senior-tester<br/>(independent verification)"]
+    T1 --> TCG{{"Gate: Test coverage<br/>+ Devil's Advocate"}}
+    T2 --> TCG
+    T3 --> TCG
+    TCG --> DONE["Tickets → DONE,<br/>commits linked"]
+```
+
+Two things make this observable rather than a black box:
+
+- **A ticket is opened before any lane starts** and accumulates a work-log entry per meaningful step —
+  what changed, why, which files, what was decided (`ticketing-and-traceability`). Commits carry the
+  ticket id, so `git log --grep=` walks it in either direction.
+- **Lanes are branches, and telemetry is keyed on the branch.** `claude-kit tickets` reads the Claude
+  Code session transcripts (metadata only — usage counters, model id, agent name, timestamp) and
+  attributes tokens, cache, elapsed time, and the agent that ran to whichever ticket names that branch.
+
+### The board
+
+```bash
+claude-kit tickets                # board: one row per ticket, in-progress first
+claude-kit tickets --watch 5      # re-render every 5s while a run is in flight
+claude-kit tickets --graph        # dependency DAG — what is blocked by what
+claude-kit tickets --graph-git    # the commit graph with each commit's ticket attached
+claude-kit tickets CKIT-74        # one ticket: full work log + per-lane telemetry
+claude-kit tickets --html         # a Kanban board in your browser
+```
+
+`--html` writes a self-contained page to `.claude/state/ticket-board.html` and prints a `file://` URL.
+It is a **file, not a server** — the page refreshes itself and the `capture-ticket-telemetry` Stop hook
+rewrites it after each turn, so an open tab tracks a running pipeline live with nothing daemonised:
+
+![The claude-kit ticket board — Kanban columns for in progress, in review, actionable, blocked and done, each card showing model, tokens, cache, elapsed time and commit](docs/images/ticket-board.png)
+
+Token counts are **deduplicated by request id** — streaming rewrites the same usage block many times,
+and a naive sum overstates output by ~3× — and cache reads are counted separately from fresh input
+because they routinely differ by three orders of magnitude. Full reference:
+[`docs/cli.md`](docs/cli.md#the-ticket-chart-claude-kit-tickets).
+
+---
+
 ## Profiles & what lands in your project
 
 The profile you pick decides how much lands in `.claude/`. Measured on a React + FastAPI +

{claude_code_kit-0.72.0 → claude_code_kit-0.73.0}/agents/pr-raiser.md

@@ -128,6 +128,11 @@ After the PR is created, **close the tickets**: set each to DONE and record the
 on the ticket and in `docs/project/tickets/index.json` (`ticketing-and-traceability`). Skip when no
 local ticket store is in use.
 
+If the `claude-kit` CLI is available, run `claude-kit tickets <PREFIX>-<N>` before closing and copy the
+final figures (requests, tokens, cache, model, elapsed) into the ticket's work log. They are derived
+from the session transcript, which lives outside the repo and will not survive it — writing them onto
+the ticket is what makes the cost part of the permanent record.
+
 ### Step 7: Report
 Return to the Orchestrator:
 - PR URL

{claude_code_kit-0.72.0 → claude_code_kit-0.73.0}/catalog/profiles.yaml

@@ -104,7 +104,9 @@ profiles:
     # NOTE: the agent-side capture hooks (capture-learnings / -catchup / -stop) are deliberately NOT
     # listed here — they are installed by the init-time `capture_mode` choice via catalog/capture.yaml
     # (see catalog._apply_capture_mode), not by profile membership. load-learnings (recall) stays.
-    hooks: [load-continuity, load-learnings, load-autonomy, guard-rm-rf, guard-push-main, guard-destructive-git, protect-secrets, guard-commit-secrets, warn-shared-modules, warn-llm-io, lint-fix, type-check]
+    # capture-ticket-telemetry rides with the ticketing-and-traceability skill above: it is unrelated
+    # to capture_mode, self-throttles, and no-ops until a ticket store exists.
+    hooks: [load-continuity, load-learnings, load-autonomy, guard-rm-rf, guard-push-main, guard-destructive-git, protect-secrets, guard-commit-secrets, warn-shared-modules, warn-llm-io, lint-fix, type-check, capture-ticket-telemetry]
 
   enterprise:
     label: "Enterprise — adds DevOps, Observability, full audit + acceptance"

{claude_code_kit-0.72.0 → claude_code_kit-0.73.0}/docs/cli.md

@@ -17,6 +17,7 @@ exports the kit's configuration. Install: `pip install claude-code-kit` (see
 | `pipeline validate · status · close-gate · abort` | Inspect/mutate the `/sdlc` state files (gate/lane/evidence coherence); **does not run** the pipeline |
 | `list-options` | List available frontend/backend/database/profile/MCP options |
 | `status [path]` | Show what's installed, the selection, and working memory |
+| `tickets [ID] [--path DIR] [--graph\|--graph-git] [--html] [--watch N] [--json]` | Live ticket board with tokens / model / agent / elapsed per ticket; `--graph` for the dependency graph, `--graph-git` for the commit graph, `--html` for a browser Kanban board, an `ID` for the detail view |
 | `version` | Print the version |
 | `package-org-pack` · `install-org-pack` | **Planned** — packaging/distribution of org capability packs. Today these are hidden stubs that describe the intended behavior and exit 2; org packs already install via `init` (organization scope) |
 
@@ -27,6 +28,53 @@ worktrees); plus the `/sdlc` skill inside any scaffolded project.
 > When MCP servers are selected, `init` also writes a derived **`.mcp.lock.json`** pinning each
 > server's resolved package version — inspect it (or run `doctor --mcp`) to see exactly what would run.
 
+## The ticket chart (`claude-kit tickets`)
+
+Reads the local ticket store (`docs/project/tickets/`, created by the `ticketing-and-traceability`
+skill) and joins it with usage figures parsed live from the Claude Code session transcript:
+
+```
+CKIT  4 tickets  3 open  2 actionable  1 blocked  1 in progress  1 done
+
+ID      TITLE                              STATUS       AGENT      MODEL     TOKENS  CACHE  TIME  COMMITS
+CKIT-2  Ticket board and dependency graph  IN PROGRESS  developer  opus-4-8  34.5k   5.9M   9m    -
+CKIT-3  Wire the tickets CLI command       BLOCKED      -          -         -       -      -     -
+```
+
+Three things worth knowing:
+
+- **`BLOCKED` is derived, not stored.** A ticket is blocked when something it `depends_on` is still
+  open. Sub-tickets (`child_of`) are *not* blocked by an open parent. The header always shows the open
+  count next to actionable, so a fully-gated backlog can't be mistaken for an empty one.
+- **Telemetry is per branch.** `gitBranch` is the only ticket-shaped key a transcript carries, so
+  tickets sharing a branch show that branch's totals — the board footnotes this and the detail view
+  names the tickets that share the figure.
+- **Only metadata is read** — token counts, model ids, agent names, timestamps, branch. Never message
+  content. `--watch N` re-renders every N seconds; figures move as each turn completes.
+
+Without a ticket store the command prints a short hint; without transcripts the board still renders
+with `-` in the telemetry columns.
+
+### In the browser (`--html`)
+
+```bash
+claude-kit tickets --html          # writes .claude/state/ticket-board.html, prints a file:// URL
+```
+
+That produces a Kanban board — **IN PROGRESS · IN REVIEW · ACTIONABLE · BLOCKED · DONE** — with one
+card per ticket showing its model, tokens, cache, elapsed time, agent, branch, commits, and any
+blocker. Open the printed `file://` URL and leave the tab up.
+
+It is a **file, not a server**. Nothing runs in the background: a `<meta http-equiv="refresh">` tag
+makes the browser re-read the file, and the `capture-ticket-telemetry` Stop hook rewrites it as the
+session progresses — together that gives live progress with no daemon and no port. The hook only
+refreshes the board *if the file already exists*, so generating it once is what opts you in.
+
+The page is fully self-contained: inline CSS, no JavaScript, no fonts, no images, no CDN. Opening it
+makes zero network requests, so ticket titles never leave the machine. It follows your OS light/dark
+preference. Use `--refresh 0` for a static snapshot you want to keep or share, or `--refresh 30` to
+slow the reload down.
+
 ## Safe upgrades — how your edits are protected
 
 Every install records per-file checksums and an `owner` (kit / overlay / user-editable) in

{claude_code_kit-0.72.0 → claude_code_kit-0.73.0}/docs/influences.md

@@ -41,6 +41,7 @@ non-duplicative gaps**, minimally and catalog-wired.
 | **[usestrix/strix](https://github.com/usestrix/strix)** (Apache-2.0 — *external tool, documented not bundled; zero code copied*) | The kit's security stage was entirely **static** (secret / dependency / OWASP / policy readers) with no dynamic exploit-validation lane, and pentesting was documentation-only (`shannon-ai-pentest` / `zap-vapt-scanning`) with **no agent that actually runs one** — so "run a pentest" had nowhere to route | A new **`strix-ai-pentest`** skill (drives the Apache-2.0 `strix-agent` CLI — targets/scan-modes/diff-scope/headless-CI/providers/viewer/safety) + a new **`pentest-scanner`** agent: a conditional, authorization-gated **dynamic** security sub-scanner that drives Strix / Shannon / ZAP and feeds **PoC-validated** findings to the Security Clear gate (non-blocking when its preflight fails). Wired into `security-reviewer`, `tester`, and the orchestrator; the three pentest skills + the agent promoted to the **standard** profile — **1 new skill, 1 new agent** | `0.70.0` |
 | **[PentesterFlow/agent](https://github.com/PentesterFlow/agent)** (Apache-2.0 — *external tool, documented not bundled; zero code copied*) | The pentest lane had autonomous (Strix/Shannon) and DAST (ZAP) options but no **human-in-the-loop / analyst-controlled** tool — the supervised, approval-gated mode that scoped engagements and bug bounty need, and the only no-Docker / local-model path | A new **`pentesterflow-pentest`** skill (drives the Apache-2.0 `pentesterflow` binary — HITL approval model, local/hosted backends, `--target`/`--resume`/`--burp`, built-in skills, evidence-backed `confirm_finding` reports, Burp bridge + MCP, safety) added to the `pentest-scanner` tool set (Strix / Shannon / **PentesterFlow** / ZAP) and the **standard** profile — **1 new skill, 0 new agents** | `0.71.0` |
 | **[rpostulart/Claude-Project-Tracker](https://github.com/rpostulart/Claude-Project-Tracker)** (**no license / all rights reserved** — *ideas absorbed in our own words, zero code copied*) | Git-native project tracking as the audit trail the pipeline lacked — a ticket opened **before** work starts, every step logged (what/why/which-files/decisions), a functional/technical/decision wiki, and commits linked back to tickets so any change traces to its reasoning | A new **`ticketing-and-traceability`** skill (local `docs/project/tickets/` Markdown+JSON store · `<PREFIX>-<N>` ids · OPEN→DONE lifecycle · per-change work-log · a wiki that *indexes* the spec/dev-docs/ADRs, never duplicates · ticket↔commit convention · optional `task-tracker-sync` mirror) + orchestrator **Stage TK** (one ticket per story, after the persona/plan/story gates and before implementation) wired through `pr-raiser`/`story-planner`/`spec-doc-writer`, `mandatory-workflow` §1g + §Commit-format, and reused `git-workflow-and-versioning`/`documentation-and-adrs`/`task-tracker-sync` — **advisory** (no hooks); **1 new skill, 0 new agents/rules/hooks** (not adopted: the reference's Deno server + web Kanban UI) | `0.72.0` |
+| **[quazardous/aiball](https://github.com/quazardous/aiball)** (MIT, © 2026 David Berlioz — *concepts re-expressed in our own words, zero code copied*) | 0.72.0's ticket store recorded *what changed and why* but nothing about **what the work cost**, and a flat ticket list cannot say which work is genuinely startable — a backlog where every item is gated reads identically to an empty one | A **runtime chart**: `claude-kit tickets` (terminal board · `--graph` dependency graph · `--graph-git` commit graph · per-ticket detail · `--watch` · `--json` · **`--html`** browser Kanban board, a self-contained file plus meta-refresh rather than a server) over two new modules — `telemetry.py` (metadata-only transcript aggregation, deduped by `requestId`, attributed by `gitBranch`) and `tickets.py`, which adopts aiball's **relation model** (`depends_on`/`blocks` gate workability; `child_of`/`parent_of` lineage deliberately does not), its derived **BLOCKED** status, and its **lens invariant** (always surface the open count beside actionable) — plus a throttled `capture-ticket-telemetry` Stop hook; **0 new skills/agents/rules, 1 new hook** (not adopted: aiball's daemon, web board, and PTY proxy — the kit ships configuration, not a service) | `0.73.0` |
 
 > Each adoption is detailed in the [CHANGELOG](../CHANGELOG.md) — including, for every review, what we
 > deliberately **did not** add because the kit already covered it.

claude_code_kit-0.73.0/hooks/scripts/capture-ticket-telemetry.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Persist a durable snapshot of ticket telemetry (tokens / model / agent / timing) -- NON-BLOCKING.
+#
+# `claude-kit tickets` reads the session transcript live, which is exactly what you want for the
+# in-flight numbers. Transcripts are not forever, though: they live outside the repo under
+# ~/.claude/projects/ and get pruned or lost with the machine. This Stop hook keeps a snapshot inside
+# the project so the history survives that, and so pr-raiser has final figures to fold into the ticket
+# at closure.
+#
+# The snapshot is produced by `claude-kit tickets --json` rather than re-derived here in jq. That
+# matters: usage blocks repeat across streaming writes, so the totals are only correct if identical
+# requestIds are collapsed before summing (a naive sum overstates output ~3.3x). Shelling out keeps
+# exactly one implementation of that rule -- the tested Python one -- instead of a second, silently
+# divergent copy in shell.
+#
+# Conservative + safe by construction:
+#   * Silent no-op without the `claude-kit` CLI (plugin-only installs), without a ticket store, or
+#     outside a project directory. Never fails a turn.
+#   * Throttled: rewrites at most once per CLAUDE_KIT_TELEMETRY_INTERVAL seconds (default 60), so a
+#     burst of short turns doesn't re-scan the transcript set every time.
+#   * Detached background job -- the hook returns immediately and never delays the next prompt.
+#   * Writes only inside the gitignored .claude/state/, so it produces no commit noise.
+#   * Metadata only: token counts, model ids, agent names, timestamps. No message content.
+#   * Opt out with CLAUDE_KIT_NO_TELEMETRY=1.
+#
+# It also refreshes the HTML board -- but ONLY if that file already exists. Its presence is the
+# opt-in signal: you get it by running `claude-kit tickets --html` once, and from then on the browser's
+# auto-refresh shows live progress. Terminal-only users never pay for a render they don't look at.
+set -u
+
+[ -n "${CLAUDE_KIT_NO_TELEMETRY:-}" ] && exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+command -v claude-kit >/dev/null 2>&1 || exit 0
+
+INPUT=$(cat 2>/dev/null) || exit 0
+PROJECT_DIR=$(printf '%s' "$INPUT" | jq -r '.cwd // empty' 2>/dev/null)
+[ -n "$PROJECT_DIR" ] || PROJECT_DIR="${CLAUDE_PROJECT_DIR:-}"
+[ -n "$PROJECT_DIR" ] && [ -d "$PROJECT_DIR" ] || exit 0
+
+# No ticket store means nothing to attribute telemetry to.
+[ -d "$PROJECT_DIR/docs/project/tickets" ] || exit 0
+
+STATE_DIR="$PROJECT_DIR/.claude/state"
+SNAPSHOT="$STATE_DIR/ticket-telemetry.json"
+BOARD="$STATE_DIR/ticket-board.html"
+
+INTERVAL="${CLAUDE_KIT_TELEMETRY_INTERVAL:-60}"
+case "$INTERVAL" in '' | *[!0-9]*) INTERVAL=60 ;; esac
+
+# Throttle: skip when the existing snapshot is younger than the interval. `find -newermt` is not
+# portable, so compare mtimes via stat, tolerating either GNU or BSD syntax.
+#
+# GNU is tried FIRST on purpose. BSD `stat` has no `-c` at all, so it errors and falls through
+# cleanly -- whereas on GNU `stat -f` means "filesystem status" and `%m` is the mount point, so
+# BSD-first would *succeed* on Linux, return `/`, and silently disable the throttle.
+if [ -f "$SNAPSHOT" ] && [ "$INTERVAL" -gt 0 ]; then
+  MTIME=$(stat -c %Y "$SNAPSHOT" 2>/dev/null || stat -f %m "$SNAPSHOT" 2>/dev/null || echo '')
+  NOW=$(date +%s 2>/dev/null || echo '')
+  case "$MTIME" in '' | *[!0-9]*) MTIME='' ;; esac
+  case "$NOW" in '' | *[!0-9]*) NOW='' ;; esac
+  # An unreadable clock or mtime falls through and just writes -- better a redundant scan than none.
+  if [ -n "$MTIME" ] && [ -n "$NOW" ] && [ $((NOW - MTIME)) -lt "$INTERVAL" ]; then
+    exit 0
+  fi
+fi
+
+mkdir -p "$STATE_DIR" 2>/dev/null || exit 0
+
+# Detached so the turn never waits on the scan. Write to a temp file and move into place, so a reader
+# never observes a half-written snapshot.
+(
+  TMP="$SNAPSHOT.$$.tmp"
+  if claude-kit tickets --path "$PROJECT_DIR" --json >"$TMP" 2>/dev/null; then
+    mv -f "$TMP" "$SNAPSHOT" 2>/dev/null || rm -f "$TMP" 2>/dev/null
+  else
+    rm -f "$TMP" 2>/dev/null
+  fi
+  # Only when the board already exists -- see the opt-in note in the header.
+  [ -f "$BOARD" ] && claude-kit tickets --path "$PROJECT_DIR" --html >/dev/null 2>&1
+) >/dev/null 2>&1 &
+
+exit 0

{claude_code_kit-0.72.0 → claude_code_kit-0.73.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "claude-code-kit"
-version = "0.72.0"
+version = "0.73.0"
 description = "Cookiecutter-style scaffolder for an autonomous Claude Code SDLC configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates, working memory, and a self-improving learnings loop."
 readme = "README.md"
 requires-python = ">=3.9"

{claude_code_kit-0.72.0 → claude_code_kit-0.73.0}/skills/ticketing-and-traceability/SKILL.md

@@ -146,6 +146,27 @@ This is the "trace any change back to its reasoning" requirement, enforced by co
   into the ticket's `index.json` entry and, if useful, the work-log. Now the link is navigable both
   ways: commit → ticket (via the message) and ticket → commits (via the index).
 
+## Seeing the board
+
+When the pip CLI is installed, `claude-kit tickets` renders the store as a live chart — one row per
+ticket with its status, the agent and model that did the work, tokens, cache, and elapsed time, ordered
+in-progress first. `--graph` shows the dependency graph (what is blocked by what), `--graph-git` walks
+the commit graph with each commit's ticket attached, `claude-kit tickets <PREFIX>-<N>` opens one
+ticket's detail with its full work log, and `--watch 5` re-renders while a run is in flight.
+
+For a browser view, `claude-kit tickets --html` writes a Kanban board to
+`.claude/state/ticket-board.html` and prints a `file://` URL. It is a plain file, not a server — the
+page reloads itself and the Stop hook keeps it current, so it tracks progress live with nothing
+running in the background.
+
+Two conventions make those figures work, so record them:
+
+- **Put the branch on the ticket** (`- **Branch:** feat/…`). Usage is attributed by branch; a ticket
+  with no branch shows no telemetry. Tickets sharing a branch share its totals.
+- **Declare dependencies in `index.json`** under `relations`: `depends_on` / `blocks` gate whether a
+  ticket is workable and surface it as **BLOCKED**; `child_of` / `parent_of` express structure and
+  deliberately do *not* gate. `relates_to` and `duplicates` are informational.
+
 ## Optional external mirror
 
 The local store is always the source of truth. If the project runs an external tracker and wants the

{claude_code_kit-0.72.0 → claude_code_kit-0.73.0}/src/claude_kit/__init__.py

@@ -7,4 +7,4 @@ Docker): ``claude-kit init`` asks ordered questions and lays down ``CLAUDE.md``
 as a plugin. Extensibility is data-driven via the ``catalog/`` (stacks, profiles, MCP).
 """
 
-__version__ = "0.72.0"
+__version__ = "0.73.0"