claude-code-kit 0.76.0__tar.gz → 0.78.0__tar.gz

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "displayName": "Claude Kit SDLC",
       "source": "./",
       "description": "Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with a tamper-evident gate ledger, working memory, and a self-improving learnings loop.",
-      "version": "0.76.0",
+      "version": "0.78.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "claude-kit",
   "displayName": "Claude Kit SDLC",
-  "version": "0.76.0",
+  "version": "0.78.0",
   "description": "Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with a tamper-evident gate ledger, working memory, and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/CHANGELOG.md

@@ -4,6 +4,269 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.78.0] — 2026-08-08
+
+**Two decisions carried out of the 0.77.0 evaluation, one of which only half works.** Both are
+prose changes to shipped payload — no code, no schema, no CLI surface. They are released together
+because they answer the same question from opposite directions: what a rule is *for* when a hook
+already does the job, and what routing prose can make a session do.
+
+### Added
+
+- **`templates/CLAUDE.md` now says: do not perform a coordinator's role yourself — spawn the
+  coordinator.** The failure this addresses is not idleness but a convincing imitation. Measured on
+  the same task with the same agents installed, a session asked directly spawned `developer` and
+  `sdlc-code-reviewer` in sequence — the right leaf work, in the right order — but never spawned
+  `orchestrator`; asked for a security review it dispatched all four sub-scanners in parallel but
+  never spawned `security-reviewer`. The designed behaviour happened; the agent that owns the gate
+  ledger, stage order, lane/wave state and resume snapshot did not. **This works for one of the two
+  coordinators** (F-036, recorded `partially_fixed`, not `fixed`):
+
+  | coordinator | spawned itself | baseline | verdict |
+  |---|---|---|---|
+  | `security-reviewer` | 6/8 | 0/1 | works |
+  | `orchestrator` | 1/8 | 0/1 | does not — still ad-hoc |
+
+  Two wordings, 8 runs each. The combined 4/8 vs 3/8 is one run on n=4 and is noise; the per-agent
+  split is stable across both wordings. The `orchestrator` result reproduces E-060's conclusion —
+  the probe hands the session the orchestrator's own job description and then asks for the work, so
+  adopting the role is close to the reasonable reading of the prompt. Through `/sdlc` it dispatches
+  correctly. **If you want the pipeline, invoke `/claude-kit:sdlc`; do not rely on this paragraph to
+  route you there.**
+
+### Changed
+
+- **`rules/continuity.md` now states why it restates what the hook already does.** Ablation shows
+  `load-continuity.sh` is both necessary *and* sufficient for the file-observable half of the
+  continuity protocol: with the hook on, the behaviour happens whether or not the rule is loaded.
+  That makes the overlap read as dead weight — and deleting it would be wrong. Hooks are opt-out,
+  can be disabled per project, are skipped by harnesses that do not run `SessionStart`, and are the
+  first thing removed when someone is debugging. An install with no hooks still needs the resume
+  contract stated somewhere. The rule is now explicit that the prose is the contract and the hook is
+  one implementation of it, so neither may be deleted on the grounds that the other covers it
+  (E-020) — which is exactly the inference the ablation invites.
+
+### Not adopted (deliberately)
+
+- **A wording that routes through the `sdlc` skill instead of naming the agent.** It fired **0/8** —
+  with the skill installed (125 in the workspace), the `Skill` tool allow-listed, and the paragraph
+  verified present in the workspace `CLAUDE.md`. This is F-110 reproducing inside a fix for a
+  different finding: routing prose cannot delegate to a skill that will not trigger on task-shaped
+  work. It bounds what any instruction of this shape can achieve, so the shipped wording names the
+  agent directly. The skill-shaped variant is not a worse sentence, it is a sentence with no
+  mechanism behind it.
+
+- **Rewording until `orchestrator` self-spawns.** Two wordings at 8 runs each moved
+  `security-reviewer` to 6/8 and left `orchestrator` at 1/8; the split held across both. A third
+  wording was not attempted, because the per-agent stability says the variable is not the wording —
+  it is that the probe's prompt *is* the orchestrator's job description, and E-060 already reached
+  that conclusion once. Shipping a partial fix with the gap named is honest; iterating prose against
+  a probe artefact until the number moves is how a measurement becomes a target. F-036 stays open.
+
+- **F-110 itself.** Skills fire 19/20 on prompts that restate their own description and **0/90** on
+  realistic task-shaped work. Whether skills *ought* to surface unprompted, or are reference
+  material a session reads on demand, is a product decision rather than a defect to patch, and it is
+  unchanged by this release. The 19/20 figure should continue to be read as the easiest possible
+  case.
+
+## [0.77.0] — 2026-08-04
+
+**The kit stopped fitting in the window it ships into.** Every rule in `.claude/rules/` loaded at
+launch, on every session, whether or not it applied. Measured on a default install: **101,255 tokens
+of rules, 173,750 tokens of standing context — 87% of a 200k window consumed before a single word of
+work.** On the flagship path this was not a slow session, it was a dead one: a `/sdlc` run on the
+shipped default was killed by autocompact thrashing having dispatched *zero* agents.
+
+### Fixed
+
+- **Rules are now split into a covenant and a scoped set.** Seven rules whose trigger is *temporal*
+  — `rarv-cycle`, `risk-classification`, `autonomy-levels`, `quality-gates`, `mandatory-workflow`,
+  `human-in-the-loop`, `continuity` — still load at launch, because "every turn" and "every change"
+  cannot be expressed as a file glob. The other eighteen carry `paths:` frontmatter and load when you
+  touch matching files.
+
+  | | standing context | attributable to rules | % of a 200k window |
+  |---|---:|---:|---:|
+  | before | 173,750 | 101,255 | 87% |
+  | after | 91,511 | 19,016 | 46% |
+
+  **Nothing was moved, renamed, shortened or deleted.** Every rule keeps its full text at its
+  existing path, so all ~668 `.claude/rules/<name>.md` citations across agents, skills and docs still
+  resolve, and any rule remains readable by name at any time.
+
+- **`CLAUDE.md` gained a rule index** — the seven always-on rules and the eighteen on-demand ones,
+  each with a "read it when" trigger, so a scoped rule stays discoverable rather than merely absent.
+
+- **`documentation.md` is scoped to source files, not only markdown.** It mandates headers and
+  docstrings on *source*; scoping it to `**/*.md` would have inverted it, loading the rule when
+  editing docs and hiding it when editing the code it governs.
+
+- **Security- and observability-sensitive work now reaches a specialist regardless of which
+  workflow it routed to.** Across fifteen shipped-default scenario runs, `agents_spawned` and
+  `skills_invoked` were both empty — the entire agent and skill layer was dormant. Two structural
+  causes: pipeline stages are written as bracketed role *labels* (`[Developer]`), which read as a
+  hat the main session puts on rather than an agent to spawn; and anything that is not a new feature
+  routes to a six-step bug-fix flow with no specialist step, so a SQL-injection fix bypassed the
+  security stage by construction. `mandatory-workflow.md` gained a **Specialist routing** block keyed
+  on the *surface the change touches*, an explicit statement that a bracketed label names an agent,
+  and a proportionality clause. Measured: baseline 0 spawns; with the block, `security-reviewer` in
+  2/2 runs (one fanning out to all four sub-scanners), while a docs-only task still spawns nothing
+  and passes.
+
+- **The learnings hook no longer tells every session that capture is automatic.**
+  `load-learnings.sh` injected "New learnings are captured automatically" unconditionally, but
+  0.76.0 consent-gated the capture hooks *off* by default — so in a default install the kit asserted
+  a falsehood into context on every session, and a self-defeating one: an agent told its learnings
+  are already recorded has no reason to record them. It now reads the installed `settings.json` and
+  states which of the two worlds the project is in.
+
+- **Reference solutions, fixtures and holdouts are excluded from `ruff`.** They are data, not this
+  project's code — spec behaviours match against their source *text*, so import-sorting or
+  reformatting them could silently change what a check matches. Mirrors the existing
+  `collect_ignore_glob` in the eval conftest.
+
+- **The commit secret-guard now catches URI-embedded credentials and AWS secret access keys.**
+  `hooks/scripts/guard-secrets.sh` matched only vendor-*prefixed* tokens (`AKIA…`, `sk_live_…`,
+  `ghp_…`) and PEM headers, so `postgresql://svc:<real-password>@db/warehouse` and
+  `AWS_SECRET_ACCESS_KEY=<40 chars>` — neither of which carries a distinguishing prefix — committed
+  cleanly. Both are detected now, and the hook's values-not-names rule is preserved: the AWS key
+  matches only when the variable name sits *adjacent to* a 40-character value, so a CI binding or a
+  prose mention still passes. URI credentials require a high-entropy password (≥16 characters,
+  excluding placeholder shapes such as `user:pass`, `<REDACTED>`, `${VAR}` and `YOUR_*`) — this repo
+  alone ships 30+ documentation placeholders of that shape, and a guard that blocks a compose-file
+  example teaches people to work around the guard.
+
+- **Skills that were losing selection now win it.** Ten skills either lost to a plausible neighbour
+  on a restatement of their own description (`api-integration` → `tanstack-react-query-patterns`,
+  `component-design` → `frontend-ui-engineering`, `performance-optimization` →
+  `frontend-ui-engineering`, `smoke-test` → `run`) or fired nothing at all (`load-testing`,
+  `manual-test`, `sprint`, `security-and-hardening`, `security-verification`,
+  `modernization-and-migration`). `CLAUDE.md` gained a **Skill routing** section stating each
+  boundary — what the skill is *not* — plus the four that were simply silent. Measured over 20 runs
+  (10 skills × 2 replicates, serial, prompts fixed up front): **19/20 invoked the target skill by
+  name, against a recorded baseline of 0/10.**
+
+  The section also explains *why* these particular skills need naming: sixteen of them carry
+  `disable-model-invocation: true`, so the picker never volunteers them. That is a deliberate design
+  choice and **not** a prohibition — 13 of the 14 slash-only runs invoked their skill normally once
+  it was named. A drift test pins the list in both directions, so a skill that gains the flag cannot
+  go quietly unroutable and one that loses it cannot keep a rationale that no longer applies.
+
+- **Two repo validators can now fail.** `check_skill_descriptions.py` and
+  `check_cross_references.py` both detected their planted defects but exited 0 by design, so a
+  regression in either shipped silently — and two over-long descriptions had persisted precisely
+  because nothing failed. Both offenders are long since fixed and both checkers are clean, so CI now
+  runs them with `--strict`. Verified two-sided rather than assumed: each exits 1 on a planted
+  defect and 0 on the shipped payload.
+
+- **The release docs no longer describe a manual step that has been automated since 0.57.0.**
+  `CONTRIBUTING.md` and `CLAUDE.md` both told the releaser to "tag the release and push", which
+  `publish.yml`'s `github-release` job has done automatically for eighteen releases. That stale
+  instruction is also why `scripts/backfill-releases.sh` looked like dead code: nothing told anyone
+  to run it. Both sections now state that tagging is automatic and name the script as the recovery
+  path for a published version missing its tag.
+
+### Added
+
+- **`verify-continuity-writeback.sh`** — a Stop hook that reports when a session changed files but
+  never wrote back to `CONTINUITY.md`. `rarv-cycle.md` step 4 ("update `CONTINUITY.md` with what
+  passed") was observed 0/12 across every measured arm *including the arm where `rarv-cycle` was the
+  only rule loaded*: a rule that cannot cause its behaviour even alone is not weak prose but an
+  unkept contract, so it gets a mechanism — the Stop-hook mirror of the SessionStart hook that
+  already carries the read half. The signal is mtime ordering rather than "was the file touched",
+  because the rule asks for a write-back *after* the work and a stale file must not be credited.
+  Whether the content is any good is deliberately not graded: that is an LLM judgement, and this
+  kit's own rules forbid substituting one for a deterministic oracle. Never blocks; every unknown
+  (no git, no jq, unreadable mtime) degrades to silence.
+- `scripts/evals/grade_covenant.py` — grades the covenant dilution sweep, refuses to score a run
+  that produced no oracle verdict, and prints the specificity control beside the result so a
+  prompt-length effect cannot be read as a rule effect.
+- Nine hook-script tests: six two-sided ones for the write-back hook (it must *fire* on a planted
+  defect and stay *silent* on the compliant control, a clean tree, its own `.claude/` output, a stop
+  chain, and outside a git repo) and three pinning both arms of the capture-state wording.
+- `scripts/evals/measure-standing-context.sh` — reproducible standing-context measurement
+  (`input + cache_creation + cache_read`), with an empty-directory control so the kit's cost is
+  reported as a *difference* and never as a raw session total.
+- Four new payload pins in `tests/test_rule_frontmatter.py`: the covenant is frontmatter-free, every
+  other core rule carries valid globs, covenant membership is exhaustive (a new rule must make a
+  deliberate covenant-or-scoped choice rather than joining the always-on set by omission), and
+  `documentation.md` matches source.
+- Eight `guard-secrets.sh` scenarios in `tests/evals/hooks/hook-scenarios.json` — three proving the
+  new detections fire, five as false-positive controls. All five controls also pass against the
+  *pre-fix* hook, so the change is measured to add catches without adding noise.
+- A `pentest-scanner` entry in `docs/KNOWN_LIMITATIONS.md`. The agent is enterprise-only, opt-in and
+  preflight-gated, so a default install correctly reports `SKIPPED`; separately, a request phrased as
+  a general "run a penetration test" can be refused by the model platform under its cyber-content
+  policy before the agent's own gate is reached. That is a platform response the kit cannot suppress,
+  and users should know it rather than meet it as a surprise.
+
+### Not adopted (deliberately)
+
+- **A "Persona routing" section in `templates/org/rules/ai-working-agreement.md`.** It was written,
+  and then measurement removed the reason for it. The finding behind it (F-044) reported that three
+  org personas — `founder-prototype-agent`, `internal-tools-builder`, `staff-pm-reviewer` — are
+  never selected for work their own descriptions advertise, and that a generic `Explore` or
+  `general-purpose` agent takes it instead. That was measured 0/6, with the probe's standing
+  deviation of moving `.claude/rules` out of the workspace. Re-run with the rules left in place and
+  **no routing prose at all**, the same personas are selected 5/6. Persona routing is delivered *by*
+  the org rules, so the probe had been deleting the mechanism and then reporting the mechanism
+  missing. The prose was reverted: it addressed a defect that does not exist in a shipped install,
+  and adding payload to close a measurement artefact is the churn this work is supposed to prevent.
+  The harness bugs the exercise surfaced were kept and fixed (F-106 through F-108).
+
+- **Slimming the covenant rules and relocating their detail (Phase 2 of the design spec).** Would
+  reach ~78,700 standing context (rules ~8,000) — a further ~14k tokens. It requires rewriting four
+  large rules into contracts plus a new `references/` home, with scaffolder, validator and
+  upgrade-path work. Phase 1 already captures ~90% of the available reduction and is the difference
+  between exceeding a 200k window and fitting inside it; the rest is a separate release. The plan
+  stands in `docs/rules-context-budget.md`. **Update:** Phase 2's premise has since been measured
+  and does not hold. It rested on the covenant rules diluting each other (F-073) — but that
+  hypothesis was formed when 25 rules loaded and the prompt ran ~163k tokens. Re-taken at 7 rules,
+  the shipped arm is indistinguishable from the isolated one (severity labelled 5/5 vs 5/5; blocking
+  verdict 3/5 vs 4/5, Fisher one-sided p=0.50). The specificity control also showed
+  `severity_classified` never discriminated at all — 3/3 for a rule with no severity ladder — so
+  part of F-073's original evidence rested on a check that could not fail. Phase 2 is now a
+  token-cost optimisation with no measured behavioural defect behind it.
+
+- **Splitting `mandatory-workflow.md`.** At 25,307 B it is a third of the always-on budget and the
+  obvious first cut. It is not being cut: Phase 1 already removed the failure it would have
+  addressed (three scenarios that died with "Prompt is too long" now complete), and with no live
+  defect the split is churn against a 668-citation surface.
+
+- **Fixing the two SC-22 oracle defects found while measuring the specialist routing.** One check
+  flags an f-string in an *error message* as SQL injection, penalising a session for adding input
+  validation; the other demands a parameterised rewrite while also requiring the pristine tests —
+  which assert the un-parameterised return type — to keep passing, so no correct implementation can
+  pass the scenario. Both are recorded (F-096, F-097) and neither is touched here: SC-22 is sealed
+  by `task-bank-lock.json` and both were found *after* seeing candidate output. Editing a locked
+  oracle to fit the implementation is the one move the evaluation contract forbids outright; they
+  belong in a fresh pre-registered lock. **Update:** that fresh lock was authorised and taken, so
+  one of the two is now fixed and the other turned out not to exist. F-096's regex is replaced by
+  `caller_values_never_reach_the_sql_text`, which calls each helper twice with different caller
+  values (including `x' OR '1'='1`) and asserts the SQL *text* is identical across both and free of
+  the injected fragment — shape-agnostic, so it measures the security property however the solution
+  returns its query. F-097's premise was **wrong** and its proposed fix was reverted: both reference
+  solutions return `str` and satisfy the pristine tests, so the scenario was always passable and the
+  exclusions would have been unjustified holes. Re-locked with the two-sided proof re-run. Both
+  replicates now agree — injection check **passes**, contract check **fails** — because the
+  candidate's `(sql, params)` rewrite closes the injection but changes the return type, which
+  silently turns `assert "FROM orders" in orders_for_customer(7)` from a substring search into
+  element equality. A real regression, now legible instead of masked by a broken check.
+- **Scoping the covenant rules too.** Tried, measured, reverted. A path glob is a claim about *when*
+  a rule applies; for these seven the honest answer is "always", and globbing them silently exempts
+  docs-only, YAML-only and migration-only changes from gate and workflow discipline.
+- **Moving rule text out of `.claude/rules/` (Direction B).** Byte-identical moves look clean, but
+  they break ~668 citations and leave two homes for "rules" permanently.
+- **Putting every agent on `opus`.** The three-tier policy in `rules/model-tiers.md` is a cost
+  control, not an oversight; collapsing it would also leave that rule contradicting the payload.
+- **Rewording `pentest-scanner` so the platform stops refusing it.** Tuning wording until a safety
+  control stops firing is evading it, not fixing anything. The refusal is documented as the platform
+  behaviour it is; the agent's preflight gate, which is strict and correct, is left alone.
+- **Blocking low-entropy passwords in connection URIs** (`://svc:hunter2@db`). They are not
+  distinguishable from the `user:pass` placeholders that fill real compose files, CI configs and
+  docs; the false positives would cost more than the catch, and a guard people route around protects
+  nothing. The `secret-scanner` agent remains the deeper, non-blocking net for those.
+
 ## [0.76.0] — 2026-08-01
 
 **The Trust Release — enforcement catches up with the promise.** The kit has always *claimed* that
@@ -63,6 +326,42 @@ protect them, and a learning-capture job that ran before anyone consented to it.
   numbers are annotated as the 2026-07-07 measurement snapshot; `docs/launch/posts.md` gains a
   historical-snapshot banner.
 
+### Fixed (adversarial review of this release, pre-merge)
+
+A 6-lens adversarial review of the release branch (37 findings, every one reproduced live before
+being accepted) hardened the new surfaces before they shipped:
+
+- **Ledger integrity:** a `--force` re-record no longer poisons later `validate` runs (an
+  `overridden` entry is exempt from the monotonic-order check — it is the *documented* exception,
+  not tampering); the resume position is anchored at the **max** of all recorded gates so a forced
+  backfill can never rewind it; the snapshot lock now covers the whole read-modify-write (two
+  concurrent closes: one wins, one gets a clean refusal instead of silently overwriting), with a
+  60 s stale-lock steal so a crashed run can't wedge the pipeline; `close-gate` / `skip-gate`
+  refuse to record onto an **aborted** run; a skip records `verification: "agent"` (running the
+  CLI is not human attestation — `human` stays reserved for #74's explicit sign-off).
+- **Evidence portability:** evidence paths are resolved against the **project root** (never the
+  caller's CWD) and stored project-relative, so a different checkout location or a CI runner can
+  still re-hash the ledger; `validate` warns (not fails) on history entries from a different
+  profile's gate set.
+- **Gate order corrected:** `contract-clear` closes at the merge-review join (MR2) — **before**
+  test-coverage and security-clear, matching the orchestrator's Gate ↔ Stage map; the profile gate
+  lists and the ordered-resolution tests now pin the execution order exactly.
+- **Consent edges:** a non-TTY `init` (piped stdin / EOF) can never self-answer the capture
+  question into "on"; `capture_mode: on`/`true` in a config file is a hard error naming the real
+  modes (YAML 1.1 parses bare `on` as a boolean — a silent no-op before); `upgrade` prints a
+  notice when it preserves a pre-0.76 install's enabled capture; `privacy-report` matches hook
+  commands by exact basename (a look-alike script can no longer spoof an "OK" line).
+- **Wiring:** the orchestrator, the `/sdlc` skill, `rules/quality-gates.md` §2.5, and
+  `rules/continuity.md` now instruct agents to record verdicts **through the CLI ledger** when
+  `claude-kit` is on PATH — the enforcement layer is reachable from the pipeline that needs it,
+  not just from a human at a terminal.
+
+**Migration note (pre-0.76 installs):** upgrades never change your recorded `capture_mode` — a
+mode chosen (or defaulted) before 0.76.0 stays active and the upgrade says so; audit with
+`claude-kit privacy-report`, disable via `CLAUDE_KIT_NO_AUTOCAPTURE=1` or re-init. Existing
+pipeline snapshots without `gate_history` remain valid; the ledger starts recording from the next
+`close-gate`, anchoring wherever the run currently stands.
+
 ### Not adopted (deliberately)
 
 - **Splitting the plugin into core/standard/enterprise packages.** Profiles already gate what a

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/CLAUDE.md

@@ -42,7 +42,7 @@ The kit's central data flow is **Selection → catalog.resolve() → ResolvedPla
 
 | Module | Role |
 |--------|------|
-| `cli.py` | Typer app — all CLI commands (`init`, `validate`, `doctor`, `diff`, `export`, `upgrade`, `pipeline`, `list-options`, `status`). Experimental/planned commands are hidden unless `CLAUDE_KIT_EXPERIMENTAL=1`. |
+| `cli.py` | Typer app — all CLI commands (`init`, `validate`, `doctor`, `diff`, `export`, `upgrade`, `pipeline`, `list-options`, `status`, `privacy-report`). Experimental/planned commands are hidden unless `CLAUDE_KIT_EXPERIMENTAL=1`. |
 | `models.py` | Dataclass contracts: `Selection`, `ResolvedPlan`, `OrgPlan`, `InitOptions`, `FileRecord`, `UpgradeJournal`. The typed seam between prompts → resolver → installer → upgrader. |
 | `catalog.py` | The resolver — converts a `Selection` into a `ResolvedPlan` by reading the catalog YAML files. Must stay branch-free. |
 | `prompts.py` | Interactive `init` question flow (stack, profile, MCP, org scope, …). |
@@ -52,7 +52,7 @@ The kit's central data flow is **Selection → catalog.resolve() → ResolvedPla
 | `upgrader.py` | Safe, edit-preserving upgrade: checksum comparison, transactional journal, sidecar fallback for user-edited files. |
 | `validator.py` | Structural validation of an installed config (`validate` + `--strict` mode). |
 | `schemas.py` | JSON Schema definitions for catalog integrity checks (`validate --strict`). |
-| `pipeline.py` | Deterministic `/sdlc` state-file ops (validate, status, close-gate, abort) — inspects the state files, does **not** run the pipeline. |
+| `pipeline.py` | Deterministic `/sdlc` state-file ops (validate, status, close-gate, skip-gate, abort) — owns the append-only `gate_history` ledger (order enforcement, evidence sha256, atomic locked writes); inspects/records state, does **not** run the pipeline. |
 | `export.py` | Projection into Cursor / AGENTS.md / Copilot formats. |
 | `detect.py` | Stack detection from a target repo (heuristic-based; non-blocking). |
 | `report.py` | Human-readable reporting for `doctor` and `status` commands. |
@@ -138,7 +138,8 @@ root are read directly by the plugin **and** bundled into the wheel (mapped to
   shellcheck -S warning hooks/scripts/*.sh scripts/*.sh
   python scripts/gen_hooks.py --check          # hooks.json + settings.json drift
   python scripts/check_docs_consistency.py     # version parity + CHANGELOG heading
-  python scripts/check_cross_references.py     # rule/skill/agent refs in prose exist (warn-only)
+  python scripts/check_cross_references.py --strict    # rule/skill/agent refs in prose exist
+  python scripts/check_skill_descriptions.py --strict  # descriptions within the 250-char picker cap
   ```
 - **Stack-leakage guard:** `grep -rInE 'fastapi|sqlalchemy|alembic|docker' rules agents skills` — should
   be clean (balanced multi-framework *example* lists are acceptable; a real leak is agnostic logic
@@ -163,6 +164,8 @@ root are read directly by the plugin **and** bundled into the wheel (mapped to
 4. Build: `python3 -m build && python3 -m twine check dist/*`.
 5. Merge to `main` — CI auto-publishes to PyPI (OIDC trusted publishing). Manual `twine upload` is
    the fallback.
-6. Tag the release and push so plugin users get the update.
+6. Nothing to tag by hand — `publish.yml`'s `github-release` job creates the `vX.Y.Z` tag and the
+   GitHub Release on every successful publish (since 0.57.0). `scripts/backfill-releases.sh
+   --dry-run` is the recovery path if a published version is ever missing its tag.
 
 See `CONTRIBUTING.md` for the full contributor workflow.

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/CONTRIBUTING.md

@@ -1,7 +1,8 @@
 # Contributing to claude-kit
 
 Thanks for helping improve claude-kit! This guide covers the repo conventions, how to test
-locally, and how to release.
+locally, and how to release. Participation is governed by our [Code of Conduct](CODE_OF_CONDUCT.md);
+security issues go through [SECURITY.md](SECURITY.md) rather than a public issue.
 
 ## Mental model
 
@@ -77,6 +78,10 @@ mypy
 shellcheck -S warning hooks/scripts/*.sh scripts/*.sh
 python scripts/gen_hooks.py --check
 python scripts/check_docs_consistency.py
+python scripts/check_cross_references.py --strict
+python scripts/check_skill_descriptions.py --strict
+python scripts/check_rule_sizes.py
+python scripts/check_mcp_pins.py
 
 # Build + validate the package:
 python3 -m build
@@ -106,7 +111,10 @@ a specific stack — `pytest` enforces the no-Docker invariant on a scaffolded p
 3. `pytest` green, then `python3 -m build && python3 -m twine check dist/*`.
 4. CI auto-publishes to PyPI on merge to `main` when the version is new (`.github/workflows/publish.yml`,
    OIDC trusted publishing). Manual `python3 -m twine upload dist/*` is the fallback.
-5. Tag the release and push so plugin users get the update.
+5. The tag and GitHub Release are created for you — `publish.yml`'s `github-release` job does both on
+   every successful publish (since 0.57.0), so there is nothing to tag by hand. If a release ever
+   lands on PyPI without its tag, `scripts/backfill-releases.sh --dry-run` shows what is missing and
+   the same script without the flag creates it; it is idempotent, so re-running is safe.
 6. Publish the context-cost report for the release: run `claude plugin details claude-kit@claude-kit`
    in Claude Code and paste the token/context figures into the release notes, so users can see what
    the plugin costs their context window before installing.

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: claude-code-kit
-Version: 0.76.0
+Version: 0.78.0
 Summary: Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with a tamper-evident gate ledger, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -163,7 +163,7 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 | 🤖 **Agent roster** | **29** tiered agents led by an Orchestrator that never writes code, plus per-database overlay agents and 6 org personas ([full roster](docs/agents.md)) |
 | 📐 **Rules & skills** | **25** stack-agnostic core rules + **115** context-activated skills (58 core + 57 stack-collection), pulled into context on demand |
 | 🧱 **Stacks & overlays** | A stack-agnostic core + **13** overlay rule files (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands and path-scoped to load only when you touch matching files |
-| 🛠️ **Hooks & guards** | **19** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
+| 🛠️ **Hooks & guards** | **20** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
 | 📊 **Traceability & live board** | A git-native ticket per story with a work-log and commit linkage, plus `claude-kit tickets` — a terminal chart and a browser Kanban board showing each lane's status, agent, model, tokens and elapsed time ([below](#parallel-lanes-and-the-live-ticket-board)) |
 | 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **24** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
 
@@ -218,7 +218,7 @@ flowchart TD
 | Profile | Gates that run |
 |---|---|
 | **lean** | code-review · build-green |
-| **standard** | spec-complete · em-approved · code-review · build-green · test-coverage · security-clear · contract-clear\* |
+| **standard** | spec-complete · em-approved · code-review · build-green · contract-clear\* · test-coverage · security-clear |
 | **enterprise** | standard + pipeline-green · observability-ready · acceptance |
 
 \* `contract-clear` (API breaking-change diff) self-skips when the stack exposes no API surface.

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/README.md

@@ -130,7 +130,7 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 | 🤖 **Agent roster** | **29** tiered agents led by an Orchestrator that never writes code, plus per-database overlay agents and 6 org personas ([full roster](docs/agents.md)) |
 | 📐 **Rules & skills** | **25** stack-agnostic core rules + **115** context-activated skills (58 core + 57 stack-collection), pulled into context on demand |
 | 🧱 **Stacks & overlays** | A stack-agnostic core + **13** overlay rule files (React · FastAPI · Go · Postgres · Mongo) wired to your exact commands and path-scoped to load only when you touch matching files |
-| 🛠️ **Hooks & guards** | **19** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
+| 🛠️ **Hooks & guards** | **20** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
 | 📊 **Traceability & live board** | A git-native ticket per story with a work-log and commit linkage, plus `claude-kit tickets` — a terminal chart and a browser Kanban board showing each lane's status, agent, model, tokens and elapsed time ([below](#parallel-lanes-and-the-live-ticket-board)) |
 | 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **24** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
 
@@ -185,7 +185,7 @@ flowchart TD
 | Profile | Gates that run |
 |---|---|
 | **lean** | code-review · build-green |
-| **standard** | spec-complete · em-approved · code-review · build-green · test-coverage · security-clear · contract-clear\* |
+| **standard** | spec-complete · em-approved · code-review · build-green · contract-clear\* · test-coverage · security-clear |
 | **enterprise** | standard + pipeline-green · observability-ready · acceptance |
 
 \* `contract-clear` (API breaking-change diff) self-skips when the stack exposes no API surface.

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/agents/acceptance-reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: acceptance-reviewer
-description: Final acceptance gate before human review. Independently verifies that delivered work satisfies every acceptance criterion in the spec, end to end, and that all prior gates actually passed. Read-only — produces an accept/reject verdict.
+description: Checks delivered work against every acceptance criterion in the spec, end to end, and confirms all prior gates actually passed. Use when work claims to be done and needs independent sign-off. Read-only accept/reject verdict.
 tools: Read, Glob, Grep, Bash
 permissionMode: plan
 model: sonnet

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/agents/auditor.md

@@ -3,6 +3,7 @@ name: auditor
 description: Uses Chrome DevTools MCP to audit pages for accessibility, performance, responsive layout, and console errors. Read-only — produces audit reports.
 model: sonnet
 color: orange
+tools: Read, Glob, Grep, Bash, SendMessage, mcp__chrome-devtools
 tier: specialist
 ---
 
@@ -10,10 +11,17 @@ tier: specialist
 
 You are a UI audit agent for the project. You use Chrome DevTools MCP to audit deployed or dev pages for accessibility, performance, and responsive issues.
 
-> No `tools:` allowlist on purpose — you inherit the full toolset so the Chrome DevTools MCP tools
-> (navigate, snapshot, screenshot, performance trace, console) are actually reachable; an explicit
-> list would exclude them. You are **read-only by discipline**: never edit files, never mutate app
-> state — browser interaction is for inspection only, and your output is the report below.
+> `mcp__chrome-devtools` is a **server-level grant**: it admits every tool that server exposes
+> (navigate, snapshot, screenshot, performance trace, console) without naming them one by one, so
+> the allowlist does not go stale when the server's tool set changes. You hold no `Write`, no
+> `Edit`, and no `Agent`.
+>
+> **`Bash` is the exception, and it is on you.** You hold it so you can run the project's own
+> commands — start a dev server, check a build, curl a health endpoint — and `Bash` can write
+> files. So for you "read-only" is not a property the allowlist enforces; it is a rule you keep.
+> Never use `Bash` to create, edit, move or delete anything in the project. If an audit appears to
+> need a write, say so in the report and stop. Browser interaction is for inspection only, and
+> your output is the report below.
 
 ## Audit Workflow
 

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/agents/observability-engineer.md

@@ -1,6 +1,6 @@
 ---
 name: observability-engineer
-description: Observability agent for production readiness. Owns SLOs/SLIs, health and readiness checks, structured logging, alert rules, and request tracing. Runs after DevOps and gates the pipeline at "Observability Ready" before the PR is raised.
+description: Makes a service observable in production — SLOs and SLIs, health and readiness checks, structured logging, alert rules, request tracing. Use when a change needs monitoring or operational readiness. Owns the Observability Ready gate.
 tools: Read, Write, Edit, Bash, Glob, Grep
 permissionMode: acceptEdits
 model: sonnet

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/agents/orchestrator.md

@@ -28,7 +28,7 @@ subsets, so at Stage 0 derive this run's **active gate set** before dispatching
 | Profile | Active gates | Pipeline shape |
 |---------|--------------|----------------|
 | **lean** | code-review · build-green | Developer → SDLC Code Reviewer → build/tests green → Tester (full) → PR Raiser. No spec/design/architecture/EM/senior-tester agents exist — you hold the requirements and acceptance context yourself in CONTINUITY.md. |
-| **standard** | + spec-complete · em-approved · test-coverage · security-clear · contract-clear | The full pipeline below, minus DevOps / Observability / Acceptance. |
+| **standard** | + spec-complete · em-approved · contract-clear · test-coverage · security-clear | The full pipeline below, minus DevOps / Observability / Acceptance. |
 | **enterprise** | + pipeline-green · observability-ready · acceptance | The full pipeline below, all stages. |
 
 ## Core Behavior
@@ -50,6 +50,8 @@ subsets, so at Stage 0 derive this run's **active gate set** before dispatching
 
 Alongside the freeform file, maintain the **structured resume snapshot** `.claude/state/pipeline-snapshot.json` (schema in `.claude/rules/continuity.md`): write/update it at every stage transition with the active profile/scope, mode, stage, per-lane status, `last_gate_passed`, open findings by severity, the machine-derived repo identity (`git` branch/sha/worktrees and `pr` when one exists — from commands, never from conversation memory), and the next action. On resume, **reload it as context** — re-enter at the first gate *after* `last_gate_passed`, re-running only un-passed or defect-affected lanes; never re-run setup or re-apply edits already committed. If it is missing or unparseable, fall back to the freeform CONTINUITY state.
 
+**Gate verdicts go through the deterministic ledger, not hand edits.** Probe once per run for the subcommands themselves — `claude-kit pipeline close-gate --help >/dev/null 2>&1` and the same for `skip-gate` — never with `command -v claude-kit`, which passes for a binary of any age and lets a CLI installed long before the current payload look fully capable. When the subcommands answer, record every gate PASS by running `claude-kit pipeline close-gate <gate-token> --evidence <evidence-file>` (and a conditional gate that provably does not apply with `claude-kit pipeline skip-gate <gate-token> --reason '<why>'`) — the CLI enforces the installed gate order, refuses closes with open Critical/High/Medium findings, hashes the evidence, and writes atomically, which is what makes the ledger trustworthy. You still write the rest of the snapshot (stage, lanes, findings, next) yourself. When a subcommand is missing, append the `gate_history` entry per the schema by hand, keep the evidence file in the repo so a later `claude-kit pipeline validate` can re-verify it, and state which subcommand was missing alongside `claude-kit --version` — a stale binary on PATH is the likely cause, and reporting it as a missing product feature is a false statement about the kit. If the ledger write *itself* fails — refused path, read-only directory, denied tool — retry under `.claude/state/`, then hand-write the entry, and if neither is possible report the gate BLOCKED with the path and the error. Finishing the run with no ledger and calling it a success is the one option that is never available: a missing ledger is supposed to be noticeable.
+
 Every agent you dispatch runs the **RARV** cycle (Reason → Act → Reflect → Verify) and must show a green Verify before its gate may pass (`.claude/rules/rarv-cycle.md`). Classify every finding by the **severity model** in `.claude/rules/quality-gates.md` — a gate is PASS only with zero Critical/High/Medium open.
 
 ---
@@ -763,7 +765,11 @@ PIPELINE: DEFECT LOOP (cycle 1/2) - Backend lane re-entered, re-test API lane on
 ### Gate ↔ Stage Map (tokens for `last_gate_passed` / `gate_evidence`)
 
 Use these canonical gate tokens — they match `catalog/profiles.yaml` and the `sdlc` skill — in
-`.claude/state/pipeline-snapshot.json`:
+`.claude/state/pipeline-snapshot.json`. The table is in **execution order** (the same order
+`claude-kit pipeline close-gate` enforces): record each gate the moment it passes via
+`claude-kit pipeline close-gate <token> --evidence <file>` (skip a non-applicable conditional
+gate with `skip-gate <token> --reason '<why>'`); hand-edit the ledger only when the CLI is not
+installed:
 
 | Gate token | Stage(s) | PASS signal | Profiles |
 |------------|----------|-------------|----------|
@@ -830,7 +836,7 @@ silently, and never marked PASS. Every stage that *is* active is mandatory.
 13. **Escalate clearly.** Provide: what failed, which lane, how many attempts, unresolved issues.
 14. **Verify outputs exist.** Check that expected files are created before marking a stage complete.
 15. **Prefer parallel over sequential.** If two stages have no data dependency, run them in parallel.
-16. **Persist working memory.** Read/write `.claude/CONTINUITY.md` every turn and at every stage transition; recover from it after compaction. Mirror gate-precise state into `.claude/state/pipeline-snapshot.json` and resume from it by *reloading* (re-enter after `last_gate_passed`), never by re-running passed gates or re-applying committed edits.
+16. **Persist working memory.** Read/write `.claude/CONTINUITY.md` every turn and at every stage transition; recover from it after compaction. Mirror gate-precise state into `.claude/state/pipeline-snapshot.json` and resume from it by *reloading* (re-enter after `last_gate_passed`), never by re-running passed gates or re-applying committed edits. Gate verdicts are recorded through `claude-kit pipeline close-gate` / `skip-gate` whenever those subcommands answer `--help` — never by hand-editing `gate_history`, and never gated on `command -v` alone.
 17. **Anti-sycophancy.** In standard+, the plan is critiqued by `devils-advocate` before approval is final (Stage PC); and a unanimous PASS at the test-coverage gate is not VERIFIED until `devils-advocate` returns CONFIRMED or CONFIRMED-WITH-COSTS. Every verdict carries a premortem and a merits-and-costs balance sheet; record accepted costs in `CONTINUITY.md`.
 18. **Operability gates.** For deployable/observable changes, run DevOps (Pipeline Green) and Observability (Observability Ready) before the PR Raiser.
 19. **Name the skills in every spawn.** Each worker prompt states which skill(s) to load for its stage (Skill Routing table); never assume a worker will find them itself.

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/agents/security-reviewer.md

@@ -1,6 +1,6 @@
 ---
 name: security-reviewer
-description: Security stage coordinator. Runs at Phase 5.4 (after test-coverage VERIFIED, before DevOps). Dispatches four sub-scanners in parallel — secret, dependency, owasp, policy — and owns the Security Clear gate.
+description: Reviews a change for security problems — hardcoded secrets, vulnerable dependencies, OWASP Top 10 issues, missing security policies — via four parallel sub-scanners. Use when a change needs a security review. Owns the Security Clear gate.
 tools: Agent, Read, Glob, Grep, Bash, SendMessage
 permissionMode: plan
 model: sonnet

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/agents/story-planner.md

@@ -1,6 +1,6 @@
 ---
 name: story-planner
-description: Turns an approved spec into an ordered, dependency-aware set of small implementable stories/tasks, identifying which can run in parallel. Use after the spec is approved and before implementation begins.
+description: Breaks an approved spec into an ordered, dependency-aware set of small implementable stories, and identifies which can run in parallel. Use when work needs splitting into tickets, sequencing, or a parallelisation plan.
 tools: Read, Glob, Grep, Write
 model: sonnet
 color: cyan

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/agents/technical-architect.md

@@ -1,6 +1,6 @@
 ---
 name: technical-architect
-description: Reviews specs and developer documentation from an architecture perspective. Validates system design, scalability, integration patterns, and technical feasibility after senior developer review and before EM review.
+description: Reviews a spec or design for architectural soundness — system design, scalability, integration patterns, feasibility, failure modes. Use when a design needs an architecture review before it is built.
 tools: Read, Glob, Grep, SendMessage
 permissionMode: plan
 model: sonnet

{claude_code_kit-0.76.0 → claude_code_kit-0.78.0}/catalog/profiles.yaml

@@ -31,7 +31,10 @@ profiles:
       - code-review-and-quality
       - using-agent-skills
     gates: [code-review, build-green]
-    hooks: [load-continuity, lint-fix]
+    # verify-continuity-writeback is listed wherever load-continuity is: a profile that reads
+    # working memory at session start but never checks it was written back pays continuity's cost
+    # and gets none of its resumability.
+    hooks: [load-continuity, verify-continuity-writeback, lint-fix]
 
   standard:
     label: "Standard — full SDLC, parallel lanes, security gate"
@@ -106,13 +109,15 @@ profiles:
     # contract-clear self-skips when the stack exposes no API contract surface, so it is inert for
     # non-API projects on standard while enforcing backward-compatibility for API-exposing backends
     # (e.g. FastAPI). Promoted from enterprise-only per brief #2 P0-1 — see CHANGELOG 0.13.0.
-    gates: [spec-complete, em-approved, code-review, build-green, test-coverage, security-clear, contract-clear]
+    # Position: contract-clear closes at MR2 (the merge-reviewer join, right after the build-green
+    # lanes and BEFORE the test/security stages) — see the Gate ↔ Stage map in agents/orchestrator.md.
+    gates: [spec-complete, em-approved, code-review, build-green, contract-clear, test-coverage, security-clear]
     # NOTE: the agent-side capture hooks (capture-learnings / -catchup / -stop) are deliberately NOT
     # listed here — they are installed by the init-time `capture_mode` choice via catalog/capture.yaml
     # (see catalog._apply_capture_mode), not by profile membership. load-learnings (recall) stays.
     # capture-ticket-telemetry rides with the ticketing-and-traceability skill above: it is unrelated
     # to capture_mode, self-throttles, and no-ops until a ticket store exists.
-    hooks: [load-continuity, load-learnings, load-autonomy, guard-rm-rf, guard-push-main, guard-destructive-git, protect-secrets, guard-commit-secrets, warn-shared-modules, warn-llm-io, lint-fix, type-check, capture-ticket-telemetry]
+    hooks: [load-continuity, verify-continuity-writeback, load-learnings, load-autonomy, guard-rm-rf, guard-push-main, guard-destructive-git, protect-secrets, guard-commit-secrets, warn-shared-modules, warn-llm-io, lint-fix, type-check, capture-ticket-telemetry]
 
   enterprise:
     label: "Enterprise — adds DevOps, Observability, full audit + acceptance"
@@ -124,5 +129,5 @@ profiles:
       - incident-responder
       - risk-classifier
     skills: all
-    gates: [spec-complete, em-approved, code-review, build-green, test-coverage, security-clear, contract-clear, pipeline-green, observability-ready, acceptance]
+    gates: [spec-complete, em-approved, code-review, build-green, contract-clear, test-coverage, security-clear, pipeline-green, observability-ready, acceptance]
     hooks: all