claude-code-kit 0.80.0__tar.gz → 0.82.0__tar.gz

{claude_code_kit-0.80.0 → claude_code_kit-0.82.0}/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "displayName": "Claude Kit SDLC",
       "source": "./",
       "description": "Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with a tamper-evident gate ledger, working memory, and a self-improving learnings loop.",
-      "version": "0.80.0",
+      "version": "0.82.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.80.0 → claude_code_kit-0.82.0}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "claude-kit",
   "displayName": "Claude Kit SDLC",
-  "version": "0.80.0",
+  "version": "0.82.0",
   "description": "Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with a tamper-evident gate ledger, working memory, and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.80.0 → claude_code_kit-0.82.0}/CHANGELOG.md

@@ -4,6 +4,130 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.82.0] — 2026-08-17
+
+**Pipeline speed.** Three field-feedback sets from live SDLC runs (3 projects, 18 levers) triaged
+into 12 payload adoptions, each adversarially verified against the existing prose before adoption.
+The organizing principle: the orchestrator's context window is the pipeline's scarce resource —
+throughput = stories-per-window × concurrent-windows.
+
+### Added
+- **Bounded handoff contract** (`rules/quality-gates.md` §2.5): reviewer/tester/scanner handoffs
+  lead with a verdict/severity/findings header; the orchestrator persists the full body verbatim
+  without re-analyzing it.
+- **Mechanical VALIDATE bound** (§2.5): the orchestrator's independent VALIDATE is exit codes +
+  scope diff + recorded coverage number — diff-level correctness explicitly belongs to the code
+  reviewer.
+- **Planning-chain total budget + audited waiver wiring** (§2): max 2 full re-review generations,
+  then human escalation; residual Mediums acceptable only via the existing loud
+  `close-gate --force --override-reason` path with owner + revisit trigger. Critical/High never.
+- **Story-level risk routing** (`rules/risk-classification.md`): low-risk stories take the reduced
+  chain (developer → code reviewer → tester); sensitive surfaces override the tier; run-level
+  gates and code review untouched.
+- **Batchable stories + story groups + dispatch sizing** (`rules/mandatory-workflow.md` §1f /
+  Phase 2, `agents/story-planner.md`): ≤3 mechanical stories per shared dispatch (one commit
+  each); story groups defined; one story per dispatch as the default; land one end-to-end slice
+  early.
+- **Story-group fan-out** (`skills/sdlc/SKILL.md`): one orchestrator per disjoint story group in
+  its own worktree; human approval per mainline merge; run-level gates on the merged output.
+- **Tier probe before fan-out** (`rules/model-tiers.md`): probe-spawn each planned tier once per
+  run; instant zero-token death = unavailable → fall back one tier and record.
+- **Question batching** (`rules/human-in-the-loop.md`): non-blocking asks queue to CONTINUITY and
+  surface as one round per gate; blocking stops and 1b interviews unchanged.
+- **Spec evidence hygiene** (`agents/spec-doc-writer.md`, `rules/documentation.md`,
+  `skills/spec-driven-development`): executed evidence is cited by path, never pasted into specs.
+- **Warm shared test services** (`rules/testing.md`): start once per run, reuse across defect-loop
+  cycles; per-test state reset and the clean-cold-start delivery check stand.
+- **Operator playbook** (`docs/pipeline-speed-playbook.md`, repo-only — not bundled): the same
+  levers as paste-ready dispatch instructions for in-flight runs on older installs.
+
+### Changed
+- `agents/orchestrator.md`: developer dispatch input is now the story under implementation (was:
+  the whole approved spec) — fixing an internal inconsistency with VALIDATE's per-story scope
+  check; the scribe persists reports without re-analysis; Stage SP carries the risk/batchable
+  tags. Net size 846 → 853 lines, held deliberately near-flat (F-036).
+- `skills/_references/orchestration-patterns.md`: the depth-≤1 anti-pattern now names the sdlc
+  pipeline's main-session → orchestrator(s) → workers topology as the deliberate exception.
+
+### Not adopted (deliberately)
+- **Enabling specific models on a provider deployment / credential-refresh commands** — user
+  environment, not payload; generalized instead into the tier probe.
+- **Lowering the coverage floor (100% → 97%)** — the kit already ships 90% "or as defined by the
+  project's coverage policy" (`rules/testing.md`); the 100% floor was that project's own spec.
+- **Docker-specific warm-stack guidance** — the core stays container-agnostic; adopted only as
+  stack-agnostic warm-services prose.
+- **Giving read-only reviewers Write access so reports bypass the orchestrator** — write
+  confinement and read-only review are deliberate (least-privilege, authorship bias); bounded
+  handoffs fix the cost instead.
+- **Orchestrator-spawning-orchestrator trees** — fan-out stays in the main session (the `sdlc`
+  entrypoint); depth beyond the pipeline contract remains an anti-pattern.
+- **Project-specific story merges / scope cuts** — the general forms (batching, slice-early
+  sequencing) are adopted; the specific calls stay with the projects.
+
+## [0.81.0] — 2026-08-15
+
+**The board shows up on its own, and it shows the whole ticket.** Two things were wrong with
+`claude-kit tickets --html`: nothing in a `/sdlc` run ever created it, and a card carried far less
+than the terminal detail view already knew. Both are fixed — `/sdlc` opens a browser board at
+ticket creation, and clicking a card now opens a full issue view.
+
+### Added
+
+- **`/sdlc` opens the board at Stage TK.** The orchestrator runs `claude-kit tickets --open` right
+  after the tickets are written and before the first implementation agent spawns — tickets exist,
+  work is about to start, the human wants to watch. This is also what switches the live refresh on:
+  the `capture-ticket-telemetry` Stop hook's opt-in signal is simply that the file exists
+  (`[ -f "$BOARD" ]`), so one command at Stage TK makes the rest of the run watchable. Never a
+  gate — a missing CLI is reported and the pipeline carries on.
+- **`claude-kit tickets --open`** writes the board and launches the default browser. It **implies
+  `--html`** rather than erroring without it, opens **once** under `--watch` rather than once per
+  tick, and fails soft: a raising or `False`-returning `webbrowser.open` prints the `file://` URL
+  and still exits 0, so SSH, CI and containers get the path instead of a broken exit code.
+- **A per-ticket issue view.** Every ticket now renders a full panel below the board carrying what
+  the terminal `render_detail` already knew and the browser did not: status, branch, spec, design,
+  pipeline stage and last gate passed, blockers, non-gating lineage (`child_of`/`parent_of`),
+  commits, declared files, per-agent telemetry with the shared-branch caveat, and the work log.
+  Cards are anchors to it; a `× close` anchor dismisses it; the browser back button works.
+- **A sprint-style status strip** across the top — the gate chain with the current position marked
+  and an `N/M` tally — rendered from `pipeline_stage()` and `installed_gates()`. It is omitted
+  entirely when there is no active run, rather than rendering an empty chain.
+- **Text avatars.** Each card carries the acting agent's initials in a CSS circle
+  (`developer` → DE, `sdlc-code-reviewer` → SR). Text, not an image — see below.
+
+### Changed
+
+- `pipeline.installed_gates()` is public (was `_installed_gates`). Three eval scripts already
+  reached into the private name; naming it honestly beat adding a wrapper around it.
+- `render_html()` takes optional `stage=` and `gates=`, following the existing injectable
+  `generated_at=` convention so the renderer stays pure and testable.
+- `commands/sdlc.md` gains `Bash` in `allowed-tools`. The orchestrator has its own, so the normal
+  path already worked; this closes the latent gap in the skill's documented fallback ("if the
+  `orchestrator` agent is unavailable, act as the orchestrator yourself"), which could not shell
+  out.
+
+### Not adopted (deliberately)
+
+- **No JavaScript — so no filter-as-you-type and no drag-to-reorder.** Both were on the table and
+  both were dropped. `tests/test_board_html.py` asserts `"<script" not in html`, and that single
+  line is doing double duty: it is the self-containment guard *and* the XSS guard. A board with no
+  script tag at all cannot execute an injected one, whatever a ticket title contains. Adding one
+  `<script>` for filtering would demote that absolute into a per-sink review of every interpolated
+  string. The interactivity that survived is CSS-only (`:target` reveal, anchors as click targets),
+  which costs nothing to audit. Avatars are text in a circle for the same reason: `<img>` is pinned
+  out alongside `http://`, `<link>` and `@import` so the file stays one artifact you can email.
+- **No two-pane layout.** A persistent detail rail would mean either a fixed viewport split (bad at
+  1280px with five columns) or JS-driven resizing. Click-through gives the full width to whichever
+  view you are actually reading.
+- **No real JIRA integration.** This is a rendering of the local git-native store, not a client.
+  Pushing tickets to an external tracker stays `task-tracker-sync` plus the opt-in Atlassian MCP
+  server; the local store remains the source of truth in both directions.
+- **No assignee field.** The board attributes work from transcript telemetry (`agentName`), which
+  is a record of who *did* act. There is no assignment model in the ticket store, and inventing an
+  assignee dropdown would show a field that nothing writes and nothing reads.
+- **No hook change.** The refresh already keys off the file existing; creating it once at Stage TK
+  flips that switch for the whole run. Editing a hook would have meant regenerating `hooks.json`
+  and `settings.json` for no behavioural gain.
+
 ## [0.80.0] — 2026-08-14
 
 **Django is selectable.** The second Python framework goes live as a pure catalog change plus

{claude_code_kit-0.80.0 → claude_code_kit-0.82.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: claude-code-kit
-Version: 0.80.0
+Version: 0.82.0
 Summary: Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with a tamper-evident gate ledger, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
@@ -164,7 +164,7 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 | 📐 **Rules & skills** | **25** stack-agnostic core rules + **121** context-activated skills (58 core + 63 stack-collection), pulled into context on demand |
 | 🧱 **Stacks & overlays** | A stack-agnostic core + **14** overlay rule files (React · FastAPI · Django · Go · Postgres · Mongo) wired to your exact commands and path-scoped to load only when you touch matching files |
 | 🛠️ **Hooks & guards** | **20** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
-| 📊 **Traceability & live board** | A git-native ticket per story with a work-log and commit linkage, plus `claude-kit tickets` — a terminal chart and a browser Kanban board showing each lane's status, agent, model, tokens and elapsed time ([below](#parallel-lanes-and-the-live-ticket-board)) |
+| 📊 **Traceability & live board** | A git-native ticket per story with a work-log and commit linkage, plus `claude-kit tickets` — a terminal chart and a click-through browser Kanban board (gate strip, per-ticket issue view, agent/model/token/timing figures) that `/sdlc` opens for you when it creates the tickets ([below](#parallel-lanes-and-the-live-ticket-board)) |
 | 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **24** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
 
 Profiles (`lean` · `standard` · `enterprise`), team scopes, autonomy levels, and org capability
@@ -275,13 +275,21 @@ claude-kit tickets --graph        # dependency DAG — what is blocked by what
 claude-kit tickets --graph-git    # the commit graph with each commit's ticket attached
 claude-kit tickets CKIT-74        # one ticket: full work log + per-lane telemetry
 claude-kit tickets --html         # a Kanban board in your browser
+claude-kit tickets --open         # the same board, opened for you
 ```
 
-`--html` writes a self-contained page to `.claude/state/ticket-board.html` and prints a `file://` URL.
+`--html` writes a self-contained page to `.claude/state/ticket-board.html` and prints a `file://` URL;
+`--open` does that and launches your browser (and quietly falls back to the printed path on a headless
+box). **`/sdlc` runs `--open` for you** the moment it creates the tickets, before any implementation
+agent starts — so you watch the run rather than reading chat for status.
+
 It is a **file, not a server** — the page refreshes itself and the `capture-ticket-telemetry` Stop hook
-rewrites it after each turn, so an open tab tracks a running pipeline live with nothing daemonised:
+rewrites it after each turn, so an open tab tracks a running pipeline live with nothing daemonised.
+A header strip shows which gate the pipeline is on, and clicking any card opens a full issue view —
+spec, design, stage, files, commits, per-agent telemetry and the work log — all with **no JavaScript
+at all**, so the page makes zero network requests and leaks nothing:
 
-![The claude-kit ticket board — Kanban columns for in progress, in review, actionable, blocked and done, each card showing model, tokens, cache, elapsed time and commit](docs/images/ticket-board.png)
+![The claude-kit ticket board — a pipeline gate strip above Kanban columns for in progress, in review, actionable, blocked and done, each card showing model, tokens, cache, elapsed time, branch, commits and the acting agent's initials; below the board, one ticket's issue view is open with its status, spec, design, stage, files, commits, per-agent telemetry and work log](docs/images/ticket-board.png)
 
 Token counts are **deduplicated by request id** — streaming rewrites the same usage block many times,
 and a naive sum overstates output by ~3× — and cache reads are counted separately from fresh input

{claude_code_kit-0.80.0 → claude_code_kit-0.82.0}/README.md

@@ -131,7 +131,7 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 | 📐 **Rules & skills** | **25** stack-agnostic core rules + **121** context-activated skills (58 core + 63 stack-collection), pulled into context on demand |
 | 🧱 **Stacks & overlays** | A stack-agnostic core + **14** overlay rule files (React · FastAPI · Django · Go · Postgres · Mongo) wired to your exact commands and path-scoped to load only when you touch matching files |
 | 🛠️ **Hooks & guards** | **20** event hooks — deterministic safety guards and advisory warnings — that no-op gracefully without `jq` |
-| 📊 **Traceability & live board** | A git-native ticket per story with a work-log and commit linkage, plus `claude-kit tickets` — a terminal chart and a browser Kanban board showing each lane's status, agent, model, tokens and elapsed time ([below](#parallel-lanes-and-the-live-ticket-board)) |
+| 📊 **Traceability & live board** | A git-native ticket per story with a work-log and commit linkage, plus `claude-kit tickets` — a terminal chart and a click-through browser Kanban board (gate strip, per-ticket issue view, agent/model/token/timing figures) that `/sdlc` opens for you when it creates the tickets ([below](#parallel-lanes-and-the-live-ticket-board)) |
 | 📦 **Distribution & lifecycle** | Plugin **and** pip from one source, **24** ready MCP fragments (version-pinned), edit-preserving `upgrade`, and a root `AGENTS.md` at init so non-Claude agents share the same standards |
 
 Profiles (`lean` · `standard` · `enterprise`), team scopes, autonomy levels, and org capability
@@ -242,13 +242,21 @@ claude-kit tickets --graph        # dependency DAG — what is blocked by what
 claude-kit tickets --graph-git    # the commit graph with each commit's ticket attached
 claude-kit tickets CKIT-74        # one ticket: full work log + per-lane telemetry
 claude-kit tickets --html         # a Kanban board in your browser
+claude-kit tickets --open         # the same board, opened for you
 ```
 
-`--html` writes a self-contained page to `.claude/state/ticket-board.html` and prints a `file://` URL.
+`--html` writes a self-contained page to `.claude/state/ticket-board.html` and prints a `file://` URL;
+`--open` does that and launches your browser (and quietly falls back to the printed path on a headless
+box). **`/sdlc` runs `--open` for you** the moment it creates the tickets, before any implementation
+agent starts — so you watch the run rather than reading chat for status.
+
 It is a **file, not a server** — the page refreshes itself and the `capture-ticket-telemetry` Stop hook
-rewrites it after each turn, so an open tab tracks a running pipeline live with nothing daemonised:
+rewrites it after each turn, so an open tab tracks a running pipeline live with nothing daemonised.
+A header strip shows which gate the pipeline is on, and clicking any card opens a full issue view —
+spec, design, stage, files, commits, per-agent telemetry and the work log — all with **no JavaScript
+at all**, so the page makes zero network requests and leaks nothing:
 
-![The claude-kit ticket board — Kanban columns for in progress, in review, actionable, blocked and done, each card showing model, tokens, cache, elapsed time and commit](docs/images/ticket-board.png)
+![The claude-kit ticket board — a pipeline gate strip above Kanban columns for in progress, in review, actionable, blocked and done, each card showing model, tokens, cache, elapsed time, branch, commits and the acting agent's initials; below the board, one ticket's issue view is open with its status, spec, design, stage, files, commits, per-agent telemetry and work log](docs/images/ticket-board.png)
 
 Token counts are **deduplicated by request id** — streaming rewrites the same usage block many times,
 and a naive sum overstates output by ~3× — and cache reads are counted separately from fresh input

{claude_code_kit-0.80.0 → claude_code_kit-0.82.0}/agents/orchestrator.md

@@ -9,7 +9,7 @@ tier: orchestrator
 
 You are the **Orchestrator** — the pipeline controller for the engineering delivery workflow. You NEVER write code. You only delegate, coordinate, monitor, and gate.
 
-**Write confinement (hard rule).** Your Write/Edit tools exist ONLY to persist pipeline state and gate evidence: `.claude/CONTINUITY.md`, `.claude/state/` (the resume snapshot, run manifests, wave state), `.claude/artifacts/` records, and the gate reports read-only reviewers hand back (e.g. `docs/security/{feature}_*.md`, `docs/api/{feature}_api-change-report.md`). You never create or modify source code, tests, configs, or feature documentation — that is always delegated. If a task seems to require you to edit anything else, that is a routing error: dispatch the right agent instead. You are also the **scribe for read-only gate agents**: reviewers and scanners run read-only and *report* back to you — you persist their returned reports verbatim to their canonical paths, and record their verdicts, open findings, and durable lessons into CONTINUITY.md / the snapshot (promoting recurring ones to `agent-memory/` via `remember`) on their behalf.
+**Write confinement (hard rule).** Your Write/Edit tools exist ONLY to persist pipeline state and gate evidence: `.claude/CONTINUITY.md`, `.claude/state/` (the resume snapshot, run manifests, wave state), `.claude/artifacts/` records, and the gate reports read-only reviewers hand back (e.g. `docs/security/{feature}_*.md`, `docs/api/{feature}_api-change-report.md`). You never create or modify source code, tests, configs, or feature documentation — that is always delegated. If a task seems to require you to edit anything else, that is a routing error: dispatch the right agent instead. You are also the **scribe for read-only gate agents**: reviewers and scanners run read-only and *report* back to you — you persist their returned reports verbatim to their canonical paths **without re-analyzing them** (bounded handoff — `.claude/rules/quality-gates.md` §2.5), and record their verdicts, open findings, and durable lessons into CONTINUITY.md / the snapshot (promoting recurring ones to `agent-memory/` via `remember`) on their behalf.
 
 **Mandatory reading before every pipeline run:** `CLAUDE.md` (repo root) — the authoritative engineering delivery rules.
 
@@ -338,7 +338,10 @@ code is written.
 - **Gate**: every acceptance criterion is covered (no **gap**), no story maps to no criterion (no
   **scope creep**), the graph is acyclic, and the parallel set is genuinely unblocked. A gap or
   scope-creep finding routes back to the **spec-doc-writer** (fix the spec) — never silently into
-  a lane. The story breakdown then drives lane assignment at Fork Point 2.
+  a lane. The story breakdown then drives lane assignment at Fork Point 2. Carry each story's
+  **risk / batchable** tags into routing: low-risk stories take the reduced chain, and up to 3
+  batchable stories may share one dispatch (`.claude/rules/risk-classification.md` → Story-level
+  routing; `.claude/rules/mandatory-workflow.md` §1f).
 - For **single-stack** work (Mode A), this runs after EM approval and before the Developer; there
   is no merge-reviewer, so the Story Planner runs directly on the EM-approved spec.
 
@@ -360,6 +363,14 @@ starting work" discipline. Using `ticketing-and-traceability`:
 - **Fast-track (Mode D)**: collapse to a single ticket for the change rather than one per story.
 - **Not installed**: if `ticketing-and-traceability` isn't in the active profile (e.g. lean), skip
   this stage and note the skip in CONTINUITY.md — the pipeline proceeds unchanged.
+- **Open the board — once, here.** With the tickets written, run
+  `claude-kit tickets --open` and report the printed `file://` path in chat. This is the
+  right moment: the tickets exist and no implementation has started, so the human gets a live
+  view of the whole run before any of it happens. From then on the `capture-ticket-telemetry`
+  Stop hook refreshes that file after every turn — **its opt-in signal is the file existing**, so
+  this one command is what makes the rest of the run visible. Do not re-run it per stage; the page
+  reloads itself. If the CLI is unavailable, say so once and continue — the board is an
+  observability aid and never a gate.
 
 The ticket id assigned here rides with the work: implementation lanes append work-log entries to it
 (VALIDATE / JOIN below), and the PR stage links its commits and closes it.
@@ -372,7 +383,9 @@ The ticket id assigned here rides with the work: implementation lanes append wor
 
 **[4a-FE] Developer (frontend mode):**
 - **Spawn**: `developer` in **frontend mode** with `isolation: "worktree"`.
-- **Input**: Approved spec + design spec.
+- **Input**: the story under implementation — its declared file scope + acceptance criteria — with
+  the approved spec + design spec as reference (one story per dispatch;
+  `.claude/rules/mandatory-workflow.md` Phase 2).
 
 **[4v-FE] Independent VALIDATE (you — not a sub-agent):**
 - When the Developer reports done, do **not** take the self-report at face value. In the lane's
@@ -380,8 +393,9 @@ The ticket id assigned here rides with the work: implementation lanes append wor
   `git diff --name-only` against the story's declared file scope.
 - A red check is a defect. **Out-of-scope changes are a defect** — route back to the Developer
   with the offending file list. The lane does not reach the Code Reviewer until *your own* run
-  is green. (Structural form of the evidence rule: a verdict must be backed by output you
-  captured — `.claude/rules/quality-gates.md` §2.5.)
+  is green — and VALIDATE is exactly this, nothing deeper: diff-level correctness is [4b]'s job
+  (`.claude/rules/quality-gates.md` §2.5, "mechanical — and nothing more"; the same section's
+  evidence rule still binds what you did run.)
 - **Work-log the step** on the story's ticket (`ticketing-and-traceability`): what changed, why, and
   the files from `git diff --name-only`; advance the ticket `OPEN → IN PROGRESS`. Skip silently if the
   ticket store isn't in use.
@@ -402,7 +416,8 @@ The ticket id assigned here rides with the work: implementation lanes append wor
 
 **[4a-BE] Developer (backend mode):**
 - **Spawn**: `developer` in **backend mode** with `isolation: "worktree"`.
-- **Input**: Approved backend spec.
+- **Input**: the backend story under implementation (file scope + criteria), with the approved
+  backend spec as reference.
 
 **[4v-BE] Independent VALIDATE (you — not a sub-agent):** same contract as [4v-FE] — re-run the
 backend test + lint commands yourself in the lane's worktree, diff `git diff --name-only` against

{claude_code_kit-0.80.0 → claude_code_kit-0.82.0}/agents/spec-doc-writer.md

@@ -264,6 +264,9 @@ Before marking the spec complete, verify:
 - [ ] Non-functional requirements are addressed (performance, security, accessibility)
 - [ ] Implementation steps are in dependency order (step N doesn't depend on step N+1)
 - [ ] Open questions are flagged for human resolution
+- [ ] No executed evidence pasted in — command output and measurement blocks live at their
+      `.claude/state/` or artifact path and are **cited by path**; the spec stays
+      requirements-sized because every agent reads it
 - [ ] No hardcoded values — reference the project's config/constants
 
 ## Multi-Stack Guidance

{claude_code_kit-0.80.0 → claude_code_kit-0.82.0}/agents/story-planner.md

@@ -26,12 +26,19 @@ dependency, so the orchestrator can fan work out across lanes and worktrees.
 A story breakdown (write it where the spec lives, or to `.claude/state/` for the run), containing:
 
 1. **Stories** — each with a stable id, a one-line goal, the acceptance criteria it satisfies, and
-   the files/modules it touches. Keep each story small enough for one focused implementation pass.
+   the files/modules it touches, plus two routing tags: **risk** (`low` | `standard` — `low` only
+   when the story is local, reversible, and touches no sensitive area per
+   `.claude/rules/risk-classification.md`; when in doubt, `standard`) and **batchable** (`true`
+   only for mechanical low-risk stories — docs, changelog, packaging, examples, version bumps).
+   Keep each story small enough for one focused implementation pass — each story is the unit of
+   **one dispatch**.
 2. **Dependency graph** — `blockedBy` / `blocks` between stories; the graph must be acyclic.
 3. **Parallelizable set** — which stories have no unmet dependencies and can start immediately, and
    along which lanes (e.g. backend vs frontend) per `.claude/rules/mandatory-workflow.md`.
 4. **Sequencing** — a suggested order for the rest, with the join points where a Merge Reviewer is
-   needed (shared API contract, shared data model).
+   needed (shared API contract, shared data model). Sequence one thin **end-to-end slice early**:
+   every later story then validates against a running system instead of prose — the slice *is* the
+   foundation; build it first, then widen.
 5. **Traceability** — every acceptance criterion in the spec maps to at least one story; flag any
    criterion with no story (a gap) and any story with no criterion (scope creep).
 

{claude_code_kit-0.80.0 → claude_code_kit-0.82.0}/commands/sdlc.md

@@ -1,7 +1,7 @@
 ---
 description: Run the full autonomous SDLC pipeline on a task via the orchestrator
 argument-hint: "<feature or task description>"
-allowed-tools: Skill, Agent, Read, Glob, Grep, TaskCreate, TaskGet, TaskList, TaskUpdate
+allowed-tools: Skill, Agent, Bash, Read, Glob, Grep, TaskCreate, TaskGet, TaskList, TaskUpdate
 ---
 
 Run the claude-kit autonomous SDLC pipeline for:

{claude_code_kit-0.80.0 → claude_code_kit-0.82.0}/docs/install.md

@@ -132,6 +132,19 @@ README.claude-sdlc.md
 - **A full React design system** — picking React installs design tokens, UX patterns, and
   mobile/Capacitor guidelines that the UI skills and `ui-designer` agent read.
 
+## Watching a run
+
+`/sdlc` opens the ticket board for you. At Stage TK — after the stories are approved and the
+tickets are written, before any implementation agent starts — the orchestrator runs `claude-kit
+tickets --open`, which writes `.claude/state/ticket-board.html` and launches your browser. From
+then on the `capture-ticket-telemetry` Stop hook refreshes that file after every turn, so the page
+tracks the run live with nothing daemonised. The board is a single self-contained file: no
+JavaScript, no network requests, no server.
+
+Outside a run, `claude-kit tickets` renders the same store as a terminal chart, `--html` writes the
+board without opening it, and `claude-kit tickets <PREFIX>-<N>` prints one ticket's detail. If no
+browser can be launched (SSH, CI, a container), `--open` prints the `file://` URL and exits 0.
+
 ## Memory & continuous learning
 
 - **Working memory across sessions** — `CONTINUITY.md` survives context compaction so the pipeline

claude_code_kit-0.82.0/docs/pipeline-speed-playbook.md

@@ -0,0 +1,74 @@
+# Pipeline Speed Playbook — for in-flight runs (installs ≤ 0.81.0)
+
+Run-level instructions that recover most of 0.82.0's speed levers **without upgrading**. Each
+recipe says what to paste into your orchestrator dispatch (or run yourself). After
+`claude-kit upgrade`, the payload carries all of this natively and this doc is obsolete.
+
+## 1. Probe model tiers before any fan-out
+
+Most agents pin `model: sonnet`/`opus` in frontmatter; if your deployment doesn't serve an alias,
+the spawn dies **instantly with ~0 tokens**. Before the first fan-out, spawn one trivial agent per
+tier ("reply with one word"). On instant death: pass an explicit `model:` override on **every**
+dispatch for that run and note it in CONTINUITY.md. Re-probe each new session — availability
+flips. Refresh credentials before long sessions (e.g. `! gcloud auth login --update-adc` on
+Vertex).
+
+## 2. One story per dispatch + resume from the snapshot
+
+Ask for one story per orchestrator invocation, not "stories 2–5". A 90-minute dispatch that dies
+at minute 85 loses everything unwritten; two 40-minute dispatches lose at most half. On crash,
+resume from `.claude/state/pipeline-snapshot.json`: re-enter after `last_gate_passed`; never
+re-run passed gates or re-apply committed edits.
+
+## 3. Bound the orchestrator's own verification (paste into the dispatch)
+
+> Your independent VALIDATE is exactly: re-run the test/lint/build commands (capture exit codes),
+> `git diff --name-only` vs the story's declared file scope, record the printed coverage number.
+> Nothing deeper — no line-by-line diff reading, no content proofs. The code reviewer owns
+> correctness. Reviewer reports: read the verdict + severity counts + findings table only; persist
+> the body verbatim without re-analyzing it.
+
+## 4. Cap the review chain; waive residual Mediums loudly
+
+State at dispatch: "2 full re-review generations, then escalate." At escalation, accept a residual
+Medium as a known gap with the **audited** override (first probe your CLI:
+`claude-kit pipeline close-gate --help | grep -q force` — a stale binary may lack it):
+
+```
+claude-kit pipeline close-gate <gate> --force --override-reason '<finding>: accepted known gap — owner: <role>, revisit: <trigger>'
+```
+
+`validate`/`status` will WARN on it forever — that's the point. Critical/High: never waive. If the
+CLI lacks `--force`, hand-write the `gate_history` entry (schema: `.claude/rules/continuity.md`).
+
+## 5. Fan out disjoint stories across orchestrators
+
+When ≥2 unblocked stories have disjoint file boundaries: one orchestrator per story group, each in
+its own `git worktree` (each gets its own CONTINUITY/snapshot). Merge in dependency order — you
+approve each mainline merge — then run the run-level gates (test coverage, security) on the merged
+output in the primary checkout.
+
+## 6. Route ceremony by story risk; batch the mechanical tail
+
+Low-risk stories (docs/changelog/packaging/config; nothing touching auth, queries, secrets,
+tenancy, migrations): developer → code reviewer → tester only. Batch up to 3 of them into one
+dispatch, one commit per story. Any story touching a sensitive surface gets the full chain —
+decide by surface, never by size.
+
+## 7. Keep the spec requirements-sized
+
+Move executed-evidence blocks (command output, measurements) out of `docs/specs/*` into
+`.claude/state/gate-evidence/`, leaving one-line citations. Every agent reads the spec on every
+spawn — a 7,000-line spec is a per-spawn tax.
+
+## 8. Two habits that round it out
+
+Queue non-blocking questions in CONTINUITY "Open Questions"; raise them as one batch at the next
+gate (blocking stops stay immediate). Start shared test services once per run and reuse across
+defect-loop cycles (reset state between tests; the final clean-cold-start check still runs).
+
+## What NOT to cut
+
+Code review (it catches Criticals that reading alone approves), the security pass on sensitive
+surfaces, and the real-environment verification your project relies on. Speed comes from cutting
+re-verification and idle ceremony — not verification.