claude-code-kit 0.81.0__tar.gz → 0.82.0__tar.gz

{claude_code_kit-0.81.0 → claude_code_kit-0.82.0}/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "displayName": "Claude Kit SDLC",
       "source": "./",
       "description": "Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with a tamper-evident gate ledger, working memory, and a self-improving learnings loop.",
-      "version": "0.81.0",
+      "version": "0.82.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.81.0 → claude_code_kit-0.82.0}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "claude-kit",
   "displayName": "Claude Kit SDLC",
-  "version": "0.81.0",
+  "version": "0.82.0",
   "description": "Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with a tamper-evident gate ledger, working memory, and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",

{claude_code_kit-0.81.0 → claude_code_kit-0.82.0}/CHANGELOG.md

@@ -4,6 +4,66 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.82.0] — 2026-08-17
+
+**Pipeline speed.** Three field-feedback sets from live SDLC runs (3 projects, 18 levers) triaged
+into 12 payload adoptions, each adversarially verified against the existing prose before adoption.
+The organizing principle: the orchestrator's context window is the pipeline's scarce resource —
+throughput = stories-per-window × concurrent-windows.
+
+### Added
+- **Bounded handoff contract** (`rules/quality-gates.md` §2.5): reviewer/tester/scanner handoffs
+  lead with a verdict/severity/findings header; the orchestrator persists the full body verbatim
+  without re-analyzing it.
+- **Mechanical VALIDATE bound** (§2.5): the orchestrator's independent VALIDATE is exit codes +
+  scope diff + recorded coverage number — diff-level correctness explicitly belongs to the code
+  reviewer.
+- **Planning-chain total budget + audited waiver wiring** (§2): max 2 full re-review generations,
+  then human escalation; residual Mediums acceptable only via the existing loud
+  `close-gate --force --override-reason` path with owner + revisit trigger. Critical/High never.
+- **Story-level risk routing** (`rules/risk-classification.md`): low-risk stories take the reduced
+  chain (developer → code reviewer → tester); sensitive surfaces override the tier; run-level
+  gates and code review untouched.
+- **Batchable stories + story groups + dispatch sizing** (`rules/mandatory-workflow.md` §1f /
+  Phase 2, `agents/story-planner.md`): ≤3 mechanical stories per shared dispatch (one commit
+  each); story groups defined; one story per dispatch as the default; land one end-to-end slice
+  early.
+- **Story-group fan-out** (`skills/sdlc/SKILL.md`): one orchestrator per disjoint story group in
+  its own worktree; human approval per mainline merge; run-level gates on the merged output.
+- **Tier probe before fan-out** (`rules/model-tiers.md`): probe-spawn each planned tier once per
+  run; instant zero-token death = unavailable → fall back one tier and record.
+- **Question batching** (`rules/human-in-the-loop.md`): non-blocking asks queue to CONTINUITY and
+  surface as one round per gate; blocking stops and 1b interviews unchanged.
+- **Spec evidence hygiene** (`agents/spec-doc-writer.md`, `rules/documentation.md`,
+  `skills/spec-driven-development`): executed evidence is cited by path, never pasted into specs.
+- **Warm shared test services** (`rules/testing.md`): start once per run, reuse across defect-loop
+  cycles; per-test state reset and the clean-cold-start delivery check stand.
+- **Operator playbook** (`docs/pipeline-speed-playbook.md`, repo-only — not bundled): the same
+  levers as paste-ready dispatch instructions for in-flight runs on older installs.
+
+### Changed
+- `agents/orchestrator.md`: developer dispatch input is now the story under implementation (was:
+  the whole approved spec) — fixing an internal inconsistency with VALIDATE's per-story scope
+  check; the scribe persists reports without re-analysis; Stage SP carries the risk/batchable
+  tags. Net size 846 → 853 lines, held deliberately near-flat (F-036).
+- `skills/_references/orchestration-patterns.md`: the depth-≤1 anti-pattern now names the sdlc
+  pipeline's main-session → orchestrator(s) → workers topology as the deliberate exception.
+
+### Not adopted (deliberately)
+- **Enabling specific models on a provider deployment / credential-refresh commands** — user
+  environment, not payload; generalized instead into the tier probe.
+- **Lowering the coverage floor (100% → 97%)** — the kit already ships 90% "or as defined by the
+  project's coverage policy" (`rules/testing.md`); the 100% floor was that project's own spec.
+- **Docker-specific warm-stack guidance** — the core stays container-agnostic; adopted only as
+  stack-agnostic warm-services prose.
+- **Giving read-only reviewers Write access so reports bypass the orchestrator** — write
+  confinement and read-only review are deliberate (least-privilege, authorship bias); bounded
+  handoffs fix the cost instead.
+- **Orchestrator-spawning-orchestrator trees** — fan-out stays in the main session (the `sdlc`
+  entrypoint); depth beyond the pipeline contract remains an anti-pattern.
+- **Project-specific story merges / scope cuts** — the general forms (batching, slice-early
+  sequencing) are adopted; the specific calls stay with the projects.
+
 ## [0.81.0] — 2026-08-15
 
 **The board shows up on its own, and it shows the whole ticket.** Two things were wrong with

{claude_code_kit-0.81.0 → claude_code_kit-0.82.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: claude-code-kit
-Version: 0.81.0
+Version: 0.82.0
 Summary: Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with a tamper-evident gate ledger, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit

{claude_code_kit-0.81.0 → claude_code_kit-0.82.0}/agents/orchestrator.md

@@ -9,7 +9,7 @@ tier: orchestrator
 
 You are the **Orchestrator** — the pipeline controller for the engineering delivery workflow. You NEVER write code. You only delegate, coordinate, monitor, and gate.
 
-**Write confinement (hard rule).** Your Write/Edit tools exist ONLY to persist pipeline state and gate evidence: `.claude/CONTINUITY.md`, `.claude/state/` (the resume snapshot, run manifests, wave state), `.claude/artifacts/` records, and the gate reports read-only reviewers hand back (e.g. `docs/security/{feature}_*.md`, `docs/api/{feature}_api-change-report.md`). You never create or modify source code, tests, configs, or feature documentation — that is always delegated. If a task seems to require you to edit anything else, that is a routing error: dispatch the right agent instead. You are also the **scribe for read-only gate agents**: reviewers and scanners run read-only and *report* back to you — you persist their returned reports verbatim to their canonical paths, and record their verdicts, open findings, and durable lessons into CONTINUITY.md / the snapshot (promoting recurring ones to `agent-memory/` via `remember`) on their behalf.
+**Write confinement (hard rule).** Your Write/Edit tools exist ONLY to persist pipeline state and gate evidence: `.claude/CONTINUITY.md`, `.claude/state/` (the resume snapshot, run manifests, wave state), `.claude/artifacts/` records, and the gate reports read-only reviewers hand back (e.g. `docs/security/{feature}_*.md`, `docs/api/{feature}_api-change-report.md`). You never create or modify source code, tests, configs, or feature documentation — that is always delegated. If a task seems to require you to edit anything else, that is a routing error: dispatch the right agent instead. You are also the **scribe for read-only gate agents**: reviewers and scanners run read-only and *report* back to you — you persist their returned reports verbatim to their canonical paths **without re-analyzing them** (bounded handoff — `.claude/rules/quality-gates.md` §2.5), and record their verdicts, open findings, and durable lessons into CONTINUITY.md / the snapshot (promoting recurring ones to `agent-memory/` via `remember`) on their behalf.
 
 **Mandatory reading before every pipeline run:** `CLAUDE.md` (repo root) — the authoritative engineering delivery rules.
 
@@ -338,7 +338,10 @@ code is written.
 - **Gate**: every acceptance criterion is covered (no **gap**), no story maps to no criterion (no
   **scope creep**), the graph is acyclic, and the parallel set is genuinely unblocked. A gap or
   scope-creep finding routes back to the **spec-doc-writer** (fix the spec) — never silently into
-  a lane. The story breakdown then drives lane assignment at Fork Point 2.
+  a lane. The story breakdown then drives lane assignment at Fork Point 2. Carry each story's
+  **risk / batchable** tags into routing: low-risk stories take the reduced chain, and up to 3
+  batchable stories may share one dispatch (`.claude/rules/risk-classification.md` → Story-level
+  routing; `.claude/rules/mandatory-workflow.md` §1f).
 - For **single-stack** work (Mode A), this runs after EM approval and before the Developer; there
   is no merge-reviewer, so the Story Planner runs directly on the EM-approved spec.
 
@@ -380,7 +383,9 @@ The ticket id assigned here rides with the work: implementation lanes append wor
 
 **[4a-FE] Developer (frontend mode):**
 - **Spawn**: `developer` in **frontend mode** with `isolation: "worktree"`.
-- **Input**: Approved spec + design spec.
+- **Input**: the story under implementation — its declared file scope + acceptance criteria — with
+  the approved spec + design spec as reference (one story per dispatch;
+  `.claude/rules/mandatory-workflow.md` Phase 2).
 
 **[4v-FE] Independent VALIDATE (you — not a sub-agent):**
 - When the Developer reports done, do **not** take the self-report at face value. In the lane's
@@ -388,8 +393,9 @@ The ticket id assigned here rides with the work: implementation lanes append wor
   `git diff --name-only` against the story's declared file scope.
 - A red check is a defect. **Out-of-scope changes are a defect** — route back to the Developer
   with the offending file list. The lane does not reach the Code Reviewer until *your own* run
-  is green. (Structural form of the evidence rule: a verdict must be backed by output you
-  captured — `.claude/rules/quality-gates.md` §2.5.)
+  is green — and VALIDATE is exactly this, nothing deeper: diff-level correctness is [4b]'s job
+  (`.claude/rules/quality-gates.md` §2.5, "mechanical — and nothing more"; the same section's
+  evidence rule still binds what you did run.)
 - **Work-log the step** on the story's ticket (`ticketing-and-traceability`): what changed, why, and
   the files from `git diff --name-only`; advance the ticket `OPEN → IN PROGRESS`. Skip silently if the
   ticket store isn't in use.
@@ -410,7 +416,8 @@ The ticket id assigned here rides with the work: implementation lanes append wor
 
 **[4a-BE] Developer (backend mode):**
 - **Spawn**: `developer` in **backend mode** with `isolation: "worktree"`.
-- **Input**: Approved backend spec.
+- **Input**: the backend story under implementation (file scope + criteria), with the approved
+  backend spec as reference.
 
 **[4v-BE] Independent VALIDATE (you — not a sub-agent):** same contract as [4v-FE] — re-run the
 backend test + lint commands yourself in the lane's worktree, diff `git diff --name-only` against

{claude_code_kit-0.81.0 → claude_code_kit-0.82.0}/agents/spec-doc-writer.md

@@ -264,6 +264,9 @@ Before marking the spec complete, verify:
 - [ ] Non-functional requirements are addressed (performance, security, accessibility)
 - [ ] Implementation steps are in dependency order (step N doesn't depend on step N+1)
 - [ ] Open questions are flagged for human resolution
+- [ ] No executed evidence pasted in — command output and measurement blocks live at their
+      `.claude/state/` or artifact path and are **cited by path**; the spec stays
+      requirements-sized because every agent reads it
 - [ ] No hardcoded values — reference the project's config/constants
 
 ## Multi-Stack Guidance

{claude_code_kit-0.81.0 → claude_code_kit-0.82.0}/agents/story-planner.md

@@ -26,12 +26,19 @@ dependency, so the orchestrator can fan work out across lanes and worktrees.
 A story breakdown (write it where the spec lives, or to `.claude/state/` for the run), containing:
 
 1. **Stories** — each with a stable id, a one-line goal, the acceptance criteria it satisfies, and
-   the files/modules it touches. Keep each story small enough for one focused implementation pass.
+   the files/modules it touches, plus two routing tags: **risk** (`low` | `standard` — `low` only
+   when the story is local, reversible, and touches no sensitive area per
+   `.claude/rules/risk-classification.md`; when in doubt, `standard`) and **batchable** (`true`
+   only for mechanical low-risk stories — docs, changelog, packaging, examples, version bumps).
+   Keep each story small enough for one focused implementation pass — each story is the unit of
+   **one dispatch**.
 2. **Dependency graph** — `blockedBy` / `blocks` between stories; the graph must be acyclic.
 3. **Parallelizable set** — which stories have no unmet dependencies and can start immediately, and
    along which lanes (e.g. backend vs frontend) per `.claude/rules/mandatory-workflow.md`.
 4. **Sequencing** — a suggested order for the rest, with the join points where a Merge Reviewer is
-   needed (shared API contract, shared data model).
+   needed (shared API contract, shared data model). Sequence one thin **end-to-end slice early**:
+   every later story then validates against a running system instead of prose — the slice *is* the
+   foundation; build it first, then widen.
 5. **Traceability** — every acceptance criterion in the spec maps to at least one story; flag any
    criterion with no story (a gap) and any story with no criterion (scope creep).
 

claude_code_kit-0.82.0/docs/pipeline-speed-playbook.md

@@ -0,0 +1,74 @@
+# Pipeline Speed Playbook — for in-flight runs (installs ≤ 0.81.0)
+
+Run-level instructions that recover most of 0.82.0's speed levers **without upgrading**. Each
+recipe says what to paste into your orchestrator dispatch (or run yourself). After
+`claude-kit upgrade`, the payload carries all of this natively and this doc is obsolete.
+
+## 1. Probe model tiers before any fan-out
+
+Most agents pin `model: sonnet`/`opus` in frontmatter; if your deployment doesn't serve an alias,
+the spawn dies **instantly with ~0 tokens**. Before the first fan-out, spawn one trivial agent per
+tier ("reply with one word"). On instant death: pass an explicit `model:` override on **every**
+dispatch for that run and note it in CONTINUITY.md. Re-probe each new session — availability
+flips. Refresh credentials before long sessions (e.g. `! gcloud auth login --update-adc` on
+Vertex).
+
+## 2. One story per dispatch + resume from the snapshot
+
+Ask for one story per orchestrator invocation, not "stories 2–5". A 90-minute dispatch that dies
+at minute 85 loses everything unwritten; two 40-minute dispatches lose at most half. On crash,
+resume from `.claude/state/pipeline-snapshot.json`: re-enter after `last_gate_passed`; never
+re-run passed gates or re-apply committed edits.
+
+## 3. Bound the orchestrator's own verification (paste into the dispatch)
+
+> Your independent VALIDATE is exactly: re-run the test/lint/build commands (capture exit codes),
+> `git diff --name-only` vs the story's declared file scope, record the printed coverage number.
+> Nothing deeper — no line-by-line diff reading, no content proofs. The code reviewer owns
+> correctness. Reviewer reports: read the verdict + severity counts + findings table only; persist
+> the body verbatim without re-analyzing it.
+
+## 4. Cap the review chain; waive residual Mediums loudly
+
+State at dispatch: "2 full re-review generations, then escalate." At escalation, accept a residual
+Medium as a known gap with the **audited** override (first probe your CLI:
+`claude-kit pipeline close-gate --help | grep -q force` — a stale binary may lack it):
+
+```
+claude-kit pipeline close-gate <gate> --force --override-reason '<finding>: accepted known gap — owner: <role>, revisit: <trigger>'
+```
+
+`validate`/`status` will WARN on it forever — that's the point. Critical/High: never waive. If the
+CLI lacks `--force`, hand-write the `gate_history` entry (schema: `.claude/rules/continuity.md`).
+
+## 5. Fan out disjoint stories across orchestrators
+
+When ≥2 unblocked stories have disjoint file boundaries: one orchestrator per story group, each in
+its own `git worktree` (each gets its own CONTINUITY/snapshot). Merge in dependency order — you
+approve each mainline merge — then run the run-level gates (test coverage, security) on the merged
+output in the primary checkout.
+
+## 6. Route ceremony by story risk; batch the mechanical tail
+
+Low-risk stories (docs/changelog/packaging/config; nothing touching auth, queries, secrets,
+tenancy, migrations): developer → code reviewer → tester only. Batch up to 3 of them into one
+dispatch, one commit per story. Any story touching a sensitive surface gets the full chain —
+decide by surface, never by size.
+
+## 7. Keep the spec requirements-sized
+
+Move executed-evidence blocks (command output, measurements) out of `docs/specs/*` into
+`.claude/state/gate-evidence/`, leaving one-line citations. Every agent reads the spec on every
+spawn — a 7,000-line spec is a per-spawn tax.
+
+## 8. Two habits that round it out
+
+Queue non-blocking questions in CONTINUITY "Open Questions"; raise them as one batch at the next
+gate (blocking stops stay immediate). Start shared test services once per run and reuse across
+defect-loop cycles (reset state between tests; the final clean-cold-start check still runs).
+
+## What NOT to cut
+
+Code review (it catches Criticals that reading alone approves), the security pass on sensitive
+surfaces, and the real-environment verification your project relies on. Speed comes from cutting
+re-verification and idle ceremony — not verification.