claude-code-kit 0.82.0__tar.gz → 0.83.0__tar.gz

{claude_code_kit-0.82.0 → claude_code_kit-0.83.0}/.claude-plugin/marketplace.json

@@ -10,8 +10,8 @@
       "name": "claude-kit",
       "displayName": "Claude Kit SDLC",
       "source": "./",
-      "description": "Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with a tamper-evident gate ledger, working memory, and a self-improving learnings loop.",
-      "version": "0.82.0",
+      "description": "Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker): install CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json, then run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with an evidence-hashed gate ledger, working memory, and a self-improving learnings loop.",
+      "version": "0.83.0",
       "license": "MIT",
       "keywords": ["sdlc", "agents", "orchestration", "quality-gates", "workflow", "scaffold", "cookiecutter"]
     }

{claude_code_kit-0.82.0 → claude_code_kit-0.83.0}/.claude-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "claude-kit",
   "displayName": "Claude Kit SDLC",
-  "version": "0.82.0",
-  "description": "Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with a tamper-evident gate ledger, working memory, and a self-improving learnings loop.",
+  "version": "0.83.0",
+  "description": "Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker). `claude-kit init` asks ordered questions and installs CLAUDE.md + .claude/ (rules, the profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with an evidence-hashed gate ledger, working memory, and a self-improving learnings loop.",
   "author": {
     "name": "Arjunsingh Yadav",
     "url": "https://github.com/ajyadav013"

{claude_code_kit-0.82.0 → claude_code_kit-0.83.0}/CHANGELOG.md

@@ -4,6 +4,99 @@ All notable changes to claude-kit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project uses
 [semantic versioning](https://semver.org/).
 
+## [0.83.0] — 2026-08-20
+
+**Trust-boundary hardening.** This release makes pipeline transitions explicit, confines project
+mutations to a checked filesystem capability, makes strict schema validation fail closed, and
+promotes the exact artifacts verified by CI into PyPI and GitHub Releases.
+
+### Added
+
+- **Explicit pipeline lifecycle:** `pipeline start`, `adopt`, `resume`, `record-findings`, `complete`,
+  and `abort`. `record-findings` binds all five exact severity counts to current evidence and HEAD
+  before any gate transition; a new run never assumes that unrecorded findings are zero.
+  Fresh runs begin at the first active gate; adopting work in flight records the historical gates,
+  reason, and adopting identity. Schema-v1 snapshots remain readable and can be explicitly adopted
+  into schema v2; unknown future schemas are refused.
+- **Canonical gate definitions** in `catalog/profiles.yaml`, including required/conditional status,
+  allowed not-applicable conditions, and a digest persisted with each install and run. Required
+  gates cannot be skipped. Conditional gates require a configured condition plus hashed evidence.
+- **Structured Medium accepted risk:** `pipeline accept-risk` records finding ID, reason, acceptor,
+  owner, ticket, revisit trigger/expiry, compensating control, gate, commit, evidence, and finding-set
+  binding under the distinct `accepted-risk` status. A stale record must be explicitly refreshed;
+  Critical and High findings are never waivable.
+- **Project-root filesystem capability and rollback journal.** Install, merge, force install, and
+  upgrade preflight selected payloads, stage and strictly validate the complete result, reject
+  traversal/link/reparse-point escapes, and snapshot the bounded mutation surface before applying.
+  Ordinary failures roll back; an interrupted schema-v2 transaction is detected and recovered on
+  the next run.
+- **Claude Code compatibility catalog** with a declared minimum version, tested versions, feature
+  floors, and recognized lifecycle events. CI exercises the official strict plugin validator at the
+  minimum and current stable pins; `doctor` distinguishes missing, unsupported, tested, untested,
+  and feature-limited installations.
+- **Release provenance and recovery:** one CI build, SHA-256 manifest, clean-wheel smoke, artifact
+  attestation, exact-artifact Trusted Publishing, post-publish digest verification, matching GitHub
+  Release assets, and a documented partial-release recovery path. Workflow lint/security checks and
+  a scheduled stable-version drift check now guard the release definitions.
+
+### Changed
+
+- `jsonschema` is a normal runtime dependency. `validate --strict` can no longer succeed after
+  skipping schema checks; current catalogs and persisted artifacts are validated against their
+  declared metaschemas and supported schema versions.
+- Ordinary `close-gate --force` transitions are refused. `skip-gate` remains a compatibility CLI
+  alias for structured `not-applicable`; old `skipped` and `overridden` ledger records remain
+  readable but are surfaced as legacy records requiring review.
+- The stack-catalog snapshot now carries `schema_version`, canonical `gate_definitions`, and their
+  SHA-256 digest. Existing schema-v1 init options and upgrade journals retain their documented
+  migration paths; future versions fail closed rather than being guessed at.
+- Native Windows project mutation now fails closed instead of using a pathname-recheck fallback
+  vulnerable to junction swaps. Use WSL on a POSIX-semantics filesystem for `init`, upgrade,
+  export, and pipeline writes; plugin discovery and read-only inspection remain available.
+- Local evidence hashes are described as **content-integrity checks**, not tamper evidence: an actor
+  able to edit both a ledger and its adjacent hash can rewrite both.
+
+### Security
+
+- All Python installer/upgrader destination paths now reject absolute, drive-qualified, UNC,
+  traversal, symlink, junction, and reparse-point escapes, including backup and sidecar targets.
+  Destination ancestry and leaves are checked again at mutation time; supported POSIX writes are
+  anchored by directory file descriptors and concurrent lifecycle/runtime writes are coordinated
+  by a handle-tied project lease. Platforms without those primitives are refused before mutation.
+- Missing selected payload components now abort before the live project is touched. Staged output
+  must pass strict validation and its manifest cannot claim absent files.
+- Installer-created bytecode and cache directories inside an installed package payload are excluded
+  from generated projects and their ownership manifest.
+- Publication no longer rebuilds after verification and no longer uses `skip-existing`. An existing
+  PyPI version is accepted only when every remote digest matches the verified artifact set; other
+  registry responses fail closed with bounded retry/timeout behavior.
+
+### Migration
+
+- Existing installations upgrade in place. Re-run `claude-kit init` (merge) or `claude-kit upgrade`
+  to persist gate definitions in the stack snapshot. Start a new run with `pipeline start`, or use
+  `pipeline adopt --reason ... --adopted-by ...` to migrate readable schema-v1 work in flight.
+- Native Windows users must run mutating CLI operations in WSL on a filesystem providing POSIX
+  descriptor and lock semantics. The refusal does not alter an existing installation.
+- Automation that used `close-gate --force` must use an ordinary evidenced pass, fix Critical/High
+  findings, or use `accept-risk` for fully structured Medium-only risk. Automation that skipped
+  conditional gates must supply `--condition` and `--evidence`.
+
+### Not adopted (deliberately)
+
+- **Authenticated/signed evidence, mechanical test-result parsers, and policy-as-code** — local
+  hashing now has accurate semantics; signed envelopes and parser-backed verification are separate
+  Phase 2 designs in `docs/roadmap/hardening-backlog.md`.
+- **Portable replacement of every Bash/jq hook** — the current limitations remain explicit;
+  cross-platform security-hook runtime work is scoped as its own migration rather than folded into
+  the installer transaction.
+- **A native Win32 mutation backend** — secure junction-resistant writes require held directory
+  handles and native race tests; 0.83 fails closed instead of shipping an unverified fallback, and
+  the Phase 2 OS-support issue owns that backend and support matrix.
+- **Changing GitHub repository or PyPI environment settings from a workflow** — required controls
+  are documented for maintainers and current settings were audited, but repository governance stays
+  an explicit owner action.
+
 ## [0.82.0] — 2026-08-17
 
 **Pipeline speed.** Three field-feedback sets from live SDLC runs (3 projects, 18 levers) triaged

{claude_code_kit-0.82.0 → claude_code_kit-0.83.0}/CLAUDE.md

@@ -52,7 +52,7 @@ The kit's central data flow is **Selection → catalog.resolve() → ResolvedPla
 | `upgrader.py` | Safe, edit-preserving upgrade: checksum comparison, transactional journal, sidecar fallback for user-edited files. |
 | `validator.py` | Structural validation of an installed config (`validate` + `--strict` mode). |
 | `schemas.py` | JSON Schema definitions for catalog integrity checks (`validate --strict`). |
-| `pipeline.py` | Deterministic `/sdlc` state-file ops (validate, status, close-gate, skip-gate, abort) — owns the append-only `gate_history` ledger (order enforcement, evidence sha256, atomic locked writes); inspects/records state, does **not** run the pipeline. |
+| `pipeline.py` | Deterministic `/sdlc` state-file operations (`start`/`adopt`/`resume`, findings, passed/not-applicable/accepted-risk gates, completion/abort, validation/status) — owns the versioned lifecycle and evidence-hashed append-only ledger; inspects/records state, does **not** run the pipeline. |
 | `export.py` | Projection into Cursor / AGENTS.md / Copilot formats. |
 | `detect.py` | Stack detection from a target repo (heuristic-based; non-blocking). |
 | `report.py` | Human-readable reporting for `doctor` and `status` commands. |
@@ -66,14 +66,14 @@ The kit's central data flow is **Selection → catalog.resolve() → ResolvedPla
 | `.claude-plugin/marketplace.json` | Marketplace entry so `/plugin marketplace add` works |
 | `agents/` | SDLC pipeline subagents (auto-discovered by the plugin); each carries a `tier:` field |
 | `skills/` | Agent skills (auto-discovered by the plugin); `skills/sdlc/` is the `/sdlc` entrypoint |
-| `commands/` | Slash commands: `/claude-kit:init`, `:sdlc`, `:status`, `:abort` (init prefers the pip CLI, falls back to `init.sh`; sdlc delegates to the `sdlc` skill; abort tears down an in-progress `/sdlc` run) |
+| `commands/` | Slash commands: `/claude-kit:init`, `:sdlc`, `:status`, `:abort` (init requires the pip CLI; sdlc delegates to the `sdlc` skill; abort tears down an in-progress `/sdlc` run) |
 | `hooks/hooks.json` + `hooks/scripts/` | Event hooks (paths via `${CLAUDE_PLUGIN_ROOT}`) |
 | `rules/` | The 25-file stack-agnostic engineering rule set (scaffolded into `.claude/rules/`), including the agent-operation rules (reasoning, guardrails, resilience, goal-setting, human-in-the-loop, model-tiers, evals, tool-design — see `docs/agentic-patterns.md`), the program-scale `wave-orchestration` rule, the service-level `resilience-engineering` rule, and the org-core rules `autonomy-levels` + `risk-classification` (see `docs/org-capabilities.md`) |
 | `catalog/` | **Data-driven registry** — `stacks.yaml` · `profiles.yaml` · `mcp.yaml` · `org.yaml`. The only thing that decides what `resolve()` installs. Adding a stack/profile/server/pack is a data change here. |
 | `templates/` | `CLAUDE.md`, `CLAUDE.stack.md.tmpl`, `README.claude-sdlc.md.tmpl`, `CONTINUITY.template.md`, `settings.json`, `artifacts/`, `agent-memory/` seed |
 | `templates/stacks/<kind>/<id>/` | Per-stack **overlay** content: `rules/` (+ `agents/` for DB stacks). **No application code, no Docker** — the only place stack-specific content lives. |
 | `templates/org/` | **Org overlay** content (scope-gated, organization only): `skills/`, `agents/` (personas), `rules/` (policy/vibe), `packs/<pack>/{pack.yaml,README.md}`, `README.md`. Wired via `catalog/org.yaml`. The only place org-specific content lives. |
-| `scripts/init.sh` | Thin no-pip fallback scaffolder (copies the full payload; no catalog resolution) |
+| `scripts/init.sh` | Compatibility dispatcher to the Python CLI; never writes project files itself |
 | `src/claude_kit/` | The pip CLI (Typer): `cli.py`, `catalog.py` (resolver), `prompts.py`, `models.py`, `scaffold.py` (installer), `render.py` (Jinja2), `hooks.py`, `validator.py` (incl. `validate --strict` + `check_catalog`), `upgrader.py`, `pipeline.py` (deterministic `/sdlc` state-file ops) |
 | `tests/` | pytest suite (catalog, render, scaffold, validator, upgrader, CLI; incl. the profile×stack×scope self-test matrix) |
 | `examples/` | Synthetic end-to-end `/sdlc` worked example (repo reference; **not** bundled into the wheel) |
@@ -125,8 +125,8 @@ root are read directly by the plugin **and** bundled into the wheel (mapped to
 
 - **Plugin:** `claude` → `/plugin marketplace add .` → `/plugin install claude-kit@claude-kit` (loads the
   agents/skills/commands/hooks from this checkout).
-- **CLI:** `pip install -e '.[dev]'` then `claude-kit init /tmp/demo --defaults` (or interactive),
-  `claude-kit validate /tmp/demo`, `claude-kit diff /tmp/demo`, and inspect the result.
+- **CLI:** `pip install -e '.[dev]'` then `claude-kit init ./ck-demo --defaults` (or interactive),
+  `claude-kit validate ./ck-demo`, `claude-kit diff ./ck-demo`, and inspect the result.
 - **Tests:** `pytest` runs the full suite. Run a single test with `pytest tests/test_catalog.py -k "test_name"`.
   The suite calls library functions directly (no subprocess) for speed and determinism, using the
   bundled payload resolved via `scaffold.payload_dir()`. Key invariants asserted: no-Docker,
@@ -161,11 +161,13 @@ root are read directly by the plugin **and** bundled into the wheel (mapped to
 1. Bump the version in **all five** places (see golden rule #6 above).
 2. Add a `CHANGELOG.md` entry with a **"Not adopted (deliberately)"** block.
 3. Ensure `pytest` + all lint/drift checks are green.
-4. Build: `python3 -m build && python3 -m twine check dist/*`.
-5. Merge to `main` — CI auto-publishes to PyPI (OIDC trusted publishing). Manual `twine upload` is
-   the fallback.
-6. Nothing to tag by hand — `publish.yml`'s `github-release` job creates the `vX.Y.Z` tag and the
-   GitHub Release on every successful publish (since 0.57.0). `scripts/backfill-releases.sh
-   --dry-run` is the recovery path if a published version is ever missing its tag.
+4. Build locally with `python3 -m build && python3 -m twine check dist/*` as a verification step;
+   local artifacts are never release inputs.
+5. Merge to `main`. CI builds wheel and sdist once, smoke-tests that exact `verified-dist` artifact,
+   and the publish workflow promotes those same bytes through PyPI Trusted Publishing.
+6. Nothing is uploaded or tagged by hand. For partial-publication recovery, dispatch `Publish
+   verified distributions` with the numeric successful `main` CI run ID that produced the original
+   artifact; follow `docs/operations/release-recovery.md`. Never use an ad-hoc rebuild or manual
+   `twine upload` as a fallback.
 
 See `CONTRIBUTING.md` for the full contributor workflow.

{claude_code_kit-0.82.0 → claude_code_kit-0.83.0}/CONTRIBUTING.md

@@ -10,9 +10,9 @@ security issues go through [SECURITY.md](SECURITY.md) rather than a public issue
   `templates/`, `catalog/` — are the **kit payload** and the **single source of truth**.
 - The plugin reads them directly from the root; the pip wheel bundles them under
   `claude_kit/_payload/` via `force-include` in `pyproject.toml`. **Never duplicate this content.**
-- `src/claude_kit/` is the pip CLI (the canonical scaffolder). `scripts/init.sh` is a **thin no-pip
-  fallback** for the `/claude-kit:init` plugin command — it copies the full payload with no catalog
-  resolution; don't reimplement the resolver in bash.
+- `src/claude_kit/` is the pip CLI and the only supported scaffolder. `scripts/init.sh` is a
+  compatibility dispatcher to that CLI; it performs no project writes. Do not reimplement catalog
+  resolution or filesystem mutation in bash.
 - claude-kit installs **configuration only** — never application code, never Docker.
 
 ## Golden rules
@@ -28,6 +28,14 @@ security issues go through [SECURITY.md](SECURITY.md) rather than a public issue
    manifests go there).
 5. **Hook scripts** use `${CLAUDE_PLUGIN_ROOT}` for plugin context and **degrade to no-ops** when a
    tool isn't present — detect, never hard-fail.
+6. **All project mutations go through `ProjectFS`.** Treat a target checkout and `.claude/` as
+   untrusted: no direct `Path.write_*`, `mkdir`, rename, unlink, `shutil.copy*`, or recursive delete
+   in installer, upgrader, or pipeline-state paths. Keep mutation-time ancestry/leaf checks and add
+   adversarial symlink/reparse tests for every new destination class.
+7. **Gate policy is catalog data.** Add or change a gate once in the canonical `gate_definitions`
+   registry in `catalog/profiles.yaml`; do not reproduce required/skippable policy in CLI branches or
+   prose. Conditional gates need closed condition identifiers. Run installs persist the definition
+   digest so state cannot silently inherit changed policy.
 
 ## Adding components
 
@@ -40,7 +48,7 @@ security issues go through [SECURITY.md](SECURITY.md) rather than a public issue
 - **Rule** → add `rules/<name>.md`; cross-reference siblings as `.claude/rules/<name>.md`.
 - **Hook** → add a script to `hooks/scripts/`, register it in the `HOOK_REGISTRY` in
   `src/claude_kit/hooks.py`, and list its id in the relevant profile's `hooks:`. To surface it in the
-  plugin and/or the no-pip starter, add its id to `PLUGIN_HOOK_IDS` / `STARTER_HOOK_IDS` (same module),
+  plugin and/or static starter template, add its id to `PLUGIN_HOOK_IDS` / `STARTER_HOOK_IDS` (same module),
   then **run `python scripts/gen_hooks.py`** to regenerate `hooks/hooks.json` and
   `templates/settings.json` — **never hand-edit those two files** (a drift test, `gen_hooks.py --check`,
   fails the build if they diverge from the registry). A plugin-only hook (no CLI scaffold equivalent,
@@ -53,7 +61,9 @@ security issues go through [SECURITY.md](SECURITY.md) rather than a public issue
   `templates/stacks/<stack_dir>/rules/<name>.md` (+ `agents/` for a database). Mark not-yet-ready
   entries `status: planned`. No Python change is needed — `catalog.resolve()` must stay branch-free.
 - **Profile** → add an entry to `catalog/profiles.yaml` (compose with `inherit:`; `all` selects
-  everything). **MCP server** → add an entry to `catalog/mcp.yaml` with a `config` fragment using
+  everything). Every referenced gate must have one canonical `gate_definitions` entry; required
+  gates set `skippable: false`, while conditional gates enumerate exact `skip_conditions`.
+  **MCP server** → add an entry to `catalog/mcp.yaml` with a `config` fragment using
   `${ENV}` placeholders (never real credentials).
 
 ## Local testing
@@ -65,9 +75,9 @@ security issues go through [SECURITY.md](SECURITY.md) rather than a public issue
 # CLI:
 pip install -e '.[dev]'
 claude-kit list-options
-claude-kit init /tmp/ck-demo --defaults && ls -R /tmp/ck-demo/.claude
-claude-kit validate /tmp/ck-demo
-claude-kit diff /tmp/ck-demo
+claude-kit init ./ck-demo --defaults && ls -R ./ck-demo/.claude
+claude-kit validate ./ck-demo
+claude-kit diff ./ck-demo
 
 # Tests:
 pytest
@@ -82,6 +92,7 @@ python scripts/check_cross_references.py --strict
 python scripts/check_skill_descriptions.py --strict
 python scripts/check_rule_sizes.py
 python scripts/check_mcp_pins.py
+claude plugin validate . --strict
 
 # Build + validate the package:
 python3 -m build
@@ -108,13 +119,17 @@ a specific stack — `pytest` enforces the no-Docker invariant on a scaffolded p
    so keep it. If those blocks ever grow unwieldy they may later split into `docs/decision-log.md`,
    but **only if** the README's CHANGELOG cross-reference is updated in the same change; until then
    they stay in `CHANGELOG.md` by design.
-3. `pytest` green, then `python3 -m build && python3 -m twine check dist/*`.
-4. CI auto-publishes to PyPI on merge to `main` when the version is new (`.github/workflows/publish.yml`,
-   OIDC trusted publishing). Manual `python3 -m twine upload dist/*` is the fallback.
-5. The tag and GitHub Release are created for you — `publish.yml`'s `github-release` job does both on
-   every successful publish (since 0.57.0), so there is nothing to tag by hand. If a release ever
-   lands on PyPI without its tag, `scripts/backfill-releases.sh --dry-run` shows what is missing and
-   the same script without the flag creates it; it is idempotent, so re-running is safe.
+3. `pytest` and every static/drift check green, then `python3 -m build` and
+   `python3 -m twine check dist/*`. Run the official `claude plugin validate . --strict` at the
+   declared minimum and current stable Claude Code versions (CI owns that matrix).
+4. CI builds wheel + sdist **once**, smoke-tests the exact wheel, writes `SHA256SUMS`, and uploads the
+   `verified-dist` artifact. The publish workflow authenticates the successful main-branch CI run and
+   promotes those exact files through OIDC Trusted Publishing with PEP 740 and GitHub artifact
+   attestations. It must never rebuild or use `skip-existing`.
+5. The tag and GitHub Release are created from the verified commit and receive the same wheel, sdist,
+   and checksum manifest. A partial release is recovered by dispatching the documented workflow for
+   the original CI run; do not make an ad-hoc local rebuild. Follow
+   [`docs/operations/release-recovery.md`](docs/operations/release-recovery.md).
 6. Publish the context-cost report for the release: run `claude plugin details claude-kit@claude-kit`
    in Claude Code and paste the token/context figures into the release notes, so users can see what
    the plugin costs their context window before installing.

{claude_code_kit-0.82.0 → claude_code_kit-0.83.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.5
 Name: claude-code-kit
-Version: 0.82.0
-Summary: Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with a tamper-evident gate ledger, working memory, and a self-improving learnings loop.
+Version: 0.83.0
+Summary: Evidence-gated SDLC for Claude Code, installed as configuration (no app code, no Docker). Asks ordered questions and installs CLAUDE.md + .claude/ (rules, the chosen profile's agents/skills, hooks, artifact templates) + optional .mcp.json; run /sdlc to drive spec → review → build → test → security → ship through profile-aware quality gates with an evidence-hashed gate ledger, working memory, and a self-improving learnings loop.
 Project-URL: Homepage, https://github.com/ajyadav013/claude-kit
 Project-URL: Repository, https://github.com/ajyadav013/claude-kit
 Project-URL: Issues, https://github.com/ajyadav013/claude-kit/issues
@@ -17,7 +17,9 @@ Classifier: Topic :: Software Development
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.9
 Requires-Dist: jinja2>=3.1
+Requires-Dist: jsonschema>=4.0
 Requires-Dist: pyyaml>=6.0
+Requires-Dist: tomli>=2.0; python_version < '3.11'
 Requires-Dist: typer>=0.12
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == 'dev'
@@ -43,7 +45,8 @@ phase.**
 
 The differentiator is trust: **every gate verdict must cite real command output, and the
 deterministic state layer refuses to close a gate out of order or with unresolved
-Critical/High/Medium findings.** It installs as **configuration, not a runtime** — no application
+Critical/High findings; Medium findings require a separate, structured human risk acceptance.** It
+installs as **configuration, not a runtime** — no application
 code in your repo and no daemon: Claude Code configuration, local hooks, and an optional CLI.
 
 </div>
@@ -149,8 +152,9 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 </details>
 
 > **Prerequisites:** [Claude Code](https://www.claude.com/product/claude-code); Python ≥ 3.9 for the CLI;
-> `jq` for the shell hooks (they no-op without it). **Windows** users: run inside WSL or Git Bash for
-> the hooks. Every install question, the `init.yaml` format, what lands on disk, and plugin-update
+> `jq` for the shell hooks (they no-op without it). **Windows** users: run mutating CLI commands in
+> WSL on a filesystem with POSIX descriptor/lock semantics; native Windows mutation fails closed
+> until a handle-anchored backend is available. Every install question, the `init.yaml` format, what lands on disk, and plugin-update
 > steps: **[docs/install.md](docs/install.md)**.
 
 ---
@@ -159,7 +163,7 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 
 | Area | What you get |
 |------|--------------|
-| 🔁 **Pipeline & quality gates** | Gate-enforced progression — a phase advances only with zero open Critical/High/Medium findings — plus a fast-track for small changes and an anti-sycophancy `devils-advocate` pass |
+| 🔁 **Pipeline & quality gates** | Explicit start/adopt lifecycle and ordered progression: Critical/High always block; Medium requires a distinct, structured accepted-risk record; conditional gates need configured not-applicable evidence; plus a fast-track and `devils-advocate` pass |
 | 🤖 **Agent roster** | **29** tiered agents led by an Orchestrator that never writes code, plus per-database overlay agents and 6 org personas ([full roster](docs/agents.md)) |
 | 📐 **Rules & skills** | **25** stack-agnostic core rules + **121** context-activated skills (58 core + 63 stack-collection), pulled into context on demand |
 | 🧱 **Stacks & overlays** | A stack-agnostic core + **14** overlay rule files (React · FastAPI · Django · Go · Postgres · Mongo) wired to your exact commands and path-scoped to load only when you touch matching files |
@@ -182,8 +186,9 @@ Four ideas do the heavy lifting:
    is an **auto-Critical finding** — the same severity as a hardcoded secret
    ([`quality-gates.md` §2.5](rules/quality-gates.md)).
 2. **Quality gates with a shared severity model.** Every finding is classified
-   Critical / High / Medium / Low / Cosmetic. A gate passes **only** with zero Critical/High/Medium
-   open. No silent advancement.
+   Critical / High / Medium / Low / Cosmetic. Critical and High always block. Medium never becomes an
+   ordinary pass: proceeding requires a structured, human-attested `accepted-risk` record tied to
+   the current gate, commit, findings, and evidence. No silent advancement.
 3. **RARV self-check.** Every agent runs **R**eason → **A**ct → **R**eflect → **V**erify and must show
    a *green Verify* (real commands run, not imagined) before handing off.
 4. **Blind review + Devil's Advocate.** Parallel reviewers judge independently; a *unanimous* PASS
@@ -221,10 +226,19 @@ flowchart TD
 | **standard** | spec-complete · em-approved · code-review · build-green · contract-clear\* · test-coverage · security-clear |
 | **enterprise** | standard + pipeline-green · observability-ready · acceptance |
 
-\* `contract-clear` (API breaking-change diff) self-skips when the stack exposes no API surface.
+\* `contract-clear` (API breaking-change diff) is conditional: when the stack exposes no API
+surface, it may be marked `not-applicable` only with the configured condition and current evidence.
 A **fast-track** mode collapses small changes (< 5 files) to Developer → Code Reviewer → Tester → PR;
 organization scope at `regulated` strictness adds `accessibility-clear` (WCAG-AA on changed UI).
 
+The state layer does not infer that a run has begun. `claude-kit pipeline start` opens a fresh run at
+its first active gate; work already in flight must use `pipeline adopt` with a reason and adopting
+identity. Gate results are recorded with `close-gate`, `not-applicable`, or `accept-risk`, then the
+run ends explicitly with `complete` or `abort`. Before any gate transition, `record-findings` binds
+all five exact severity counts to a project-contained report and the current commit; a new commit or
+report requires a fresh record. `status` and `validate --json` expose adoption and accepted-risk
+records without translating them into PASS.
+
 See the real captured run in [`examples/real-run/`](examples/real-run/) — a feature driven through
 every gate on a Go project, with the verbatim state file, agent verdicts, diff, and an asciicast —
 or the [synthetic walkthrough](examples/react-fastapi-postgres-feature/) of the default stack. To
@@ -371,14 +385,29 @@ through the alibaba/microsoft/google/Meta/Netflix·aws·apple org reviews — li
 ## Security & trust model
 
 claude-kit installs **configuration only** — no application code, no Docker, nothing that runs as a
-service. Three honest caveats before you rely on it:
+service. Its controls span several trust boundaries; the label matters more than the word "gate":
+
+| Control | Enforcement type | Trust boundary |
+|---|---|---|
+| Gate order and lifecycle | Mechanically enforced | Python pipeline layer |
+| Test result | Agent-enforced today; mechanical parsing is planned | Agent report and cited artifact |
+| Hook guard | Hook-enforced | Requires the Claude hook runtime, POSIX shell, and `jq` |
+| Security scanner result | Externally verified or Agent-enforced, depending on scanner | External tool output or scanner agent |
+| Accepted risk | Human-attested | Structured record bound to gate, commit, evidence, and findings |
+| MCP permissions | Externally verified plus local policy | External server and Claude Code; **not a sandbox** |
+| Local evidence hash | Mechanically enforced content-integrity check | Detects artifact drift; a writer can change both file and ledger |
+
+Other prose requirements are **Advisory** unless one of those layers enforces them. Three honest
+caveats before you rely on the system:
 
 - **The guard hooks are convenience, not a hardened boundary.** They raise the cost of a mistake but
   don't sandbox the agent; they need a POSIX shell + `jq` and silently no-op without them. Seatbelts,
   not walls.
-- **Most quality gates are agent protocols, not mechanical enforcement.** Only the hook scripts are
-  deterministic, host-enforced checks; a capable model can still be wrong or skip a step — keep a
-  human in the loop for anything that matters. Relatedly: the agents' `permissionMode` confinement
+- **Most quality results are agent protocols, not independently parsed test results.** The Python
+  layer mechanically enforces lifecycle, order, allowed transition types, bindings, and evidence
+  hashes; it does not prove that an arbitrary evidence file means the tests passed. A capable model
+  can still be wrong or skip a step — keep a human in the loop for anything that matters. Relatedly:
+  the agents' `permissionMode` confinement
   (read-only reviewers) binds only in **init-scaffolded** projects — plugin-loaded agents ignore
   it, so run the pipeline from a scaffolded project when that confinement matters.
 - **MCP servers are third-party code.** Each fragment runs an external package — pinned to an exact
@@ -415,7 +444,7 @@ Issues and PRs welcome — see [`CONTRIBUTING.md`](CONTRIBUTING.md). To dogfood
 
 ```bash
 # As a plugin:  /plugin marketplace add .   then   /plugin install claude-kit@claude-kit
-# As the CLI:   pip install -e '.[dev]'   then   claude-kit init /tmp/demo --defaults   &&   pytest
+# As the CLI:   pip install -e '.[dev]'   then   claude-kit init ./ck-demo --defaults   &&   pytest
 ```
 
 ## License

{claude_code_kit-0.82.0 → claude_code_kit-0.83.0}/README.md

@@ -10,7 +10,8 @@ phase.**
 
 The differentiator is trust: **every gate verdict must cite real command output, and the
 deterministic state layer refuses to close a gate out of order or with unresolved
-Critical/High/Medium findings.** It installs as **configuration, not a runtime** — no application
+Critical/High findings; Medium findings require a separate, structured human risk acceptance.** It
+installs as **configuration, not a runtime** — no application
 code in your repo and no daemon: Claude Code configuration, local hooks, and an optional CLI.
 
 </div>
@@ -116,8 +117,9 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 </details>
 
 > **Prerequisites:** [Claude Code](https://www.claude.com/product/claude-code); Python ≥ 3.9 for the CLI;
-> `jq` for the shell hooks (they no-op without it). **Windows** users: run inside WSL or Git Bash for
-> the hooks. Every install question, the `init.yaml` format, what lands on disk, and plugin-update
+> `jq` for the shell hooks (they no-op without it). **Windows** users: run mutating CLI commands in
+> WSL on a filesystem with POSIX descriptor/lock semantics; native Windows mutation fails closed
+> until a handle-anchored backend is available. Every install question, the `init.yaml` format, what lands on disk, and plugin-update
 > steps: **[docs/install.md](docs/install.md)**.
 
 ---
@@ -126,7 +128,7 @@ claude-kit init --defaults      # non-interactive: React + Python/FastAPI + Post
 
 | Area | What you get |
 |------|--------------|
-| 🔁 **Pipeline & quality gates** | Gate-enforced progression — a phase advances only with zero open Critical/High/Medium findings — plus a fast-track for small changes and an anti-sycophancy `devils-advocate` pass |
+| 🔁 **Pipeline & quality gates** | Explicit start/adopt lifecycle and ordered progression: Critical/High always block; Medium requires a distinct, structured accepted-risk record; conditional gates need configured not-applicable evidence; plus a fast-track and `devils-advocate` pass |
 | 🤖 **Agent roster** | **29** tiered agents led by an Orchestrator that never writes code, plus per-database overlay agents and 6 org personas ([full roster](docs/agents.md)) |
 | 📐 **Rules & skills** | **25** stack-agnostic core rules + **121** context-activated skills (58 core + 63 stack-collection), pulled into context on demand |
 | 🧱 **Stacks & overlays** | A stack-agnostic core + **14** overlay rule files (React · FastAPI · Django · Go · Postgres · Mongo) wired to your exact commands and path-scoped to load only when you touch matching files |
@@ -149,8 +151,9 @@ Four ideas do the heavy lifting:
    is an **auto-Critical finding** — the same severity as a hardcoded secret
    ([`quality-gates.md` §2.5](rules/quality-gates.md)).
 2. **Quality gates with a shared severity model.** Every finding is classified
-   Critical / High / Medium / Low / Cosmetic. A gate passes **only** with zero Critical/High/Medium
-   open. No silent advancement.
+   Critical / High / Medium / Low / Cosmetic. Critical and High always block. Medium never becomes an
+   ordinary pass: proceeding requires a structured, human-attested `accepted-risk` record tied to
+   the current gate, commit, findings, and evidence. No silent advancement.
 3. **RARV self-check.** Every agent runs **R**eason → **A**ct → **R**eflect → **V**erify and must show
    a *green Verify* (real commands run, not imagined) before handing off.
 4. **Blind review + Devil's Advocate.** Parallel reviewers judge independently; a *unanimous* PASS
@@ -188,10 +191,19 @@ flowchart TD
 | **standard** | spec-complete · em-approved · code-review · build-green · contract-clear\* · test-coverage · security-clear |
 | **enterprise** | standard + pipeline-green · observability-ready · acceptance |
 
-\* `contract-clear` (API breaking-change diff) self-skips when the stack exposes no API surface.
+\* `contract-clear` (API breaking-change diff) is conditional: when the stack exposes no API
+surface, it may be marked `not-applicable` only with the configured condition and current evidence.
 A **fast-track** mode collapses small changes (< 5 files) to Developer → Code Reviewer → Tester → PR;
 organization scope at `regulated` strictness adds `accessibility-clear` (WCAG-AA on changed UI).
 
+The state layer does not infer that a run has begun. `claude-kit pipeline start` opens a fresh run at
+its first active gate; work already in flight must use `pipeline adopt` with a reason and adopting
+identity. Gate results are recorded with `close-gate`, `not-applicable`, or `accept-risk`, then the
+run ends explicitly with `complete` or `abort`. Before any gate transition, `record-findings` binds
+all five exact severity counts to a project-contained report and the current commit; a new commit or
+report requires a fresh record. `status` and `validate --json` expose adoption and accepted-risk
+records without translating them into PASS.
+
 See the real captured run in [`examples/real-run/`](examples/real-run/) — a feature driven through
 every gate on a Go project, with the verbatim state file, agent verdicts, diff, and an asciicast —
 or the [synthetic walkthrough](examples/react-fastapi-postgres-feature/) of the default stack. To
@@ -338,14 +350,29 @@ through the alibaba/microsoft/google/Meta/Netflix·aws·apple org reviews — li
 ## Security & trust model
 
 claude-kit installs **configuration only** — no application code, no Docker, nothing that runs as a
-service. Three honest caveats before you rely on it:
+service. Its controls span several trust boundaries; the label matters more than the word "gate":
+
+| Control | Enforcement type | Trust boundary |
+|---|---|---|
+| Gate order and lifecycle | Mechanically enforced | Python pipeline layer |
+| Test result | Agent-enforced today; mechanical parsing is planned | Agent report and cited artifact |
+| Hook guard | Hook-enforced | Requires the Claude hook runtime, POSIX shell, and `jq` |
+| Security scanner result | Externally verified or Agent-enforced, depending on scanner | External tool output or scanner agent |
+| Accepted risk | Human-attested | Structured record bound to gate, commit, evidence, and findings |
+| MCP permissions | Externally verified plus local policy | External server and Claude Code; **not a sandbox** |
+| Local evidence hash | Mechanically enforced content-integrity check | Detects artifact drift; a writer can change both file and ledger |
+
+Other prose requirements are **Advisory** unless one of those layers enforces them. Three honest
+caveats before you rely on the system:
 
 - **The guard hooks are convenience, not a hardened boundary.** They raise the cost of a mistake but
   don't sandbox the agent; they need a POSIX shell + `jq` and silently no-op without them. Seatbelts,
   not walls.
-- **Most quality gates are agent protocols, not mechanical enforcement.** Only the hook scripts are
-  deterministic, host-enforced checks; a capable model can still be wrong or skip a step — keep a
-  human in the loop for anything that matters. Relatedly: the agents' `permissionMode` confinement
+- **Most quality results are agent protocols, not independently parsed test results.** The Python
+  layer mechanically enforces lifecycle, order, allowed transition types, bindings, and evidence
+  hashes; it does not prove that an arbitrary evidence file means the tests passed. A capable model
+  can still be wrong or skip a step — keep a human in the loop for anything that matters. Relatedly:
+  the agents' `permissionMode` confinement
   (read-only reviewers) binds only in **init-scaffolded** projects — plugin-loaded agents ignore
   it, so run the pipeline from a scaffolded project when that confinement matters.
 - **MCP servers are third-party code.** Each fragment runs an external package — pinned to an exact
@@ -382,7 +409,7 @@ Issues and PRs welcome — see [`CONTRIBUTING.md`](CONTRIBUTING.md). To dogfood
 
 ```bash
 # As a plugin:  /plugin marketplace add .   then   /plugin install claude-kit@claude-kit
-# As the CLI:   pip install -e '.[dev]'   then   claude-kit init /tmp/demo --defaults   &&   pytest
+# As the CLI:   pip install -e '.[dev]'   then   claude-kit init ./ck-demo --defaults   &&   pytest
 ```
 
 ## License