Keel v1.10.0 — Native Claude Code project config, and projects that catch up when Keel does

What's new in 1.10.0

Native Claude Code project configuration (optional package)

Keel can now generate the configuration Claude Code loads natively — per project, only with your consent, and derived exclusively from decisions the project has already recorded. New reference: references/claude-config.md.

• .claude/rules/ — three path-scoped rules distilled from the technical plan and the security profile: code-style.md, security.md and docs-discipline.md. They load only when a session touches matching source files, stay under ~40 lines each, and point to their docs/ sources instead of duplicating them.
• .claude/agents/ — three read-only reviewer subagents: code-reviewer (conventions, reuse, i18n, accessibility, docs), security-auditor (the loaded security profile) and docs-verifier (docs/api/INDEX.md ↔ docs, one-to-one). They flag; they never rewrite.
• .claude/settings.json — a minimal permission allow-list built ONLY from the plan's verified tooling and playground commands, ALWAYS confirmed by the user before writing.
• Confidential-data pre-commit gate — a classic git hook (.githooks/pre-commit + core.hooksPath) that blocks staged secrets in EVERY environment and editor, not only Claude Code sessions. Installed at the scaffold and verified by blocking a synthetic secret, with a conscious, on-the-record bypass policy.
• .mcp.json — only when the technical plan defines development MCP servers; environment expansion, never a literal secret.

When it happens. Offered once, in the Phase 1 step 0a batch (and at adoption step 2); recorded in the project card as Claude config: [none / rules / rules+agents / full]. Rules and agents materialize at Phase 2 close, when their sources are fixed; settings, the gate and .mcp.json at the Phase 5 scaffold. In adoption, rules encode the OBSERVED conventions — never imposed ones — and existing .claude/ config is inventoried and reconciled, never overwritten.

Position in the workflow. The CLAUDE.md lock remains the universal mechanism — only Claude Code loads rules, agents and settings, so nothing critical to the workflow lives only in .claude/. CLAUDE.local.md and .claude/settings.local.json are never created by Keel but always gitignored. Phase 7's export-ignore now also covers generated config, .githooks/ and .mcp.json — none of it ever ships in the distributable.

Post-update reconciliation — the project catches up when Keel does

A Keel update changes the workflow; until now it did not change the project. New procedure in references/project-state.md, "Post-update reconciliation".

• When it runs. Right after the session-start update check replaces any copy, and on resume whenever the project card's Keel baseline: is older than the running version — or missing (any project created before 1.10.0).
• What it does. Re-reads the new SKILL.md and the current phase's reference (the copies in context belong to the old version), diffs versions via the changelog, and extracts what touches the PROJECT itself: files and directories that should now exist, new project-card lines, lock-block refreshes between the KEEL:BEGIN/END delimiters, questions a phase now asks that this project was never asked, new one-time verifications. Then it presents ONE batched catch-up plan you approve, trim or defer — deferrals are recorded in PROGRESS.md open items, never forgotten.
• What it never does. Re-open recorded decisions (conflicts are surfaced; the recorded decision wins until you reverse it), re-run completed phases, or force-install optional mechanisms — it asks their never-asked question, e.g. this release's Claude config package on a pre-1.10.0 project.
• The trail. New project-card line Keel baseline: vX.Y.Z, stamped at creation (Phase 1 step 0a / adoption step 2) and advanced ONLY by completing a reconciliation — a skill update alone never advances it.

How to update

Replace your installed keel/ directory with this release's (see INSTALL.md, "Updating"). Projects that embed the skill get their .claude/skills/keel/ copy updated automatically by the session-start update check — and from this release on, the session then offers the post-update reconciliation so the project itself catches up too.