v2.1.40 — Challenge the premise, test like a user, prove the finding

Highlights

Plans now get challenged before they get built. /plan-plus gains a Premise
Challenge phase that asks up to four forcing questions — who actually wants this,
what they do today instead, the smallest version worth shipping this week, and
what happens if you build nothing at all. The phase closes with a numbered list
of premises you confirm, and alternatives are only explored once those premises
hold. Bug fixes and small changes skip it automatically.

Scope is now an explicit decision, not a drift. Phase 3 picks a scope mode —
Expand, Selective, Hold, or Reduce — before the YAGNI review runs, and every
proposed addition is decided on its own rather than swept in with the rest.

No failure is silent by accident. Phase 4 adds a failure map: each new entry
point, what can go wrong there, whether it is handled, and what the user actually
sees. A silent failure has to be handled or recorded as an accepted risk.

QA tests like a user, not only like a script. qa-lead maps the files you
changed to the pages and endpoints they serve and tests those first, then walks
each one exploratorily — submitting empty and invalid forms, hitting empty and
error states, using back/forward and deep links — and reads the console after
every single action rather than once per page. Findings are reported with a
weighted 0-100 Health Score.

Security findings now have to clear an evidence bar. security-architect
follows an ordered audit procedure (application model, attack surface, secrets,
supply chain, CI/CD, LLM/agent surface, OWASP, STRIDE), and a finding counts as
supported only when it can show an attacker-controlled entry point, a path
across a boundary, a concrete impact, and that existing protections do not
already stop it. Anything short of that is labelled unconfirmed with the
missing link named.

Methodology for these three areas is adapted from
gstack (MIT, © Garry Tan) and rewritten for
bkit; attribution is recorded in NOTICE. No gstack source files are included.

What changes for you

You will be asked harder questions at plan time. /plan-plus on a new
user-facing feature now asks up to four additional questions before it proposes
approaches, and it takes a position on your answers instead of agreeing with
them. Enthusiasm no longer reads as demand; an existing workaround does. If you
want to move on, it asks the single most important remaining question and then
proceeds — it will not ask a third time. On a bug fix or an internal refactor
the phase is skipped or reduced, so short tasks do not get longer.

"Do nothing" can now be one of your options. When the cost of inaction turns
out to be low, that shows up as a real alternative in Phase 2 rather than being
assumed away.

QA reports look different. docs/05-qa/{feature}.qa-report.md gains three
sections: a Scope table showing which changed file maps to which page and whether
it got full or smoke coverage, a Health Score breakdown across eight weighted
categories, and an Issues table in fix order with reproduction steps and console
or network evidence. Pages that were not exercised are now visible as such, and a
score computed over partly untested ground is marked provisional.

Your pass/fail verdict has not moved. The Health Score is informational only.
qaPassRate >= 95%, critical count, and runtime error count still decide
QA_PASS / QA_FAIL exactly as before, so no project that passed yesterday fails
today because of this release.

Failed QA hands off more usefully. On QA_FAIL, issues go to Act in fix order
with reproduction steps, under a one-issue-per-fix rule, with a regression test
added at the lowest level that can catch each fix, and re-verification through
the existing act → qa retry. Act now stops and asks you when a fix starts
spreading into unrelated files, gets reverted, or begins breaking tests that were
passing.

Security reports state their own coverage. Every report opens with
complete, partial, or not assessed and names the phases it skipped,
so a clean result is distinguishable from an unexamined one. An empty result now
reads "No supported findings in the assessed scope" with the scope listed,
instead of "no issues".

Nothing was added to your installation. No new skill, agent, hook, command,
or quality gate — the counts stay at 44 skills, 34 agents, 2 commands. These are
changes inside components you already have, so there is no new surface to learn
and nothing to reconfigure. Upgrading is drop-in.

Verification

• CI (Invocation Contract Check) is green on this release: 7140 pass, 0 fail,
  0 errored files, 7142 test cases, across both jobs.
• node scripts/docs-code-sync.js — passed, all counts consistent across code
  and docs.
• node scripts/check-skills-docs-code-sync.js — 44/44 skills pass.
• node scripts/validate-plugin.js --strict — 44/44 skills, 34/34 agents, 2/2
  commands, 0 errors, 0 warnings.
• Hook live-run evidence re-recorded against Claude Code 2.1.282 (23/23), since
  the version bump changed hooks/hooks.json. Observed events and tool coverage
  are identical to the v2.1.39 recording.
• Installed from the marketplace and exercised: claude plugin install bkit@bkit-marketplace reports 2.1.40 with 44 skills, 34 agents and 21 hook
  events; both MCP servers answer tools/list with 19 tools (13 + 6); and a live
  claude -p session loads the new plan-plus text, reporting Phase 1.5
  "Premise Challenge", the four forcing questions, and the four scope modes.

Full changelog: v2.1.39...v2.1.40