cc-codeconductor 0.5.0 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-codeconductor",
-  "version": "0.5.0",
+  "version": "1.1.0",
   "description": "A multi-agent orchestration framework for AI-assisted software engineering workflows.",
   "keywords": [
     "ai",
@@ -16,6 +16,8 @@
   "license": "MIT",
   "files": [
     "dist/index.js",
+    "dist/library.js",
+    "dist/**/*.d.ts",
     "policy.yml",
     "presets/",
     "src/presets/"
@@ -28,15 +30,29 @@
     "node": ">=20.11"
   },
   "type": "module",
+  "main": "./dist/library.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/library.js"
+    }
+  },
   "bin": {
     "cc-codeconductor": "./dist/index.js",
     "codeconductor": "./dist/index.js"
   },
   "scripts": {
     "dev": "bun run src/cli/main.ts",
-    "build": "bun build src/cli/main.ts --target=node --outfile=dist/index.js",
+    "build": "bun run scripts/build.ts",
+    "build:cli": "bun build src/cli/main.ts --target=node --outfile=dist/index.js",
+    "build:lib": "bun build src/index.ts --target=node --outfile=dist/library.js --packages=external",
+    "build:types": "tsc -p tsconfig.lib.json --emitDeclarationOnly",
     "test": "bun test",
+    "test:fast": "bun run scripts/test-fast.ts",
     "typecheck": "tsc --noEmit",
+    "lint": "bun run scripts/lint.ts",
+    "check:coverage": "bun run scripts/check-coverage.ts",
     "check:prompt-changelog": "bun run scripts/check-prompt-changelog.ts",
     "release:patch": "bash release.sh patch",
     "release:minor": "bash release.sh minor",

package/policy.yml

@@ -42,23 +42,24 @@ denyWrite:
   - ".git/**"
   - ".claude/**"
   - ".opencode/**"
+  # Session handoffs belong in .codeconductor/sessions/ (gitignored). The
+  # compiler does not exist yet; gitignore + workflow redaction are the
+  # compensating controls for /cc:handoff.
   - ".codeconductor/**"
   - ".code-conductor/policy.yml"
   - "/etc/**"
   - "/var/**"
   - "~/**"
 
-# Credential patterns for secret detection.
-# These are merged with CodeConductorConfig.safety.secretPatterns at runtime.
-secretPatterns:
-  - password
-  - secret
-  - api_key
-  - token
-  - api[_-]?key
-  - access[_-]?token
-  - auth[_-]?token
-  - private[_-]?key
+# Optional keyword patterns for secret detection, merged with
+# CodeConductorConfig.safety.secretPatterns at runtime.
+#
+# Built-in detection does NOT rely on this list: high-confidence signatures
+# (AWS access key ids, AWS_SECRET_ACCESS_KEY values, GitHub PATs, PEM/OpenSSH
+# private key headers) are enforced in code and always active. Entries here add
+# legacy keyword matching (`<keyword> = <value of 8+ chars>`), which is prone to
+# false positives — add them only when a project needs them.
+secretPatterns: []
 
 targets:
   opencode:

package/presets/agy/AGENTS.md

@@ -74,7 +74,16 @@ Antigravity CLI loads custom slash commands from `.agents/workflows/*.md`. The f
 | `/cc-tdd-cycle`  | Runs a Test-Driven Development (TDD) cycle                         |
 | `/cc-api-contract`| Handles API contract modification and validation                  |
 | `/cc-db-migration`| Coordinates database schema migrations safely                      |
+| `/cc-iterative`  | Advanced iterative workflow — wayfinding, grilling, TDD, council |
+| `/cc-explore`    | Map the repo and recommend the next `/cc:` command               |
+| `/cc-triage`     | Classify type, risk, and destination workflow                    |
+| `/cc-prototype`  | Disposable spike in an isolated worktree                         |
+| `/cc-handoff`    | Compact the session to `.codeconductor/` Markdown                |
+| `/cc-clarify`    | Re-explain the last deliverable in Task Card vocabulary          |
+| `/cc-backlog`    | Author or append BACKLOG.md and plan OpenSpec change folders   |
+| `/cc-openspec`   | OpenSpec delivery loop from BACKLOG.md                         |
 | `/cc-pagespeed`  | Performs a web performance and Core Web Vitals audit               |
+| `/cc-security`   | Authorized defensive security workflow (authorization gate)   |
 
 ---
 
@@ -99,13 +108,13 @@ When multiple signals apply, take the highest risk level. Do not average.
 
 | Task Type            | Risk        | Route                                               |
 | -------------------- | ----------- | --------------------------------------------------- |
-| New feature design   | any         | `architect` → `implementer`                         |
-| Bug fix              | low         | `implementer`                                       |
-| Bug fix              | medium–high | `task-coach` → `implementer` → `tester`             |
+| New feature design   | any         | `architect` → `tester` → `implementer`              |
+| Bug fix              | low         | `tester` → `implementer`                            |
+| Bug fix              | medium–high | `task-coach` → `tester` → `implementer`             |
 | Refactor             | low         | `implementer`                                       |
 | Refactor             | medium–high | `architect` → `implementer` → `reviewer`            |
 | API change           | any         | `architect` → `implementer` → `reviewer`            |
-| Database migration   | any         | `architect` → `implementer` → `tester` → `reviewer` |
+| Database migration   | any         | `architect` → `tester` → `implementer` → `reviewer` |
 | Test coverage        | any         | `tester`                                            |
 | Documentation update | any         | `docs`                                              |
 | Codebase exploration | any         | `repo-explorer`                                     |
@@ -265,7 +274,7 @@ High-risk checkpoint: [yes | no — if yes, describe what triggers a stop]
 **Does not:** Write files. Execute commands. Make routing decisions.
 
 **Template matching:**
-The planner matches objective keywords against built-in templates (auth, crud, search, notification, migration) and falls back to a generic 4-task chain: task-coach → architect → implementer → tester.
+The planner matches objective keywords against built-in templates (auth, crud, search, notification, migration) and falls back to a generic 4-task chain: task-coach → architect → tester → implementer.
 
 **Dependency order delegation (orchestrator):**
 When the orchestrator receives a GoalGraph, it delegates tasks in dependency order. A task is only routed after all its `depends_on` targets complete with status `done`. If a dependency is `blocked`, the dependent task remains `pending`. The orchestrator tracks the graph state in `.codeconductor/current-goal.yml`.

package/presets/agy/gates/pre-commit/GATE.md

@@ -0,0 +1,137 @@
+# Pre-commit Gate: Typecheck, Lint, and Test
+
+Este gate instala un hook `pre-commit` que ejecuta `bun run typecheck`, `bun run lint` y `bun run test` antes de permitir commits en el repositorio. Si cualquiera de estos comandos falla, el commit es bloqueado.
+
+## Cuándo usar
+
+**Para agentes**: Integra este gate en flujos de desarrollo local cuando quieras garantizar que los cambios typecheck correctamente y pasan los tests antes de ser cometidos.
+
+**Para equipos**: Utiliza este gate como barrera de calidad local (sin dependencias externas) para prevenir commits con errores de tipado o tests fallidos.
+
+## Instalación
+
+### Paso 1: Descarga el script
+
+El script está embebido abajo (sección "Script Installer").
+
+### Paso 2: Ejecuta en la raíz de tu proyecto
+
+Desde la raíz del repositorio (o cualquier subdirectorio), extrae el bloque ```bash de este archivo y ejecuta:
+
+    bash << 'SCRIPT_EOF'
+    #!/bin/bash
+    set -e
+    # [contenido del bloque bash de abajo]
+    SCRIPT_EOF
+
+O, más simplemente, guarda el script en un archivo temporal y ejecútalo:
+
+    curl -s https://raw.githubusercontent.com/.../ | bash
+
+### Paso 3: Verifica
+
+Después de la instalación, debería verse:
+
+    Pre-commit hook installed successfully.
+
+## Script Installer
+
+```bash
+#!/bin/bash
+set -e
+
+# Resolver git directory dinámicamente (worktree-safe)
+GIT_DIR=$(git rev-parse --git-dir)
+HOOK_PATH="$GIT_DIR/hooks/pre-commit"
+
+# Detectar Husky o lint-staged en package.json
+if grep -q '"husky"' package.json 2>/dev/null || grep -q '"lint-staged"' package.json 2>/dev/null; then
+  echo "Warning: Husky or lint-staged detected in package.json. Installation skipped."
+  exit 0
+fi
+
+# Verificar si un pre-commit hook ya existe
+if [ -f "$HOOK_PATH" ]; then
+  echo "Warning: Pre-commit hook already exists at $HOOK_PATH. Not overwriting."
+  exit 0
+fi
+
+# Crear directorio hooks si no existe
+mkdir -p "$GIT_DIR/hooks"
+
+# Escribir el hook pre-commit
+cat > "$HOOK_PATH" << 'HOOK_EOF'
+#!/bin/bash
+bun run typecheck || exit 1
+bun run lint || exit 1
+bun run test || exit 1
+HOOK_EOF
+
+# Hacer el hook ejecutable
+chmod +x "$HOOK_PATH"
+
+echo "Pre-commit hook installed successfully."
+```
+
+## Notas de implementación
+
+- **Sin dependencias externas**: El script no instala Husky, lint-staged, ni ninguna otra herramienta. Solo escribe un archivo shell y configura permisos.
+- **Resolución dinámica de git dir**: Usa `git rev-parse --git-dir` para localizar el directorio correcto, incluso en worktrees.
+- **Detección de conflictos**: Si Husky o lint-staged ya está en `package.json`, el script avisa y no instala para evitar conflictos.
+- **Protección de hooks existentes**: Si ya existe un `.git/hooks/pre-commit`, el script no lo sobrescribe.
+- **Solo Bun**: El hook ejecuta `bun run typecheck`, `bun run lint` y `bun run test`. Asegúrate de que estos scripts están definidos en `package.json`.
+
+## Verificación
+
+Después de instalar, verifica que el hook está en su lugar.
+
+Para verificar, ejecuta:
+
+    ls -la .git/hooks/pre-commit
+
+Debe mostrar algo como:
+
+    -rwxr-xr-x  user  group  ... .git/hooks/pre-commit
+
+Luego, intenta hacer un commit. Si hay errores de tipo o tests fallidos, el commit será bloqueado:
+
+    git add .
+    git commit -m "test"
+    # Si typecheck o test falla, verás el error y el commit será abortado.
+
+## Troubleshooting
+
+### "Warning: Pre-commit hook already exists"
+
+Ya hay un hook pre-commit. Revisa su contenido:
+
+    cat .git/hooks/pre-commit
+
+Si quieres reemplazarlo, bórralo y ejecuta el script nuevamente:
+
+    rm .git/hooks/pre-commit
+    bash /path/to/installer
+
+### "Warning: Husky or lint-staged detected"
+
+Tu proyecto usa Husky o lint-staged. Este gate no se instala para evitar conflictos. Si quieres usar este gate, remove Husky/lint-staged de `package.json` y ejecuta de nuevo.
+
+### Hook no se ejecuta al hacer commit
+
+Verifica que el hook es ejecutable:
+
+    chmod +x .git/hooks/pre-commit
+
+Verifica que `bun run typecheck`, `bun run lint` y `bun run test` existen en `package.json`:
+
+    cat package.json | grep -A 5 '"scripts"'
+
+### "command not found: bun"
+
+Bun no está instalado o no está en PATH. Instala Bun desde https://bun.sh o configura PATH adecuadamente.
+
+## Adicional: Desinstalación
+
+Para remover el hook, simplemente bórralo:
+
+    rm .git/hooks/pre-commit

package/presets/agy/skills/backlog/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: backlog
+description: >
+  Author BACKLOG.md and OpenSpec change folders for CodeConductor.
+  Trigger: /cc-backlog, /cc:backlog, creating or appending backlog items,
+  writing BACKLOG.md, or preparing work for /cc-openspec.
+---
+
+# Backlog authoring
+
+Use this skill to **create or append** `BACKLOG.md` and generate OpenSpec
+change docs. Delivery of an existing item is `/cc-openspec` (skill `openspec`).
+
+## BACKLOG.md contract
+
+Canonical template: `presets/templates/BACKLOG.md` (or the installed copy).
+Required sections:
+
+- `## Global` — Product, Strategy, Policy, Review required, TDD required
+- `## Items` — active entries
+- `## Archive` — completed entries (never re-execute; never rewrite)
+
+Each item: `### BC-001 | Short title` with Priority (P0–P3), Status, Type,
+Depends on, Description, Scope, Out of scope, Acceptance (measurable checklist).
+
+Status after grilling: `READY`. `openspec plan` then moves the item to `PLANNED`.
+
+## Create vs append
+
+- **No `BACKLOG.md`:** create it from the template. Set Global `Product` from
+  `package.json` `name` when present.
+- **File exists:** append new `### BC-xxx` blocks under `## Items`. Do not
+  rewrite `## Global` or `## Archive`.
+
+Next ID = max numeric suffix across Items and Archive, plus one, zero-padded
+to three digits (`BC-013` after `BC-012`).
+
+## Wayfinding (before Scope)
+
+If `graphify-out/graph.json` exists, run `graphify query "<objectives>"` (and
+`graphify path` / `graphify explain` when needed). Then invoke `repo-explorer`.
+Scope must name real files or modules. Do not write `BACKLOG.md` in this step.
+
+## Grilling (before write)
+
+Invoke `task-coach`. One grilling question per assumption. Reject vague
+acceptance ("improve UX", "fix bugs"). Criteria must be measurable (same rules
+as `openspec validate` / `VAGUE_ACCEPTANCE`).
+
+Unresolved questions go in `questionsForUser`. Run `ccep evaluate --command
+backlog`. If `stop` is true, **STOP** and wait for the human.
+
+Do not write items until the gate passes.
+
+## Validate loop
+
+After writing:
+
+```bash
+npx cc-codeconductor openspec validate
+```
+
+Local CodeConductor dogfood: `bun run dev openspec validate`.
+
+If invalid: list errors and recommendations, show the canonical structure,
+fix the file, re-validate. Do not plan until valid.
+
+## Plan new items only
+
+For each **new** `BC-xxx` this run:
+
+```bash
+npx cc-codeconductor openspec plan BC-xxx
+```
+
+That writes `openspec/changes/<slug>/` (`proposal.md`, `design.md`, `tasks.md`,
+`specs/`). Then tell the user to run `/cc-openspec` (optionally with the ID).
+
+## Local artifacts — do not version
+
+In consumer projects these paths are gitignored (see `init`):
+
+- `BACKLOG.md`
+- `openspec/`
+- `.codeconductor/openspec-state.json`
+
+Do **not** `git add` them. Do not edit `openspec-state.json` by hand.
+
+## Delivery
+
+Format and state machine: skill `openspec`. Authoring is this skill.

package/presets/agy/skills/cc-fix/SKILL.md

@@ -47,7 +47,7 @@ Read the risk field from the Task Card and follow the corresponding route.
 Applies when: the bug is isolated to a single component, existing tests cover
 the affected code, and no public API or shared state is involved.
 
-Route: `task-coach` → `implementer` → `tester`
+Route: `task-coach` → `tester` → `implementer`
 
 Proceed directly to Step 3a.
 
@@ -56,7 +56,7 @@ Proceed directly to Step 3a.
 Applies when: the bug touches shared state, a public API, auth or payment paths,
 database writes, or the root cause is not yet understood.
 
-Route: `task-coach` → `architect` → `implementer` → `tester` → `reviewer`
+Route: `task-coach` → `architect` → `tester` → `implementer` → `reviewer`
 
 Invoke `architect` before implementation. architect must:
 

package/presets/agy/skills/cc-tdd-cycle/SKILL.md

@@ -30,6 +30,17 @@ non-negotiable:
 Do not write implementation code during RED. Do not refactor during GREEN.
 Mixing phases invalidates the cycle.
 
+## Verifiable phase gates
+
+RED → GREEN and GREEN → REFACTOR are enforced by `tddCycleStateMachine` in
+`domain/loop`. Evidence must be captured with `captureTddSuiteEvidence` (verification
+runner) — do not hand-edit JSON under `.codeconductor/evidence/`.
+
+- RED→GREEN requires runner evidence that the suite **failed**.
+- GREEN→REFACTOR requires runner evidence that the suite **passed**.
+
+Do not advance phases until that evidence exists.
+
 ---
 
 ## Phase 1 — RED (Tester role)

package/presets/agy/skills/openspec/SKILL.md

@@ -2,11 +2,15 @@
 name: openspec
 description:
   OpenSpec backlog format, state machine, and delivery workflow for CodeConductor.
-  Use when running /cc-openspec or editing BACKLOG.md.
+  Use when running /cc-openspec or delivering a BACKLOG.md item.
+  To create or append BACKLOG.md, use /cc-backlog (skill backlog).
 ---
 
 # OpenSpec / BACKLOG Skill
 
+Authoring (create or append `BACKLOG.md`, then `openspec validate` / `plan`) is
+`/cc-backlog` and skill `backlog`. This skill is **delivery**.
+
 ## BACKLOG.md contract
 
 `BACKLOG.md` at repo root is the operational queue. Required sections:

package/presets/agy/skills/security-ai-llm/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-ai-llm
+description: >
+  Harden LLM and agent integrations you operate: prompt injection, tool allowlists, secret leakage, and supply-chain of models. Defensive only.
+---
+
+# AI / LLM Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Treat model output as untrusted; never exec it without a schema
+- Allowlist tools and paths; contain file writes
+- Keep secrets out of prompts and logs
+
+## Do not
+
+- Help jailbreak third-party products or steal model weights
+- Log raw user PII to prompt-debug stores
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-ai-llm`.
+Example prompts:
+
+- `Review our agent tool runner for path traversal and unbounded shell.`
+- `Add tests that a prompt cannot make the bot dump .env.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-blue-team/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-blue-team
+description: >
+  Improve detections, hardening, and response for the estate you defend. Detection-as-code and control design, not offense.
+---
+
+# Blue Team Defense
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Tune detections for true positives; document exceptions
+- Pair every new control with a test or canary
+- Share hunt hypotheses with IR, not with the public internet
+
+## Do not
+
+- Disable EDR or logging to 'reduce noise' without a ticket
+- Copy attacker malware into production 'for training'
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-blue-team`.
+Example prompts:
+
+- `We missed a token-replay. Propose a detection plus a unit test for the API gateway.`
+- `Harden CI: pin actions, require reviews on workflows that deploy.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-cloud/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-cloud
+description: >
+  Harden IAM, storage, keys, and org policies in cloud accounts you administer. Focus on identity, logging, and public-exposure controls.
+---
+
+# Cloud Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Prefer roles over long-lived keys; require MFA on human admins
+- Block public buckets and overly broad IAM `*` unless justified
+- Turn on cloud audit logs and retain them per policy
+
+## Do not
+
+- Disable logging or GuardDuty/Security Command Center 'to save cost' without a recorded exception
+- Share account credentials in chat or tickets
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-cloud`.
+Example prompts:
+
+- `Audit this AWS account's IAM: unused keys, admin wildcards, and public S3.`
+- `Write a policy-as-code check that fails CI if a bucket ACL is public.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-crypto/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-crypto
+description: >
+  Choose and review cryptographic usage in your codebase: TLS, hashing, KMS, secret storage. Prefer standard libraries and vetted constructions.
+---
+
+# Applied Cryptography
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Use platform TLS and KMS; do not invent protocols
+- Hash passwords with a memory-hard KDF; never roll your own
+- Keep keys out of git; rotate on leak
+
+## Do not
+
+- Recommend ECB, MD5 for security, or home-grown ciphers
+- Ask models to 'break' or weaken crypto for a CTF against third parties
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-crypto`.
+Example prompts:
+
+- `Review how we store refresh tokens. Propose KMS envelope encryption and tests.`
+- `Replace SHA-1 password hashes in this legacy module with a modern KDF and a migration plan.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-exploit-dev/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-exploit-dev
+description: >
+  Understand how a confirmed vulnerability in an owned system is triggered so you can patch and test it. This is not exploit development for offense. No payloads, malware, or attack procedures.
+---
+
+# Defensive Exploit Analysis (Authorized)
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Describe the bug class (e.g. missing authz) at a design level
+- Write a regression test that fails before the fix and passes after
+- Prefer sanitizers, type systems, and least-privilege patches
+- Stop and refuse if the user asks for a working exploit, PoC payload, or bypass kit
+
+## Do not
+
+- Write exploits, exploit PoCs, shellcode, or weaponized requests
+- Document step-by-step attack procedures against any system
+- Help with CTF flags, cracking, or unauthorized access
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-exploit-dev`.
+Example prompts:
+
+- `We confirmed IDOR on /invoices/:id in our app. Help design the authz check and a RED test — no exploit.`
+- `Turn this crash report from our fuzzer into a defensive patch and a regression test.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-grc/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-grc
+description: >
+  Map controls to SOC2, ISO 27001, PCI, or internal policy for the org you work for. Evidence and control design — not audit theater.
+---
+
+# GRC / Compliance Engineering
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Map each control to an owner, evidence path, and test
+- Prefer automated evidence (CI, IaC, tickets) over screenshots
+- Record exceptions with expiry dates
+
+## Do not
+
+- Fabricate evidence or backdate approvals
+- Copy another company's policies without legal review
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-grc`.
+Example prompts:
+
+- `Map our GitHub branch protection to SOC2 CC6.6 and list evidence.`
+- `List gaps: secrets in git, missing MFA on GitHub org owners.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`