cc-codeconductor 1.0.0 → 1.1.0

package/presets/agy/skills/security-ot-ics/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-ot-ics
+description: >
+  Advise on defensive security for industrial control systems you operate. Safety first. No process-disruption guidance.
+---
+
+# OT / ICS Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Separate OT networks; no direct internet to PLCs
+- Change default credentials; document who can stop a line
+- Patch with maintenance windows; test on a replica
+
+## Do not
+
+- Suggest actions that could halt unsafe physical processes
+- Scan or 'test' live safety systems without OT engineering approval
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-ot-ics`.
+Example prompts:
+
+- `Review the jump-host design between IT and the plant VLAN.`
+- `Draft a change window checklist for a PLC firmware update.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-recon/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-recon
+description: >
+  Map owned assets, attack surface, and inventory for systems the requester is authorized to assess. Use for asset discovery, service catalogs, and exposure reviews — never unauthorized scanning.
+---
+
+# Authorized Reconnaissance
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Inventory hosts, services, and identities the authorization letter names
+- Prefer read-only, rate-limited discovery against owned environments
+- Record data sources (CMDB, cloud APIs, repo maps) in the Task Card
+- Flag shadow IT only to the asset owner
+
+## Do not
+
+- Scan networks, IPs, or tenants outside the authorization window
+- Use third-party scanners against production without change control
+- Store credentials, tokens, or dumps in the skill output
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-recon`.
+Example prompts:
+
+- `Inventory the staging VPC we own: services, public endpoints, and IAM principals in scope for Q3.`
+- `From this repo, list internet-facing routes and compare them to the authorized asset list.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-red-team/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-red-team
+description: >
+  Plan purple-team / adversary-simulation exercises against systems you are contracted to test. High-level objectives and detection gaps only. No live attack procedures or payloads.
+---
+
+# Authorized Adversary Simulation (Planning)
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Require a rules-of-engagement document before any exercise
+- Map ATT&CK techniques to detections you want to validate
+- Coordinate with blue team; prefer tabletop if production risk is high
+
+## Do not
+
+- Provide exploit steps, malware, phishing kits, or C2 playbooks
+- Run unapproved tests against production
+- Help with unauthorized 'red team' against third parties
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-red-team`.
+Example prompts:
+
+- `Draft ROE and in-scope techniques for an internal purple-team week on staging.`
+- `List detections we should have for credential stuffing against our login — no attack scripts.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-reverse-engineering/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-reverse-engineering
+description: >
+  Analyze binaries or protocols you own (or have license to inspect) to improve security, compatibility, or incident response. Not for cracking, DRM bypass, or malware creation.
+---
+
+# Authorized Reverse Engineering
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Confirm license and ownership before inspecting a binary
+- Focus on trust boundaries, crypto misuse, and update integrity
+- Document findings as hardening tasks with tests where code exists
+
+## Do not
+
+- Bypass license checks, DRM, or access controls you do not own
+- Publish unpacking or unpacker tutorials for third-party software
+- Produce malware droppers or obfuscators
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-reverse-engineering`.
+Example prompts:
+
+- `Review our firmware update signer: how is the public key pinned, and what tests prove tamper detection?`
+- `Map native JNI entrypoints in our Android app for unsafe string concatenation.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-soc-automation/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-soc-automation
+description: >
+  Automate detection, enrichment, and response playbooks for a SOC you operate. Keep humans in the loop for destructive actions.
+---
+
+# SOC Automation
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Automate enrichment (WHOIS, asset owner, hash reputation) not auto-wipe
+- Version playbooks; require approval for isolate/disable-user actions
+- Test detections with synthetic events in a lab tenant
+
+## Do not
+
+- Auto-disable production users or servers without an approval gate
+- Pipe raw secrets from tickets into chat webhooks
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-soc-automation`.
+Example prompts:
+
+- `Draft a SOAR playbook: phishing report → hash lookup → ticket, no auto-containment.`
+- `Turn this Sigma-style idea into a documented detection plus a false-positive test.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-threat-hunting/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-threat-hunting
+description: >
+  Hunt for adversary techniques in telemetry you are authorized to query. Hypothesis-driven, evidence-first, no live offensive operations.
+---
+
+# Threat Hunting
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- State a hypothesis (technique + data source + expected artifact)
+- Query only approved telemetry (SIEM, EDR, cloud logs)
+- Promote confirmed hits to IR with timestamps and host identity
+
+## Do not
+
+- Run offensive tooling on production to 'verify' a hunt
+- Query personal mailboxes or systems outside the authorization scope
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-threat-hunting`.
+Example prompts:
+
+- `Hypothesis: stolen refresh tokens in our IdP logs this week. Query patterns and list follow-ups.`
+- `Hunt for unusual service-account key creation in GCP for project X (authorized).`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-vuln-assessment/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-vuln-assessment
+description: >
+  Plan and report authorized vulnerability assessments on owned systems. Prioritize evidence, severity, and remediations. Do not deliver exploit payloads.
+---
+
+# Vulnerability Assessment
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Use scanner findings plus code review as evidence, not as a scoreboard
+- Map issues to OWASP / CWE and to a concrete fix in the repo
+- Require a reproduction that is safe (config, unit test, or staging)
+- Track false positives explicitly
+
+## Do not
+
+- Ship exploit PoCs, weaponized payloads, or live attack scripts
+- Scan production without a documented freeze and rollback
+- Mark a finding closed without a failing-then-passing test when code changes
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-vuln-assessment`.
+Example prompts:
+
+- `Assess the checkout API in staging (ticket SEC-214). Report exploitable authz gaps as remediations, not exploits.`
+- `Triage SAST results on src/auth and turn confirmed issues into failing tests plus patches.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-web/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-web
+description: >
+  Review and harden web apps (authz, XSS, CSRF, SSRF, injection) on code you maintain. Complements the OWASP `security` skill. No exploit kits.
+---
+
+# Web Application Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Enforce authorization on every handler; never rely on the UI
+- Parameterize queries; reject unknown fields
+- Treat cookies, tokens, and redirects as untrusted until validated
+- Add tests for authz, CSRF, and open redirects when you change those paths
+
+## Do not
+
+- Provide XSS or SQLi payloads for use against systems you do not own
+- Disable CSRF or SameSite 'to make local dev easier' in production configs
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-web`.
+Example prompts:
+
+- `Review our Next.js Server Actions for IDOR and CSRF. Propose tests, not exploits.`
+- `Harden the file-upload endpoint: type, size, path containment, and tests.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/workflows/cc-ask.md

@@ -36,10 +36,11 @@ The catalog is only:
 | `/cc:refactor` | structure, no behavior change |
 | `/cc:review` | inspect a diff/PR |
 | `/cc:tdd-cycle` | red → green → refactor |
+| `/cc:backlog` | create or append BACKLOG.md / objectives |
 | `/cc:openspec` | BACKLOG / BC-xxx delivery |
 
 If the CLI is unavailable, apply the same catalog and the same priority:
-openspec → tdd-cycle → review → refactor → fix → feature (default).
+backlog (author) vs openspec (deliver) → tdd-cycle → review → refactor → fix → feature (default).
 
 ---
 

package/presets/agy/workflows/cc-backlog.md

@@ -0,0 +1,69 @@
+---
+name: cc-backlog
+description:
+  Author BACKLOG.md — wayfinding, grilling, create or append items, validate
+  with openspec, and plan OpenSpec change folders for /cc-openspec.
+---
+
+# Backlog Authoring Workflow
+
+Objectives: $ARGUMENTS
+
+Create or append valid `BACKLOG.md` items and OpenSpec change docs. Do **not**
+deliver implementation — that is `/cc-openspec`.
+
+---
+
+## Step 0 — CCEP Bootstrap
+
+Command: `backlog` (fixed for this workflow — do not infer from user text)
+
+1. Run: `npx cc-codeconductor ccep parse --command backlog "$ARGUMENTS" --output json`
+2. Run: `npx cc-codeconductor ccep resolve --command backlog "$ARGUMENTS" --output json`
+3. Run: `npx cc-codeconductor ccep profile backlog --output json`
+4. After planner/intake JSON is available, run: `npx cc-codeconductor ccep evaluate --command backlog --input <planner.json> --output json`. If `stop` is true, show questions or risks and wait for human input.
+5. Delegate to subagents using compiled CCEP prompts — never forward raw `$ARGUMENTS` to planners.
+
+---
+
+## Step 1 — Wayfinding (repo-explorer)
+
+If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"`. Invoke
+`repo-explorer`. Do not write `BACKLOG.md`. Scope must name real files.
+
+---
+
+## Step 2 — Relentless Grilling (task-coach)
+
+Invoke `task-coach`. Measurable acceptance only. One grilling question at a time.
+
+**STOP here.** Unresolved grilling questions populate `questionsForUser`;
+`ccep evaluate --command backlog` halts until a human answers.
+
+---
+
+## Step 3 — Write or append BACKLOG.md
+
+Apply skill `backlog`. Create from template if missing; otherwise append under
+`## Items`. Next `BC-NNN` = max existing + 1. Status `READY`. Do not rewrite
+`## Global` or `## Archive`. Do not `git add` `BACKLOG.md` or `openspec/`.
+
+---
+
+## Step 4 — Validate (mandatory gate)
+
+Run `npx cc-codeconductor openspec validate`. If invalid, show errors and
+canonical structure, fix, re-validate. **STOP** planning until valid.
+
+---
+
+## Step 5 — Plan new items
+
+For each new `BC-id`: `npx cc-codeconductor openspec plan <BC-id>`.
+
+---
+
+## Completion
+
+Report IDs, validate result, change folders. Tell the user to run `/cc-openspec`.
+Apply skill `backlog`.

package/presets/agy/workflows/cc-explore.md

@@ -28,7 +28,7 @@ If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"`. Invoke `
 
 ## Step 2 — Suggest next command (orchestrator)
 
-Recommend exactly one next slash command (`/cc:feature`, `/cc:fix`, `/cc:refactor`, `/cc:review`, `/cc:triage`, …) with a one-sentence rationale. Do not start that workflow.
+Recommend exactly one next slash command (`/cc:feature`, `/cc:fix`, `/cc:refactor`, `/cc:review`, `/cc:backlog`, `/cc:openspec`, `/cc:triage`, …) with a one-sentence rationale. Do not start that workflow.
 
 ---
 

package/presets/agy/workflows/cc-openspec.md

@@ -46,6 +46,8 @@ Use `$ARGUMENTS` BC-id or `npx cc-codeconductor openspec status` for next READY
 
 Run `npx cc-codeconductor openspec plan <BC-id>`. Show TaskCards and `openspec/changes/` path.
 
+Drive status with CLI (do not edit openspec-state.json): `openspec start <cardId>`, `openspec done <cardId>`, `openspec block <cardId> --reason "…"`, `openspec archive <itemId>`.
+
 ---
 
 ## Step 4 — Execute loop
@@ -70,6 +72,6 @@ Reviewer approves or rejects against acceptance criteria. Reject → `IN_PROGRES
 
 ## Step 6 — Update
 
-Mark DONE, move to Archive in BACKLOG.md, run `openspec scan`.
+Mark DONE with `openspec archive <itemId>` (all cards must be done), then run `openspec scan`.
 
 Apply skill `openspec` for format and state rules.

package/presets/agy/workflows/cc-security.md

@@ -0,0 +1,180 @@
+---
+name: cc-security
+description: >
+  Run the authorized defensive security workflow — domain security-* skills,
+  authorization gate, risk-based routing, hardening, and review.
+---
+
+# Defensive Security Workflow
+
+Security objective: $ARGUMENTS
+
+Provide the following information in $ARGUMENTS:
+
+- What must be reviewed or hardened, and why
+- Domain: a `security-*` skill id (recon, vuln-assessment, web, cloud, IR,
+  hunting, GRC, …) or `web-app` / `api` / `cloud-config` /
+  `dependency-supply-chain` / `secrets`
+- Authorization: who authorized this work on this target, and the scope boundary
+- Risk classification (`low`, `medium`, or `high`), if known
+- Scope: which files, modules, repos, or environments are in and out of bounds
+
+---
+
+## Scope and authorization
+
+This workflow performs **authorized defensive security work only**: threat
+modeling, hardening, secure configuration, dependency and supply-chain review,
+secret hygiene, and detection coverage.
+
+Refuse outright and offer the defensive equivalent instead (threat model,
+hardening, detection coverage, dependency audit):
+
+- Exploit or proof-of-concept development
+- Malware authoring, or malware analysis intended for reuse
+- Reverse engineering aimed at bypassing a control
+- Red-team playbooks
+- Any unauthorized-access procedure
+
+Scope is limited to the repository under analysis. Do not scan, probe, or
+perform reconnaissance against third-party hosts.
+
+Do not proceed without an authorization statement. Do not produce exploit
+payloads, malware, or attack procedures.
+
+---
+
+## Step 0 — CCEP Bootstrap
+
+Command: `security` (fixed for this workflow — do not infer from user text)
+
+1. Run: `npx cc-codeconductor ccep parse --command security "$ARGUMENTS" --output json`
+2. Run: `npx cc-codeconductor ccep resolve --command security "$ARGUMENTS" --output json`
+3. Run: `npx cc-codeconductor ccep profile security --output json`
+4. After planner/intake JSON is available, run: `npx cc-codeconductor ccep evaluate --command security --input <planner.json> --output json`. If `stop` is true, show questions or risks and wait for human input.
+5. Delegate to subagents using compiled CCEP prompts — never forward raw `$ARGUMENTS` to planners.
+   Canonical delivery order is test-before-implement whenever both phases apply.
+
+---
+
+## Step 1 — Wayfinding (repo-explorer)
+
+If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"` (and
+`graphify path` / `graphify explain` when needed). Then invoke `repo-explorer`
+to map modules, conventions, and impact radius. Do not write code in this step.
+Record a Repo Map artifact before intake. Load the matching `security-*` skill
+for the named domain (see `.claude/skills/security-*/SKILL.md`). Keep the OWASP
+`security` skill for application-security reviews.
+
+---
+
+## Step 2 — Task Card validation (task-coach)
+
+Invoke `task-coach` with the security objective above.
+
+task-coach must produce a Task Card that includes:
+
+- Objective: what must be reviewed or hardened, in one sentence
+- Domain: which `security-*` skill applies, or `web-app` / `api` /
+  `cloud-config` / `dependency-supply-chain` / `secrets`
+- Authorization: who authorized this work on this target, and the scope boundary
+- Risk classification: `low`, `medium`, or `high`
+- Scope: which files or modules are likely affected
+
+If authorization is absent, unclear, or names a system the requester does not
+own or operate, **STOP and refuse. Do not route the task.**
+
+Redact secrets, tokens, and credentials from any evidence before it enters the
+Task Card. Summarize logs; do not paste env files.
+
+**STOP here. Show the Task Card and wait for human confirmation.**
+
+---
+
+## Step 3 — Route by risk
+
+Read the risk field from the Task Card and follow the corresponding route.
+
+### Low-risk route
+
+Applies when: the weakness is isolated, not exploitable in the current
+configuration, and no authentication, secret, or dependency boundary is
+involved.
+
+Route: `task-coach` → `tester` → `implementer`
+
+Proceed directly to Step 4 (tests), then Step 5a.
+
+### Medium or high-risk route
+
+Applies when: the work touches authentication, authorization, secrets,
+cryptography, trust-boundary input validation, or a dependency upgrade.
+
+Route: `task-coach` → `architect` → `tester` → `implementer` → `reviewer`
+
+Invoke `architect` before implementation. architect must:
+
+- Identify the weakness and the affected trust boundary
+- Define the hardening approach and affected files
+- Flag any regression risk to adjacent components
+- Produce a Technical Plan
+
+On **high** risk, also invoke `security-reviewer` before Reviewer.
+
+**STOP here if high-risk. Show the Technical Plan and wait for human approval
+before continuing.**
+
+---
+
+## Step 4 — Tests (tester)
+
+Invoke `tester` for all risk levels.
+
+tester must:
+
+1. Write a regression test that proves the weakness exists and confirm it fails
+   before any change (RED)
+2. Verify that existing tests still pass
+3. Produce a Coverage Summary: test added, case covered
+
+---
+
+## Step 5a — Implementation, low-risk (implementer)
+
+Invoke `implementer` with the Task Card.
+Implementer creates a Git Worktree before touching any file; all edits happen inside it.
+
+implementer must:
+
+1. Apply the minimal hardening change — no unrelated changes
+2. Run the suite and make the RED regression test pass
+3. Produce an Implementation Summary: weakness, change applied, files changed
+
+---
+
+## Step 5b — Implementation, medium/high-risk (implementer)
+
+Invoke `implementer` with the approved Technical Plan and the Task Card.
+Implementer creates a Git Worktree before touching any file; all edits happen inside it.
+
+implementer must follow the plan exactly. Any deviation requires a new Technical
+Plan approval. After implementation, run the full test suite. No exploit code.
+
+---
+
+## Step 6 — Review (Reviewer role) — medium/high-risk only
+
+Invoke `reviewer` with the diff and Task Card. The Reviewer must apply the OWASP
+rules in the `security` skill.
+
+reviewer produces a Review Report with CRITICAL / WARNING / SUGGESTION findings.
+If any CRITICAL findings exist, **STOP**. Do not close the task until they are
+resolved.
+
+---
+
+## Completion
+
+Report: Task Card, Implementation Summary, regression test added, Review Report
+(if applicable). The task is complete only when: the regression test passes, the
+full suite passes, and no CRITICAL review findings remain.

package/presets/claude/CLAUDE.md

@@ -738,6 +738,10 @@ apply `.claude/skills/php-pro/SKILL.md`.
 When the active task touches backend security, authorization, or data verification,
 apply `.claude/skills/security/SKILL.md`.
 
+When the active task is authorized security work (recon, assessment, IR, hunting,
+or a named domain), apply the matching `.claude/skills/security-*` skill (for example
+`.claude/skills/security-web/SKILL.md`) and run `/cc-security`.
+
 When the active task requires debugging frontend interactions or accessibility (a11y) checks,
 apply `.claude/skills/a11y-debugging/SKILL.md` and `.claude/skills/modern-web-guidance/SKILL.md`.
 

package/presets/claude/commands/cc/ask.md

@@ -36,10 +36,11 @@ The catalog is only:
 | `/cc:refactor` | structure, no behavior change |
 | `/cc:review` | inspect a diff/PR |
 | `/cc:tdd-cycle` | red → green → refactor |
+| `/cc:backlog` | create or append BACKLOG.md / objectives |
 | `/cc:openspec` | BACKLOG / BC-xxx delivery |
 
 If the CLI is unavailable, apply the same catalog and the same priority:
-openspec → tdd-cycle → review → refactor → fix → feature (default).
+backlog (author) vs openspec (deliver) → tdd-cycle → review → refactor → fix → feature (default).
 
 ---