cc-codeconductor 1.0.0 → 1.2.0

package/presets/claude/skills/security-vuln-assessment/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-vuln-assessment
+description: >
+  Plan and report authorized vulnerability assessments on owned systems. Prioritize evidence, severity, and remediations. Do not deliver exploit payloads.
+---
+
+# Vulnerability Assessment
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Use scanner findings plus code review as evidence, not as a scoreboard
+- Map issues to OWASP / CWE and to a concrete fix in the repo
+- Require a reproduction that is safe (config, unit test, or staging)
+- Track false positives explicitly
+
+## Do not
+
+- Ship exploit PoCs, weaponized payloads, or live attack scripts
+- Scan production without a documented freeze and rollback
+- Mark a finding closed without a failing-then-passing test when code changes
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-vuln-assessment`.
+Example prompts:
+
+- `Assess the checkout API in staging (ticket SEC-214). Report exploitable authz gaps as remediations, not exploits.`
+- `Triage SAST results on src/auth and turn confirmed issues into failing tests plus patches.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-web/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-web
+description: >
+  Review and harden web apps (authz, XSS, CSRF, SSRF, injection) on code you maintain. Complements the OWASP `security` skill. No exploit kits.
+---
+
+# Web Application Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Enforce authorization on every handler; never rely on the UI
+- Parameterize queries; reject unknown fields
+- Treat cookies, tokens, and redirects as untrusted until validated
+- Add tests for authz, CSRF, and open redirects when you change those paths
+
+## Do not
+
+- Provide XSS or SQLi payloads for use against systems you do not own
+- Disable CSRF or SameSite 'to make local dev easier' in production configs
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-web`.
+Example prompts:
+
+- `Review our Next.js Server Actions for IDOR and CSRF. Propose tests, not exploits.`
+- `Harden the file-upload endpoint: type, size, path containment, and tests.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/testing-tdd/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: testing-tdd
+description:
+  Guides agents through Red-Green-Refactor with runner-captured evidence.
+  Use when running /cc-tdd-cycle, writing tests before implementation, or
+  Global TDD required is yes.
+---
+
+# Test-Driven Development
+
+## Overview
+
+Red (failing test) → Green (minimal code) → Refactor. Evidence comes from
+`captureTddSuiteEvidence`, not handmade JSON.
+
+## When to Use
+
+- `/cc-tdd-cycle`, new behavior, bug fixes, TDD-required OpenSpec items
+
+**NOT** for docs-only changes or when the Task Card forbids tests.
+
+## Process
+
+1. Write the failing test that encodes one acceptance criterion. Run the suite.
+   It MUST fail (`suiteFails === true`).
+2. Implement the minimum that turns it green. Do not expand scope.
+3. Refactor only with a green suite.
+4. Capture evidence via the verification runner (`openspec done` on test/implement
+   when TDD is required).
+5. Cover happy path, edge, and error for each behavior.
+
+Local: `bun run dev`. Pyramid default: many unit, fewer integration, rare E2E.
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+| --- | --- |
+| I'll add tests later | Later means never. Red first. |
+| This is too small to test | If it can break, it needs a failing test first. |
+| I'll write the evidence JSON | Handmade TDD JSON is rejected. |
+
+## Red Flags
+
+- Tests that assert implementation details instead of behavior
+- Green without a recorded red
+- Skipping error cases
+
+## Verification
+
+- [ ] Suite failed before implement
+- [ ] Suite passed after implement
+- [ ] Runner evidence exists (not handmade)
+- [ ] Optional: `bun run dev scorecard suite-run --suite workflow-gates`

package/presets/claude/skills/using-cc-skills/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: using-cc-skills
+description:
+  Maps incoming work to the CodeConductor slash command and workflow skill.
+  Use when starting a session or deciding which /cc-* command applies.
+---
+
+# Using CodeConductor skills
+
+## Overview
+
+Pick one slash command. Follow its skill. Invoke CLI for gates. Do not invent
+a parallel process.
+
+## When to Use
+
+- Start of a session, ambiguous request, or "which /cc should I run?"
+
+## Process
+
+| Intent | Command | Skill |
+| --- | --- | --- |
+| New backlog item | `/cc-backlog` | `backlog` |
+| Deliver a BC-xxx item | `/cc-openspec` | `openspec` |
+| New feature | `/cc-feature` | `openspec` + `testing-tdd` |
+| Bug fix | `/cc-fix` | `testing-tdd` |
+| Review a diff | `/cc-review` | `evaluation` |
+| TDD cycle only | `/cc-tdd-cycle` | `testing-tdd` |
+| Scorecard / suites | `/cc-scorecard` | `evaluation` |
+
+Then run the matching CLI (`openspec validate`, `scorecard create --from-diff`,
+`hook pre-tool`, `scorecard suite-run`).
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+| --- | --- |
+| I'll skip the slash and just code | Skipping the workflow is a defect. |
+
+## Red Flags
+
+- Two slash commands in parallel that mutate the same files
+- Implementing before `openspec analyze` when a change folder is active
+
+## Verification
+
+- [ ] One command selected and shown to the user
+- [ ] Matching skill loaded before edits

package/presets/codex/AGENTS.md

@@ -64,20 +64,24 @@ Skipping any step is not an optimization. It is a defect.
 
 ## Trigger Phrases
 
-Codex does not load custom slash commands from this preset. Use these natural
-language patterns to activate each workflow:
+Invoke workflows as Codex skills (`$cc-feature`, `$cc-openspec`, …). Custom
+prompts under `~/.codex/prompts` are deprecated. Natural-language phrases still
+work:
 
-| Workflow     | Trigger phrase                                     |
+| Workflow     | Skill / trigger                                    |
 | ------------ | -------------------------------------------------- |
-| Full feature | "Run the feature workflow for: [description]"      |
-| Bug fix      | "Run the fix workflow for: [description]"          |
-| Refactor     | "Run the refactor workflow for: [scope]"           |
-| API contract | "Run the API contract workflow for: [change]"      |
-| DB migration | "Run the database migration workflow for: [scope]" |
-| Code review  | "Run a structured review of: [target]"             |
-| Test plan    | "Create a test plan for: [scope]"                  |
-| Task intake  | "Help me define a Task Card for: [vague request]"  |
-| PageSpeed    | "Run a PageSpeed audit for: [url]"                 |
+| Full feature | `$cc-feature` or "Run the feature workflow for:"   |
+| Bug fix      | `$cc-fix`                                          |
+| Refactor     | `$cc-refactor`                                     |
+| API contract | `$cc-api-contract`                                 |
+| DB migration | `$cc-db-migration`                                 |
+| Code review  | `$cc-review`                                       |
+| Test plan    | `$cc-test-plan`                                    |
+| TDD cycle    | `$cc-tdd-cycle`                                    |
+| Backlog      | `$cc-backlog`                                      |
+| OpenSpec     | `$cc-openspec`                                     |
+| Scorecard    | `$cc-scorecard`                                    |
+| PageSpeed    | `$cc-pagespeed` or "PageSpeed audit"               |
 
 ---
 

package/presets/codex/commands/cc-ask.md

@@ -36,10 +36,11 @@ The catalog is only:
 | `/cc:refactor` | structure, no behavior change |
 | `/cc:review` | inspect a diff/PR |
 | `/cc:tdd-cycle` | red → green → refactor |
+| `/cc:backlog` | create or append BACKLOG.md / objectives |
 | `/cc:openspec` | BACKLOG / BC-xxx delivery |
 
 If the CLI is unavailable, apply the same catalog and the same priority:
-openspec → tdd-cycle → review → refactor → fix → feature (default).
+backlog (author) vs openspec (deliver) → tdd-cycle → review → refactor → fix → feature (default).
 
 ---
 

package/presets/codex/gates/pre-commit/GATE.md

@@ -1,6 +1,6 @@
-# Pre-commit Gate: Typecheck and Test
+# Pre-commit Gate: Typecheck, Lint, and Test
 
-Este gate instala un hook `pre-commit` que ejecuta `bun run typecheck` y `bun run test` antes de permitir commits en el repositorio. Si cualquiera de estos comandos falla, el commit es bloqueado.
+Este gate instala un hook `pre-commit` que ejecuta `bun run typecheck`, `bun run lint` y `bun run test` antes de permitir commits en el repositorio. Si cualquiera de estos comandos falla, el commit es bloqueado.
 
 ## Cuándo usar
 
@@ -63,6 +63,7 @@ mkdir -p "$GIT_DIR/hooks"
 cat > "$HOOK_PATH" << 'HOOK_EOF'
 #!/bin/bash
 bun run typecheck || exit 1
+bun run lint || exit 1
 bun run test || exit 1
 HOOK_EOF
 
@@ -78,7 +79,7 @@ echo "Pre-commit hook installed successfully."
 - **Resolución dinámica de git dir**: Usa `git rev-parse --git-dir` para localizar el directorio correcto, incluso en worktrees.
 - **Detección de conflictos**: Si Husky o lint-staged ya está en `package.json`, el script avisa y no instala para evitar conflictos.
 - **Protección de hooks existentes**: Si ya existe un `.git/hooks/pre-commit`, el script no lo sobrescribe.
-- **Solo Bun**: El hook ejecuta `bun run typecheck` y `bun run test`. Asegúrate de que estos scripts están definidos en `package.json`.
+- **Solo Bun**: El hook ejecuta `bun run typecheck`, `bun run lint` y `bun run test`. Asegúrate de que estos scripts están definidos en `package.json`.
 
 ## Verificación
 
@@ -121,7 +122,7 @@ Verifica que el hook es ejecutable:
 
     chmod +x .git/hooks/pre-commit
 
-Verifica que `bun run typecheck` y `bun run test` existen en `package.json`:
+Verifica que `bun run typecheck`, `bun run lint` y `bun run test` existen en `package.json`:
 
     cat package.json | grep -A 5 '"scripts"'
 

package/presets/codex/skills/backlog/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: backlog
+description: >
+  Guides agents through authoring BACKLOG.md and OpenSpec change folders.
+  Use when running /cc-backlog or /cc:backlog, creating or appending backlog
+  items, or preparing work for /cc-openspec. Delivery is skill openspec.
+---
+
+# Backlog authoring
+
+## Overview
+
+Create or append `BACKLOG.md`, then `openspec validate` / `plan`. Do not deliver
+the item here.
+
+## When to Use
+
+- `/cc-backlog`, first backlog in a repo, or appending `### BC-xxx` items
+
+**NOT** for executing an item (`openspec`) or for scorecards (`evaluation`).
+
+## Process
+
+1. If `graphify-out/graph.json` exists, `graphify query "<objectives>"`. Then
+   `repo-explorer`. Scope names real files.
+2. Invoke `task-coach`. One grilling question per assumption. Reject vague
+   acceptance ("improve UX"). At most 3 `[NEEDS CLARIFICATION]`.
+3. `ccep evaluate --command backlog`. If `stop`, wait for the human.
+4. Create `BACKLOG.md` from `presets/templates/BACKLOG.md` or append under
+   `## Items`. Do not rewrite `## Global` or `## Archive`.
+5. Next ID = max numeric suffix in Items + Archive + 1, zero-padded (`BC-013`).
+6. `bun run dev openspec validate` (or `npx cc-codeconductor`). Fix until valid.
+7. `openspec plan BC-xxx` for each **new** item this run. Then tell the user
+   to run `/cc-openspec`.
+
+Required sections: `## Global`, `## Items`, `## Archive`. Each item:
+`### BC-001 | Title` with Priority, Status (`READY` after grilling), Type,
+Depends on, Description, Scope, Out of scope, Acceptance.
+
+Local artifacts (`BACKLOG.md`, `openspec/`, `.codeconductor/openspec-state.json`)
+are gitignored in consumer projects. Do not `git add` them.
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+| --- | --- |
+| This fix is small; skip the Task Card | Every item needs measurable acceptance. |
+| I'll validate later | Do not plan until `openspec validate` passes. |
+| Archive can be rewritten | Archive is history. Never rewrite or re-execute. |
+
+## Red Flags
+
+- Acceptance that cannot fail a check
+- Editing `openspec-state.json` by hand
+- Planning an invalid backlog
+
+## Verification
+
+- [ ] `openspec validate` exit 0
+- [ ] New items have `FR`/`SC`-ready measurable acceptance
+- [ ] User pointed at `/cc-openspec` for delivery

package/presets/codex/skills/cc-api-contract/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: cc-api-contract
+description: compatibility constraints, contract tests, documentation, and review.
+---
+
+# api-contract
+
+Invoke as `$cc-api-contract`. The user request follows the skill mention.
+
+# API Contract Workflow
+
+API contract request: $ARGUMENTS
+
+## Step 0 — CCEP Bootstrap
+
+Command: `api-contract` (fixed for this workflow — do not infer from user text)
+
+1. Run: `npx cc-codeconductor ccep parse --command api-contract "$ARGUMENTS" --output json`
+2. Run: `npx cc-codeconductor ccep resolve --command api-contract "$ARGUMENTS" --output json`
+3. Run: `npx cc-codeconductor ccep profile api-contract --output json`
+4. After planner/intake JSON is available, run: `npx cc-codeconductor ccep evaluate --command api-contract --input <planner.json> --output json`. If `stop` is true, show questions or risks and wait for human input.
+5. Delegate to subagents using compiled CCEP prompts — never forward raw `$ARGUMENTS` to planners.
+
+---
+
+## Step 0b — OpenSpec quality gates
+
+If `openspec status` reports an active change folder:
+
+1. Run: `npx cc-codeconductor openspec validate --output json`
+2. Run: `npx cc-codeconductor openspec analyze --output json`
+3. If analyze `stop` is true or any finding is CRITICAL, stop. Do not delegate to implementer.
+4. Next command spelling on this runner: `/cc:api-contract`
+
+Local development: `bun run dev <same argv>`. Published package: `npx cc-codeconductor`.
+
+---
+
+
+## Step 1 — Task Card validation (Task Coach role)
+
+Invoke the `task-coach` subagent via the Task tool.
+
+The Task Card must classify the task as high risk by default and include the
+affected public interface, request/response examples, compatibility notes,
+versioning impact, consumer impact, contract tests, and docs acceptance
+criteria.
+
+**STOP here. Show the completed Task Card and wait for human confirmation.**
+
+---
+
+## Step 2 — Technical Plan (Architect role)
+
+Invoke the `architect` subagent via the Task tool.
+
+Define the API contract, validation strategy, compatibility behavior, docs or
+OpenAPI changes, and reviewer blocking conditions.
+
+**STOP here. Show the Technical Plan and wait for explicit human approval.**
+
+---
+
+## Step 3 — Implementation (Implementer role)
+
+Invoke the `implementer` subagent via the Task tool.
+
+Apply the minimal diff, preserve compatible behavior unless explicitly approved
+as breaking, and update only the planned files.
+
+---
+
+## Step 4 — Contract Tests (Tester role)
+
+Invoke the `tester` subagent via the Task tool.
+
+Add or update tests for request shape, response shape, status/error behavior,
+and backward compatibility.
+
+---
+
+## Step 5 — Review (Reviewer role)
+
+Invoke the `reviewer` subagent via the Task tool.
+
+Block on missing contract tests, undocumented breaking changes, or docs/OpenAPI
+drift.

package/presets/codex/skills/cc-backlog/SKILL.md

@@ -0,0 +1,108 @@
+---
+name: cc-backlog
+description: validate with openspec, and plan OpenSpec change folders for /cc-openspec.
+---
+
+# backlog
+
+Invoke as `$cc-backlog`. The user request follows the skill mention.
+
+# Backlog Authoring Workflow
+
+Objectives: $ARGUMENTS
+
+Create or append valid `BACKLOG.md` items and OpenSpec change docs. Do **not**
+deliver implementation — that is `/cc-openspec`.
+
+---
+
+## Step 0 — CCEP Bootstrap
+
+Command: `backlog` (fixed for this workflow — do not infer from user text)
+
+1. Run: `npx cc-codeconductor ccep parse --command backlog "$ARGUMENTS" --output json`
+2. Run: `npx cc-codeconductor ccep resolve --command backlog "$ARGUMENTS" --output json`
+3. Run: `npx cc-codeconductor ccep profile backlog --output json`
+4. After planner/intake JSON is available, run: `npx cc-codeconductor ccep evaluate --command backlog --input <planner.json> --output json`. If `stop` is true, show questions or risks and wait for human input.
+5. Delegate to subagents using compiled CCEP prompts — never forward raw `$ARGUMENTS` to planners.
+
+---
+
+## Step 1 — Wayfinding (repo-explorer)
+
+If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"` (and
+`graphify path` / `graphify explain` when needed). Then invoke `repo-explorer`
+to map modules, conventions, and impact radius. Do not write `BACKLOG.md` in
+this step. Record a Repo Map so Scope names real files or modules.
+
+---
+
+## Step 2 — Relentless Grilling (task-coach)
+
+Invoke `task-coach`. Produce complete backlog item fields: title, type, risk,
+scope, description, out of scope, measurable acceptance criteria.
+
+Every assumption must survive one grilling question. Reject vague acceptance
+("improve UX", "fix bugs").
+
+If any field is missing or ambiguous, ask one clarifying question at a time.
+
+**STOP here.** Unresolved grilling questions populate `questionsForUser` in the
+CCEP-1 `planner-output`; `ccep evaluate --command backlog` halts until a human
+answers. Do not write `BACKLOG.md` until that confirmation.
+
+---
+
+## Step 3 — Write or append BACKLOG.md (docs)
+
+Apply skill `backlog`.
+
+- If `BACKLOG.md` is absent, create it from the canonical template
+  (`presets/templates/BACKLOG.md`). Set Global `Product` from `package.json`
+  `name` when present.
+- If it exists, append new `### BC-xxx` items under `## Items`. Do not rewrite
+  `## Global` or `## Archive`.
+- Next ID = max `BC-NNN` across Items and Archive, plus one.
+- New items: Status `READY`, Progress `0%`, measurable Acceptance checklist.
+
+Do **not** `git add` `BACKLOG.md` or `openspec/`.
+
+---
+
+## Step 4 — Validate (mandatory gate)
+
+Run:
+
+```bash
+npx cc-codeconductor openspec validate
+```
+
+If validation fails:
+
+1. List all errors and recommendations from the CLI output.
+2. Show the canonical BACKLOG.md structure (## Global, ## Items, ### BC-001 | Title, Priority, Status, Type, Depends on, Description, Scope, Acceptance).
+3. Fix the file and re-run validate. **STOP** planning until valid.
+
+---
+
+## Step 5 — Plan new items
+
+For each **new** `BC-xxx` from this run:
+
+```bash
+npx cc-codeconductor openspec plan <BC-id>
+```
+
+Show TaskCards and `openspec/changes/<slug>/` (proposal, design, tasks, specs).
+
+---
+
+## Completion
+
+Report: item IDs added, validate result, change folder paths.
+
+Tell the user to run `/cc-openspec` (optionally `/cc-openspec BC-xxx`) to
+deliver. Do not start delivery in this workflow.
+
+Apply skill `backlog` for create/append rules. Apply skill `openspec` only for
+format and state-machine reference.

package/presets/codex/skills/cc-clarify/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: cc-clarify
+description: CodeConductor clarify workflow
+---
+
+# clarify
+
+Invoke as `$cc-clarify`. The user request follows the skill mention.
+
+# Clarify Workflow
+
+Clarify request: $ARGUMENTS
+
+## Step 0 — CCEP Bootstrap
+
+Command: `clarify` (fixed for this workflow — do not infer from user text)
+
+1. Run: `npx cc-codeconductor ccep parse --command clarify "$ARGUMENTS" --output json`
+2. Run: `npx cc-codeconductor ccep resolve --command clarify "$ARGUMENTS" --output json`
+3. Run: `npx cc-codeconductor ccep profile clarify --output json`
+4. After planner/intake JSON is available, run: `npx cc-codeconductor ccep evaluate --command clarify --input <planner.json> --output json`. If `stop` is true, show questions or risks and wait for human input.
+5. Delegate to subagents using compiled CCEP prompts — never forward raw `$ARGUMENTS` to planners.
+
+---
+
+## Step 1 — Re-explain (task-coach)
+
+Invoke `task-coach` / `orchestrator`. Restate the last Task Card, plan, or review in the project's vocabulary. Do not add new scope. If questions remain, one question per branch.
+
+**STOP if ConfirmationGate reports questions.**
+
+---
+
+## Completion
+
+A plain-language restatement plus any remaining questions. Then resume the previous workflow.

package/presets/codex/skills/cc-council/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: cc-council
+description: Council-driven workflow with CCEP-1 bootstrap
+---
+
+# council
+
+Invoke as `$cc-council`. The user request follows the skill mention.
+
+# Council-Driven Workflow
+
+Task request: $ARGUMENTS
+
+## Step 0 — CCEP Bootstrap
+
+Command: `council` (fixed for this workflow — do not infer from user text)
+command: council
+
+1. Run: `npx cc-codeconductor ccep parse --command council "$ARGUMENTS" --output json`
+2. Run: `npx cc-codeconductor ccep resolve --command council "$ARGUMENTS" --output json`
+3. Run: `npx cc-codeconductor ccep profile council --output json`
+4. After planner/intake JSON is available, run: `npx cc-codeconductor ccep evaluate --command council --input <planner.json> --output json`. If `stop` is true, show questions or risks and wait for human input.
+5. Delegate to subagents using compiled CCEP prompts — never forward raw `$ARGUMENTS` to planners.
+
+---
+
+## Step 1 — Wayfinding (repo-explorer)
+
+If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"` (and
+`graphify path` / `graphify explain` when needed). Then invoke `repo-explorer`
+to map impact radius before deliberation. Do not write code in this step.
+
+---
+
+## Step 2 — Deliberation & Specification (SDD)
+
+Invoke the `council` skill to analyze the request before writing any code. The council must act as a steering committee involving `task-coach` (Product), `architect`, and `devil`.
+
+The council must:
+1. Clarify the prompt and define the absolute minimum scope (Simplicity Gate).
+2. Explicitly document all assumptions and run the Grilling protocol on each one (Think Before Coding).
+3. Draft a Task Card & Technical Plan (The Specification).
+
+**STOP here.** Unresolved grilling questions populate `questionsForUser` in the
+CCEP-1 `planner-output`; `ccep evaluate` (ConfirmationGate) halts until a human
+answers. Show the agreed Task Card & Technical Plan and wait for confirmation
+before continuing.
+
+---
+
+## Step 3 — Test Definition (TDD)
+
+Invoke `tester` with the approved Task Card & Technical Plan.
+
+tester must:
+1. Write failing tests based on the Acceptance Criteria defined in the Task Card.
+2. Confirm the tests fail as expected (Red state).
+
+**Goal-Driven Execution (Karpathy)**: Do not proceed until verifiable tests are written and fail for the correct reasons.
+
+---
+
+## Step 4 — Surgical Implementation
+
+Invoke `implementer` with the failing tests and the Technical Plan.
+
+implementer must:
+1. Write the minimal code required to pass the tests.
+2. Touch ONLY the files specified in the Technical Plan (Surgical Changes).
+3. NOT refactor adjacent code, change existing styles, or build speculative features.
+4. Run the tests. Loop `implementer` -> `tester` until all tests pass (Green state).
+
+---
+
+## Step 5 — Multi-Perspective Council Review
+
+Invoke the `council` skill on the generated diff to perform the final review phase.
+
+The council will evaluate the diff against the 6 axes (Architecture, Security, Product, Delivery, DataOps, Devil).
+
+If ANY agent votes CRITICAL (especially due to over-engineering, scope creep, or missing the verifiable goals):
+- The Review Report status is **BLOCKED**.
+- Return to Step 4 with the feedback.
+
+If APPROVED (no CRITICAL findings):
+- Deliver the final Council Verdict and the diff summary.
+
+---
+
+## Completion
+
+Deliver the complete Council Verdict. The feature is only complete when tests pass and the council explicitly approves the implementation according to the specification.