cc-codeconductor 1.0.0 → 1.2.0

package/presets/cursor/commands/cc/tdd-cycle.md

@@ -31,6 +31,20 @@ Command: `tdd-cycle` (fixed for this workflow — do not infer from user text)
 
 ---
 
+## Step 0b — OpenSpec quality gates
+
+If `openspec status` reports an active change folder:
+
+1. Run: `npx cc-codeconductor openspec validate --output json`
+2. Run: `npx cc-codeconductor openspec analyze --output json`
+3. If analyze `stop` is true or any finding is CRITICAL, stop. Do not delegate to implementer.
+4. Next command spelling on this runner: `/cc:tdd-cycle`
+
+Local development: `bun run dev <same argv>`. Published package: `npx cc-codeconductor`.
+
+---
+
+
 ## Before you begin — mandatory pre-check
 
 This command enforces strict TDD discipline. The three phases are sequential and

package/presets/cursor/gates/pre-commit/GATE.md

@@ -1,6 +1,6 @@
-# Pre-commit Gate: Typecheck and Test
+# Pre-commit Gate: Typecheck, Lint, and Test
 
-Este gate instala un hook `pre-commit` que ejecuta `bun run typecheck` y `bun run test` antes de permitir commits en el repositorio. Si cualquiera de estos comandos falla, el commit es bloqueado.
+Este gate instala un hook `pre-commit` que ejecuta `bun run typecheck`, `bun run lint` y `bun run test` antes de permitir commits en el repositorio. Si cualquiera de estos comandos falla, el commit es bloqueado.
 
 ## Cuándo usar
 
@@ -63,6 +63,7 @@ mkdir -p "$GIT_DIR/hooks"
 cat > "$HOOK_PATH" << 'HOOK_EOF'
 #!/bin/bash
 bun run typecheck || exit 1
+bun run lint || exit 1
 bun run test || exit 1
 HOOK_EOF
 
@@ -78,7 +79,7 @@ echo "Pre-commit hook installed successfully."
 - **Resolución dinámica de git dir**: Usa `git rev-parse --git-dir` para localizar el directorio correcto, incluso en worktrees.
 - **Detección de conflictos**: Si Husky o lint-staged ya está en `package.json`, el script avisa y no instala para evitar conflictos.
 - **Protección de hooks existentes**: Si ya existe un `.git/hooks/pre-commit`, el script no lo sobrescribe.
-- **Solo Bun**: El hook ejecuta `bun run typecheck` y `bun run test`. Asegúrate de que estos scripts están definidos en `package.json`.
+- **Solo Bun**: El hook ejecuta `bun run typecheck`, `bun run lint` y `bun run test`. Asegúrate de que estos scripts están definidos en `package.json`.
 
 ## Verificación
 
@@ -121,7 +122,7 @@ Verifica que el hook es ejecutable:
 
     chmod +x .git/hooks/pre-commit
 
-Verifica que `bun run typecheck` y `bun run test` existen en `package.json`:
+Verifica que `bun run typecheck`, `bun run lint` y `bun run test` existen en `package.json`:
 
     cat package.json | grep -A 5 '"scripts"'
 

package/presets/cursor/skills/backlog/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: backlog
+description: >
+  Guides agents through authoring BACKLOG.md and OpenSpec change folders.
+  Use when running /cc-backlog or /cc:backlog, creating or appending backlog
+  items, or preparing work for /cc-openspec. Delivery is skill openspec.
+---
+
+# Backlog authoring
+
+## Overview
+
+Create vs append `BACKLOG.md`, then `openspec validate` / `plan`. Do not deliver
+the item here.
+
+## When to Use
+
+- `/cc-backlog`, first backlog in a repo, or appending `### BC-xxx` items
+
+**NOT** for executing an item (`openspec`) or for scorecards (`evaluation`).
+
+## Process
+
+1. If `graphify-out/graph.json` exists, `graphify query "<objectives>"`. Then
+   `repo-explorer`. Scope names real files.
+2. Invoke `task-coach`. One grilling question per assumption. Reject vague
+   acceptance ("improve UX"). At most 3 `[NEEDS CLARIFICATION]`.
+3. `ccep evaluate --command backlog`. If `stop`, wait for the human.
+4. Create `BACKLOG.md` from `presets/templates/BACKLOG.md` or append under
+   `## Items`. Do not rewrite `## Global` or `## Archive`.
+5. Next ID = max numeric suffix in Items + Archive + 1, zero-padded (`BC-013`).
+6. `bun run dev openspec validate` (or `npx cc-codeconductor`). Fix until valid.
+7. `openspec plan BC-xxx` for each **new** item this run. Then tell the user
+   to run `/cc-openspec`.
+
+Required sections: `## Global`, `## Items`, `## Archive`. Each item:
+`### BC-001 | Title` with Priority, Status (`READY` after grilling), Type,
+Depends on, Description, Scope, Out of scope, Acceptance.
+
+Local artifacts (`BACKLOG.md`, `openspec/`, `.codeconductor/openspec-state.json`)
+are gitignored in consumer projects. Do not `git add` them.
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+| --- | --- |
+| This fix is small; skip the Task Card | Every item needs measurable acceptance. |
+| I'll validate later | Do not plan until `openspec validate` passes. |
+| Archive can be rewritten | Archive is history. Never rewrite or re-execute. |
+
+## Red Flags
+
+- Acceptance that cannot fail a check
+- Editing `openspec-state.json` by hand
+- Planning an invalid backlog
+
+## Verification
+
+- [ ] `openspec validate` exit 0
+- [ ] New items have `FR`/`SC`-ready measurable acceptance
+- [ ] User pointed at `/cc-openspec` for delivery

package/presets/cursor/skills/evaluation/SKILL.md

@@ -1,8 +1,65 @@
 ---
 name: evaluation
-description: Scorecard, outcomes, model profiles. Use with /cc-scorecard.
-
-disable-model-invocation: true
+description:
+  Guides agents through scorecards, outcomes, model profiles, and eval suites.
+  Use when running /cc-scorecard or /cc:scorecard, measuring a deliverable, or
+  checking workflow gates with suite-run.
 ---
 
-See `presets/claude/skills/evaluation/SKILL.md` for full evaluation workflow.
+# Evaluation
+
+## Overview
+
+A scorecard measures the deliverable against eight weighted criteria. Spec
+quality checklists are reviewer-owned. "Seems right" is not a verdict.
+
+Pass threshold: weighted score >= 2.0 and no criterion at 0.
+
+## When to Use
+
+- After implement/review, before `openspec archive`
+- Comparing models or prompt versions
+- Proving the workflow tools still work (`suite-run`)
+
+**NOT** for rewriting specs (reviewer checklist) or for implementing code.
+
+## Process
+
+Local: `bun run dev`. Published: `npx cc-codeconductor`.
+
+```text
+scorecard create --task BC-001 --from-diff
+scorecard record --task BC-001 --verdict PASS --score 2.5
+scorecard list | aggregate | models | regression | matrix | compare-models
+scorecard prompt-diff 0.4.0 0.5.0 --agent architect
+scorecard experiment start --suite harness-v1
+scorecard suite-run --suite workflow-gates
+scorecard suite-run --suite hook-guardrails
+scorecard suite-run --suite scorecard-signals
+```
+
+`openspec analyze` can auto-suggest `acceptance` / `tests` on `--from-diff`.
+Archive needs PASS when review is required.
+
+Outcomes append to `.codeconductor/evaluation/outcomes.jsonl`.
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+| --- | --- |
+| I'll fill the scorecard by hand without a diff | Use `--from-diff` and runner evidence. |
+| Suites are optional toys | `suite-run` is the workflow tool that proves gates. |
+| Handmade TDD JSON is fine | The runner rejects it. |
+
+## Red Flags
+
+- PASS with a criterion at 0
+- Archive without a recorded scorecard when review is required
+- Declaring the workflow ready without `suite-run` or `scorecard record`
+
+## Verification
+
+- [ ] Scorecard created from diff (or explicit scores)
+- [ ] Verdict PASS / REVISE / REJECT recorded
+- [ ] For process changes: `scorecard suite-run --suite hook-guardrails` (and
+      `workflow-gates` / `scorecard-signals` when those gates changed)

package/presets/cursor/skills/openspec/SKILL.md

@@ -1,52 +1,66 @@
 ---
 name: openspec
 description:
-  OpenSpec backlog format, state machine, and delivery workflow for CodeConductor.
-  Use when running /cc-openspec or editing BACKLOG.md.
-
-disable-model-invocation: true
+  Guides agents through OpenSpec delivery from BACKLOG.md (validate, analyze,
+  test-before-implement, scorecard, archive). Use when running /cc-openspec,
+  /cc:openspec, or delivering an existing backlog item. Authoring BACKLOG.md
+  is skill backlog, not this skill.
 ---
 
-# OpenSpec / BACKLOG Skill
+# OpenSpec delivery
+
+## Overview
 
-## BACKLOG.md contract
+This skill delivers an existing `BACKLOG.md` item. It is a workflow with CLI
+gates, not a reference doc. Specs describe WHAT; `design.md` describes HOW.
 
-`BACKLOG.md` at repo root is the operational queue. Required sections:
+## When to Use
 
-- `## Global` — Product, Strategy, Policy, Review required, TDD required
-- `## Items` — active backlog entries
-- `## Archive` — completed entries (do not re-execute)
+- `/cc-openspec` or `openspec next` / `plan` / `done` / `archive`
+- An item is `READY` or later and must move through the state machine
 
-Each item: `### BC-001 | Short title` with Priority (P0–P3), Status, Type, Depends on, Description, Scope, Out of scope, Acceptance (measurable checklist).
+**NOT** for creating `BACKLOG.md` (use skill `backlog`) or for stack-specific
+coding rules.
 
-## Status machine
+## Process
 
-`TODO` → `READY` → `PLANNED` → `IN_PROGRESS` → `REVIEW` → `DONE` → Archive
+Local CLI is `bun run dev`. Published package is `npx cc-codeconductor`.
 
-`BLOCKED` can return to `READY` when resolved. Reviewer rejection: `REVIEW` → `IN_PROGRESS`.
+1. `openspec validate` — must pass before delivery.
+2. `openspec plan BC-xxx` if the item is not yet `PLANNED`.
+3. `openspec analyze --output json` — CRITICAL findings exit 1. Do not implement.
+4. Phases: discover (`repo-explorer`) → design (`architect`) → test (`tester`) →
+   implement (`implementer`) → review (`reviewer`). If Global `TDD required: yes`,
+   test runs before implement.
+5. `openspec done` on test/implement requires `captureTddSuiteEvidence`. Handmade
+   evidence JSON is rejected.
+6. `scorecard create --task BC-xxx --from-diff` then record a verdict.
+7. `openspec archive` only after human review when `Review required: yes` and
+   the scorecard is PASS.
 
-## CLI commands
+Status machine: `TODO` → `READY` → `PLANNED` → `IN_PROGRESS` → `REVIEW` → `DONE`
+→ Archive. `BLOCKED` returns to `READY`. Reviewer rejection: `REVIEW` →
+`IN_PROGRESS`.
 
-```bash
-npx cc-codeconductor openspec validate
-npx cc-codeconductor openspec scan
-npx cc-codeconductor openspec plan BC-001
-npx cc-codeconductor openspec status
-npx cc-codeconductor openspec next
-```
+## Common Rationalizations
 
-## OpenSpec folders
+| Rationalization | Reality |
+| --- | --- |
+| Validate is bureaucracy | `openspec validate` is the gate. Skipping it is a defect. |
+| I'll add tests after green | Global TDD required means tester before implementer. |
+| I'll write the evidence JSON myself | Handmade TDD JSON is rejected. Use the verification runner. |
+| The item is small; skip analyze | `openspec analyze` CRITICAL still stops implement. |
 
-Each item generates `openspec/changes/<slug>/` with `proposal.md`, `design.md`, `tasks.md`, `specs/`.
+## Red Flags
 
-## Agent phases
+- Implementing while analyze reports CRITICAL
+- Archive without a PASS scorecard when review is required
+- Acceptance like "improve UX" with no measurable check
 
-| Phase | Agent |
-|-------|-------|
-| discover | repo-explorer |
-| design | architect |
-| test | tester |
-| implement | implementer |
-| review | reviewer |
+## Verification
 
-When Global `TDD required: yes`, test runs before implement.
+- [ ] `openspec validate` exit 0
+- [ ] `openspec analyze --output json` has no CRITICAL
+- [ ] TDD evidence from the runner when TDD is required
+- [ ] `scorecard create --from-diff` recorded
+- [ ] Suite check (optional): `bun run dev scorecard suite-run --suite workflow-gates`

package/presets/cursor/skills/security-ai-llm/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-ai-llm
+description: >
+  Harden LLM and agent integrations you operate: prompt injection, tool allowlists, secret leakage, and supply-chain of models. Defensive only.
+---
+
+# AI / LLM Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Treat model output as untrusted; never exec it without a schema
+- Allowlist tools and paths; contain file writes
+- Keep secrets out of prompts and logs
+
+## Do not
+
+- Help jailbreak third-party products or steal model weights
+- Log raw user PII to prompt-debug stores
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-ai-llm`.
+Example prompts:
+
+- `Review our agent tool runner for path traversal and unbounded shell.`
+- `Add tests that a prompt cannot make the bot dump .env.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/cursor/skills/security-blue-team/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-blue-team
+description: >
+  Improve detections, hardening, and response for the estate you defend. Detection-as-code and control design, not offense.
+---
+
+# Blue Team Defense
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Tune detections for true positives; document exceptions
+- Pair every new control with a test or canary
+- Share hunt hypotheses with IR, not with the public internet
+
+## Do not
+
+- Disable EDR or logging to 'reduce noise' without a ticket
+- Copy attacker malware into production 'for training'
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-blue-team`.
+Example prompts:
+
+- `We missed a token-replay. Propose a detection plus a unit test for the API gateway.`
+- `Harden CI: pin actions, require reviews on workflows that deploy.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/cursor/skills/security-cloud/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-cloud
+description: >
+  Harden IAM, storage, keys, and org policies in cloud accounts you administer. Focus on identity, logging, and public-exposure controls.
+---
+
+# Cloud Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Prefer roles over long-lived keys; require MFA on human admins
+- Block public buckets and overly broad IAM `*` unless justified
+- Turn on cloud audit logs and retain them per policy
+
+## Do not
+
+- Disable logging or GuardDuty/Security Command Center 'to save cost' without a recorded exception
+- Share account credentials in chat or tickets
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-cloud`.
+Example prompts:
+
+- `Audit this AWS account's IAM: unused keys, admin wildcards, and public S3.`
+- `Write a policy-as-code check that fails CI if a bucket ACL is public.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/cursor/skills/security-crypto/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-crypto
+description: >
+  Choose and review cryptographic usage in your codebase: TLS, hashing, KMS, secret storage. Prefer standard libraries and vetted constructions.
+---
+
+# Applied Cryptography
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Use platform TLS and KMS; do not invent protocols
+- Hash passwords with a memory-hard KDF; never roll your own
+- Keep keys out of git; rotate on leak
+
+## Do not
+
+- Recommend ECB, MD5 for security, or home-grown ciphers
+- Ask models to 'break' or weaken crypto for a CTF against third parties
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-crypto`.
+Example prompts:
+
+- `Review how we store refresh tokens. Propose KMS envelope encryption and tests.`
+- `Replace SHA-1 password hashes in this legacy module with a modern KDF and a migration plan.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/cursor/skills/security-exploit-dev/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-exploit-dev
+description: >
+  Understand how a confirmed vulnerability in an owned system is triggered so you can patch and test it. This is not exploit development for offense. No payloads, malware, or attack procedures.
+---
+
+# Defensive Exploit Analysis (Authorized)
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Describe the bug class (e.g. missing authz) at a design level
+- Write a regression test that fails before the fix and passes after
+- Prefer sanitizers, type systems, and least-privilege patches
+- Stop and refuse if the user asks for a working exploit, PoC payload, or bypass kit
+
+## Do not
+
+- Write exploits, exploit PoCs, shellcode, or weaponized requests
+- Document step-by-step attack procedures against any system
+- Help with CTF flags, cracking, or unauthorized access
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-exploit-dev`.
+Example prompts:
+
+- `We confirmed IDOR on /invoices/:id in our app. Help design the authz check and a RED test — no exploit.`
+- `Turn this crash report from our fuzzer into a defensive patch and a regression test.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/cursor/skills/security-grc/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-grc
+description: >
+  Map controls to SOC2, ISO 27001, PCI, or internal policy for the org you work for. Evidence and control design — not audit theater.
+---
+
+# GRC / Compliance Engineering
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Map each control to an owner, evidence path, and test
+- Prefer automated evidence (CI, IaC, tickets) over screenshots
+- Record exceptions with expiry dates
+
+## Do not
+
+- Fabricate evidence or backdate approvals
+- Copy another company's policies without legal review
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-grc`.
+Example prompts:
+
+- `Map our GitHub branch protection to SOC2 CC6.6 and list evidence.`
+- `List gaps: secrets in git, missing MFA on GitHub org owners.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/cursor/skills/security-incident-response/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-incident-response
+description: >
+  Coordinate containment, eradication, and recovery for an authorized incident. Preserve evidence, communicate facts, and avoid destructive actions without approval.
+---
+
+# Incident Response
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Follow the org IR plan: detect, contain, eradicate, recover, lessons
+- Preserve logs and disk images before reboot or wipe
+- Redact secrets from tickets and chat
+- Track timeline, systems, and decision-makers
+
+## Do not
+
+- Wipe systems before evidence capture unless imminent ransomware spread is approved
+- Blame individuals in the working notes; stick to systems and facts
+- Reuse attacker tooling from the incident as a 'test'
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-incident-response`.
+Example prompts:
+
+- `P1: suspected token theft on api-prod. Draft containment and evidence steps for the IR commander.`
+- `After containment, write the lessons-learned outline and the regression tests we should add.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/cursor/skills/security-log-analysis/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-log-analysis
+description: >
+  Query and interpret security logs you are authorized to read. Build detections and investigations without leaking PII.
+---
+
+# Security Log Analysis
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Minimize PII in saved queries and screenshots
+- Time-box queries; record the query and the index in the ticket
+- Correlate identity, source IP, and resource — not just a single field
+
+## Do not
+
+- Export full production logs to a laptop or public gist
+- Query other customers' tenants in a multi-tenant SaaS
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-log-analysis`.
+Example prompts:
+
+- `Find failed logins then a success from a new country for our IdP (last 24h).`
+- `Explain this CloudTrail burst: is it deploy automation or a key leak?`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`