cc-codeconductor 1.0.0 → 1.2.0

package/presets/agy/skills/security-soc-automation/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-soc-automation
+description: >
+  Automate detection, enrichment, and response playbooks for a SOC you operate. Keep humans in the loop for destructive actions.
+---
+
+# SOC Automation
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Automate enrichment (WHOIS, asset owner, hash reputation) not auto-wipe
+- Version playbooks; require approval for isolate/disable-user actions
+- Test detections with synthetic events in a lab tenant
+
+## Do not
+
+- Auto-disable production users or servers without an approval gate
+- Pipe raw secrets from tickets into chat webhooks
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-soc-automation`.
+Example prompts:
+
+- `Draft a SOAR playbook: phishing report → hash lookup → ticket, no auto-containment.`
+- `Turn this Sigma-style idea into a documented detection plus a false-positive test.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-threat-hunting/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-threat-hunting
+description: >
+  Hunt for adversary techniques in telemetry you are authorized to query. Hypothesis-driven, evidence-first, no live offensive operations.
+---
+
+# Threat Hunting
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- State a hypothesis (technique + data source + expected artifact)
+- Query only approved telemetry (SIEM, EDR, cloud logs)
+- Promote confirmed hits to IR with timestamps and host identity
+
+## Do not
+
+- Run offensive tooling on production to 'verify' a hunt
+- Query personal mailboxes or systems outside the authorization scope
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-threat-hunting`.
+Example prompts:
+
+- `Hypothesis: stolen refresh tokens in our IdP logs this week. Query patterns and list follow-ups.`
+- `Hunt for unusual service-account key creation in GCP for project X (authorized).`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-vuln-assessment/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-vuln-assessment
+description: >
+  Plan and report authorized vulnerability assessments on owned systems. Prioritize evidence, severity, and remediations. Do not deliver exploit payloads.
+---
+
+# Vulnerability Assessment
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Use scanner findings plus code review as evidence, not as a scoreboard
+- Map issues to OWASP / CWE and to a concrete fix in the repo
+- Require a reproduction that is safe (config, unit test, or staging)
+- Track false positives explicitly
+
+## Do not
+
+- Ship exploit PoCs, weaponized payloads, or live attack scripts
+- Scan production without a documented freeze and rollback
+- Mark a finding closed without a failing-then-passing test when code changes
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-vuln-assessment`.
+Example prompts:
+
+- `Assess the checkout API in staging (ticket SEC-214). Report exploitable authz gaps as remediations, not exploits.`
+- `Triage SAST results on src/auth and turn confirmed issues into failing tests plus patches.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-web/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-web
+description: >
+  Review and harden web apps (authz, XSS, CSRF, SSRF, injection) on code you maintain. Complements the OWASP `security` skill. No exploit kits.
+---
+
+# Web Application Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Enforce authorization on every handler; never rely on the UI
+- Parameterize queries; reject unknown fields
+- Treat cookies, tokens, and redirects as untrusted until validated
+- Add tests for authz, CSRF, and open redirects when you change those paths
+
+## Do not
+
+- Provide XSS or SQLi payloads for use against systems you do not own
+- Disable CSRF or SameSite 'to make local dev easier' in production configs
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-web`.
+Example prompts:
+
+- `Review our Next.js Server Actions for IDOR and CSRF. Propose tests, not exploits.`
+- `Harden the file-upload endpoint: type, size, path containment, and tests.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/testing-tdd/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: testing-tdd
+description:
+  Guides agents through Red-Green-Refactor with runner-captured evidence.
+  Use when running /cc-tdd-cycle, writing tests before implementation, or
+  Global TDD required is yes.
+---
+
+# Test-Driven Development
+
+## Overview
+
+Red (failing test) → Green (minimal code) → Refactor. Evidence comes from
+`captureTddSuiteEvidence`, not handmade JSON.
+
+## When to Use
+
+- `/cc-tdd-cycle`, new behavior, bug fixes, TDD-required OpenSpec items
+
+**NOT** for docs-only changes or when the Task Card forbids tests.
+
+## Process
+
+1. Write the failing test that encodes one acceptance criterion. Run the suite.
+   It MUST fail (`suiteFails === true`).
+2. Implement the minimum that turns it green. Do not expand scope.
+3. Refactor only with a green suite.
+4. Capture evidence via the verification runner (`openspec done` on test/implement
+   when TDD is required).
+5. Cover happy path, edge, and error for each behavior.
+
+Local: `bun run dev`. Pyramid default: many unit, fewer integration, rare E2E.
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+| --- | --- |
+| I'll add tests later | Later means never. Red first. |
+| This is too small to test | If it can break, it needs a failing test first. |
+| I'll write the evidence JSON | Handmade TDD JSON is rejected. |
+
+## Red Flags
+
+- Tests that assert implementation details instead of behavior
+- Green without a recorded red
+- Skipping error cases
+
+## Verification
+
+- [ ] Suite failed before implement
+- [ ] Suite passed after implement
+- [ ] Runner evidence exists (not handmade)
+- [ ] Optional: `bun run dev scorecard suite-run --suite workflow-gates`

package/presets/agy/skills/using-cc-skills/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: using-cc-skills
+description:
+  Maps incoming work to the CodeConductor slash command and workflow skill.
+  Use when starting a session or deciding which /cc-* command applies.
+---
+
+# Using CodeConductor skills
+
+## Overview
+
+Pick one slash command. Follow its skill. Invoke CLI for gates. Do not invent
+a parallel process.
+
+## When to Use
+
+- Start of a session, ambiguous request, or "which /cc should I run?"
+
+## Process
+
+| Intent | Command | Skill |
+| --- | --- | --- |
+| New backlog item | `/cc-backlog` | `backlog` |
+| Deliver a BC-xxx item | `/cc-openspec` | `openspec` |
+| New feature | `/cc-feature` | `openspec` + `testing-tdd` |
+| Bug fix | `/cc-fix` | `testing-tdd` |
+| Review a diff | `/cc-review` | `evaluation` |
+| TDD cycle only | `/cc-tdd-cycle` | `testing-tdd` |
+| Scorecard / suites | `/cc-scorecard` | `evaluation` |
+
+Then run the matching CLI (`openspec validate`, `scorecard create --from-diff`,
+`hook pre-tool`, `scorecard suite-run`).
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+| --- | --- |
+| I'll skip the slash and just code | Skipping the workflow is a defect. |
+
+## Red Flags
+
+- Two slash commands in parallel that mutate the same files
+- Implementing before `openspec analyze` when a change folder is active
+
+## Verification
+
+- [ ] One command selected and shown to the user
+- [ ] Matching skill loaded before edits

package/presets/agy/workflows/cc-api-contract.md

@@ -21,6 +21,20 @@ Command: `api-contract` (fixed for this workflow — do not infer from user text
 
 ---
 
+## Step 0b — OpenSpec quality gates
+
+If `openspec status` reports an active change folder:
+
+1. Run: `npx cc-codeconductor openspec validate --output json`
+2. Run: `npx cc-codeconductor openspec analyze --output json`
+3. If analyze `stop` is true or any finding is CRITICAL, stop. Do not delegate to implementer.
+4. Next command spelling on this runner: `/cc-api-contract`
+
+Local development: `bun run dev <same argv>`. Published package: `npx cc-codeconductor`.
+
+---
+
+
 ## Step 1 — Task Card validation (task-coach)
 
 Invoke `task-coach` with the request above.

package/presets/agy/workflows/cc-ask.md

@@ -36,10 +36,11 @@ The catalog is only:
 | `/cc:refactor` | structure, no behavior change |
 | `/cc:review` | inspect a diff/PR |
 | `/cc:tdd-cycle` | red → green → refactor |
+| `/cc:backlog` | create or append BACKLOG.md / objectives |
 | `/cc:openspec` | BACKLOG / BC-xxx delivery |
 
 If the CLI is unavailable, apply the same catalog and the same priority:
-openspec → tdd-cycle → review → refactor → fix → feature (default).
+backlog (author) vs openspec (deliver) → tdd-cycle → review → refactor → fix → feature (default).
 
 ---
 

package/presets/agy/workflows/cc-backlog.md

@@ -0,0 +1,69 @@
+---
+name: cc-backlog
+description:
+  Author BACKLOG.md — wayfinding, grilling, create or append items, validate
+  with openspec, and plan OpenSpec change folders for /cc-openspec.
+---
+
+# Backlog Authoring Workflow
+
+Objectives: $ARGUMENTS
+
+Create or append valid `BACKLOG.md` items and OpenSpec change docs. Do **not**
+deliver implementation — that is `/cc-openspec`.
+
+---
+
+## Step 0 — CCEP Bootstrap
+
+Command: `backlog` (fixed for this workflow — do not infer from user text)
+
+1. Run: `npx cc-codeconductor ccep parse --command backlog "$ARGUMENTS" --output json`
+2. Run: `npx cc-codeconductor ccep resolve --command backlog "$ARGUMENTS" --output json`
+3. Run: `npx cc-codeconductor ccep profile backlog --output json`
+4. After planner/intake JSON is available, run: `npx cc-codeconductor ccep evaluate --command backlog --input <planner.json> --output json`. If `stop` is true, show questions or risks and wait for human input.
+5. Delegate to subagents using compiled CCEP prompts — never forward raw `$ARGUMENTS` to planners.
+
+---
+
+## Step 1 — Wayfinding (repo-explorer)
+
+If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"`. Invoke
+`repo-explorer`. Do not write `BACKLOG.md`. Scope must name real files.
+
+---
+
+## Step 2 — Relentless Grilling (task-coach)
+
+Invoke `task-coach`. Measurable acceptance only. One grilling question at a time.
+
+**STOP here.** Unresolved grilling questions populate `questionsForUser`;
+`ccep evaluate --command backlog` halts until a human answers.
+
+---
+
+## Step 3 — Write or append BACKLOG.md
+
+Apply skill `backlog`. Create from template if missing; otherwise append under
+`## Items`. Next `BC-NNN` = max existing + 1. Status `READY`. Do not rewrite
+`## Global` or `## Archive`. Do not `git add` `BACKLOG.md` or `openspec/`.
+
+---
+
+## Step 4 — Validate (mandatory gate)
+
+Run `npx cc-codeconductor openspec validate`. If invalid, show errors and
+canonical structure, fix, re-validate. **STOP** planning until valid.
+
+---
+
+## Step 5 — Plan new items
+
+For each new `BC-id`: `npx cc-codeconductor openspec plan <BC-id>`.
+
+---
+
+## Completion
+
+Report IDs, validate result, change folders. Tell the user to run `/cc-openspec`.
+Apply skill `backlog`.

package/presets/agy/workflows/cc-db-migration.md

@@ -22,6 +22,20 @@ Command: `db-migration` (fixed for this workflow — do not infer from user text
 
 ---
 
+## Step 0b — OpenSpec quality gates
+
+If `openspec status` reports an active change folder:
+
+1. Run: `npx cc-codeconductor openspec validate --output json`
+2. Run: `npx cc-codeconductor openspec analyze --output json`
+3. If analyze `stop` is true or any finding is CRITICAL, stop. Do not delegate to implementer.
+4. Next command spelling on this runner: `/cc-db-migration`
+
+Local development: `bun run dev <same argv>`. Published package: `npx cc-codeconductor`.
+
+---
+
+
 ## Step 1 — Task Card validation (task-coach)
 
 Invoke `task-coach` with the request above.

package/presets/agy/workflows/cc-explore.md

@@ -28,7 +28,7 @@ If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"`. Invoke `
 
 ## Step 2 — Suggest next command (orchestrator)
 
-Recommend exactly one next slash command (`/cc:feature`, `/cc:fix`, `/cc:refactor`, `/cc:review`, `/cc:triage`, …) with a one-sentence rationale. Do not start that workflow.
+Recommend exactly one next slash command (`/cc:feature`, `/cc:fix`, `/cc:refactor`, `/cc:review`, `/cc:backlog`, `/cc:openspec`, `/cc:triage`, …) with a one-sentence rationale. Do not start that workflow.
 
 ---
 

package/presets/agy/workflows/cc-feature.md

@@ -22,6 +22,24 @@ Command: `feature` (fixed for this workflow — do not infer from user text)
 
 ---
 
+## Step 0b — OpenSpec quality gates
+
+If `openspec status` reports an active change folder:
+
+1. Run: `npx cc-codeconductor openspec validate --output json`
+2. Run: `npx cc-codeconductor openspec analyze --output json`
+3. If analyze `stop` is true or any finding is CRITICAL, stop. Do not delegate to implementer.
+4. Next command spelling on this runner: `/cc-feature`
+
+Local development: `bun run dev <same argv>`. Published package: `npx cc-codeconductor`.
+
+Skills: `using-cc-skills`, `openspec`, `testing-tdd`, `evaluation`.
+Do not skip `openspec analyze` when a change folder is active.
+"I'll add tests later" is not allowed — tester before implementer.
+
+---
+
+
 ## Step 1 — Wayfinding (repo-explorer)
 
 If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"` (and

package/presets/agy/workflows/cc-fix.md

@@ -32,6 +32,20 @@ Command: `fix` (fixed for this workflow — do not infer from user text)
 
 ---
 
+## Step 0b — OpenSpec quality gates
+
+If `openspec status` reports an active change folder:
+
+1. Run: `npx cc-codeconductor openspec validate --output json`
+2. Run: `npx cc-codeconductor openspec analyze --output json`
+3. If analyze `stop` is true or any finding is CRITICAL, stop. Do not delegate to implementer.
+4. Next command spelling on this runner: `/cc-fix`
+
+Local development: `bun run dev <same argv>`. Published package: `npx cc-codeconductor`.
+
+---
+
+
 ## Step 1 — Wayfinding (repo-explorer)
 
 If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"` (and

package/presets/agy/workflows/cc-iterative.md

@@ -22,6 +22,20 @@ Command: `iterative` (fixed for this workflow — do not infer from user text)
 
 ---
 
+## Step 0b — OpenSpec quality gates
+
+If `openspec status` reports an active change folder:
+
+1. Run: `npx cc-codeconductor openspec validate --output json`
+2. Run: `npx cc-codeconductor openspec analyze --output json`
+3. If analyze `stop` is true or any finding is CRITICAL, stop. Do not delegate to implementer.
+4. Next command spelling on this runner: `/cc-iterative`
+
+Local development: `bun run dev <same argv>`. Published package: `npx cc-codeconductor`.
+
+---
+
+
 ## Step 1 — Wayfinding (repo-explorer)
 
 If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"` (and

package/presets/agy/workflows/cc-openspec.md

@@ -30,6 +30,20 @@ Command: `openspec` (fixed for this workflow — do not infer from user text)
 
 ---
 
+## Step 0b — OpenSpec quality gates
+
+If `openspec status` reports an active change folder:
+
+1. Run: `npx cc-codeconductor openspec validate --output json`
+2. Run: `npx cc-codeconductor openspec analyze --output json`
+3. If analyze `stop` is true or any finding is CRITICAL, stop. Do not delegate to implementer.
+4. Next command spelling on this runner: `/cc-openspec`
+
+Local development: `bun run dev <same argv>`. Published package: `npx cc-codeconductor`.
+
+---
+
+
 ## Step 1 — Scan
 
 Run `npx cc-codeconductor openspec scan`. Report new, modified, and closed items.
@@ -46,6 +60,8 @@ Use `$ARGUMENTS` BC-id or `npx cc-codeconductor openspec status` for next READY
 
 Run `npx cc-codeconductor openspec plan <BC-id>`. Show TaskCards and `openspec/changes/` path.
 
+Drive status with CLI (do not edit openspec-state.json): `openspec start <cardId>`, `openspec done <cardId>`, `openspec block <cardId> --reason "…"`, `openspec archive <itemId>`.
+
 ---
 
 ## Step 4 — Execute loop
@@ -70,6 +86,6 @@ Reviewer approves or rejects against acceptance criteria. Reject → `IN_PROGRES
 
 ## Step 6 — Update
 
-Mark DONE, move to Archive in BACKLOG.md, run `openspec scan`.
+Mark DONE with `openspec archive <itemId>` (all cards must be done), then run `openspec scan`.
 
 Apply skill `openspec` for format and state rules.

package/presets/agy/workflows/cc-scorecard.md

@@ -20,6 +20,8 @@ Command: `scorecard` (fixed for this workflow — do not infer from user text)
 
 ---
 
+If a change folder exists, run `npx cc-codeconductor openspec analyze --output json` first. `--from-diff` overlays FR/SC coverage onto `acceptance` and TDD evidence onto `tests`.
+
 1. `npx cc-codeconductor scorecard create --task <id> --from-diff`
 2. Complete criteria per docs/agent-scorecard.md
 3. `scorecard regression` if needed