cc-codeconductor 1.1.0 → 1.3.0

package/presets/claude/commands/cc/spec-mutation.md

@@ -0,0 +1,194 @@
+---
+description: >-
+  Spec-locked TDD with a mutation-testing gate — refine the intent
+  into an immutable Gherkin contract (SHA-256 frozen), implement under the
+  three laws of TDD, pass a judge audit, and merge only if every mutant dies.
+---
+
+# Spec-Mutation — Hard Spec → TDD → Judge → Mutation Gate
+
+Scope: $ARGUMENTS
+
+Describe what behavior you want to implement. Include:
+
+- The function, method, or feature to implement
+- The expected behavior (inputs, outputs, invariants, edge cases)
+- The allowed file scope (production files that may change)
+- The test command for the affected suite (e.g. `pytest tests/test_billing.py`)
+
+---
+
+## Step 0 — CCEP Bootstrap
+
+Command: `spec-mutation` (fixed for this workflow — do not infer from user text)
+
+1. Run: `npx cc-codeconductor ccep parse --command spec-mutation "$ARGUMENTS" --output json`
+2. Run: `npx cc-codeconductor ccep resolve --command spec-mutation "$ARGUMENTS" --output json`
+3. Run: `npx cc-codeconductor ccep profile spec-mutation --output json`
+4. After planner/intake JSON is available, run: `npx cc-codeconductor ccep evaluate --command spec-mutation --input <planner.json> --output json`. If `stop` is true, show questions or risks and wait for human input.
+5. Delegate to subagents using compiled CCEP prompts — never forward raw `$ARGUMENTS` to planners.
+   Canonical delivery order is test-before-implement whenever both phases apply.
+
+---
+
+## Step 0b — OpenSpec quality gates
+
+If `openspec status` reports an active change folder:
+
+1. Run: `npx cc-codeconductor openspec validate --output json`
+2. Run: `npx cc-codeconductor openspec analyze --output json`
+3. If analyze `stop` is true or any finding is CRITICAL, stop. Do not delegate to implementer.
+4. Next command spelling on this runner: `/cc:spec-mutation`
+
+Local development: `bun run dev <same argv>`. Published package: `npx cc-codeconductor`.
+
+---
+
+## Contract
+
+The Gherkin specification is the **immutable contract** of the system. No code
+merges unless it survives intentional source mutations. The loop is closed:
+
+```
+[Human + spec_partner] ──> [gherkin_author] ──> [Test Freeze: SHA-256]
+                                                       │
+┌──────────────────────────────────────────────────────┘
+▼
+[tdd_craftsman] <───────────────┐ (surviving mutant)
+   (Red-Green-Refactor)         │
+        │                       │
+        ▼                       │
+     [judge] ───────────> [mutation_testing] ───> [Safe Merge]
+```
+
+Role mapping onto Conductor Agents (AGENTS.md):
+
+| Workflow role      | Conductor Agent   | Deliverable                                |
+| ------------------ | ----------------- | ------------------------------------------ |
+| `craftsman_lead`   | `orchestrator`    | Routed Task Cards, per-stage scorecards    |
+| `spec_partner`     | `task-coach`      | Spec draft with invariants and boundaries  |
+| `gherkin_author`   | `contract-builder`| Strict `.feature` file (Given/When/Then)   |
+| `tdd_craftsman`    | `tester` → `implementer` | Failing test, then minimal production code |
+| `judge`            | `reviewer`        | Binary verdict (PASS/REJECT) with scoring  |
+| `mutation_testing` | `tester` (runner) | Killed/survived mutant report              |
+
+## Stage 1 — Interactive refinement (`spec_partner` / task-coach)
+
+Do not jump to implementation. Apply Socratic questioning to the initial intent:
+
+- Preconditions, postconditions, and edge cases.
+- Invariant matrix: what must always be true.
+- Scope boundaries: explicit `Scope / Files` and `Scope / Out` for the Task Card.
+
+Stop gate: human confirms the draft before formalization.
+
+## Stage 2 — Hard Spec formalization (`gherkin_author` / contract-builder)
+
+Formalize the agreed draft into `specs/<task>.feature` using strict Gherkin:
+
+- No vague language ("must respond fast" is forbidden — use measurable Then steps).
+- Every scenario declares preconditions (`Given`), actions (`When`), and
+  observable states (`Then`).
+- Once the human approves the `.feature`, freeze it:
+
+```bash
+shasum -a 256 specs/<task>.feature tests/ > .codeconductor/tasks/<task_id>.lock
+```
+
+From this point `specs/` and `tests/` are **read-only** for implementation
+agents. Before every later gate, recompute the hash; any single-byte difference
+aborts the pipeline with scorecard 0 (Specification Gaming).
+
+## Stage 3 — TDD under the three laws (`tdd_craftsman`)
+
+Delegates to the `/cc:tdd-cycle` state machine (`tddCycleStateMachine` in
+`domain/loop`). Evidence must be captured with `captureTddSuiteEvidence` — do
+not hand-edit JSON under `.codeconductor/evidence/`.
+
+1. **Law 1 (RED):** no production code except to make a failing test pass. A
+   compile error from a missing interface counts as a failure.
+2. **Law 2:** write exactly one failing assertion or scenario at a time.
+3. **Law 3 (GREEN):** write only the minimal production code to pass. No
+   speculative code, no preventive heuristics, stdlib-first.
+
+Hard rule: any write attempt against `specs/` or `tests/` during GREEN/REFACTOR
+is a harness violation — stop execution and report.
+
+## Stage 4 — Judge audit (`judge` / reviewer)
+
+Deterministic gates before spending compute on mutation:
+
+- Clean compile / diagnostics exit code 0.
+- Traceability: every Gherkin step maps to an implemented test step.
+- Scope Gaming audit: `git diff --name-only` must match the Task Card
+  `Scope / Files` exactly. Relaxed types, weakened assertions, or out-of-scope
+  edits → REJECT with findings.
+
+Verdict is binary: PASS continues to the mutation gate; REJECT returns to the
+`implement` phase with the findings attached.
+
+## Stage 5 — Mutation gate (`mutation_testing`)
+
+Run the deterministic AST mutator shipped with this preset:
+
+```bash
+python3 presets/shared/mutation_runner.py \
+  --target <production_file.py> \
+  --test-command "<test command>" \
+  --spec-folder specs
+```
+
+The runner applies deterministic operator mutations (`>` → `<=`, `==` → `!=`,
+`is` → `is not`, …) one at a time, re-runs the suite per mutant, and restores
+the original source unconditionally (`finally` rollback).
+
+- **Mutant killed (tests fail):** the suite detects the corruption. Continue.
+- **Mutant survived (tests pass):** the tests are blind to this branch. The
+  runner writes `specs/handover.md` + appends to
+  `specs/implementation-summary.md` and exits with code **2**.
+
+Non-Python stacks: substitute Stryker (JS/TS), PITest (JVM), or Mutmut
+(Python full-suite) with the same contract — 100% kill rate or hands-off.
+
+### Hands-off protocol (exit code 2)
+
+1. Do NOT modify production code to "fix" a surviving mutant.
+2. Route back to `tdd_craftsman` with `specs/handover.md` as input: write the
+   missing failing test (Law 1 & 2) that asserts the mutated branch.
+3. Re-run stages 3–5.
+
+### Circuit breaker (max 3 loops)
+
+The orchestrator keeps a persistent counter per Task Card. If the
+`tdd_craftsman ↔ mutation_testing` loop does not reach a 100% kill rate after
+**3 iterations**:
+
+- Cancel active subagents (stop token/context spend).
+- `git checkout -- <scope>` rollback to the last clean state.
+- Scorecard: `STATUS = BLOCKED`; escalate to a human operator. The branch stays
+  frozen until human arbitration.
+
+## Guardrails (harness-enforced, not prompt-enforced)
+
+- **Test Freezing:** SHA-256 of `specs/` + `tests/` stored in
+  `.codeconductor/tasks/<task_id>.lock`; hash mismatch aborts the pipeline.
+- **Scope Guardian:** `fs_write`/`fs_patch` paths are validated against the Task
+  Card `Scope / Files`; path escapes (`../`) and critical files (`**/.env*`,
+  `**/credentials*`, infrastructure roots) are denied per `policy.yml`.
+- **RBAC per role:** `gherkin_author` writes only `specs/`; `tdd_craftsman`
+  reads specs/tests and writes only scoped `src/`; `judge` and
+  `mutation_testing` are read-only except the runner's rolled-back patch.
+- **Worktree isolation:** run the whole flow in a dedicated `git worktree`;
+  protected branches (`main`, `master`, `develop`) are never touched.
+
+## Completion criteria
+
+- [ ] `.feature` approved and frozen (SHA-256 lock file exists and matches).
+- [ ] RED → GREEN → REFACTOR evidence captured per phase.
+- [ ] Judge verdict PASS (compile clean, traceability complete, scope clean).
+- [ ] Mutation runner exits 0 with `total_mutants_killed == total_points`.
+- [ ] Scorecard records the kill rate and iteration count (≤ 3).
+
+## Next
+
+Run `/cc:review` on the diff before merging.

package/presets/claude/commands/cc/tdd-cycle.md

@@ -1,6 +1,6 @@
 ---
 description: >-
-  [cc: alias] Run a structured Red-Green-Refactor TDD cycle — write a failing
+  Run a structured Red-Green-Refactor TDD cycle — write a failing
   test first, implement the minimum code to pass it, then refactor with the
   suite green.
 ---
@@ -31,6 +31,20 @@ Command: `tdd-cycle` (fixed for this workflow — do not infer from user text)
 
 ---
 
+## Step 0b — OpenSpec quality gates
+
+If `openspec status` reports an active change folder:
+
+1. Run: `npx cc-codeconductor openspec validate --output json`
+2. Run: `npx cc-codeconductor openspec analyze --output json`
+3. If analyze `stop` is true or any finding is CRITICAL, stop. Do not delegate to implementer.
+4. Next command spelling on this runner: `/cc:tdd-cycle`
+
+Local development: `bun run dev <same argv>`. Published package: `npx cc-codeconductor`.
+
+---
+
+
 ## Before you begin — mandatory pre-check
 
 This command enforces strict TDD discipline. The three phases are sequential and
@@ -274,3 +288,6 @@ The TDD cycle is complete when:
 
 If the behavior requires additional test cases, start a new `/tdd-cycle` with
 the next scenario. One cycle = one behavior.
+
+Skill: `testing-tdd`. Evidence from the verification runner only — handmade TDD
+JSON is rejected. Optional gate: `bun run dev scorecard suite-run --suite workflow-gates`.

package/presets/claude/commands/cc/test-plan.md

@@ -1,6 +1,6 @@
 ---
 description: >-
-  [cc: alias] Generate a structured test plan for a feature or module — covers
+  Generate a structured test plan for a feature or module — covers
   unit, integration, contract, and edge cases without writing implementation code.
 ---
 
@@ -148,3 +148,7 @@ Deliver the complete Test Plan document. Save it as
 
 This command produces a plan, not test files. No production code and no test
 code is written during this command.
+
+## Next
+
+Implement against this plan with `/cc:tdd-cycle` or `/cc:feature`.

package/presets/claude/commands/cc/triage.md

@@ -1,6 +1,6 @@
 ---
 description: >-
-  [cc: alias] Classify a request into type, risk, and the destination CodeConductor command.
+  Classify a request into type, risk, and the destination CodeConductor command.
 ---
 
 # Triage Workflow

package/presets/claude/settings.json

@@ -151,15 +151,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "if echo \"$CLAUDE_TOOL_INPUT_FILE_PATH\" | grep -qE '\\.(ts|tsx|js|jsx|mjs|cjs|json|jsonc|md|mdx|css|scss|html|astro|yaml|yml)$'; then npx --no-install prettier --write \"$CLAUDE_TOOL_INPUT_FILE_PATH\" 2>/dev/null || true; fi"
-          },
-          {
-            "type": "command",
-            "command": "if echo \"$CLAUDE_TOOL_INPUT_FILE_PATH\" | grep -qE '\\.(ts|tsx|js|jsx|mjs|cjs)$'; then npx --no-install eslint --fix \"$CLAUDE_TOOL_INPUT_FILE_PATH\" 2>/dev/null || true; fi"
-          },
-          {
-            "type": "command",
-            "command": "if echo \"$CLAUDE_TOOL_INPUT_FILE_PATH\" | grep -qE '\\.py$'; then ruff format \"$CLAUDE_TOOL_INPUT_FILE_PATH\" 2>/dev/null && ruff check --fix \"$CLAUDE_TOOL_INPUT_FILE_PATH\" 2>/dev/null || true; fi"
+            "command": "node .claude/hooks/invoke-hook.cjs post-tool"
           }
         ]
       }
@@ -170,7 +162,17 @@
         "hooks": [
           {
             "type": "command",
-            "command": "if echo \"$CLAUDE_TOOL_INPUT_COMMAND\" | grep -qE '(\\.env|secrets/|id_rsa|\\.pem|\\.key)\\b' && echo \"$CLAUDE_TOOL_INPUT_COMMAND\" | grep -qE '(cat|less|more|head|tail|cp |mv |scp )'; then echo 'Bloqueado: intento de leer archivos sensibles' >&2; exit 2; elif echo \"$CLAUDE_TOOL_INPUT_COMMAND\" | grep -qE '^\\s*git\\s+(push|reset\\s+--hard)' || echo \"$CLAUDE_TOOL_INPUT_COMMAND\" | grep -qE '^\\s*git\\s+clean\\s+(-[a-z]*f[a-z]*|--force)' || echo \"$CLAUDE_TOOL_INPUT_COMMAND\" | grep -qE '^\\s*git\\s+branch\\s+(-D|--delete\\s+--force)' || echo \"$CLAUDE_TOOL_INPUT_COMMAND\" | grep -qE '^\\s*git\\s+checkout\\s+(-f|--force|--discard-changes|--theirs|--ours|-\\s|-$)' || echo \"$CLAUDE_TOOL_INPUT_COMMAND\" | grep -qE '^\\s*git\\s+restore\\s+(-f|--force|--discard-changes|--theirs|--ours)'; then echo \"Bloqueado: El agente no tiene autoridad sobre este comando.\" >&2; exit 2; fi"
+            "command": "node .claude/hooks/invoke-hook.cjs pre-tool"
+          }
+        ]
+      }
+    ],
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node .claude/hooks/invoke-hook.cjs session-start"
           }
         ]
       }
@@ -180,7 +182,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo \"[subagent fin] $(date -Iseconds)\" >> ~/.claude/subagent.log"
+            "command": "node -e \"var fs=require('fs');var os=require('os');var p=require('path');var dir=p.join(os.homedir(),'.claude');fs.mkdirSync(dir,{recursive:true});fs.appendFileSync(p.join(dir,'subagent.log'),'[subagent fin] '+new Date().toISOString()+'\\n');\""
           }
         ]
       }

package/presets/claude/skills/android/SKILL.md

@@ -1,6 +1,5 @@
 ---
 id: android
-version: 1.0.0
 name: Android + Kotlin (Jetpack Compose & Media3)
 description: >
   Provides expert knowledge for building modern native Android apps using Kotlin, Jetpack Compose, Material Design 3, MVI architecture, Hilt dependency injection, and Media3/ExoPlayer.

package/presets/claude/skills/api-versioning/SKILL.md

@@ -1,6 +1,5 @@
 ---
 id: api-versioning
-version: 1.0.0
 name: API Versioning
 description: >
   Provides expert knowledge for designing, implementing, and managing REST API

package/presets/claude/skills/backlog/SKILL.md

@@ -1,91 +1,61 @@
 ---
 name: backlog
 description: >
-  Author BACKLOG.md and OpenSpec change folders for CodeConductor.
-  Trigger: /cc-backlog, /cc:backlog, creating or appending backlog items,
-  writing BACKLOG.md, or preparing work for /cc-openspec.
+  Guides agents through authoring BACKLOG.md and OpenSpec change folders.
+  Use when running /cc-backlog or /cc:backlog, creating or appending backlog
+  items, or preparing work for /cc-openspec. Delivery is skill openspec.
 ---
 
 # Backlog authoring
 
-Use this skill to **create or append** `BACKLOG.md` and generate OpenSpec
-change docs. Delivery of an existing item is `/cc-openspec` (skill `openspec`).
+## Overview
 
-## BACKLOG.md contract
+Create or append `BACKLOG.md`, then `openspec validate` / `plan`. Do not deliver
+the item here.
 
-Canonical template: `presets/templates/BACKLOG.md` (or the installed copy).
-Required sections:
+## When to Use
 
-- `## Global` — Product, Strategy, Policy, Review required, TDD required
-- `## Items` — active entries
-- `## Archive` — completed entries (never re-execute; never rewrite)
+- `/cc-backlog`, first backlog in a repo, or appending `### BC-xxx` items
 
-Each item: `### BC-001 | Short title` with Priority (P0–P3), Status, Type,
-Depends on, Description, Scope, Out of scope, Acceptance (measurable checklist).
+**NOT** for executing an item (`openspec`) or for scorecards (`evaluation`).
 
-Status after grilling: `READY`. `openspec plan` then moves the item to `PLANNED`.
+## Process
 
-## Create vs append
+1. If `graphify-out/graph.json` exists, `graphify query "<objectives>"`. Then
+   `repo-explorer`. Scope names real files.
+2. Invoke `task-coach`. One grilling question per assumption. Reject vague
+   acceptance ("improve UX"). At most 3 `[NEEDS CLARIFICATION]`.
+3. `ccep evaluate --command backlog`. If `stop`, wait for the human.
+4. Create `BACKLOG.md` from `presets/templates/BACKLOG.md` or append under
+   `## Items`. Do not rewrite `## Global` or `## Archive`.
+5. Next ID = max numeric suffix in Items + Archive + 1, zero-padded (`BC-013`).
+6. `bun run dev openspec validate` (or `npx cc-codeconductor`). Fix until valid.
+7. `openspec plan BC-xxx` for each **new** item this run. Then tell the user
+   to run `/cc-openspec`.
 
-- **No `BACKLOG.md`:** create it from the template. Set Global `Product` from
-  `package.json` `name` when present.
-- **File exists:** append new `### BC-xxx` blocks under `## Items`. Do not
-  rewrite `## Global` or `## Archive`.
+Required sections: `## Global`, `## Items`, `## Archive`. Each item:
+`### BC-001 | Title` with Priority, Status (`READY` after grilling), Type,
+Depends on, Description, Scope, Out of scope, Acceptance.
 
-Next ID = max numeric suffix across Items and Archive, plus one, zero-padded
-to three digits (`BC-013` after `BC-012`).
+Local artifacts (`BACKLOG.md`, `openspec/`, `.codeconductor/openspec-state.json`)
+are gitignored in consumer projects. Do not `git add` them.
 
-## Wayfinding (before Scope)
+## Common Rationalizations
 
-If `graphify-out/graph.json` exists, run `graphify query "<objectives>"` (and
-`graphify path` / `graphify explain` when needed). Then invoke `repo-explorer`.
-Scope must name real files or modules. Do not write `BACKLOG.md` in this step.
+| Rationalization | Reality |
+| --- | --- |
+| This fix is small; skip the Task Card | Every item needs measurable acceptance. |
+| I'll validate later | Do not plan until `openspec validate` passes. |
+| Archive can be rewritten | Archive is history. Never rewrite or re-execute. |
 
-## Grilling (before write)
+## Red Flags
 
-Invoke `task-coach`. One grilling question per assumption. Reject vague
-acceptance ("improve UX", "fix bugs"). Criteria must be measurable (same rules
-as `openspec validate` / `VAGUE_ACCEPTANCE`).
+- Acceptance that cannot fail a check
+- Editing `openspec-state.json` by hand
+- Planning an invalid backlog
 
-Unresolved questions go in `questionsForUser`. Run `ccep evaluate --command
-backlog`. If `stop` is true, **STOP** and wait for the human.
+## Verification
 
-Do not write items until the gate passes.
-
-## Validate loop
-
-After writing:
-
-```bash
-npx cc-codeconductor openspec validate
-```
-
-Local CodeConductor dogfood: `bun run dev openspec validate`.
-
-If invalid: list errors and recommendations, show the canonical structure,
-fix the file, re-validate. Do not plan until valid.
-
-## Plan new items only
-
-For each **new** `BC-xxx` this run:
-
-```bash
-npx cc-codeconductor openspec plan BC-xxx
-```
-
-That writes `openspec/changes/<slug>/` (`proposal.md`, `design.md`, `tasks.md`,
-`specs/`). Then tell the user to run `/cc-openspec` (optionally with the ID).
-
-## Local artifacts — do not version
-
-In consumer projects these paths are gitignored (see `init`):
-
-- `BACKLOG.md`
-- `openspec/`
-- `.codeconductor/openspec-state.json`
-
-Do **not** `git add` them. Do not edit `openspec-state.json` by hand.
-
-## Delivery
-
-Format and state machine: skill `openspec`. Authoring is this skill.
+- [ ] `openspec validate` exit 0
+- [ ] New items have `FR`/`SC`-ready measurable acceptance
+- [ ] User pointed at `/cc-openspec` for delivery

package/presets/claude/skills/django-orm/SKILL.md

@@ -1,6 +1,5 @@
 ---
 id: django-orm
-version: 1.0.0
 name: Django ORM
 description: >
   Django ORM patterns for multi-tenant POS projects: efficient queries,

package/presets/claude/skills/django-testing/SKILL.md

@@ -1,6 +1,5 @@
 ---
 id: django-testing
-version: 1.0.0
 name: Django Testing
 description: >
   Testing patterns for multi-tenant Django POS projects using pytest-django,

package/presets/claude/skills/evaluation/SKILL.md

@@ -1,42 +1,65 @@
 ---
 name: evaluation
 description:
-  Agent scorecard criteria, outcome tracking, model profiles, and evaluation CLI.
-  Use when running /cc:scorecard or measuring deliverable quality.
+  Guides agents through scorecards, outcomes, model profiles, and eval suites.
+  Use when running /cc-scorecard or /cc:scorecard, measuring a deliverable, or
+  checking workflow gates with suite-run.
 ---
 
-# Evaluation Skill
+# Evaluation
 
-## Scorecard criteria (8 weighted)
+## Overview
 
-See `docs/agent-scorecard.md`. Pass threshold: weighted score >= 2.0, no criterion at 0.
+A scorecard measures the deliverable against eight weighted criteria. Spec
+quality checklists are reviewer-owned. "Seems right" is not a verdict.
 
-## CLI
+Pass threshold: weighted score >= 2.0 and no criterion at 0.
 
-```bash
-npx cc-codeconductor scorecard create --task BC-001 --from-diff
-npx cc-codeconductor scorecard record --task BC-001 --verdict PASS --score 2.5
-npx cc-codeconductor scorecard list
-npx cc-codeconductor scorecard aggregate
-npx cc-codeconductor scorecard models
-npx cc-codeconductor scorecard regression
-npx cc-codeconductor scorecard matrix
-npx cc-codeconductor scorecard compare-models
-npx cc-codeconductor scorecard prompt-diff 0.4.0 0.5.0 --agent architect
+## When to Use
+
+- After implement/review, before `openspec archive`
+- Comparing models or prompt versions
+- Proving the workflow tools still work (`suite-run`)
+
+**NOT** for rewriting specs (reviewer checklist) or for implementing code.
+
+## Process
+
+Local: `bun run dev`. Published: `npx cc-codeconductor`.
+
+```text
+scorecard create --task BC-001 --from-diff
+scorecard record --task BC-001 --verdict PASS --score 2.5
+scorecard list | aggregate | models | regression | matrix | compare-models
+scorecard prompt-diff 0.4.0 0.5.0 --agent architect
+scorecard experiment start --suite harness-v1
+scorecard suite-run --suite workflow-gates
+scorecard suite-run --suite hook-guardrails
+scorecard suite-run --suite scorecard-signals
 ```
 
-## Outcome tracking
+`openspec analyze` can auto-suggest `acceptance` / `tests` on `--from-diff`.
+Archive needs PASS when review is required.
 
-Append-only: `.codeconductor/evaluation/outcomes.jsonl`
+Outcomes append to `.codeconductor/evaluation/outcomes.jsonl`.
 
-Record after each phase (openspec) and after review gate with agent, model, verdict, optional cost/tokens.
+## Common Rationalizations
 
-## Execution profiles
+| Rationalization | Reality |
+| --- | --- |
+| I'll fill the scorecard by hand without a diff | Use `--from-diff` and runner evidence. |
+| Suites are optional toys | `suite-run` is the workflow tool that proves gates. |
+| Handmade TDD JSON is fine | The runner rejects it. |
 
-`.codeconductor/evaluation/execution-profile.yml` — `balanced`, `quality`, `economical`.
+## Red Flags
 
-Use `scorecard models` before OpenSpec execute loop to show phase → agent → model.
+- PASS with a criterion at 0
+- Archive without a recorded scorecard when review is required
+- Declaring the workflow ready without `suite-run` or `scorecard record`
 
-## Verdicts
+## Verification
 
-PASS / REVISE / REJECT — see scorecard calculator rules in docs.
+- [ ] Scorecard created from diff (or explicit scores)
+- [ ] Verdict PASS / REVISE / REJECT recorded
+- [ ] For process changes: `scorecard suite-run --suite hook-guardrails` (and
+      `workflow-gates` / `scorecard-signals` when those gates changed)

package/presets/claude/skills/jpa-postgres/SKILL.md

@@ -1,6 +1,5 @@
 ---
 id: jpa-postgres
-version: 1.0.0
 name: JPA + PostgreSQL
 description: >
   Provides expert knowledge of JPA entity design, relationship mapping, Flyway