cc-codeconductor 1.4.1 → 1.5.0

package/presets/cursor/commands/cc/tdd-cycle.md

@@ -68,6 +68,14 @@ runner) — do not hand-edit JSON under `.codeconductor/evidence/`.
 
 Do not advance phases until that evidence exists.
 
+### Receipt-Driven Development
+
+Run the verification runner with the matching `phase` (`red`, `green`, or
+`refactor`). It records an RDD receipt for the complete candidate. Before a
+handoff, phase transition, or final review, verify that receipt. A changed
+source, test, contract, lockfile, or runner configuration invalidates it and
+requires the affected phase to run again.
+
 ---
 
 ## Phase 1 — RED (Tester role)

package/presets/cursor/skills/android/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: android
-name: Android + Kotlin (Jetpack Compose & Media3)
+name: android
 description: >
   Provides expert knowledge for building modern native Android apps using Kotlin, Jetpack Compose, Material Design 3, MVI architecture, Hilt dependency injection, and Media3/ExoPlayer.
 

package/presets/cursor/skills/api-versioning/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: api-versioning
-name: API Versioning
+name: api-versioning
 description: >
   Provides expert knowledge for designing, implementing, and managing REST API
   versioning strategies with deprecation workflows.
@@ -39,6 +39,7 @@ quality:
   reviewed_by: codeconductor-core
   version: 0.1.0
 ---
+
 # API Versioning
 
 ## Versioning Strategies

package/presets/cursor/skills/astro/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: astro
-name: Astro
+name: astro
 description: >
   Provides expert knowledge for building Astro 5+ sites with Islands Architecture, Content Collections, TypeScript, and performance-first rendering strategies.
 

package/presets/cursor/skills/auth-token-inspector/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: auth-token-inspector
-name: Auth Token Inspector
+name: auth-token-inspector
 description: >
   Audits token storage mechanisms to prevent XSS-based JWT theft.
 user-invokable: true

package/presets/cursor/skills/code-review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: code-review
-name: Code Review
+name: code-review
 description: >
   Provides a structured framework for conducting thorough code reviews covering correctness, security, architecture alignment, performance, and technical debt.
 

package/presets/cursor/skills/django-orm/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: django-orm
-name: Django ORM
+name: django-orm
 description: >
   Django ORM patterns for multi-tenant POS projects: efficient queries,
   bulk operations, transactions, and multi-schema upload paths.
@@ -40,9 +40,8 @@ outputs:
 quality:
   reviewed_by: codeconductor-core
   version: 0.1.0
-paths:
-  - "**/*.py"
 ---
+
 ## When to Use
 
 - Writing or reviewing queryset code in any `apps/*/`
@@ -458,5 +457,4 @@ def on_order_save(sender, instance, created, **kwargs):
 - **Annotation examples**: `apps/pos/views.py` lines 59-75
 - **Exists usage**: `apps/catalog/views.py` line 112
 - **Upload paths**: `apps/catalog/models.py`
-- **Django ORM docs**:
-  <https://docs.djangoproject.com/en/5.2/topics/db/queries/>
+- **Django ORM docs**: https://docs.djangoproject.com/en/5.2/topics/db/queries/

package/presets/cursor/skills/django-testing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: django-testing
-name: Django Testing
+name: django-testing
 description: >
   Testing patterns for multi-tenant Django POS projects using pytest-django,
   RequestFactory, and mocks. No factories, no complex conftest.

package/presets/cursor/skills/django-uv/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: django-uv
-name: Django + UV
+name: django-uv
 description: >
   Provides expert knowledge for building Django 5+ projects with UV as the package manager, domain-driven app structure, ruff for linting, and pytest-django for testing.
 

package/presets/cursor/skills/drizzle-schema-architect/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: drizzle-schema-architect
-name: Drizzle Schema Architect
+name: drizzle-schema-architect
 description: >
   Generates strictly typed Drizzle ORM schemas for PostgreSQL with indexes, 
   foreign keys, and Zod schema deduction.

package/presets/cursor/skills/fastapi-pydantic-strict/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: fastapi-pydantic-strict
-name: FastAPI Pydantic Strict
+name: fastapi-pydantic-strict
 description: >
   Enforces Pydantic v2 strict models, asynchronous dependency generators, and uv environment setup.
 user-invokable: true

package/presets/cursor/skills/jpa-nplusone-detector/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: jpa-nplusone-detector
-name: JPA N+1 Query Detector
+name: jpa-nplusone-detector
 description: >
   Audits Hibernate database interactions to prevent N+1 query problems in JVM apps.
 user-invokable: true

package/presets/cursor/skills/jpa-postgres/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: jpa-postgres
-name: JPA + PostgreSQL
+name: jpa-postgres
 description: >
   Provides expert knowledge of JPA entity design, relationship mapping, Flyway
   migrations, and PostgreSQL-specific optimizations.
@@ -40,10 +40,8 @@ outputs:
 quality:
   reviewed_by: codeconductor-core
   version: 0.1.0
-paths:
-  - "**/*.kt"
-  - "**/*.java"
 ---
+
 # JPA + PostgreSQL
 
 ## Entity Design

package/presets/cursor/skills/livewire-alpine-bridge/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: livewire-alpine-bridge
-name: Livewire Alpine Bridge
+name: livewire-alpine-bridge
 description: >
   Schedules reactive frontend states cleanly using entangle directives in PHP and JS.
 user-invokable: true

package/presets/cursor/skills/nextjs-typescript/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: nextjs-typescript
-name: Next.js + TypeScript
+name: nextjs-typescript
 description: >
   Provides expert knowledge for building Next.js 15+ applications with the App Router, TypeScript, Server Components, Server Actions, and TanStack Query.
 

package/presets/cursor/skills/pagespeed-perf/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: pagespeed-perf
-name: PageSpeed Performance Audit
+name: pagespeed-perf
 description: >
   Web Performance Engineering — analyzes Core Web Vitals using the PageSpeed
   Insights API (PSI v5) and applies the 80/20 principle: identify the 20% of

package/presets/cursor/skills/python/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: python
-name: Python
+name: python
 description: >
   Python development best practices: clean code, patterns,
   type hints, decorators, context managers, and architecture.
@@ -39,9 +39,8 @@ outputs:
 quality:
   reviewed_by: codeconductor-core
   version: 0.1.0
-paths:
-  - "**/*.py"
 ---
+
 ## When to Use
 
 - Writing any Python code in the project
@@ -606,7 +605,7 @@ items = items_to_keep
 
 ## Resources
 
-- **PEP 8** — Style Guide: <https://peps.python.org/pep-0008/>
-- **PEP 484** — Type Hints: <https://peps.python.org/pep-0484/>
-- **Real Python**: <https://realpython.com/>
-- **Python Docs**: <https://docs.python.org/3/>
+- **PEP 8** — Style Guide: https://peps.python.org/pep-0008/
+- **PEP 484** — Type Hints: https://peps.python.org/pep-0484/
+- **Real Python**: https://realpython.com/
+- **Python Docs**: https://docs.python.org/3/

package/presets/cursor/skills/python-django-stack/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: python-django-stack
-name: Python Django Stack
+name: python-django-stack
 description: >
   Python and Django conventions for multi-tenant SaaS POS projects:
   views, services, naming, JSON APIs, PDFs, and cart patterns.

package/presets/cursor/skills/python-fastapi-stack/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: python-fastapi-stack
-name: Python FastAPI Stack
+name: python-fastapi-stack
 description: >
   FastAPI conventions for REST APIs: routers, Pydantic v2 schemas, dependency
   injection, error handling, pagination, and project structure.

package/presets/cursor/skills/security/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: security
-name: Security
+name: security
 description: >
   Provides expert knowledge for implementing and reviewing application security following OWASP Top 10 (2021), with stack-specific patterns for Spring Boot, Django, Next.js, and Astro.
 

package/presets/cursor/skills/seo-analytics-injector/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: seo-analytics-injector
-name: SEO Analytics Injector
+name: seo-analytics-injector
 description: >
   Verifies and injects Google Tag Manager (GTM), GA4 event triggers, and optimized meta tags.
 user-invokable: true

package/presets/cursor/skills/spring-auth-auditor/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: spring-auth-auditor
-name: Spring Auth Auditor
+name: spring-auth-auditor
 description: >
   Secures Spring Security filters, JWT validations, OAuth2 setups, and CORS/CSRF headers.
 user-invokable: true

package/presets/cursor/skills/spring-boot-feature/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: spring-boot-feature
-name: Spring Boot Feature Creation
+name: spring-boot-feature
 description: >
   Guides the creation of complete Spring Boot features following a structured,
   layer-by-layer workflow: entity, repository, service, controller, and tests.
@@ -43,10 +43,8 @@ outputs:
 quality:
   reviewed_by: codeconductor-core
   version: 0.1.0
-paths:
-  - "**/*.kt"
-  - "**/build.gradle.kts"
 ---
+
 # Spring Boot Feature Creation
 
 When asked to create a feature, follow these steps **in order**. Do not skip

package/presets/cursor/skills/spring-boot-kotlin/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: spring-boot-kotlin
-name: Spring Boot + Kotlin
+name: spring-boot-kotlin
 description: >
   Provides expert knowledge of Spring Boot conventions, Kotlin idioms, and MVC
   patterns for backend API development.

package/presets/cursor/skills/spring-boot-testing-strategy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: spring-boot-testing-strategy
-name: Spring Boot Testing Strategy
+name: spring-boot-testing-strategy
 description: >
   Provides expert knowledge of the testing pyramid, test design principles, MockK patterns, and integration testing conventions for Spring Boot + Kotlin projects.
 

package/presets/cursor/skills/sqlalchemy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: sqlalchemy
-name: SQLAlchemy
+name: sqlalchemy
 description: >
   SQLAlchemy 2.x patterns for async FastAPI projects: models, sessions, queries,
   bulk operations, transactions, and Alembic migrations.

package/presets/cursor/skills/tailwind-responsive-auditor/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: tailwind-responsive-auditor
-name: Tailwind Responsive Auditor
+name: tailwind-responsive-auditor
 description: >
   Audits Tailwind CSS usage ensuring mobile-first responsive utilities and clean classes.
 user-invokable: true

package/presets/cursor/skills/tdd-mutation-tester/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: tdd-mutation-tester
-name: TDD Mutation Tester
+name: tdd-mutation-tester
 description: >
   Performs simple mutation testing to verify test coverage and assertions.
 user-invokable: true

package/presets/gemini/GEMINI.md

@@ -35,4 +35,10 @@ intent to the right slash command.
 - Do not skip the Reviewer step for medium- or high-risk changes.
 - Do not store secrets in any file loaded by Gemini CLI.
 
+## Receipt integrity
+
+- For any implementation, test, review, handoff, or delivery decision, capture or verify the current RDD receipt with `bun run dev rdd`.
+- A receipt is valid only for its exact candidate. If code, tests, contracts, or runner configuration changed, repeat the affected verification.
+- TDD and Mutation Testing retain their existing gates; RDD verifies that their observed evidence still belongs to the current candidate.
+
 <!-- CODECONDUCTOR:END managed -->

package/presets/gemini/commands/cc/handoff.toml

@@ -28,7 +28,9 @@ errors instead of pasting dumps. If unresolved credential material remains, stop
 and wait for a human (CCEP `stopOnHighRisk`).
 
 Include: goal, Task Card status (no secret fields), files touched, test
-pass/fail (not log dumps), open questions, and the next `/cc:` command.
+pass/fail (not log dumps), open questions, the next `/cc:` command, plus links
+to the Delivery Ledger and verification evidence when they exist. Do not repeat
+the original request or transcript.
 
 Do not edit source or tests.
 

package/presets/gemini/commands/cc/odd.toml

@@ -0,0 +1,20 @@
+description = "Create or resume an opt-in Delivery Ledger for substantial authorized work."
+
+prompt = """
+# /cc:odd
+
+## Step 0 — CCEP Bootstrap
+
+```bash
+bun run dev ccep parse --command odd "{{args}}"
+bun run dev ccep resolve --command odd "{{args}}"
+bun run dev ccep profile --command odd
+```
+
+Create a ledger only after authorization and tracked coordination. Read-only and small work do not create state.
+
+When ODD has verification evidence, include its RDD receipt in the ledger
+handoff. On resume, verify it against the workspace before relying on a prior
+test or review result. If it is stale, keep the ledger and repeat only the
+invalidated verification.
+"""

package/presets/gemini/commands/cc/openspec.toml

@@ -132,6 +132,10 @@ npx cc-codeconductor openspec archive <itemId>
 
 `start` moves the card `pending → doing` and the item `PLANNED → IN_PROGRESS`. `done` marks the card complete, updates Progress, and moves the item to `REVIEW` when every card is done and review is required. `archive` requires all cards done (and review evidence when Global review is required) and moves `openspec/changes/<slug>` to `archive/`.
 
+For test and implementation cards, `done` also requires a current RDD-backed
+RED or GREEN receipt respectively. Do not reuse evidence after candidate files
+change; capture and verify the matching receipt again.
+
 ---
 
 ## Step 5 — Model matrix and execute loop
@@ -204,5 +208,5 @@ Report completion: Task Cards executed, scorecard verdict, change folder path, f
 
 ## Skill
 
-Apply `.claude/skills/openspec/SKILL.md` for backlog format rules and state transitions.
+Apply `.gemini/skills/openspec/SKILL.md` for backlog format rules and state transitions.
 """

package/presets/gemini/commands/cc/pagespeed.toml

@@ -66,9 +66,8 @@ the following steps in order:
    the output filename: `{YYYY-MM-DD}_pagespeed-{hostname}-claude.md`.
 
 2. **Collect** — Call the PageSpeed Insights API for the requested strategy
-   (`mobile`, `desktop`, or `both`). Prefer the Bun scripts in
-   `~/.claude/skills/pagespeed-perf/scripts/run.ts` if Bun is available.
-   Otherwise, use `WebFetch` to call the PSI endpoint directly.
+   (`mobile`, `desktop`, or `both`) using `WebFetch` to call the PSI endpoint
+   directly.
 
 3. **Analyze** — Extract Core Web Vitals (LCP, INP, CLS, FCP, TTFB, TBT),
    identify the LCP element, enumerate third-party scripts by blocking time,

package/presets/gemini/commands/cc/review.toml

@@ -110,6 +110,37 @@ Evaluate the diff against the following checklist:
 
 ---
 
+## Severity Rubric
+
+Classify every finding using these concrete anchors — not general judgment —
+so the same finding gets the same category on any run.
+
+**CRITICAL** (always):
+
+- Unauthenticated access to a protected resource
+- Injection (SQL, command, XSS) reachable from untrusted input
+- A secret or credential present in the diff
+- A destructive operation with no confirmation
+- The build or test suite is broken
+- A direct contradiction of an explicit acceptance criterion
+
+**WARNING**:
+
+- Missing test for a new branch or edge case
+- An error is silently swallowed — no log, no propagation
+- A change outside the declared scope
+- Inconsistent with an established pattern already in the module
+- Missing input validation in an internal function (not exposed at a trust boundary)
+
+**SUGGESTION**:
+
+- Style or naming
+- Minor readability
+- Speculative refactor that wasn't requested
+- Non-blocking micro-optimization
+
+---
+
 ## Step 3 — Review Report
 
 Produce a structured Review Report with findings in three categories:

package/presets/gemini/commands/cc/security.toml

@@ -59,7 +59,7 @@ If `graphify-out/graph.json` exists, run `graphify query "{{args}}"` (and
 `graphify path` / `graphify explain` when needed). Then invoke `repo-explorer`
 to map modules, conventions, and impact radius. Do not write code in this step.
 Record a Repo Map artifact before intake. Load the matching `security-*` skill
-for the named domain (see `.claude/skills/security-*/SKILL.md`). Keep the OWASP
+for the named domain (see `.gemini/skills/security-*/SKILL.md`). Keep the OWASP
 `security` skill for application-security reviews.
 
 ---

package/presets/gemini/commands/cc/spec-mutation.toml

@@ -125,6 +125,11 @@ Verdict is binary: PASS continues to the mutation gate; REJECT returns to the
 
 ## Stage 5 — Mutation gate (`mutation_testing`)
 
+RDD complements this gate: capture the candidate receipt before Mutation Testing
+and verify it after the runner restores production source. A survivor opens a
+new tester/reviewer-approved test revision; it never makes an earlier receipt
+valid again.
+
 Run the deterministic AST mutator shipped with this preset:
 
 ```bash

package/presets/gemini/commands/cc/tdd-cycle.toml

@@ -64,6 +64,14 @@ runner) — do not hand-edit JSON under `.codeconductor/evidence/`.
 
 Do not advance phases until that evidence exists.
 
+### Receipt-Driven Development
+
+Run the verification runner with the matching `phase` (`red`, `green`, or
+`refactor`). It records an RDD receipt for the complete candidate. Before a
+handoff, phase transition, or final review, verify that receipt. A changed
+source, test, contract, lockfile, or runner configuration invalidates it and
+requires the affected phase to run again.
+
 ---
 
 ## Phase 1 — RED (Tester role)