cc-codeconductor 1.4.1 → 1.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (219) hide show
  1. package/README.md +61 -13
  2. package/dist/core/verification/rdd-receipt.d.ts +39 -0
  3. package/dist/core/verification/verification-runner.d.ts +8 -2
  4. package/dist/index.d.ts +2 -0
  5. package/dist/index.js +1257 -330
  6. package/dist/library.js +267 -26
  7. package/dist/validation/schemas.d.ts +521 -26
  8. package/docs/generated/cli.md +20 -0
  9. package/package.json +1 -1
  10. package/presets/agy/AGENTS.md +6 -0
  11. package/presets/agy/README.md +1 -1
  12. package/presets/agy/hooks.json +1 -1
  13. package/presets/agy/scripts/invoke-hook.cjs +20 -5
  14. package/presets/agy/settings.json +1 -1
  15. package/presets/agy/skills/api-versioning/SKILL.md +394 -0
  16. package/presets/agy/skills/astro/SKILL.md +318 -0
  17. package/presets/agy/skills/auth-token-inspector/SKILL.md +30 -0
  18. package/presets/agy/skills/cc-pagespeed/SKILL.md +2 -3
  19. package/presets/agy/skills/code-review/SKILL.md +207 -0
  20. package/presets/agy/skills/django-orm/SKILL.md +460 -0
  21. package/presets/agy/skills/django-uv/SKILL.md +405 -0
  22. package/presets/agy/skills/drizzle-schema-architect/SKILL.md +50 -0
  23. package/presets/agy/skills/fastapi-pydantic-strict/SKILL.md +43 -0
  24. package/presets/agy/skills/jpa-nplusone-detector/SKILL.md +45 -0
  25. package/presets/agy/skills/jpa-postgres/SKILL.md +623 -0
  26. package/presets/agy/skills/livewire-alpine-bridge/SKILL.md +35 -0
  27. package/presets/agy/skills/nextjs-typescript/SKILL.md +390 -0
  28. package/presets/agy/skills/python/SKILL.md +611 -0
  29. package/presets/agy/skills/seo-analytics-injector/SKILL.md +43 -0
  30. package/presets/agy/skills/spring-auth-auditor/SKILL.md +29 -0
  31. package/presets/agy/skills/spring-boot-feature/SKILL.md +563 -0
  32. package/presets/agy/skills/spring-boot-testing-strategy/SKILL.md +475 -0
  33. package/presets/agy/skills/tailwind-responsive-auditor/SKILL.md +29 -0
  34. package/presets/agy/skills/tdd-mutation-tester/SKILL.md +27 -0
  35. package/presets/agy/workflows/cc-handoff.md +2 -1
  36. package/presets/agy/workflows/cc-odd.md +15 -0
  37. package/presets/agy/workflows/cc-pagespeed.md +2 -3
  38. package/presets/agy/workflows/cc-review.md +31 -0
  39. package/presets/agy/workflows/cc-security.md +1 -1
  40. package/presets/claude/CLAUDE.md +6 -0
  41. package/presets/claude/commands/cc/handoff.md +2 -1
  42. package/presets/claude/commands/cc/odd.md +15 -0
  43. package/presets/claude/commands/cc/review.md +33 -0
  44. package/presets/claude/settings.json +2 -2
  45. package/presets/claude/skills/android/SKILL.md +1 -1
  46. package/presets/claude/skills/api-versioning/SKILL.md +1 -1
  47. package/presets/claude/skills/astro/SKILL.md +318 -0
  48. package/presets/claude/skills/auth-token-inspector/SKILL.md +30 -0
  49. package/presets/claude/skills/code-review/SKILL.md +207 -0
  50. package/presets/claude/skills/django-orm/SKILL.md +1 -1
  51. package/presets/claude/skills/django-testing/SKILL.md +1 -1
  52. package/presets/claude/skills/django-uv/SKILL.md +405 -0
  53. package/presets/claude/skills/drizzle-schema-architect/SKILL.md +50 -0
  54. package/presets/claude/skills/fastapi-pydantic-strict/SKILL.md +43 -0
  55. package/presets/claude/skills/jpa-nplusone-detector/SKILL.md +45 -0
  56. package/presets/claude/skills/jpa-postgres/SKILL.md +1 -1
  57. package/presets/claude/skills/livewire-alpine-bridge/SKILL.md +35 -0
  58. package/presets/claude/skills/nextjs-typescript/SKILL.md +390 -0
  59. package/presets/claude/skills/pagespeed-perf/SKILL.md +1 -1
  60. package/presets/claude/skills/python/SKILL.md +1 -1
  61. package/presets/claude/skills/python-django-stack/SKILL.md +1 -1
  62. package/presets/claude/skills/python-fastapi-stack/SKILL.md +1 -1
  63. package/presets/claude/skills/security/SKILL.md +1 -1
  64. package/presets/claude/skills/seo-analytics-injector/SKILL.md +43 -0
  65. package/presets/claude/skills/spring-auth-auditor/SKILL.md +29 -0
  66. package/presets/claude/skills/spring-boot-feature/SKILL.md +1 -1
  67. package/presets/claude/skills/spring-boot-kotlin/SKILL.md +1 -1
  68. package/presets/claude/skills/spring-boot-testing-strategy/SKILL.md +475 -0
  69. package/presets/claude/skills/sqlalchemy/SKILL.md +1 -1
  70. package/presets/claude/skills/tailwind-responsive-auditor/SKILL.md +29 -0
  71. package/presets/claude/skills/tdd-mutation-tester/SKILL.md +27 -0
  72. package/presets/claude/skills/testing-strategy/SKILL.md +1 -1
  73. package/presets/codex/AGENTS.md +6 -0
  74. package/presets/codex/skills/android/SKILL.md +1 -1
  75. package/presets/codex/skills/api-versioning/SKILL.md +1 -1
  76. package/presets/codex/skills/astro/SKILL.md +318 -0
  77. package/presets/codex/skills/auth-token-inspector/SKILL.md +30 -0
  78. package/presets/codex/skills/cc-handoff/SKILL.md +3 -1
  79. package/presets/codex/skills/cc-odd/SKILL.md +25 -0
  80. package/presets/codex/skills/cc-openspec/SKILL.md +5 -1
  81. package/presets/codex/skills/cc-pagespeed/SKILL.md +2 -3
  82. package/presets/codex/skills/cc-review/SKILL.md +31 -0
  83. package/presets/codex/skills/cc-security/SKILL.md +1 -1
  84. package/presets/codex/skills/cc-spec-mutation/SKILL.md +5 -0
  85. package/presets/codex/skills/cc-tdd-cycle/SKILL.md +8 -0
  86. package/presets/codex/skills/code-review/SKILL.md +207 -0
  87. package/presets/codex/skills/django-orm/SKILL.md +1 -1
  88. package/presets/codex/skills/django-testing/SKILL.md +1 -1
  89. package/presets/codex/skills/django-uv/SKILL.md +405 -0
  90. package/presets/codex/skills/drizzle-schema-architect/SKILL.md +50 -0
  91. package/presets/codex/skills/fastapi-pydantic-strict/SKILL.md +43 -0
  92. package/presets/codex/skills/jpa-nplusone-detector/SKILL.md +45 -0
  93. package/presets/codex/skills/jpa-postgres/SKILL.md +1 -1
  94. package/presets/codex/skills/livewire-alpine-bridge/SKILL.md +35 -0
  95. package/presets/codex/skills/nextjs-typescript/SKILL.md +390 -0
  96. package/presets/codex/skills/pagespeed-perf/SKILL.md +1 -1
  97. package/presets/codex/skills/python/SKILL.md +1 -1
  98. package/presets/codex/skills/python-django-stack/SKILL.md +1 -1
  99. package/presets/codex/skills/python-fastapi-stack/SKILL.md +1 -1
  100. package/presets/codex/skills/security-ai-llm/SKILL.md +43 -0
  101. package/presets/codex/skills/security-blue-team/SKILL.md +43 -0
  102. package/presets/codex/skills/security-cloud/SKILL.md +43 -0
  103. package/presets/codex/skills/security-crypto/SKILL.md +43 -0
  104. package/presets/codex/skills/security-exploit-dev/SKILL.md +45 -0
  105. package/presets/codex/skills/security-grc/SKILL.md +43 -0
  106. package/presets/codex/skills/security-incident-response/SKILL.md +45 -0
  107. package/presets/codex/skills/security-log-analysis/SKILL.md +43 -0
  108. package/presets/codex/skills/security-malware-analysis/SKILL.md +44 -0
  109. package/presets/codex/skills/security-mobile/SKILL.md +43 -0
  110. package/presets/codex/skills/security-network/SKILL.md +43 -0
  111. package/presets/codex/skills/security-ot-ics/SKILL.md +43 -0
  112. package/presets/codex/skills/security-recon/SKILL.md +45 -0
  113. package/presets/codex/skills/security-red-team/SKILL.md +44 -0
  114. package/presets/codex/skills/security-reverse-engineering/SKILL.md +44 -0
  115. package/presets/codex/skills/security-soc-automation/SKILL.md +43 -0
  116. package/presets/codex/skills/security-threat-hunting/SKILL.md +43 -0
  117. package/presets/codex/skills/security-vuln-assessment/SKILL.md +45 -0
  118. package/presets/codex/skills/security-web/SKILL.md +44 -0
  119. package/presets/codex/skills/seo-analytics-injector/SKILL.md +43 -0
  120. package/presets/codex/skills/spring-auth-auditor/SKILL.md +29 -0
  121. package/presets/codex/skills/spring-boot-feature/SKILL.md +2 -2
  122. package/presets/codex/skills/spring-boot-kotlin/SKILL.md +1 -1
  123. package/presets/codex/skills/spring-boot-testing-strategy/SKILL.md +475 -0
  124. package/presets/codex/skills/sqlalchemy/SKILL.md +1 -1
  125. package/presets/codex/skills/tailwind-responsive-auditor/SKILL.md +29 -0
  126. package/presets/codex/skills/tdd-mutation-tester/SKILL.md +27 -0
  127. package/presets/codex/skills/testing-strategy/SKILL.md +1 -1
  128. package/presets/cursor/AGENTS.md +6 -0
  129. package/presets/cursor/commands/cc/handoff.md +3 -1
  130. package/presets/cursor/commands/cc/odd.md +20 -0
  131. package/presets/cursor/commands/cc/openspec.md +5 -1
  132. package/presets/cursor/commands/cc/pagespeed.md +2 -3
  133. package/presets/cursor/commands/cc/review.md +31 -0
  134. package/presets/cursor/commands/cc/security.md +1 -1
  135. package/presets/cursor/commands/cc/spec-mutation.md +5 -0
  136. package/presets/cursor/commands/cc/tdd-cycle.md +8 -0
  137. package/presets/cursor/skills/android/SKILL.md +1 -1
  138. package/presets/cursor/skills/api-versioning/SKILL.md +2 -1
  139. package/presets/cursor/skills/astro/SKILL.md +1 -1
  140. package/presets/cursor/skills/auth-token-inspector/SKILL.md +1 -1
  141. package/presets/cursor/skills/code-review/SKILL.md +1 -1
  142. package/presets/cursor/skills/django-orm/SKILL.md +3 -5
  143. package/presets/cursor/skills/django-testing/SKILL.md +1 -1
  144. package/presets/cursor/skills/django-uv/SKILL.md +1 -1
  145. package/presets/cursor/skills/drizzle-schema-architect/SKILL.md +1 -1
  146. package/presets/cursor/skills/fastapi-pydantic-strict/SKILL.md +1 -1
  147. package/presets/cursor/skills/jpa-nplusone-detector/SKILL.md +1 -1
  148. package/presets/cursor/skills/jpa-postgres/SKILL.md +2 -4
  149. package/presets/cursor/skills/livewire-alpine-bridge/SKILL.md +1 -1
  150. package/presets/cursor/skills/nextjs-typescript/SKILL.md +1 -1
  151. package/presets/cursor/skills/pagespeed-perf/SKILL.md +1 -1
  152. package/presets/cursor/skills/python/SKILL.md +6 -7
  153. package/presets/cursor/skills/python-django-stack/SKILL.md +1 -1
  154. package/presets/cursor/skills/python-fastapi-stack/SKILL.md +1 -1
  155. package/presets/cursor/skills/security/SKILL.md +1 -1
  156. package/presets/cursor/skills/seo-analytics-injector/SKILL.md +1 -1
  157. package/presets/cursor/skills/spring-auth-auditor/SKILL.md +1 -1
  158. package/presets/cursor/skills/spring-boot-feature/SKILL.md +2 -4
  159. package/presets/cursor/skills/spring-boot-kotlin/SKILL.md +1 -1
  160. package/presets/cursor/skills/spring-boot-testing-strategy/SKILL.md +1 -1
  161. package/presets/cursor/skills/sqlalchemy/SKILL.md +1 -1
  162. package/presets/cursor/skills/tailwind-responsive-auditor/SKILL.md +1 -1
  163. package/presets/cursor/skills/tdd-mutation-tester/SKILL.md +1 -1
  164. package/presets/gemini/GEMINI.md +6 -0
  165. package/presets/gemini/commands/cc/handoff.toml +3 -1
  166. package/presets/gemini/commands/cc/odd.toml +20 -0
  167. package/presets/gemini/commands/cc/openspec.toml +5 -1
  168. package/presets/gemini/commands/cc/pagespeed.toml +2 -3
  169. package/presets/gemini/commands/cc/review.toml +31 -0
  170. package/presets/gemini/commands/cc/security.toml +1 -1
  171. package/presets/gemini/commands/cc/spec-mutation.toml +5 -0
  172. package/presets/gemini/commands/cc/tdd-cycle.toml +8 -0
  173. package/presets/opencode/README.md +45 -52
  174. package/presets/opencode/agents/implementer.md +2 -0
  175. package/presets/opencode/agents/reviewer.md +2 -0
  176. package/presets/opencode/agents/tester.md +2 -0
  177. package/presets/opencode/commands/cc-handoff.md +2 -1
  178. package/presets/opencode/commands/cc-odd.md +15 -0
  179. package/presets/opencode/commands/cc-pagespeed.md +2 -3
  180. package/presets/opencode/commands/cc-review.md +31 -0
  181. package/presets/opencode/commands/cc-security.md +1 -1
  182. package/presets/opencode/opencode.jsonc +1 -1
  183. package/presets/opencode/skills/android/SKILL.md +1 -1
  184. package/presets/opencode/skills/api-versioning/SKILL.md +2 -1
  185. package/presets/opencode/skills/astro/SKILL.md +1 -1
  186. package/presets/opencode/skills/auth-token-inspector/SKILL.md +1 -1
  187. package/presets/opencode/skills/code-review/SKILL.md +1 -1
  188. package/presets/opencode/skills/django-orm/SKILL.md +3 -3
  189. package/presets/opencode/skills/django-testing/SKILL.md +1 -1
  190. package/presets/opencode/skills/django-uv/SKILL.md +1 -1
  191. package/presets/opencode/skills/drizzle-schema-architect/SKILL.md +1 -1
  192. package/presets/opencode/skills/fastapi-pydantic-strict/SKILL.md +1 -1
  193. package/presets/opencode/skills/jpa-nplusone-detector/SKILL.md +1 -1
  194. package/presets/opencode/skills/jpa-postgres/SKILL.md +2 -1
  195. package/presets/opencode/skills/livewire-alpine-bridge/SKILL.md +1 -1
  196. package/presets/opencode/skills/nextjs-typescript/SKILL.md +1 -1
  197. package/presets/opencode/skills/pagespeed-perf/SKILL.md +1 -1
  198. package/presets/opencode/skills/python/SKILL.md +6 -5
  199. package/presets/opencode/skills/python-django-stack/SKILL.md +1 -1
  200. package/presets/opencode/skills/python-fastapi-stack/SKILL.md +1 -1
  201. package/presets/opencode/skills/security/SKILL.md +1 -1
  202. package/presets/opencode/skills/seo-analytics-injector/SKILL.md +1 -1
  203. package/presets/opencode/skills/spring-auth-auditor/SKILL.md +1 -1
  204. package/presets/opencode/skills/spring-boot-feature/SKILL.md +2 -1
  205. package/presets/opencode/skills/spring-boot-kotlin/SKILL.md +1 -1
  206. package/presets/opencode/skills/spring-boot-testing-strategy/SKILL.md +1 -1
  207. package/presets/opencode/skills/sqlalchemy/SKILL.md +1 -1
  208. package/presets/opencode/skills/tailwind-responsive-auditor/SKILL.md +1 -1
  209. package/presets/opencode/skills/tdd-mutation-tester/SKILL.md +1 -1
  210. package/presets/pi/AGENTS.md +6 -0
  211. package/presets/seo-hotel/skills/astro-seo/SKILL.md +1 -1
  212. package/presets/seo-hotel/skills/geo-readiness/SKILL.md +1 -1
  213. package/presets/seo-hotel/skills/off-page/SKILL.md +1 -1
  214. package/presets/seo-hotel/skills/schema-validator/SKILL.md +1 -1
  215. package/presets/seo-hotel/skills/seo-audit/SKILL.md +1 -1
  216. package/presets/shared/invoke-hook.cjs +20 -5
  217. package/src/presets/models/roles.yml +28 -28
  218. package/src/presets/shared-skills.yml +58 -22
  219. package/src/presets/targets/pi.yml +1 -0
@@ -2,8 +2,8 @@
2
2
 
3
3
  ## Model Selection Guide
4
4
 
5
- This preset supports both **Claude (Anthropic)** and **OpenCode Go (Chinese
6
- providers)** models.
5
+ This preset uses the four requested **OpenCode Go** models. Claude (Anthropic)
6
+ can be selected as an explicit override.
7
7
 
8
8
  ---
9
9
 
@@ -13,37 +13,39 @@ providers)** models.
13
13
 
14
14
  | Model | Strength | Best For |
15
15
  | --------------------------- | ------------------------------- | ------------------------------- |
16
- | `claude-opus-4-7` | Complex reasoning, architecture | Architect, complex design |
17
- | `claude-sonnet-4-6` | Balanced, general purpose | Default for most agents |
16
+ | `claude-opus-5` | Complex reasoning, architecture | Architect, complex design |
17
+ | `claude-sonnet-5` | Balanced, general purpose | Implementation, testing |
18
18
  | `claude-haiku-4-5-20251001` | Fast, lightweight | Task Coach, Docs, Repo Explorer |
19
19
 
20
20
  ### OpenCode Go models
21
21
 
22
- Canonical slugs live in `src/presets/models/*.yml`. Production roles never use
23
- `muse-spark-1.2-contributor` (trains on prompts). `ox-alpha-free` is an optional
24
- fallback, not a default.
22
+ Canonical role assignments live in `src/presets/models/roles.yml`. Model IDs
23
+ were verified against [OpenCode Go](https://opencode.ai/docs/go/) and the live
24
+ catalog on September 25, 2026.
25
25
 
26
26
  | Model | Best for |
27
27
  | --- | --- |
28
- | `deepseek-v4-pro` | Architect |
29
- | `kimi-k3` | Security reviewer |
30
- | `qwen3.8-max` | Reviewer, contract-builder |
31
- | `glm-5.3` | Devil, complexity-auditor |
32
- | `mimo-v2.5` | Implementer |
33
- | `minimax-m3` | Tester |
34
- | `qwen3.7-plus` | Orchestrator (TUI default) |
35
- | `gpt-5.6-luna` | Task coach, planner |
36
- | `deepseek-v4-flash` | Goal planner |
37
- | `longcat-2.0` | Repo explorer |
38
- | `hy3` | Docs |
28
+ | `opencode-go/deepseek-v4.1-flash` | Architect, reviewer, contract-builder, orchestrator (TUI default), planner, goal-planner |
29
+ | `opencode-go/mimo-v2.6-flash` | Implementer, tester |
30
+ | `opencode-go/glm-5.3-flash` | Security-reviewer, devil, complexity-auditor, task-coach, repo-explorer |
31
+ | `opencode-go/muse-spark-1.3-contributor` | Docs |
32
+
33
+ These assignments are workflow choices, not a provider ranking. Generated
34
+ agents leave sampling and reasoning settings at provider defaults rather than
35
+ copying Claude-specific `effort` or forcing a shared `temperature` onto different
36
+ models. No unverified variants are configured.
37
+
38
+ Muse Contributor is included at the request of the maintainer. OpenCode documents
39
+ that it uses prompts/completions for training, is not ZDR, and has regional
40
+ restrictions. Do not send confidential material to that model; override the docs
41
+ agent with another verified model when required.
39
42
 
40
43
  ---
41
44
 
42
45
  ## Agent Model Matrix
43
46
 
44
- See `skills/cc-update-preset-models/references/role-map.md`. OpenCode column
45
- examples: architect `deepseek-v4-pro`, implementer `mimo-v2.5`, tester
46
- `minimax-m3`, reviewer `qwen3.8-max`.
47
+ See `skills/cc-update-preset-models/references/role-map.md` for the complete
48
+ cross-preset role matrix.
47
49
 
48
50
  ---
49
51
 
@@ -66,6 +68,10 @@ examples: architect `deepseek-v4-pro`, implementer `mimo-v2.5`, tester
66
68
 
67
69
  This preset uses OpenCode's permission system (v1.1.1+) with granular control:
68
70
 
71
+ Keep the V1-compatible `permission` dictionary for the `opencode` CLI. V2's
72
+ `permissions` rule list is exclusive to `opencode2` and is rejected by OpenCode
73
+ V1. Validate generated files with the actual CLI version before migrating formats.
74
+
69
75
  - **Global defaults**: Most operations require approval (`ask`)
70
76
  - **Read access**: Allowed by default, with sensitive files denied
71
77
  - **Write/Edit**: Requires approval, with protected paths denied
@@ -87,8 +93,8 @@ The following paths are denied by default:
87
93
 
88
94
  ### Simple Tasks (Q&A, intake, documentation)
89
95
 
90
- **Recommended:** `qwen3.6-plus` (OpenCode Go) or `claude-haiku-4-5-20251001`
91
- (Claude)
96
+ **Preset choice:** `glm-5.3-flash` for intake/exploration;
97
+ `muse-spark-1.3-contributor` for non-confidential docs.
92
98
 
93
99
  - Task Coach intake
94
100
  - Repo Explorer mapping
@@ -96,8 +102,8 @@ The following paths are denied by default:
96
102
 
97
103
  ### Medium Tasks (Implementation, testing)
98
104
 
99
- **Recommended:** `mimo-v2.5` or `minimax-m3` (OpenCode Go) or
100
- `claude-sonnet-4-6` (Claude)
105
+ **Preset choice:** `mimo-v2.6-flash` for implementation and testing;
106
+ `deepseek-v4.1-flash` for reviews.
101
107
 
102
108
  - Implementer code writing
103
109
  - Tester test generation
@@ -105,7 +111,8 @@ The following paths are denied by default:
105
111
 
106
112
  ### Complex Tasks (Architecture, security, multi-agent coordination)
107
113
 
108
- **Recommended:** `deepseek-v4-pro` (OpenCode Go) or `claude-opus-4-7` (Claude)
114
+ **Preset choice:** `deepseek-v4.1-flash` for design/coordination;
115
+ `glm-5.3-flash` for defensive security review.
109
116
 
110
117
  - Architect technical design
111
118
  - Orchestrator routing decisions
@@ -115,17 +122,14 @@ The following paths are denied by default:
115
122
 
116
123
  ## Usage in Agent Contracts
117
124
 
118
- Each agent file in `agents/` contains a model selection table in its
119
- frontmatter:
125
+ Agent templates contain placeholders. Installation resolves the role model
126
+ into YAML frontmatter:
120
127
 
121
128
  ```yaml
122
129
  ---
123
130
  description: ...
124
- # Model Selection
125
- | Provider | Model | Use Case |
126
- |----------|-------|----------|
127
- | Claude | claude-opus-4-7 | Complex architecture, ADRs |
128
- | OpenCode Go | deepseek-v4-pro | Best — excels at reasoning |
131
+ model: opencode-go/deepseek-v4.1-flash
132
+ mode: subagent
129
133
  ---
130
134
  ```
131
135
 
@@ -144,21 +148,10 @@ configuration in `opencode.jsonc`.
144
148
 
145
149
  ## Environment Variables
146
150
 
147
- OpenCode Go requires appropriate API keys. Set these in your environment:
148
-
149
- ```bash
150
- # DeepSeek
151
- export DEEPSEEK_API_KEY="your-key"
152
-
153
- # Qwen (Alibaba)
154
- export DASHSCOPE_API_KEY="your-key"
155
-
156
- # MiniMax
157
- export MINIMAX_API_KEY="your-key"
158
-
159
- # Kimi (Moonshot)
160
- export KIMI_API_KEY="your-key"
161
- ```
151
+ Connect to **OpenCode Go** through `/connect` and use the Go API key. The
152
+ `opencode-go/` provider does not use individual DeepSeek, GLM, MiMo, or Meta keys.
153
+ Do not store API keys in the preset. Run `opencode models opencode-go` to check
154
+ availability before using or overriding a role model.
162
155
 
163
156
  ---
164
157
 
@@ -166,10 +159,10 @@ export KIMI_API_KEY="your-key"
166
159
 
167
160
  | Scenario | Recommended |
168
161
  | ------------------------------- | -------------------------------------------------- |
169
- | Complex reasoning, architecture | OpenCode Go (`deepseek-v4-pro`) or Claude (`opus`) |
170
- | Fast iteration, simple tasks | OpenCode Go (`qwen3.6-plus`) or Claude (`haiku`) |
171
- | Code implementation | OpenCode Go (`mimo-v2.5`) or Claude (`sonnet`) |
172
- | Budget constraints | OpenCode Go (generally lower cost) |
162
+ | Complex reasoning, architecture | OpenCode Go (`deepseek-v4.1-flash`) or Claude (`opus`) |
163
+ | Fast iteration, simple tasks | OpenCode Go (`glm-5.3-flash`) or Claude (`haiku`) |
164
+ | Code implementation | OpenCode Go (`mimo-v2.6-flash`) or Claude (`sonnet`) |
165
+ | Non-confidential documentation | OpenCode Go (`muse-spark-1.3-contributor`) |
173
166
  | Availability issues | Switch to alternative from the matrix |
174
167
 
175
168
  ## Approach
@@ -222,3 +222,5 @@ Invoke via `/cc-feature`, `/cc-fix`, `/cc-tdd-cycle`, or the orchestrator.
222
222
  Do not invoke other agents. Invoke skill `testing-tdd`.
223
223
  Deliverable is incomplete without a passing suite and runner TDD evidence when
224
224
  TDD is required. Scorecard: `bun run dev scorecard create --from-diff`.
225
+ Before handing work to review or delivery, verify the current RDD receipt. Do
226
+ not rely on a test result if its candidate has changed.
@@ -288,3 +288,5 @@ Invoke skill `evaluation` and run `scorecard record` with agent `reviewer`, mode
288
288
  Invoke via `/cc-review` or the orchestrator. Do not invoke other agents.
289
289
  Invoke skill `evaluation`. Deliverable is incomplete without
290
290
  `scorecard create --from-diff` and a recorded PASS|REVISE|REJECT.
291
+ An approval applies only to the RDD candidate receipt supplied with the review;
292
+ request a fresh verification when it is stale.
@@ -291,3 +291,5 @@ and confirmed failing; list the failing test paths in `artifacts` so the
291
291
  Invoke via `/cc-tdd-cycle`, `/cc-feature`, or the orchestrator (test before
292
292
  implement). Do not invoke other agents. Invoke skill `testing-tdd`.
293
293
  Deliverable is incomplete without `captureTddSuiteEvidence` when TDD is required.
294
+ Record the matching RDD receipt and report it with the test evidence. A changed
295
+ candidate requires a new verification before handoff.
@@ -31,7 +31,8 @@ and wait for a human (CCEP `stopOnHighRisk`).
31
31
  Include: goal, Task Card status (no secret fields), files touched, test
32
32
  pass/fail (not log dumps), open questions, and the next `/cc-` command.
33
33
 
34
- Do not edit source or tests.
34
+ Link the Delivery Ledger and verification evidence when they exist; do not
35
+ repeat the original request or transcript. Do not edit source or tests.
35
36
 
36
37
  ---
37
38
 
@@ -0,0 +1,15 @@
1
+ ---
2
+ description: Create or resume an opt-in Delivery Ledger for substantial authorized work.
3
+ ---
4
+
5
+ # /cc-odd
6
+
7
+ ## Step 0 — CCEP Bootstrap
8
+
9
+ ```bash
10
+ bun run dev ccep parse --command odd "$ARGUMENTS"
11
+ bun run dev ccep resolve --command odd "$ARGUMENTS"
12
+ bun run dev ccep profile --command odd
13
+ ```
14
+
15
+ Create a ledger only after authorization and tracked coordination. Read-only and small work do not create state.
@@ -39,9 +39,8 @@ without a key, but CrUX field data requires it.
39
39
  Call the PageSpeed Insights API for the URL provided above.
40
40
 
41
41
  - Strategy: `both` (mobile + desktop) unless the user specified otherwise.
42
- - If Bun is available, use `~/.claude/skills/pagespeed-perf/scripts/run.ts`.
43
- - If Bun is unavailable, call PSI directly via WebFetch and fetch the HTML
44
- source for manual resource-hint analysis.
42
+ - Call PSI directly via WebFetch and fetch the HTML source for manual
43
+ resource-hint analysis.
45
44
 
46
45
  ---
47
46
 
@@ -118,6 +118,37 @@ reviewer must evaluate the diff against the following checklist:
118
118
 
119
119
  ---
120
120
 
121
+ ## Severity Rubric
122
+
123
+ Classify every finding using these concrete anchors — not general judgment —
124
+ so the same finding gets the same category on any run.
125
+
126
+ **CRITICAL** (always):
127
+
128
+ - Unauthenticated access to a protected resource
129
+ - Injection (SQL, command, XSS) reachable from untrusted input
130
+ - A secret or credential present in the diff
131
+ - A destructive operation with no confirmation
132
+ - The build or test suite is broken
133
+ - A direct contradiction of an explicit acceptance criterion
134
+
135
+ **WARNING**:
136
+
137
+ - Missing test for a new branch or edge case
138
+ - An error is silently swallowed — no log, no propagation
139
+ - A change outside the declared scope
140
+ - Inconsistent with an established pattern already in the module
141
+ - Missing input validation in an internal function (not exposed at a trust boundary)
142
+
143
+ **SUGGESTION**:
144
+
145
+ - Style or naming
146
+ - Minor readability
147
+ - Speculative refactor that wasn't requested
148
+ - Non-blocking micro-optimization
149
+
150
+ ---
151
+
121
152
  ## Step 3 — Review Report
122
153
 
123
154
  reviewer produces a structured Review Report with findings in three categories:
@@ -62,7 +62,7 @@ If `graphify-out/graph.json` exists, run `graphify query "$ARGUMENTS"` (and
62
62
  `graphify path` / `graphify explain` when needed). Then invoke `repo-explorer`
63
63
  to map modules, conventions, and impact radius. Do not write code in this step.
64
64
  Record a Repo Map artifact before intake. Load the matching `security-*` skill
65
- for the named domain (see `.claude/skills/security-*/SKILL.md`). Keep the OWASP
65
+ for the named domain (see `.opencode/skills/security-*/SKILL.md`). Keep the OWASP
66
66
  `security` skill for application-security reviews.
67
67
 
68
68
  ---
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "$schema": "https://opencode.ai/config.json",
3
- "model": "opencode-go/qwen3.7-plus",
3
+ "model": "opencode-go/deepseek-v4.1-flash",
4
4
  "permission": {
5
5
  "*": "ask",
6
6
  "read": {
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: android
3
- name: Android + Kotlin (Jetpack Compose & Media3)
3
+ name: android
4
4
  description: >
5
5
  Provides expert knowledge for building modern native Android apps using Kotlin, Jetpack Compose, Material Design 3, MVI architecture, Hilt dependency injection, and Media3/ExoPlayer.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: api-versioning
3
- name: API Versioning
3
+ name: api-versioning
4
4
  description: >
5
5
  Provides expert knowledge for designing, implementing, and managing REST API
6
6
  versioning strategies with deprecation workflows.
@@ -39,6 +39,7 @@ quality:
39
39
  reviewed_by: codeconductor-core
40
40
  version: 0.1.0
41
41
  ---
42
+
42
43
  # API Versioning
43
44
 
44
45
  ## Versioning Strategies
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: astro
3
- name: Astro
3
+ name: astro
4
4
  description: >
5
5
  Provides expert knowledge for building Astro 5+ sites with Islands Architecture, Content Collections, TypeScript, and performance-first rendering strategies.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: auth-token-inspector
3
- name: Auth Token Inspector
3
+ name: auth-token-inspector
4
4
  description: >
5
5
  Audits token storage mechanisms to prevent XSS-based JWT theft.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: code-review
3
- name: Code Review
3
+ name: code-review
4
4
  description: >
5
5
  Provides a structured framework for conducting thorough code reviews covering correctness, security, architecture alignment, performance, and technical debt.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: django-orm
3
- name: Django ORM
3
+ name: django-orm
4
4
  description: >
5
5
  Django ORM patterns for multi-tenant POS projects: efficient queries,
6
6
  bulk operations, transactions, and multi-schema upload paths.
@@ -41,6 +41,7 @@ quality:
41
41
  reviewed_by: codeconductor-core
42
42
  version: 0.1.0
43
43
  ---
44
+
44
45
  ## When to Use
45
46
 
46
47
  - Writing or reviewing queryset code in any `apps/*/`
@@ -456,5 +457,4 @@ def on_order_save(sender, instance, created, **kwargs):
456
457
  - **Annotation examples**: `apps/pos/views.py` lines 59-75
457
458
  - **Exists usage**: `apps/catalog/views.py` line 112
458
459
  - **Upload paths**: `apps/catalog/models.py`
459
- - **Django ORM docs**:
460
- <https://docs.djangoproject.com/en/5.2/topics/db/queries/>
460
+ - **Django ORM docs**: https://docs.djangoproject.com/en/5.2/topics/db/queries/
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: django-testing
3
- name: Django Testing
3
+ name: django-testing
4
4
  description: >
5
5
  Testing patterns for multi-tenant Django POS projects using pytest-django,
6
6
  RequestFactory, and mocks. No factories, no complex conftest.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: django-uv
3
- name: Django + UV
3
+ name: django-uv
4
4
  description: >
5
5
  Provides expert knowledge for building Django 5+ projects with UV as the package manager, domain-driven app structure, ruff for linting, and pytest-django for testing.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: drizzle-schema-architect
3
- name: Drizzle Schema Architect
3
+ name: drizzle-schema-architect
4
4
  description: >
5
5
  Generates strictly typed Drizzle ORM schemas for PostgreSQL with indexes,
6
6
  foreign keys, and Zod schema deduction.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: fastapi-pydantic-strict
3
- name: FastAPI Pydantic Strict
3
+ name: fastapi-pydantic-strict
4
4
  description: >
5
5
  Enforces Pydantic v2 strict models, asynchronous dependency generators, and uv environment setup.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: jpa-nplusone-detector
3
- name: JPA N+1 Query Detector
3
+ name: jpa-nplusone-detector
4
4
  description: >
5
5
  Audits Hibernate database interactions to prevent N+1 query problems in JVM apps.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: jpa-postgres
3
- name: JPA + PostgreSQL
3
+ name: jpa-postgres
4
4
  description: >
5
5
  Provides expert knowledge of JPA entity design, relationship mapping, Flyway
6
6
  migrations, and PostgreSQL-specific optimizations.
@@ -41,6 +41,7 @@ quality:
41
41
  reviewed_by: codeconductor-core
42
42
  version: 0.1.0
43
43
  ---
44
+
44
45
  # JPA + PostgreSQL
45
46
 
46
47
  ## Entity Design
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: livewire-alpine-bridge
3
- name: Livewire Alpine Bridge
3
+ name: livewire-alpine-bridge
4
4
  description: >
5
5
  Schedules reactive frontend states cleanly using entangle directives in PHP and JS.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: nextjs-typescript
3
- name: Next.js + TypeScript
3
+ name: nextjs-typescript
4
4
  description: >
5
5
  Provides expert knowledge for building Next.js 15+ applications with the App Router, TypeScript, Server Components, Server Actions, and TanStack Query.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: pagespeed-perf
3
- name: PageSpeed Performance Audit
3
+ name: pagespeed-perf
4
4
  description: >
5
5
  Web Performance Engineering — analyzes Core Web Vitals using the PageSpeed
6
6
  Insights API (PSI v5) and applies the 80/20 principle: identify the 20% of
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: python
3
- name: Python
3
+ name: python
4
4
  description: >
5
5
  Python development best practices: clean code, patterns,
6
6
  type hints, decorators, context managers, and architecture.
@@ -40,6 +40,7 @@ quality:
40
40
  reviewed_by: codeconductor-core
41
41
  version: 0.1.0
42
42
  ---
43
+
43
44
  ## When to Use
44
45
 
45
46
  - Writing any Python code in the project
@@ -604,7 +605,7 @@ items = items_to_keep
604
605
 
605
606
  ## Resources
606
607
 
607
- - **PEP 8** — Style Guide: <https://peps.python.org/pep-0008/>
608
- - **PEP 484** — Type Hints: <https://peps.python.org/pep-0484/>
609
- - **Real Python**: <https://realpython.com/>
610
- - **Python Docs**: <https://docs.python.org/3/>
608
+ - **PEP 8** — Style Guide: https://peps.python.org/pep-0008/
609
+ - **PEP 484** — Type Hints: https://peps.python.org/pep-0484/
610
+ - **Real Python**: https://realpython.com/
611
+ - **Python Docs**: https://docs.python.org/3/
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: python-django-stack
3
- name: Python Django Stack
3
+ name: python-django-stack
4
4
  description: >
5
5
  Python and Django conventions for multi-tenant SaaS POS projects:
6
6
  views, services, naming, JSON APIs, PDFs, and cart patterns.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: python-fastapi-stack
3
- name: Python FastAPI Stack
3
+ name: python-fastapi-stack
4
4
  description: >
5
5
  FastAPI conventions for REST APIs: routers, Pydantic v2 schemas, dependency
6
6
  injection, error handling, pagination, and project structure.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: security
3
- name: Security
3
+ name: security
4
4
  description: >
5
5
  Provides expert knowledge for implementing and reviewing application security following OWASP Top 10 (2021), with stack-specific patterns for Spring Boot, Django, Next.js, and Astro.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: seo-analytics-injector
3
- name: SEO Analytics Injector
3
+ name: seo-analytics-injector
4
4
  description: >
5
5
  Verifies and injects Google Tag Manager (GTM), GA4 event triggers, and optimized meta tags.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: spring-auth-auditor
3
- name: Spring Auth Auditor
3
+ name: spring-auth-auditor
4
4
  description: >
5
5
  Secures Spring Security filters, JWT validations, OAuth2 setups, and CORS/CSRF headers.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: spring-boot-feature
3
- name: Spring Boot Feature Creation
3
+ name: spring-boot-feature
4
4
  description: >
5
5
  Guides the creation of complete Spring Boot features following a structured,
6
6
  layer-by-layer workflow: entity, repository, service, controller, and tests.
@@ -44,6 +44,7 @@ quality:
44
44
  reviewed_by: codeconductor-core
45
45
  version: 0.1.0
46
46
  ---
47
+
47
48
  # Spring Boot Feature Creation
48
49
 
49
50
  When asked to create a feature, follow these steps **in order**. Do not skip
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: spring-boot-kotlin
3
- name: Spring Boot + Kotlin
3
+ name: spring-boot-kotlin
4
4
  description: >
5
5
  Provides expert knowledge of Spring Boot conventions, Kotlin idioms, and MVC
6
6
  patterns for backend API development.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: spring-boot-testing-strategy
3
- name: Spring Boot Testing Strategy
3
+ name: spring-boot-testing-strategy
4
4
  description: >
5
5
  Provides expert knowledge of the testing pyramid, test design principles, MockK patterns, and integration testing conventions for Spring Boot + Kotlin projects.
6
6
 
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: sqlalchemy
3
- name: SQLAlchemy
3
+ name: sqlalchemy
4
4
  description: >
5
5
  SQLAlchemy 2.x patterns for async FastAPI projects: models, sessions, queries,
6
6
  bulk operations, transactions, and Alembic migrations.
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: tailwind-responsive-auditor
3
- name: Tailwind Responsive Auditor
3
+ name: tailwind-responsive-auditor
4
4
  description: >
5
5
  Audits Tailwind CSS usage ensuring mobile-first responsive utilities and clean classes.
6
6
  user-invokable: true
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: tdd-mutation-tester
3
- name: TDD Mutation Tester
3
+ name: tdd-mutation-tester
4
4
  description: >
5
5
  Performs simple mutation testing to verify test coverage and assertions.
6
6
  user-invokable: true
@@ -40,4 +40,10 @@ act as that role for the rest of the step.
40
40
  - Do not skip the Reviewer step for medium- or high-risk changes.
41
41
  - Do not store secrets in any file loaded by Pi.
42
42
 
43
+ ## Receipt integrity
44
+
45
+ - For any implementation, test, review, handoff, or delivery decision, capture or verify the current RDD receipt with `bun run dev rdd`.
46
+ - A receipt is valid only for its exact candidate. If code, tests, contracts, or runner configuration changed, repeat the affected verification.
47
+ - TDD and Mutation Testing retain their existing gates; RDD verifies that their observed evidence still belongs to the current candidate.
48
+
43
49
  <!-- CODECONDUCTOR:END managed -->
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: astro-seo
3
- name: Astro SEO Validator
3
+ name: astro-seo
4
4
  description: >
5
5
  SEO validation specific to Astro framework projects. Checks static generation,
6
6
  meta tag rendering, Content Collections usage, Island Architecture implications
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: geo-readiness
3
- name: GEO Readiness Checker
3
+ name: geo-readiness
4
4
  description: >
5
5
  Validates AI-search readiness (Generative Engine Optimization) for hotel websites.
6
6
  Checks for citable content, factual cards, llms.txt, structured data completeness,
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  id: off-page
3
- name: SEO Off-Page & Marketing
3
+ name: off-page
4
4
  description: >
5
5
  Guidance for off-page SEO strategy specific to hotel and hospitality websites.
6
6
  Covers backlink strategy, local citations, review management, social signals,