cc-codeconductor 1.5.1 → 1.6.1

package/README.md

@@ -2,7 +2,7 @@
 
 **Stop prompting. Start orchestrating.**
 
-[![Socket Badge](https://badge.socket.dev/npm/package/cc-codeconductor/1.5.1)](https://badge.socket.dev/npm/package/cc-codeconductor/1.5.1)
+[![Socket Badge](https://badge.socket.dev/npm/package/cc-codeconductor/1.6.1)](https://badge.socket.dev/npm/package/cc-codeconductor/1.6.1)
 
 CodeConductor is an open-source framework for building structured, reproducible
 AI-assisted software engineering workflows.
@@ -15,19 +15,19 @@ contracts, task cards, and risk-based routing.
 >
 > ## Current Scope
 >
-> Published package is **1.5.1** (current stable line: **1.5.x**). Limitations
+> Published package is **1.6.1** (current stable line: **1.6.x**). Limitations
 > matrix:
 > [docs/current-status.md](docs/current-status.md). This repository:
 > `bun run dev …` (not `npx`) while iterating.
 >
-> Shipped in the 1.5.x stable line:
+> Shipped in the 1.6.x stable line:
 >
 > - `npx cc-codeconductor setup --target <target> --yes` — onboarding flow
 > - `npx cc-codeconductor init` — detects project stack, writes
 >   `.codeconductor/config.yml`, copies `council.yml` and `policy.yml` into
 >   `.codeconductor/presets/`
-> - `npx cc-codeconductor install council --target <opencode|claude|codex|agy|all>`
-> - `npx cc-codeconductor install preset --target <opencode|claude|codex|gemini|cursor|agy|all>`
+> - `npx cc-codeconductor install council --target <opencode|claude|codex|gemini|cursor|agy|pi|all>`
+> - `npx cc-codeconductor install preset --target <opencode|claude|codex|gemini|cursor|agy|pi|muse|all>`
 > - `npx cc-codeconductor install lsp --target <…>`
 > - `npx cc-codeconductor detect` / `status` / `version` / `doctor` / `update` /
 >   `migrate`
@@ -246,7 +246,7 @@ Details: [docs/v1.3.0-release-notes.md](docs/v1.3.0-release-notes.md) and
 ### Migrate from v0.5.0
 
 ```bash
-npx cc-codeconductor install preset --target=<opencode|claude|cursor|codex|gemini|agy> --force
+npx cc-codeconductor install preset --target=<opencode|claude|cursor|codex|gemini|agy|pi|muse> --force
 ```
 
 ---
@@ -325,14 +325,14 @@ Task Card → Risk Classification → Routing Policy → Conductor Agent → Del
 
 ## Supply chain
 
-Published **1.5.1** declares two production dependencies (`package.json`
+Published **1.6.1** declares two production dependencies (`package.json`
 `dependencies`; same on
 [npm](https://www.npmjs.com/package/cc-codeconductor)). Neither has further
 npm transitive dependencies.
 
 ```mermaid
 graph LR
-  cc["cc-codeconductor@1.5.1"]
+  cc["cc-codeconductor@1.6.1"]
   zod["zod@^3.23.8"]
   yaml["yaml@^2.4.5"]
   cc --> zod
@@ -860,7 +860,7 @@ codeconductor/
 
 ## Roadmap
 
-Published package: **1.5.x (current stable: 1.5.1)**. Remaining gaps (sandbox, policy compiler, full
+Published package: **1.6.x (current stable: 1.6.1)**. Remaining gaps (sandbox, policy compiler, full
 stack-specific asset pruning): [docs/current-status.md](docs/current-status.md).
 Release history: [CHANGELOG.md](CHANGELOG.md).
 

package/dist/core/runner/runner-target.d.ts

@@ -1,20 +1,20 @@
 /**
  * Runner target type
  */
-export type RunnerTarget = 'opencode' | 'claude' | 'codex' | 'gemini' | 'cursor' | 'agy' | 'pi' | 'all';
+export type RunnerTarget = 'opencode' | 'claude' | 'codex' | 'gemini' | 'cursor' | 'agy' | 'pi' | 'muse' | 'all';
 /**
  * Valid runner targets
  */
-export declare const RUNNER_TARGETS: readonly ["opencode", "claude", "codex", "gemini", "cursor", "agy", "pi", "all"];
+export declare const RUNNER_TARGETS: readonly ["opencode", "claude", "codex", "gemini", "cursor", "agy", "pi", "muse", "all"];
 /**
  * Individual runner targets (excluding 'all')
  */
-export declare const INDIVIDUAL_TARGETS: readonly ["opencode", "claude", "codex", "gemini", "cursor", "agy", "pi"];
+export declare const INDIVIDUAL_TARGETS: readonly ["opencode", "claude", "codex", "gemini", "cursor", "agy", "pi", "muse"];
 /**
  * A single, installable runner target — every RunnerTarget value except
  * 'all'. The single source for the union type repeated inline across
  * loaders/commands (manifest-loader.ts, install.command.ts, ...) — import
- * this instead of re-listing the 7 targets, so adding an 8th only requires
+ * this instead of re-listing the 8 targets, so adding a 9th only requires
  * updating INDIVIDUAL_TARGETS above.
  */
 export type IndividualRunnerTarget = (typeof INDIVIDUAL_TARGETS)[number];

package/dist/core/verification/rdd-receipt.d.ts

@@ -13,6 +13,14 @@ export interface RddReceipt {
     readonly command?: string;
     readonly outcome: 'passed' | 'failed';
     readonly capturedAt: string;
+    /**
+     * Random capture binding minted by captureReceipt and registered under
+     * `.codeconductor/rdd-receipts/`. A receipt whose nonce was never
+     * registered — including hand-written JSON with correct hashes — never
+     * verifies. Optional so previously persisted shapes still parse (and then
+     * fail closed at verification).
+     */
+    readonly nonce?: string;
 }
 export interface ReceiptVerification {
     readonly valid: boolean;
@@ -37,3 +45,14 @@ export declare function captureReceipt(projectRoot: string, input: {
  */
 export declare function collectReceiptPaths(projectRoot: string): Promise<string[]>;
 export declare function verifyReceipt(projectRoot: string, receipt: RddReceipt): Promise<ReceiptVerification>;
+export interface ReceiptLockVerification {
+    readonly valid: boolean;
+    readonly changedPaths: readonly string[];
+}
+/**
+ * Re-verify a persisted receipt lock (cc-spec-mutation pattern: freeze
+ * specs+tests behind a SHA-256 lock, recompute before every gate, abort on
+ * any single-byte difference). A missing, corrupt, or non-receipt lock fails
+ * closed — it reports invalid, never valid.
+ */
+export declare function verifyReceiptLock(projectRoot: string, lockPath: string): Promise<ReceiptLockVerification>;

package/dist/core/verification/verification-runner.d.ts

@@ -38,6 +38,22 @@ export declare function runVerification(projectRoot: string, taskId: string, goa
  * unreadable evidence all block completion.
  */
 export declare function gateTaskCompletion(projectRoot: string, taskId: string, evidenceRequired: string[], evidenceIds?: string[]): Promise<Result<boolean, Error>>;
+export interface SpecTestDiffGateOptions {
+    readonly changedFiles: readonly string[];
+    /** True only when the mutation_testing HANDS_OFF protocol routed back to add the missing test. */
+    readonly handover?: boolean;
+}
+export interface SpecTestDiffGateResult {
+    readonly passed: boolean;
+    readonly violations: readonly string[];
+}
+/**
+ * No specs/tests diffs except via HANDS_OFF (cc-spec-mutation Stage 3 hard
+ * rule + Stage 5 hands-off): specs/ and tests/ are read-only for
+ * implementers, and only the mutation runner routing back to the craftsman
+ * may add the missing test.
+ */
+export declare function gateSpecTestDiffs(options: SpecTestDiffGateOptions): SpecTestDiffGateResult;
 export declare const TDD_EVIDENCE_SOURCE = "cc verify";
 export declare const TDD_CAPTURED_BY = "verification-runner";
 export interface CaptureTddSuiteOptions extends RunVerificationOptions {