conductor-defect — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited conductor-defect (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fix bugs reported by humans one at a time, tracked via BUG_MASTER.md and per-bug BUG_FIX_PLAN.md.
This skill internally manages Ralph Loop. The user does NOT need to invoke /ralph-loop or know about Ralph Loop at all. The skill handles starting, iterating, and completing the loop transparently.
When this skill is invoked (e.g., /conductor-defect hub_middleware version:v1.0.4), the very first action — before reading any files, before Phase 0, before ANYTHING — is to silently start Ralph Loop by invoking the Skill tool internally:
Skill(skill: "ralph-loop:ralph-loop", args: "<original-user-invocation-with-all-args> --completion-promise \"ALL BUGS RESOLVED\" --max-iterations 50")Construction rule: Take the EXACT text the user typed (e.g., /conductor-defect hub_middleware version:v1.0.4 module:location-information) and pass it as the args value, appending the --completion-promise and --max-iterations flags.
| User types | Ralph Loop args |
|---|---|
/conductor-defect hub_middleware | /conductor-defect hub_middleware --completion-promise "ALL BUGS RESOLVED" --max-iterations 50 |
/conductor-defect hub_middleware version:v1.0.4 | /conductor-defect hub_middleware version:v1.0.4 --completion-promise "ALL BUGS RESOLVED" --max-iterations 50 |
/conductor-defect hub_middleware version:v1.0.3,v1.0.4 | /conductor-defect hub_middleware version:v1.0.3,v1.0.4 --completion-promise "ALL BUGS RESOLVED" --max-iterations 50 |
/conductor-defect hub_middleware version:all | /conductor-defect hub_middleware version:all --completion-promise "ALL BUGS RESOLVED" --max-iterations 50 |
/conductor-defect hub_middleware version:v1.0.4 module:location-information | /conductor-defect hub_middleware version:v1.0.4 module:location-information --completion-promise "ALL BUGS RESOLVED" --max-iterations 50 |
Skip if already active: If .claude/ralph-loop.local.md already exists, Ralph Loop is already running (this is a resumed iteration). Do NOT re-invoke — proceed directly to Phase 0.
BLOCKING: Do NOT proceed with ANY work until Ralph Loop is confirmed active (either freshly started or already running from a previous iteration).
/conductor-defect with their arguments — they never see or interact with Ralph LoopWhen ALL bugs in BUG_MASTER.md have a terminal status (FIXED, CANNOT_REPRODUCE, or HIGH_IMPACT), output the following promise tag to signal Ralph Loop that bug fixing is done:
<promise>ALL BUGS RESOLVED</promise>CRITICAL: Only output this promise when EVERY bug in BUG_MASTER.md has a terminal status. Do NOT output the promise prematurely. Do NOT output it to escape the loop.
At the START of every iteration (including the first), the agent MUST:
.claude/ralph-loop.local.md exists, skip re-invoking)NEW or IN_PROGRESSThe skill expects these arguments:
/conductor-defect <application> [version:<version>] [module:<module>]| Argument | Required | Example | Description |
|---|---|---|---|
<application> | Yes | hub_middleware | Application name to locate the context folder |
version:<version> | No | version:v1.0.4 or version:v1.0.3,v1.0.4 or version:all | Filter bugs by version. Supports single version, comma-separated list, all, or omit for all versions. Multiple versions are processed sequentially in ascending semver order |
module:<module> | No | module:location-information | Filter bugs by module |
The application name is matched against root-level application folders:
<number>_ prefix from folder names| File | Resolved Path |
|---|---|
| BUG.md | <app_folder>/context/BUG.md |
| PRD.md | <app_folder>/context/PRD.md |
| Bug Tracking Output | <app_folder>/context/bug/ |
| Module Models | <app_folder>/context/model/ |
| HTML Mockups | <app_folder>/context/mockup/ |
| Specifications | <app_folder>/context/specification/ |
| Provided | Behavior |
|---|---|
<application> only | All versions (sequential, ascending semver), all modules |
<application> + version:v1.0.4 | Single version, all modules |
<application> + version:v1.0.3,v1.0.4 | Multiple versions (sequential, ascending semver), all modules |
<application> + version:all | All versions (sequential, ascending semver), all modules |
Any above + module:<module> | Same as above, filtered to specific module |
The version: argument supports four forms:
| Form | Example | Behavior |
|---|---|---|
| Single version | version:v1.0.3 | Process only v1.0.3 |
| Comma-separated list | version:v1.0.1,v1.0.2,v1.0.3 | Process each version sequentially in ascending semver order |
| Explicit all | version:all | Discover all versions from BUG.md, process sequentially in ascending semver order |
| Omitted | _(no version arg)_ | Same as version:all |
#### Version Discovery
When version:all or omitted:
[vX.Y.Z] version tags across all module sections#### Sequential Version Processing Rule
Versions are ALWAYS processed one at a time, in ascending semver order. All bugs from version N must be fully resolved (terminal status: FIXED, CANNOT_REPRODUCE, or HIGH_IMPACT) before ANY bug from version N+1 is started. This ensures:
<app_folder>/context/
BUG.md # Bug reports grouped by module, optionally versioned
PRD.md # User stories (for recording bug fixes)
bug/ # Bug tracking folder (BUG_MASTER.md + per-module subfolders)
BUG_MASTER.md # Master checklist (created by this skill)
<module-slug>/ # Per-module folder
<BUG-XXX>/ # Per-bug folder (named by bug tag)
screenshot_*.png # Reproduction screenshots
BUG_TEST_SPEC.md # Test spec for verification
BUG_FIX_PLAN.md # Fix plan with checklist
model/ # Module models (updated if fix involves model changes)
mockup/ # HTML mockups (updated if fix involves UI changes)
specification/ # Technical specifications (updated if fix involves logic changes)CLAUDE.md is automatically loaded into context at the start of every session. It contains project details, infrastructure paths, credentials, and configuration. You do NOT need to read it manually — the information is already available in your context.
Before executing ANY tool command (Maven build, Spring Boot run, database CLI, Keycloak CLI, Playwright test, npm start, etc.), use the following from CLAUDE.md (already in context):
JAVA_HOME path specified in CLAUDE.mdWHY: CLAUDE.md contains the actual system paths, credentials, and configuration for the developer's machine. Every shell command MUST use the values from CLAUDE.md.
The BUG.md file follows a hierarchical structure mirroring the module structure in CLAUDE.md:
# Common, # System Module, # Business Module## UI/UX Standards under # Common,## User under # System Module, ## Employer under # Business Module)
tag (e.g., [v1.0.4]) on the line immediately before the bug items for that version.
# Common
## UI/UX Standards
[v1.0.4]
- Bug description here
- Priority: High
- Steps to Reproduce:
1. Step 1
2. Step 2
- Expected Result: ...
[v1.0.5]
- Another bug for a different version
---
# System Module
## User
[v1.0.5]
- Bug description here
---
## Notification
---
## Activities
---
## Audit Trail
---
## Document Management
---
# Business Module
## Location Information
---
## Corridor
---
## Recruitment Step
---
## Employer
---
## Recruitment Agent
---
## Industrial Classification
---
## Occupation Classification
---
## Job Demand
[v1.0.6]
- Bug description here
---
## Candidate Registration[vX.Y.Z] on their own line within a module sectionversion: filter is provided, only include bugs that appear AFTER the matchingversion tag and BEFORE the next version tag or module header
version:v1.0.3,v1.0.4), include bugs fromeach listed version. Bugs are grouped by version for sequential processing
version:all or version is omitted, discover ALL [vX.Y.Z] tags in BUG.md, collectbugs from every version, and group them by version for sequential processing
when multiple versions are resolved, bugs are processed version-by-version in ascending semver order. All bugs from version N must reach terminal status before version N+1 begins
## Module Name) under their parent group (H1) in BUG.md# Common, # System Module, # Business Module) are NOT modules themselves— they are organizational headers
module: filter is provided, only include bugs under the matching H2 module sectionlocation-informationmatches ## Location Information, ui-ux-standards matches ## UI/UX Standards)
module: filter is provided, include ALL modules across all groupsBug tags follow the format: BUG-XXX where XXX is a zero-padded running number with interval of 1, starting from 001.
BUG-001, BUG-002, BUG-003, ...[BUG-XXX] at the start of the bug description (after the - )[BUG-XXX] tagExample before tagging:
- Table formatting in document management is not consistent...Example after tagging:
- [BUG-001] Table formatting in document management is not consistent...Before starting any work, check CHANGELOG.md in the application folder (<app_folder>/CHANGELOG.md):
<app_folder>/CHANGELOG.md does not exist, skip this check (first-ever execution for this application).<app_folder>/CHANGELOG.md exists, scan all ## vX.Y.Z headings and determine the highest version using semantic versioning comparison."Version {requested} is lower than the current application version {highest} recorded in <app_folder>/CHANGELOG.md. Execution rejected.""Version {lowest} in the provided list is lower than the current application version {highest} recorded in <app_folder>/CHANGELOG.md. Execution rejected."When fixing bugs, check PRD.md for the following extended sections and use them as diagnostic context:
If PRD.md contains a # Design System section referencing a DESIGN_SYSTEM.md file:
If PRD.md contains an # Architecture Principle section:
If PRD.md contains a # High Level Process Flow section:
This phase runs at the START of every iteration, including the first.
.claude/ralph-loop.local.mdexists. If it does NOT exist, silently invoke Ralph Loop using the Skill tool as described in the "Internal Auto-Start Mechanism" section above. The user should NOT be informed about this step — it is an internal implementation detail. If the file already exists, skip this step.
and all infrastructure details. These values are required for every subsequent tool command.
<app_folder>/context/bug/BUG_MASTER.md existsin the Version Processing Order table. If BUG.md contains versions that are NOT yet in the Version Processing Order table (and those versions have bugs matching the module filter):
NEWCOMPLETEDCOMPLETED (and therefore all bugs have terminal status) →output <promise>ALL BUGS RESOLVED</promise> and stop
NEW orIN_PROGRESS
BUG_FIX_PLAN.md (if exists) for detailed progress#### Step 1.1: Read, Resolve Versions, and Filter BUG.md
<app_folder>/context/BUG.md[v1.0.4][v1.0.3, v1.0.4]all or omitted → scan BUG.md for ALL [vX.Y.Z] tags, deduplicate, sort ascending → [v1.0.1, v1.0.2, v1.0.3, ...]#### Step 1.2: Tag Untagged Bugs
[BUG-XXX] tags to find the highest number[BUG-XXX] tag#### Step 1.3: Create BUG_MASTER.md
Create <app_folder>/context/bug/BUG_MASTER.md with this structure:
# Bug Master — <Application Name>
**Started**: <date>
**Context**: <app_folder>/context
**Resolved Versions**: <comma-separated sorted version list, e.g., "v1.0.3, v1.0.4, v1.0.5">
**Module Filter**: <module or "All">
**Status**: IN PROGRESS
---
## Version Processing Order
| # | Version | Bug Count | Status | Started | Completed |
|---|---------|-----------|--------|---------|-----------|
| 1 | v1.0.3 | 3 | NEW | - | - |
| 2 | v1.0.4 | 5 | NEW | - | - |
| 3 | v1.0.5 | 2 | NEW | - | - |
> **Processing Rule**: All bugs from version N must reach terminal status before version N+1 begins.
---
## v1.0.3
### <Module Name>
| Code | Description | Status | Remark |
|------|-------------|--------|--------|
| BUG-001 | Short description of the bug | NEW | |
| BUG-002 | Short description of the bug | NEW | |
---
### <Another Module>
| Code | Description | Status | Remark |
|------|-------------|--------|--------|
| BUG-003 | Short description of the bug | NEW | |
---
## v1.0.4
### <Module Name>
| Code | Description | Status | Remark |
|------|-------------|--------|--------|
| BUG-004 | Short description of the bug | NEW | |
---
## Summary
| Status | Count |
|--------|-------|
| NEW | X |
| IN_PROGRESS | 0 |
| FIXED | 0 |
| CANNOT_REPRODUCE | 0 |
| HIGH_IMPACT | 0 |
| **Total** | **X** |IMPORTANT — Single version shortcut: When only a single version is resolved (either explicitly provided or only one version exists in BUG.md), the BUG_MASTER.md still uses the same structure above but with only one version section. The Version Processing Order table will have a single row.
IMPORTANT — Version-first organization: Bugs are grouped by version (H2), then by module (H3) within each version. This ensures the version-sequential processing order is visually clear and easy to track.
Status Values:
NEW — Bug has been tagged but not yet worked onIN_PROGRESS — Bug is currently being investigated/fixedFIXED — Bug has been fixed and verifiedCANNOT_REPRODUCE — Bug could not be reproduced via PlaywrightHIGH_IMPACT — Fix would potentially break other working functionalities; deferredProcess bugs version by version in the order defined in the Version Processing Order table:
COMPLETEDIN_PROGRESS and record the start dateNEW or IN_PROGRESSCOMPLETED in the Version Processing Order table, recordcompletion date, and move to the NEXT version (step 1)
NEW bug in the same version and continueCOMPLETEDFor each bug with status NEW in BUG_MASTER.md (within the current version), in order:
#### Step 2.1: Initialize Bug Folder
IN_PROGRESS<app_folder>/context/bug/<module-slug>/<BUG-XXX>/#### Step 2.2: Reproduce the Bug with Playwright
<app_folder>/context/bug/<module-slug>/<BUG-XXX>/reproduce.spec.ts
Do NOT rely on Playwright's default screenshot location. Use page.screenshot() with an absolute or project-relative path:
await page.screenshot({
path: '<app_folder>/context/bug/<module-slug>/<BUG-XXX>/screenshot_reproduce.png',
fullPage: true
});npx playwright test <path-to-script> --config=<playwright-config>CRITICAL: Screenshots MUST be saved to <app_folder>/context/bug/<module-slug>/<BUG-XXX>/. Do NOT save screenshots in the application source folder, test output folder, or Playwright's default results directory. The bug folder in the application's context/ folder is the single source of truth for all bug artifacts.
IF able to reproduce:
IF NOT able to reproduce:
CANNOT_REPRODUCE, add remark with details#### Step 2.3: Write Test Spec
Create <app_folder>/context/bug/<module-slug>/<BUG-XXX>/BUG_TEST_SPEC.md:
# Test Spec — <BUG-XXX>
**Bug**: <Short description>
**Module**: <Module Name>
**Reproduced**: Yes
---
## Pre-Conditions
- <List any required state, data, or login credentials>
## Steps to Verify Fix
1. <Step-by-step instructions to verify the bug is fixed>
2. <Navigate to...>
3. <Assert that...>
## Expected Result After Fix
- <What the user should see when the bug is fixed>
## Playwright Verification Script
// Playwright test to verify the fix test('<BUG-XXX>: <description>', async ({ page }) => { // Steps to verify...
// IMPORTANT: Save screenshots to the bug folder, NOT the source folder await page.screenshot({ path: '<app_folder>/context/bug/<module-slug>/<BUG-XXX>/screenshot_fixed.png', fullPage: true }); });
#### Step 2.4: Analyze and Plan the Fix
Create <app_folder>/context/bug/<module-slug>/<BUG-XXX>/BUG_FIX_PLAN.md:
# Fix Plan — <BUG-XXX>
**Bug**: <Short description>
**Module**: <Module Name>
**Root Cause**: <What is causing the bug>
**Impact Assessment**: <Low/Medium/High — does fixing this affect other features?>
---
## Fix Checklist
- [ ] 1. <First change to make>
- [ ] 2. <Second change to make>
- [ ] 3. Verify fix with BUG_TEST_SPEC.md
- [ ] 4. Update artifacts (mockups/specs/models/user stories)
---
## Files to Modify
| File | Change Description |
|------|-------------------|
| `path/to/file.jte` | Fix table styling |
| `path/to/file.java` | Update method logic |
---
## Fix Log
### Step 1: <description>
<timestamp> - Started
- Changes made: ...
- Result: ...IF the fix potentially affects other working functionalities (HIGH_IMPACT):
HIGH_IMPACT, add remark explaining the riskIF safe to fix:
#### Step 2.5: Apply the Fix
modified by the fix, leave a [BUG-XXX] marker comment using the language's native comment style:
* [BUG-XXX] <one-line description> (or extendthe existing Javadoc if the method already has one)
{{-- [BUG-XXX] <description> --}} immediately above the changed block@* [BUG-XXX] <description> *@ immediately above the changed block<!-- [BUG-XXX] <description> --> / -- [BUG-XXX] <description>.env / .properties: # [BUG-XXX] <description> above the changed keyExample (Java service method):
/**
* [BUG-024] Trim leading whitespace from corridor code before lookup.
*/
public Corridor findByCode(String code) { ... }The marker enables git blame and IDE search to trace any modified line back to BUG.md without consulting BUG_FIX_PLAN.md.
already carries a top-of-file traceability comment (from conductor-feature-develop's code-level traceability rule), append the [BUG-XXX] code to its Bug fixes: line, creating the line if it does not yet exist. Use the USHM##### / NFRHM#### / CONSHM### / REFHM#### codes already present in the file — do NOT change them:
/**
* Implements: USHM00003, USHM00006
* NFR: NFRHM0003
* Bug fixes: [BUG-024]
*/
public class CorridorService { ... }#### Step 2.6: Verify the Fix
await page.screenshot({
path: '<app_folder>/context/bug/<module-slug>/<BUG-XXX>/screenshot_fixed.png',
fullPage: true
});Do NOT save screenshots in the application source folder — always use the bug folder under <app_folder>/context/.
IF verified (test passes):
FIXEDIF NOT verified (test fails):
#### Step 2.7: Update Related Artifacts
Analyze the fix to determine which artifacts need updating:
A. UI Fix → Update Mockups
If the fix changed the visual appearance (HTML/CSS/layout changes in JTE templates):
<app_folder>/context/mockup/ and find the relevant module screensB. Code Logic Fix → Update Specifications
If the fix involved code logic changes (service layer, controller logic, validation):
<app_folder>/context/specification/<module-slug>/C. Module Model Fix → Update Models
If the fix involved module model changes (new/removed fields, collection changes):
<app_folder>/context/model/<module-slug>/model.md, schemas.json, and document-model.mermaid as neededD. Record in PRD.md
If the bug fix is NOT already documented in PRD.md:
<app_folder>/context/PRD.md### Bug section (positioned AFTER the ### Reference section)### Bug section does NOT exist, create one after ### Reference### Bug header, using the bug'sversion from BUG.md (e.g., [v1.0.3]). This follows the same format as all other sections in PRD.md (User Story, Non Functional Requirement, Constraint, Reference) where the version tag [vX.Y.Z] appears on its own line directly after the ### header.
### Bug
[v1.0.3]
- [BUG-001] Fixed table formatting inconsistency between document management and location information screens### Bug section already exists:last existing entry (following the same multi-version pattern used in other sections):
### Bug
[v1.0.3]
- [BUG-001] Fixed table formatting inconsistency
[v1.0.4]
- [BUG-003] Fixed another issue#### Step 2.8: Record Summary in BUG_MASTER.md
Remark column with a brief summary of what was fixedNEWAfter all bugs have been processed (every bug has a terminal status):
**Status**: to COMPLETED[BUG-XXX] source markers (Step 2.5) and anycode changes are reflected in the requirement-to-code links:
Skill(skill: "tracegen-matrix", args: "<app_folder> version:<highest-version-processed>")module filter was active for this run, pass it through: append module:<module>.<app_folder>/context/TRACEABILITY.md and appends its own CHANGELOG.md row.tracegen-matrix resolves links from thein-source traceability / [BUG-XXX] comments, with a name-based source-scan fallback.
CHANGELOG.md in the application folder (<app_folder>/CHANGELOG.md) — one entry per version processed:<app_folder>/CHANGELOG.md. If it does not exist, create it with context header.## {version} heading matching this version.--- below the context header and before any existing ## vX.Y.Z section (newest-first ordering), with a new table header and the first row.| {YYYY-MM-DD} | {application_name} | conductor-defect | {module or "All"} | Fixed {count} bugs ({list of BUG codes for this version}) |<promise>ALL BUGS RESOLVED</promise>loaded into context. Use the exact JDK path, Maven path, database credentials, and all other infrastructure details from CLAUDE.md. NEVER hardcode or guess paths.
to the next. Never work on multiple bugs simultaneously.
which bugs have been fixed and which are pending. Always keep it up to date. For detailed status of each bug, refer to the BUG_FIX_PLAN.md in each bug's folder.
If it can't be reproduced, mark it as CANNOT_REPRODUCE and move on.
HIGH_IMPACT and move to the next bug. Do not attempt risky fixes.
future session (or Ralph Loop iteration) can understand what was done and what remains.
[BUG-XXX] tags in BUG.md.Only add new tags to untagged bugs.
corresponding mockups, specifications, and module models. Keep all artifacts in sync.
BUG_MASTER.md and BUG_FIX_PLAN.md. Ralph Loop will resume from where you left off.
check for the next NEW bug and start it. Do NOT stop "to let the user review". The only valid reasons to stop within an iteration are: (a) context window approaching limit, (b) all bugs resolved (output promise), or (c) an unrecoverable error requiring user input.
Loop is active (.claude/ralph-loop.local.md exists). If not, silently invoke it using the Skill tool. The user should NEVER be asked to start Ralph Loop manually — this is an internal implementation detail handled entirely by the skill. Do NOT mention Ralph Loop to the user.
connection strings, CLIs, and credentials described in CLAUDE.md. NEVER use Docker containers, alternative databases, or different CLIs than what CLAUDE.md specifies.
(reproduction, verification, fixed) MUST be saved to <app_folder>/context/bug/<module-slug>/<BUG-XXX>/ using explicit page.screenshot({ path: ... }) calls. NEVER save screenshots in the application source folder, Playwright's default test-results directory, or any other location. The Playwright script files themselves should also be saved in the bug folder, not in the source tree.
introduces a new configuration value in a Spring Boot application, that value MUST be added under the top-level app: key in application.yml. NEVER place new application-specific keys at the YAML root (e.g., top-level notification:, batch-job:, audit-trail:) and NEVER place them under Spring framework namespaces (spring.*, server.*, management.*, logging.*, springdoc.*).
Grouping:
object-storage) sit directly under app.* with no module prefix.
app.<module-kebab-case>.*, one blockper module. If the module does not yet have an app.<module> block, create one.
Binding: bind every new app.* value via a @ConfigurationProperties record in the owning module's config subpackage. If a record already exists for that module, extend it rather than creating a second one. NEVER introduce @Value("${app....}") injections as a shortcut. Use kebab-case in YAML.
If the bug fix touches code that currently reads configuration from a root-level YAML key or a framework namespace, relocate the config under `app:` as part of the fix — do not leave the violation in place. Update the application.yml, the Java @ConfigurationProperties prefix, any @Value references, and any tests that use @TestPropertySource or @SpringBootTest(properties = ...). See SPECIFICATION.md section "Application-Specific Configuration (app: namespace)" for the rules.
modified by a bug fix MUST carry a [BUG-XXX] marker comment using the language's native comment style (Javadoc / PHPDoc / JSDoc / {{-- --}} / @* *@ / <!-- --> / #). When a modified file already carries a top-of-file traceability comment from conductor-feature-develop, append the [BUG-XXX] code to its Bug fixes: line (creating the line if it does not yet exist). See Step 2.5 for the exact comment formats per language.
Why: git blame and IDE search must surface the originating bug for any fix line directly, without consulting BUG_FIX_PLAN.md (which is a transient tracking file). PRD.md's ### Bug section captures what was fixed; the in-source [BUG-XXX] marker captures where — both are required for end-to-end traceability.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.