Eibon7
diff --git a/‎.env.example‎
Lines changed: 7 additions & 1 deletion b/‎.env.example‎
Lines changed: 7 additions & 1 deletion
diff --git a/‎.github/workflows/agent-receipts.yml‎
Lines changed: 96 additions & 0 deletions b/‎.github/workflows/agent-receipts.yml‎
Lines changed: 96 additions & 0 deletions
diff --git a/‎CLAUDE.md‎
Lines changed: 235 additions & 0 deletions b/‎CLAUDE.md‎
Lines changed: 235 additions & 0 deletions
@@ -100,4 +100,10 @@ MOCK_MODE=auto
 # Generate with: openssl rand -hex 32
 # MUST be exactly 64 hexadecimal characters (32 bytes)
 # CRITICAL: Never change this key after data is encrypted or all profiles will be lost
-# STYLE_PROFILE_ENCRYPTION_KEY=your-64-character-hex-key-here
+# STYLE_PROFILE_ENCRYPTION_KEY=your-64-character-hex-key-here
+
+# Persona Encryption (REQUIRED for Persona Setup feature - Issue #595)
+# Generate with: node scripts/generate-persona-key.js
+# MUST be exactly 64 hexadecimal characters (32 bytes for AES-256-GCM)
+# CRITICAL: Never change this key after data is encrypted or all personas will be lost
+# PERSONA_ENCRYPTION_KEY=your-64-character-hex-key-here
@@ -0,0 +1,96 @@
+name: Agent Receipt Validation
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+    branches:
+      - main
+      - develop
+
+jobs:
+  validate-receipts:
+    name: Verify Agent Receipts
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Fetch all history for diff comparison
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Verify agent receipts
+        env:
+          GITHUB_BASE_REF: ${{ github.base_ref }}
+          GITHUB_HEAD_REF: ${{ github.head_ref }}
+          GITHUB_EVENT_PATH: ${{ github.event_path }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: node scripts/ci/require-agent-receipts.js
+
+      - name: Comment on PR (if validation failed)
+        if: failure()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const prNumber = context.payload.pull_request.number;
+
+            const comment = `## ❌ Agent Receipt Validation Failed
+
+            Some required agents are missing receipts. Please follow the protocol:
+
+            ### 📋 Required Steps:
+
+            1. **Identify required agents** based on:
+               - PR labels (e.g., \`area:frontend\`, \`test:*\`)
+               - Changed files (e.g., \`*.jsx\`, \`src/services/\`)
+               - See \`agents/manifest.yaml\` for trigger definitions
+
+            2. **For each required agent:**
+               - **If invoked:** Create \`docs/agents/receipts/${prNumber}-<AgentName>.md\`
+                 - Use template: \`docs/agents/receipts/_TEMPLATE.md\`
+               - **If skipped:** Create \`docs/agents/receipts/${prNumber}-<AgentName>-SKIPPED.md\`
+                 - Use template: \`docs/agents/receipts/_TEMPLATE-SKIPPED.md\`
+                 - Include justification and risk assessment
+
+            3. **Commit and push receipts:**
+               \`\`\`bash
+               git add docs/agents/receipts/
+               git commit -m "docs(agents): Add receipts for PR #${prNumber}"
+               git push
+               \`\`\`
+
+            ### 📚 Documentation:
+            - **Agent rules:** \`CLAUDE.md\` → "Lead Orchestrator Rules"
+            - **Agent definitions:** \`agents/manifest.yaml\`
+            - **Receipt guide:** \`docs/agents/receipts/README.md\`
+            - **Quick reference:** \`docs/agents/INVENTORY.md\`
+
+            ### 🔍 Debug:
+            Check the CI logs above to see which agents are required and missing.
+            `;
+
+            github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+              body: comment
+            });
+
+      - name: Update check status
+        if: always()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prNumber = context.payload.pull_request.number;
+            const conclusion = '${{ job.status }}' === 'success' ? 'success' : 'failure';
+
+            console.log(`✅ Agent receipt validation: ${conclusion}`);
@@ -271,6 +271,56 @@ Tu tarea es generar una respuesta sarcástica e ingeniosa...
 - Platform-specific constraints (character limits, style guides)
 - Plan differentiation (Free excludes references, Pro+ includes full examples)
 
+## Persona Setup System (Issue #595)
+
+The Persona Setup feature allows users to define their identity, intolerances, and tolerances for personalized roast filtering and generation.
+
+**Key Features:**
+- 3 encrypted persona fields: identity (lo_que_me_define), intolerance (lo_que_no_tolero), tolerance (lo_que_me_da_igual)
+- AES-256-GCM encryption for data at rest
+- OpenAI embeddings (text-embedding-3-small, 1536 dimensions) for semantic matching
+- Plan-based access control (Free blocked, Starter: 2 fields, Pro+: 3 fields)
+- Full REST API with JWT authentication
+- GDPR compliance (full deletion capability)
+
+**Security Features:**
+- Industry-standard AES-256-GCM encryption with unique IVs
+- Authentication tags prevent tampering
+- No plaintext logging of sensitive data
+- Input sanitization (XSS, SQL injection prevention)
+- Character limits (300 chars plaintext, 500 encrypted)
+
+**API Endpoints:**
+- `GET /api/persona` - Retrieve user's persona (decrypted)
+- `POST /api/persona` - Create/update persona (encrypted storage)
+- `DELETE /api/persona` - Delete persona (GDPR compliance)
+- `GET /api/persona/health` - Service health check
+
+**Database Schema:**
+- 18 persona columns in `users` table (3 fields × 6 columns each)
+- pgvector extension for embedding storage and similarity search
+- Helper functions: `user_has_embeddings()`, `get_user_embeddings_metadata()`, `embeddings_need_regeneration()`
+
+**Plan Access Matrix:**
+- Free/Basic: No access (blocked)
+- Starter: `lo_que_me_define`, `lo_que_no_tolero` (2 fields)
+- Pro/Plus/Enterprise: All 3 fields including `lo_que_me_da_igual`
+
+**Implementation Files:**
+- Service: `src/services/PersonaService.js`
+- Routes: `src/routes/persona.js`
+- Encryption: `src/utils/encryption.js`
+- Migration: `database/migrations/001_add_persona_fields.sql`
+- Tests: `tests/unit/services/PersonaService.test.js`, `tests/integration/persona-api.test.js`
+
+**Environment Variable:**
+- `PERSONA_ENCRYPTION_KEY` - 64-character hex key (generate with `node scripts/generate-persona-key.js`)
+- ⚠️ CRITICAL: Never change this key after data is encrypted or all personas will be lost
+
+**Test Coverage:** 97% (149/154 tests passing)
+
+🔗 **Full documentation**: `docs/plan/issue-595.md`, `docs/test-evidence/issue-595/SUMMARY.md`
+
 ## Orquestación y Reglas
 
 ### Función de Orquestador
@@ -280,6 +330,191 @@ Tu tarea es generar una respuesta sarcástica e ingeniosa...
 - **Cuando un subagente cree un *.md táctico**: añadir bloque en spec.md para coherencia
 - **Invocar Test Engineer Agent**: tras cambios en src/ o docs de diseño para tests + evidencias visuales con Playwright
 
+### 🎯 Lead Orchestrator Rules (ENFORCEMENT)
+
+**📋 Full agent definitions:** `agents/manifest.yaml`
+**📊 Quick reference:** `docs/agents/INVENTORY.md`
+
+**CRITICAL: Every PR must follow this protocol:**
+
+#### 1. Pre-Implementation (FASE 0)
+
+**Before any implementation:**
+- ✅ **Resolve GDD nodes needed** using `node scripts/resolve-graph.js <nodes>`
+- ✅ **Use Explore agent for research** (NEVER load spec.md completely)
+- ✅ **Read `docs/patterns/coderabbit-lessons.md`** to avoid known mistakes
+- ✅ **If AC ≥3 or multi-area changes:** Create mini-plan in `docs/plan/<issue>.md`
+
+#### 2. Agent Identification
+
+**For each PR, identify required agents by:**
+
+**Labels:**
+- `area:frontend`, `area:ui` → **FrontendDev**, **UIDesigner**
+- `area:ui` + `branding`, `copy` → **WhimsyInjector**
+- `test:*`, `qa`, `validation` → **TestEngineer**
+- `priority:P0`, `priority:P1` + AC ≥3 → **TaskAssessor**
+- `critical`, `security`, `billing` → **Guardian**
+
+**Diff patterns:**
+- `*.jsx`, `*.tsx`, `*.css` → **FrontendDev**
+- `src/`, `tests/`, `*.test.js` → **TestEngineer**
+- `src/services/costControl.js`, `database/schema.sql`, `docs/nodes/*.md` → **Guardian**
+- Research needed, unclear structure → **Explore**
+
+**Conditions:**
+- AC ≥3 → **TaskAssessor**
+- Complex multi-step tasks → **general-purpose**
+- UI/UX changes → **UIDesigner** (may skip if already designed)
+- Branding/microcopy → **WhimsyInjector** (NEVER in /legal, /billing, /admin)
+
+#### 3. Agent Invocation & Receipts
+
+**For each required agent:**
+
+### Option A: Invoke the agent
+
+1. Invoke via `Task` tool (Claude Code agents) or execute script (Guardian)
+2. Record decisions, artifacts, guardrails verified
+3. Generate receipt: `docs/agents/receipts/<pr>-<AgentName>.md`
+4. Use template: `docs/agents/receipts/_TEMPLATE.md`
+
+### Option B: Skip with justification
+
+1. Document why agent not needed despite trigger match
+2. Assess risks of skipping
+3. Get approval if required (Product Owner for CRITICAL Guardian skips)
+4. Generate SKIPPED receipt: `docs/agents/receipts/<pr>-<AgentName>-SKIPPED.md`
+5. Use template: `docs/agents/receipts/_TEMPLATE-SKIPPED.md`
+
+#### 4. Guardrails (NEVER VIOLATE)
+
+**Orchestrator-specific:**
+- ❌ NEVER load spec.md completely (use resolved nodes via `resolve-graph.js`)
+- ❌ NEVER expose secrets, API keys, or .env variable names in receipts/docs
+- ❌ NEVER skip FASE 0 assessment
+- ❌ NEVER proceed without receipts for required agents
+- ✅ ALWAYS generate receipts (normal or SKIPPED) for triggered agents
+- ✅ ALWAYS update "Agentes Relevantes" in affected GDD nodes
+- ✅ ALWAYS validate GDD before commit: `node scripts/resolve-graph.js --validate`
+
+**Agent-specific guardrails:** See `agents/manifest.yaml` for each agent
+
+#### 5. CI Enforcement
+
+**Script:** `scripts/ci/require-agent-receipts.js`
+
+**What it does:**
+1. Reads `agents/manifest.yaml`
+2. Discovers changed files and labels
+3. Matches against agent triggers
+4. Verifies receipt exists (normal OR skipped) for each required agent
+5. **Fails build (exit 1) if receipts missing**
+
+**PR cannot merge without:**
+- ✅ All required agents have receipts
+- ✅ Receipts follow template format
+- ✅ Guardrails verified in receipts
+
+#### 6. Planning Thresholds
+
+**When to create mini-plan in `docs/plan/<issue>.md`:**
+- AC ≥3 (3 or more acceptance criteria)
+- Changes span multiple areas (e.g., frontend + backend + tests)
+- Complex integrations or refactors
+- Multiple agents required
+
+**Mini-plan must include:**
+- Estado Actual (current state assessment)
+- Agents to be invoked and why
+- Files affected per agent
+- Validation criteria
+- Risk assessment
+
+#### 7. Examples
+
+### Example 1: Simple Backend Fix
+
+```bash
+PR #700: Fix billing calculation bug
+Changed: src/services/billing.js, tests/unit/services/billing.test.js
+Labels: area:backend, priority:P1
+
+Required agents:
+- TestEngineer (diff: tests/)
+- Guardian (diff: billing.js - sensitive)
+
+Receipts generated:
+- docs/agents/receipts/700-TestEngineer.md ✅
+- docs/agents/receipts/700-Guardian.md ✅ (exit 0, no violations)
+```
+
+### Example 2: Frontend Feature with Branding
+
+```bash
+PR #701: New dashboard UI with microcopy
+Changed: frontend/components/Dashboard.jsx, frontend/styles/dashboard.css
+Labels: area:frontend, area:ui, branding
+
+Required agents:
+- FrontendDev (diff: *.jsx, *.css)
+- UIDesigner (label: area:ui)
+- WhimsyInjector (label: branding)
+- TestEngineer (AC: Must have E2E tests)
+
+Receipts generated:
+- docs/agents/receipts/701-FrontendDev.md ✅
+- docs/agents/receipts/701-UIDesigner-SKIPPED.md (Design pre-approved in #695)
+- docs/agents/receipts/701-WhimsyInjector.md ✅
+- docs/agents/receipts/701-TestEngineer.md ✅
+```
+
+### Example 3: Docs-Only Change
+
+```bash
+PR #702: Update integration guide
+Changed: docs/INTEGRATIONS.md
+Labels: docs
+
+Required agents: NONE (no triggers match)
+
+Receipts: None needed
+CI: Passes with 0 required agents
+```
+
+#### 8. Violations & Consequences
+
+**If receipts missing:**
+- ❌ CI fails with exit 1
+- ❌ PR cannot merge
+- ❌ Must generate missing receipts and re-push
+
+**If guardrails violated:**
+- ❌ Code review rejects PR
+- ❌ Must fix violations before re-review
+- ❌ Guardian CRITICAL violations require Product Owner approval
+
+**If secrets exposed:**
+- 🚨 CRITICAL SECURITY VIOLATION
+- 🚨 Immediate PR close and secret rotation
+- 🚨 Incident report required
+
+#### 9. Receipt Review Checklist
+
+**For code reviewers:**
+- [ ] All required agents identified correctly
+- [ ] Receipts exist (normal or SKIPPED) for each required agent
+- [ ] SKIPPED receipts have valid justification
+- [ ] Guardrails verified in normal receipts
+- [ ] No secrets or .env variables exposed
+- [ ] Artifacts listed in receipts actually exist
+- [ ] GDD nodes updated with agents in "Agentes Relevantes"
+
+---
+
+**Enforcement Status:** ✅ Active (scripts/ci/require-agent-receipts.js)
+**Last Updated:** 2025-10-19
+
 ### Configuración MCP Playwright
 
 **Para cambios de frontend:**