cc-research 1.1.2: dual-name task tracker, security pass, quantified maturity

Synthesis-quality pass plus a tracker tool-name fix. No redesign — the [#id] citation sigil, the per-strand evidence substrate, the budget rails, and all v1.1.x machinery are unchanged. Built-in tools + Claude models only; no new dependencies.

Fixed

• Live task tracker no longer silently no-ops in team-mode sessions. It now names both real tool families — TaskCreate/TaskUpdate (+ TaskList/TaskGet) for team-enabled sessions and TodoWrite for single-agent / headless-SDK sessions — and is described tool-agnostically so the orchestrator uses whichever its session exposes. (Verified against claude 2.1.148: both are live, mode-gated tools; TodoWrite stays correct for the SDK and vanilla sessions, so it was kept rather than removed.)

Synthesis quality

• Production-readiness security pass — for "should I adopt / build on X" questions, the recency self-check searches per-entity CVEs / advisories / breaking incidents (~12 mo) and persists findings as scored, citable evidence.
• Maturity quantified from the registry — weekly downloads (+ at most one usage figure) recorded as scored evidence, so the report states numbers rather than adjectives.
• Caveat discipline — non-extractable or single-sourced figures are flagged in-line; a headline number that carries weight is cross-checked against ≥ 2 independent sources.
• Recommendations can't rest on one weak source — a recommendation's primary quantitative justification may not rest on a single C/D-tier source.

Added

• verified source field (optional, nullable) — records the exact live-fetched value + date, e.g. npm dist-tags latest=19.2.6 @2026-05-22. Existing rows stay valid; the Stop-hook audit is unaffected and stays fail-open.

Install / update: plugin users run /plugin marketplace update. SDK: pipx install --force "git+https://github.com/richer-richard/cc-research.git@v1.1.2#subdirectory=sdk".