@firatcand/roster 0.1.0 → 1.0.0

package/skills/roster-orchestrator/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: roster-orchestrator
-description: "Bootstraps roster workspaces. On chat session start, surfaces pending HITL items as a single banner. On a scheduled fire, verifies the schedule is registered, dispatches the named agent via the host tool's native subagent primitive, writes a run log + state.md entry, and exits. Reads roster/<function>/schedules.yaml and roster/<function>/pending/. Subscription-billed primitives only — never invokes claude -p, claude --prompt, claude api, or the Anthropic SDK."
-version: "0.1.0"
+description: "Bootstraps roster workspaces. On chat session start, surfaces pending HITL items as a single banner. On a scheduled fire, verifies the schedule is registered, resolves the agent's merged env, dispatches the named agent via the host tool's native subagent primitive, writes a run log + state.md entry, and exits. Reads roster/<function>/schedules.yaml plus pending items at both roster/<function>/pending/ (error class) and <function>/<agent>/pending/ (lesson class). Subscription-billed primitives only — never invokes claude -p, claude --prompt, claude api, or the Anthropic SDK."
+version: "1.0.0"
 trigger_conditions:
-  - "Session start in a roster workspace (CONTEXT.md / CLAUDE.md / AGENTS.md present at cwd)"
-  - "A scheduled fire prompt names a roster agent (e.g., 'Run sdr cold-outreach for _demo')"
+  - "Session start in a roster workspace (CLAUDE.md / AGENTS.md / CONTEXT.md present at cwd)"
+  - "A scheduled fire prompt names a roster agent (e.g., 'Run sdr cold-outreach')"
   - "User invokes /roster-orchestrator"
 ---
 
@@ -12,32 +12,34 @@ trigger_conditions:
 
 The bootstrap entry point for every fresh CLI session in a roster workspace. Two modes:
 
-1. **Chat-session bootstrap** — surface a single banner if `roster/*/pending/` has items.
-2. **Scheduled fire** — verify the fire matches a registered schedule, dispatch the named agent, log the run, exit.
+1. **Chat-session bootstrap** — surface a single banner if any HITL surface has items.
+2. **Scheduled fire** — verify the fire matches a registered schedule, resolve the agent's merged env, dispatch the named agent, log the run, exit.
 
 The skill is **stateless**. It re-reads disk on every invocation so `/clear` and fresh fires both work identically.
 
 ## Working directory
 
-Operate from the workspace root only — the directory containing `CONTEXT.md` (or the `CLAUDE.md` / `AGENTS.md` symlink that points to it) plus a `roster/` directory. If invoked elsewhere, abort with:
+Operate from the workspace root only — the directory containing `config/project.yaml` (the v1 workspace identity file) plus a `roster/` directory (scheduler namespace). If invoked elsewhere, abort with:
 
-> Run roster-orchestrator from your roster workspace root (must contain CONTEXT.md and roster/).
+> Run roster-orchestrator from your roster workspace root (must contain config/project.yaml and roster/).
 
 ## Mode detection
 
 Inspect the initial prompt:
 
-- If it matches a scheduled-fire shape (`Run <agent> <plan> for <project>`, `Use the <agent> skill to <plan> for <project>`, etc.) → **scheduled-fire mode**.
+- If it matches a scheduled-fire shape (`Run <agent> <plan>`, `Use the <agent> skill to <plan>`, etc.) → **scheduled-fire mode**.
 - Otherwise → **chat-session-bootstrap mode**.
 
 When ambiguous, default to chat-session-bootstrap (it is the safe no-op when no fire is happening).
 
 ## Mode 1 — Chat-session bootstrap
 
-1. Walk `roster/*/pending/` across all functions (`gtm`, `product`, `design`, `ops`, `marketing`, …).
-2. Count files matching `*.md` (one HITL item per file).
-3. If count == 0 → print nothing, exit silently.
-4. If count > 0 → print one banner line and stop:
+1. Walk both HITL surfaces:
+   - **Error class** — `roster/<function>/pending/*.md` across all functions (synthesized by `roster pending sync` from non-zero cron exit codes / STALE detection).
+   - **Lesson class** — `<function>/<agent>/pending/*.md` across all agents (drafted by the dreamer skill).
+2. Count files matching `*.md` in each surface. Sum the counts (no dedupe — error and lesson namespaces are disjoint).
+3. If sum == 0 → print nothing, exit silently.
+4. If sum > 0 → print one banner line and stop:
    ```
    ⚠ N pending HITL items — run `roster review`
    ```
@@ -47,22 +49,48 @@ No other side effects. Do not read item bodies. Do not modify any file.
 
 ## Mode 2 — Scheduled fire
 
-1. Parse the fire prompt for `<agent>`, `<plan>`, `<project>`.
+1. Parse the fire prompt for `<agent>` and `<plan>`.
    - Preferred shape: `<function>/<agent>` (e.g., `gtm/sdr`). Use this whenever the prompt provides it.
    - Bare-agent shape (e.g., `sdr`): resolve by scanning `<function>/<agent>/` for exactly one matching directory. If zero or more than one match, abort with the parsed fields and the candidate functions.
-   - Refuse if `<agent>`, `<plan>`, or `<project>` is missing — list which one.
+   - Refuse if `<agent>` or `<plan>` is missing — list which one.
 2. Load `roster/<function>/schedules.yaml` using the resolved function from step 1.
-3. Verify an entry exists in `schedules.yaml` with matching `agent` + `plan` + `project`. If not, abort with:
-   > Schedule not registered: <function>/<agent>/<plan> for <project>. Use `roster schedule list` to see registered schedules.
-4. Dispatch the named agent via the host tool's subagent primitive (see "Subagent dispatch" below). Block until the subagent returns. The subagent runs in isolated context; nothing leaks back here.
-5. Append a single line to `roster/<function>/state.md`. Exact format (one line, three fields, pipe-separated with surrounding single spaces):
+3. Verify a matching entry exists (2-tuple lookup):
    ```
-   <utc-iso-8601> | <function>/<agent>/<plan>/<project> | <status>
+   match = none
+   for entry in schedules_yaml.schedules:
+     if entry.agent == "<function>/<agent>" and entry.plan == "<plan>":
+       match = entry
+       break
+   if match is none:
+     abort "Schedule not registered: <function>/<agent>/<plan>. Use `roster schedule list` to see registered schedules."
+   ```
+4. Resolve the agent's merged env via `resolveAgentEnv` (see "Env resolution" below). The dispatch primitive must see this merged env.
+5. Dispatch the named agent via the host tool's subagent primitive (see "Subagent dispatch" below). Block until the subagent returns. The subagent runs in isolated context; nothing leaks back here.
+6. Append a single line to `roster/<function>/state.md`. Exact format (one line, three fields, pipe-separated with surrounding single spaces):
+   ```
+   <utc-iso-8601> | <function>/<agent>/<plan> | <status>
    ```
    - `<utc-iso-8601>`: UTC, second precision, `Z` suffix. Example: `2026-05-16T14:09:00Z`.
    - `<status>`: exactly one of `success` or `failed`. No other values.
-6. The subagent itself is responsible for the full run log at `<function>/<agent>/projects/<project>/log/runs/<ts>.md`. Do not write that file from here.
-7. Exit cleanly. Do not start a new turn.
+7. The subagent itself is responsible for the full run log at `<function>/<agent>/logs/runs/<YYYY-MM>/<ts>.md` (path flattened in v1). Do not write that file from here.
+8. Exit cleanly. Do not start a new turn.
+
+## Env resolution
+
+The dispatched subagent needs workspace-wide secrets plus any agent-specific overrides. v1 ships a pure loader for this:
+
+```ts
+import { resolveAgentEnv } from '<roster-internal>';   // src/lib/env-merge.ts
+const env = resolveAgentEnv(workspaceRoot, "<function>/<agent>");
+```
+
+Precedence (each key resolved independently):
+
+1. `<function>/<agent>/.env` — if the key is defined, use that value. Empty string = explicit unset (does NOT fall through).
+2. `/.env` (workspace) — if the key is defined, use that value.
+3. Otherwise the key is unset.
+
+The orchestrator must ensure the merged env is materialized in the dispatch primitive's environment before the subagent runs — apply via the host's env-application mechanism (Claude `Task` env hand-off, Codex agent env, Gemini equivalent). Subscription-safety: only `.env` values are loaded; never inherit API-key shell exports from the user's interactive session. For scheduled fires this is reinforced upstream by the cron wrap (`env -i`).
 
 ## Subagent dispatch
 
@@ -75,7 +103,7 @@ Use the `Task` tool with `run_in_background: false`:
 ```
 Task(
   subagent_type="<agent>",
-  prompt="Run plan <plan> for project <project>",
+  prompt="Run plan <plan>",
   run_in_background=false,
 )
 ```
@@ -86,7 +114,7 @@ The subagent runs in isolated context. The return value is a short status string
 
 Invoke the subagent via natural language. Codex resolves the agent name against `~/.codex/agents/<agent>.toml`:
 
-> Use the `<agent>` subagent to run plan `<plan>` for project `<project>`.
+> Use the `<agent>` subagent to run plan `<plan>`.
 
 Wait for the subagent to return its status, then proceed to the state.md write.
 
@@ -116,7 +144,7 @@ If you encounter a workflow that seems to require one of the above, stop and sur
 ## Failure modes
 
 - **Cwd not a roster workspace** → abort with the message above.
-- **Fire prompt missing agent/plan/project** → abort, list the parsed fields.
+- **Fire prompt missing agent or plan** → abort, list the parsed fields.
 - **Schedule not registered** → abort with the `roster schedule list` pointer.
 - **Subagent dispatch fails** → write `status=failed` to state.md, do not retry. Failure-class HITL items are created by the next session-start (ROS-42 / failure observability).
 - **`roster/` directory missing** → first run on a fresh init; treat as zero pending items, exit cleanly.

package/templates/CLAUDE.project.template.md

@@ -37,7 +37,7 @@ format, project structure. When the convention isn't clear, ask before guessing.
 - Call agents across projects. An agent on Project A cannot invoke a different project's
   instance of itself.
 - Invent tools, connectors, or capabilities. If something isn't available, say so.
-- Write secrets, API keys, or credentials to any file under version control.
+- Commit secrets, API keys, or credentials to git. Tool API keys your agents need (Apollo, HeyReach, Slack, Linear, etc.) belong in `.env`, which is gitignored.
 
 ## When in doubt
 

package/templates/CONTEXT.template.md

@@ -29,7 +29,7 @@ This directive applies to both scheduled fires and interactive chat sessions.
 
 - `chief-of-staff/` — repo maintenance and project wiring
 - `dreamer/` — reflection; promotes lessons to playbooks
-- `gtm/sdr/` — outbound sales development
+- `gtm/`, `product/`, `design/`, `ops/` — function dirs with an `EXPERT.md`; populate with agents via `/chief-of-staff create-agent <function> <agent>`
 - `<function>/<agent>/agent.md` — contract for each agent (inputs, steps, tools, outputs)
 
 ## Key files
@@ -43,7 +43,7 @@ This directive applies to both scheduled fires and interactive chat sessions.
 - Modify agent contracts during a run (that is a deliberate, separate task).
 - Invoke agents across project boundaries.
 - Invent tools, MCP servers, or capabilities that are not installed.
-- Write secrets or credentials to any tracked file.
+- Commit secrets or credentials to git. Tool API keys your agents need (Apollo, HeyReach, Slack, Linear, etc.) belong in `.env`, which is gitignored.
 
 ## When in doubt
 

package/templates/gitignore-defaults.txt

@@ -3,6 +3,8 @@
 # Secrets and credentials
 .env
 .env.local
+/.env
+**/.env
 *.pem
 *.key
 

package/templates/hooks/banner.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+# roster:hitl-banner:v2 — SessionStart hook for Claude Code and Codex CLI.
+#
+# 1. (ROS-42) If `roster` is on PATH, run `roster pending sync --silent` with
+#    a 5s timeout to synthesize HITL items from any failed-fire signals
+#    (.exit non-zero + STALE detections). Silent on success, silent on
+#    skip-because-no-roster, silent on timeout.
+# 2. Count pending HITL items in $PWD/roster/<function>/pending/*.md and
+#    print one banner line if count > 0. Silent when count is 0.
+#
+# Self-contained POSIX shell — Step 1 is best-effort opt-in, never blocks
+# the session. Step 2 stays under the <200ms latency budget (p50 ~25ms).
+#
+# Installed by `roster hooks install` to:
+#   ~/.claude/hooks/roster-banner.sh
+#   ~/.codex/hooks/roster-banner.sh
+
+set -u
+
+# Run only inside roster workspaces. Quiet exit otherwise so non-roster
+# sessions get zero overhead beyond shell startup.
+[ -d "$PWD/roster" ] || exit 0
+
+# Step 1: failed-fire synthesis (best-effort).
+# Requires both `roster` on PATH AND a `timeout` binary. Skip silently
+# otherwise — better to miss a sync than to block SessionStart on a slow
+# workspace (codex review impl-pass: an unbounded fallback ran `roster
+# pending sync` with no time cap; if disk was slow the user's first Claude
+# Code message could be delayed seconds). Doctor remains the deterministic
+# way to surface failed fires for users without a timeout binary.
+if command -v roster >/dev/null 2>&1; then
+  if command -v timeout >/dev/null 2>&1; then
+    timeout 5 roster pending sync --silent --cwd "$PWD" >/dev/null 2>&1 || true
+  elif command -v gtimeout >/dev/null 2>&1; then
+    gtimeout 5 roster pending sync --silent --cwd "$PWD" >/dev/null 2>&1 || true
+  fi
+fi
+
+# Step 2: banner. `find … | wc -l` returns 0 on empty, never errors on
+# absent subdirs thanks to `-path` matching against a non-existent prefix
+# being a no-op (the explicit `2>/dev/null` covers any read-permission
+# edge case).
+count=$(find "$PWD/roster" -mindepth 3 -maxdepth 3 -type f -name '*.md' -path '*/pending/*.md' 2>/dev/null | wc -l | tr -d ' ')
+
+if [ "${count:-0}" -gt 0 ]; then
+  printf '⚠ %s pending HITL items — run `roster review`\n' "$count"
+fi

package/templates/scaffold/chief-of-staff/README.md

@@ -1,12 +1,12 @@
 # Chief of Staff Agent
 
-Operates on the agent-team repo itself. Scaffolds empty structure for new projects/agents, archives, renames, audits.
+Operates on the agent-team workspace itself. Scaffolds empty structure for new agents and functions, audits.
 
 This agent is the empty-structure scaffolder. It produces folders and template files in their default placeholder state. Filling content (voice, ICPs, brand) is a separate concern handled outside this agent.
 
 ## Why this is one agent at top level
 
-Cross-cutting infrastructure — operates on every function and every project, doesn't have its own per-project instances. Lives at the same level as `dreamer/` for the same reason.
+Cross-cutting infrastructure — operates on every function and every agent. Lives at the same level as `dreamer/` for the same reason.
 
 ## Files
 
@@ -16,7 +16,7 @@ Cross-cutting infrastructure — operates on every function and every project, d
 
 ## Invocation
 
-From repo root, in an interactive Claude Code session:
+From the workspace root, in an interactive Claude Code session:
 
 ```bash
 cd /path/to/agent-team
@@ -25,26 +25,23 @@ claude
 
 Then ask the agent to perform an operation:
 
-- "Create a new project called myproject with gtm/sdr and gtm/twitter-agent"
-- "Archive the test-scaffold project"
-- "Audit Acme Corp"
-- "Add content-agent to _demo"
-- "Rename project oldname to newname"
+- "Create a new gtm/sdr agent"
+- "Create a new function called ops"
+- "Audit the gtm/sdr agent"
 - "Audit the whole repo"
 
 The agent will:
-1. Confirm cwd is repo root
+1. Confirm cwd is the workspace root
 2. Parse intent, restate parameters back to you
-3. Show a plan before destructive ops, ask "proceed?"
+3. Show the paths it plans to create or modify
 4. Execute by invoking the appropriate `scripts/*.sh`
 5. Report what changed
 6. Never auto-commit (you commit manually)
 
 ## Operations supported
 
-- `create-project`, `create-agent`, `add-agent-to-project`
-- `remove-agent-from-project`, `archive-project`, `unarchive-project`, `rename-project`
-- `audit-project`, `audit-agent`, `audit-repo`
+- `create-agent`, `create-function`
+- `audit-agent`, `audit-repo`
 
 See `agent.md` for the full contract and confirmation rules.
 
@@ -52,14 +49,8 @@ See `agent.md` for the full contract and confirmation rules.
 
 | Operation | Backing script | Result location |
 |---|---|---|
-| create-project | `scripts/new-project.sh` | `projects/<project>/` + optional instances |
 | create-agent | `scripts/new-agent.sh` | `<function>/<agent>/` |
-| add-agent-to-project | `scripts/new-agent-instance.sh` | `<function>/<agent>/projects/<project>/` |
-| remove-agent-from-project | `scripts/remove-agent-from-project.sh` | moved to `_archive/<function>/<agent>/projects/<project>-<date>/` |
-| archive-project | `scripts/archive-project.sh` | moved to `_archive/projects/<project>-<date>/` (+ all instances) |
-| unarchive-project | `scripts/unarchive-project.sh` | restored from `_archive/` |
-| rename-project | `scripts/rename-project.sh` | folders + content updates everywhere |
-| audit-project | `scripts/audit-project.sh` | report at `chief-of-staff/logs/<YYYY-MM>/audit-*.md` |
+| create-function | `scripts/create-function.sh` | `<function>/` |
 | audit-agent | `scripts/audit-agent.sh` | report at `chief-of-staff/logs/<YYYY-MM>/audit-*.md` |
 | audit-repo | `scripts/audit-repo.sh` | report at `chief-of-staff/logs/<YYYY-MM>/audit-repo-*.md` |
 
@@ -78,9 +69,10 @@ You manually sync to GitHub. The chief-of-staff agent surfaces what changed; you
 All operations have backing scripts that work standalone:
 
 ```bash
-bash scripts/new-project.sh myproject
-bash scripts/archive-project.sh test-scaffold "no longer needed"
-bash scripts/audit-project.sh _demo
+bash scripts/new-agent.sh gtm sdr
+bash scripts/create-function.sh ops
+bash scripts/audit-agent.sh gtm sdr
+bash scripts/audit-repo.sh
 ```
 
-The chief-of-staff agent wraps these with intent-parsing, validation, confirmations, and orchestration (e.g., create-project + create-instances in one operation). Scripts are the source of truth for what each operation actually does.
+The chief-of-staff agent wraps these with intent-parsing, validation, and confirmations. Scripts are the source of truth for what each operation actually does.

package/templates/scaffold/chief-of-staff/agent.md

@@ -2,37 +2,36 @@
 
 ## Purpose
 
-Operate on the agent-team repo itself. Scaffold empty structure for new projects/agents, archive completed projects, rename, audit completeness. This agent does not run business workflows — it manages the structure those workflows live in.
+Operate on the agent-team workspace itself. Scaffold empty structure for new agents and functions, audit completeness. This agent does not run business workflows — it manages the structure those workflows live in.
 
-In **stub mode** (`create-agent`/`create-project` invoked headlessly or with `mode=stub`), this agent is an empty-structure scaffolder: it creates folders and template files in their default placeholder state — `voice.md` will say `<3 adjectives describing...>`, ICPs are `_persona-template.md`, agent purpose reads `<one paragraph...>`, and so on. In **guided mode** (the default when invoked interactively), `create-agent` runs the Guided Agent Creation dialogue defined in `skills/chief-of-staff/SKILL.md` and produces an `agent.md` with purpose, inputs, steps, tools, and subagents filled in from the dialogue answers — see that contract for the full prompt sequence. Filling project guidelines with real content remains a separate concern handled by function-level experts (a content agent, an expert, or templated generation from existing brand assets).
+In **stub mode** (`create-agent` invoked headlessly or with `mode=stub`), this agent is an empty-structure scaffolder: it creates folders and template files in their default placeholder state — `voice.md` will say `<3 adjectives describing...>`, ICPs are `_persona-template.md`, agent purpose reads `<one paragraph...>`, and so on. In **guided mode** (the default when invoked interactively), `create-agent` runs the Guided Agent Creation dialogue defined in `skills/chief-of-staff/SKILL.md` and produces an `agent.md` with purpose, inputs, steps, tools, and subagents filled in from the dialogue answers — see that contract for the full prompt sequence. Filling guidelines with real content remains a separate concern handled by function-level experts (a content agent, an expert, or templated generation from existing brand assets).
 
 When in doubt, defer to `conventions.md` for the canonical structure schema and to the `_template/` directories for the canonical scaffold contents. This agent does not duplicate those — it tells you how to USE them.
 
 ## Working directory
 
-This agent operates from repo root only. If invoked from elsewhere, abort with: "Run chief-of-staff from agent-team repo root."
+This agent operates from workspace root only. If invoked from elsewhere, abort with: "Run chief-of-staff from agent-team workspace root."
 
 ## Inputs
 
 The orchestrator (slash command or natural-language invocation) expects:
 
-- `plan`: name of a plan in `chief-of-staff/plans/` (e.g., `archive-project`, `audit-repo`)
+- `plan`: name of a plan in `chief-of-staff/plans/` (e.g., `create-agent`, `audit-repo`)
 - Per-plan inputs (positional or named — see each plan's `inputs:` block)
 
 Inputs may arrive in natural language. Parse intent, confirm parameters, then run the operation. Examples:
 
-- "Create a new project called myproject with sdr and twitter-agent" → `create-project project=myproject agents=[gtm/sdr, gtm/twitter-agent]`
-- "Archive test-scaffold" → `archive-project project=test-scaffold`
-- "Audit Acme Corp" → `audit-project project=_demo`
-- "Add content-agent to _demo" → `add-agent-to-project project=_demo function=gtm agent=content-agent`
+- "Create a new sdr agent under gtm" → `create-agent function=gtm agent=sdr`
+- "Add a new function called ops" → `create-function function=ops`
+- "Audit the gtm/sdr agent" → `audit-agent function=gtm agent=sdr`
+- "Audit the whole repo" → `audit-repo`
 
 Read at runtime:
 
 - `agent.md` (this file)
 - `chief-of-staff/plans/<plan>.yaml` — the operation recipe
 - `conventions.md` — canonical structure schema
-- `projects/_template/` — project template
-- `<function>/<agent>/projects/_template/` — agent instance template (for the relevant agent)
+- `<function>/_template/` — agent template (for the relevant function)
 - `chief-of-staff/playbook/` — global lessons about scaffolding (naming conventions, common mistakes)
 
 ## Plans
@@ -41,43 +40,34 @@ This agent runs via plans in `chief-of-staff/plans/`. Each plan wraps a backing
 
 | Plan | Description | Destructive? |
 |---|---|---|
-| `create-project` | Create a new project, optionally with agent instances | no |
 | `create-agent` | Create a new global agent under a function | no |
 | `create-function` | Add a new function category to the registry | no |
-| `add-agent-to-project` | Add an agent instance to an existing project | no |
-| `remove-agent-from-project` | Archive an agent instance (preserved in _archive) | yes |
-| `archive-project` | Archive a project + all its instances | yes |
-| `unarchive-project` | Restore an archived project | no |
-| `rename-project` | Rename a project everywhere it appears | yes |
-| `audit-project` | Validate a project's completeness; reports issues with suggested fixes | no |
-| `audit-agent` | Validate an agent's structure and instances | no |
-| `audit-repo` | Full repo audit aggregating project + agent reports | no |
+| `audit-agent` | Validate an agent's structure | no |
+| `audit-repo` | Full workspace audit aggregating agent reports | no |
 
 Invoke a plan via the slash command:
 
 ```
-/chief-of-staff create-project myproject with gtm/sdr
-/chief-of-staff archive-project test-scaffold
+/chief-of-staff create-agent gtm sdr
+/chief-of-staff create-function ops
 /chief-of-staff audit-repo
 ```
 
 Or in natural language:
 
 ```
-"Run chief-of-staff archive-project for test-scaffold"
+"Run chief-of-staff audit-repo"
 ```
 
 When invoked without a plan, lists available plans and asks which to run.
 
-Destructive plans (`archive-project`, `unarchive-project`, `remove-agent-from-project`, `rename-project`) always show the planned changes and ask "proceed?" before executing. The cross-link prompts in `create-project` (which agents to instance) and `create-agent` (which projects to instance into) are also session-only — they cannot be answered headlessly. Power users skip the prompt by passing `agents` or `add-to-projects` inline.
-
 ## Common preamble for every plan
 
-1. **Confirm cwd is repo root.** Check for presence of `CLAUDE.md`, `conventions.md`, `gtm/`, `projects/`. If not all present, abort.
+1. **Confirm cwd is workspace root.** Check for presence of `CLAUDE.md`, `conventions.md`. If not present, abort.
 2. **Parse the user's request.** Extract plan name + parameters. If ambiguous, ask before proceeding.
-3. **Show the plan.** For destructive plans, summarize what will happen and ask "proceed?". Always include the list of paths that will be created, modified, or moved.
+3. **Show the plan.** Always include the list of paths that will be created or modified.
 4. **Execute by invoking the plan's backing script.** All operations are backed by a script in `scripts/`. The script does the work; this agent orchestrates and parses output.
-5. **Report.** Summarize what changed (paths created/modified/moved). Note anything skipped or warnings.
+5. **Report.** Summarize what changed (paths created/modified). Note anything skipped or warnings.
 6. **Never auto-commit to git.** Leave commits for the user.
 
 ## Subagents
@@ -102,21 +92,21 @@ Per-plan output schemas are declared in each plan's `outputs:` block.
 
 `approval_channel: session` — this agent is invoked interactively, never via cron. All confirmations happen in-session.
 
-Confirmation gates are MANDATORY for: `archive-project`, `unarchive-project`, `rename-project`, `remove-agent-from-project`. They display the plan and ask "proceed?" before executing.
+None of the current plans are destructive. If a future plan mutates or removes user content, add a mandatory confirmation gate that displays the plan and asks "proceed?" before executing.
 
 ## Lessons protocol
 
-When you observe a pattern across operations — e.g., "users frequently forget to run create-agent before create-project for that agent's instance" — log it as a candidate lesson in the operation's log entry, in a `## Candidate lessons` section. The dreamer picks it up next pass and may write a `chief-of-staff/playbook/L-...md` lesson.
+When you observe a pattern across operations — e.g., "users frequently invoke create-agent before create-function and end up with orphaned slugs" — log it as a candidate lesson in the operation's log entry, in a `## Candidate lessons` section. The dreamer picks it up next pass and may write a `chief-of-staff/playbook/L-...md` lesson.
 
 Do NOT write to `chief-of-staff/playbook/` directly during operations. The user may write a lesson by hand with `source: human`.
 
 ## Failure modes
 
-- **Cwd not repo root**: abort with clear message
+- **Cwd not workspace root**: abort with clear message
 - **Invalid slug or function name**: abort with example of valid format
 - **Collision (target already exists)**: abort, tell user the existing path
-- **Missing dependency (e.g., agent doesn't exist for create-instance)**: abort, suggest the prerequisite plan
+- **Missing dependency (e.g., function doesn't exist when running `create-agent`)**: abort, suggest the prerequisite plan
 - **Script fails**: surface the script's stderr; don't attempt to recover by doing the work directly
 - **YAML/JSON parse error in audit**: report as failure with line number from the audit script
 - **Confirmation gate denied**: abort cleanly, no changes
-- **Partial failure mid-operation**: scripts handle their own rollback. If a script reports partial state, surface exactly what state the repo is in and what to do next.
+- **Partial failure mid-operation**: scripts handle their own rollback. If a script reports partial state, surface exactly what state the workspace is in and what to do next.

package/templates/scaffold/chief-of-staff/plans/audit-agent.yaml

@@ -1,9 +1,9 @@
 plan: audit-agent
 description: |
-  Validate a global agent's structure and all its instances. Checks required
-  agent.md sections, README, .mcp.json, .claude/settings.json, subagents,
-  playbook, projects/_template/, plans/, slash command, and per-instance
-  config validity.
+  Validate one agent at its flat shape `<function>/<agent>/`. Checks required
+  agent.md sections, README.md, config.yaml, .env (optional, agent-scoped),
+  .mcp.json, .claude/settings.json, subagents/, playbook/, plans/, and the
+  slash command at .claude/commands/<agent>.md.
 
 inputs:
   function:

package/templates/scaffold/chief-of-staff/plans/audit-repo.yaml

@@ -1,9 +1,10 @@
 plan: audit-repo
 description: |
-  Full-repo audit. Runs project audits for every live project and agent
-  audits for every live agent. Aggregates into one report. Also checks
-  universal .mcp.json, universal .claude/settings.json, root CLAUDE.md /
-  conventions.md / README.md, and orphaned instances.
+  Full workspace audit. Runs agent audits for every live agent and aggregates
+  into one report. Also checks workspace completeness: root CLAUDE.md,
+  conventions.md, README.md, config/project.yaml, guidelines/,
+  .config/functions.yaml, universal .mcp.json, and universal
+  .claude/settings.json.
 
 inputs: {}
 

package/templates/scaffold/chief-of-staff/plans/create-agent.yaml

@@ -11,8 +11,8 @@ description: |
     Produces the same on-disk layout as stub mode, but with agent.md
     sections filled in from the dialogue answers.
 
-  Either mode optionally instances the resulting agent into existing
-  projects (or prompts the caller to pick).
+  Agents scaffold at `<function>/<agent>/` — flat shape, no per-project
+  instances.
 
 inputs:
   function:
@@ -26,13 +26,9 @@ inputs:
     description: |
       Explicit branch override: `stub` or `guided`. If omitted, `resolve_mode`
       picks based on env + TTY (see that step).
-  add-to-projects:
-    required: false
-    description: List of project slugs to instance into. If omitted, the cross-link prompt runs.
 
 outputs:
   agent_path: string
-  instance_paths: list
   mode_used: string         # "stub" or "guided" — which branch executed.
   files_written: list       # absolute paths of every file the plan created or modified.
 
@@ -42,8 +38,7 @@ steps:
       Confirm ${inputs.function} is registered. Validate ${inputs.agent} slug
       against `^[a-z][a-z0-9-]*$`. Confirm `${inputs.function}/${inputs.agent}/`
       does not already exist. If ${inputs.mode} is provided, validate it is
-      one of {stub, guided}. If ${inputs.add-to-projects} provided, validate
-      each project exists at `projects/<slug>/`. If any are missing, abort.
+      one of {stub, guided}.
 
   - id: resolve_mode
     description: |
@@ -81,34 +76,10 @@ steps:
       `TODO: fill in description` placeholder. Append every file touched
       to `${files_written}`.
 
-  - id: resolve_projects
-    description: |
-      Branch on whether ${inputs.add-to-projects} was provided.
-      - If provided: use the list directly.
-      - If omitted: discover all live projects (every dir under `projects/`
-        that is not `_template` and does not start with `_`). If empty,
-        skip instancing and report "no live projects yet."
-        Otherwise present a multi-select via AskUserQuestion with options
-        [All projects, ...each project, None — agent stays global-only]
-        and `multiSelect: true`.
-
-  - id: instance_into_projects
-    tool: bash
-    args:
-      command: |
-        for proj in ${resolved_projects}; do
-          bash scripts/new-agent-instance.sh "$proj" ${inputs.function} ${inputs.agent}
-        done
-    description: |
-      For each resolved project, run `new-agent-instance.sh` and append the
-      instance line to `projects/<project>/CLAUDE.md` under
-      `## Active agent instances`. Append every created instance path to
-      `${files_written}`.
-
   - id: report
     description: |
-      Print `${outputs.mode_used}`, the global agent path, every instance
-      path, and the full `${files_written}` list.
+      Print `${outputs.mode_used}`, the agent path, and the full
+      `${files_written}` list.
 
       In **stub** mode, surface the script's "Next steps" output verbatim
       (fill `agent.md`, add subagents, configure MCPs, add at least one

package/templates/scaffold/config/project.yaml.template

@@ -0,0 +1,10 @@
+# Roster project identity.
+# After roster init: name and display_name are substituted with your project.
+# Edit the remaining fields (stage, audience, motion, created) before running agents.
+
+name: {{PROJECT_NAME}}            # required — kebab-case slug (substituted by roster init)
+display_name: "{{DISPLAY_NAME}}"  # required — human-readable name (substituted by roster init)
+stage: pre-launch                 # one of: pre-launch | post-launch | scaling | mature
+audience: ""                      # one-line description of who you sell to (fill in)
+motion: outbound                  # one of: outbound | inbound | plg | hybrid
+created: ""                       # yyyy-mm-dd — your project's kickoff date (fill in)