@firatcand/roster 0.4.0 → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (76) hide show
  1. package/README.md +77 -220
  2. package/agents/lesson-drafter.md +3 -8
  3. package/agents/pattern-detector.md +0 -1
  4. package/bin/roster.js +168 -57
  5. package/package.json +2 -3
  6. package/skills/chief-of-staff/SKILL.md +62 -78
  7. package/skills/dreamer/SKILL.md +8 -7
  8. package/skills/roster-orchestrator/SKILL.md +53 -25
  9. package/templates/CLAUDE.project.template.md +1 -1
  10. package/templates/CONTEXT.template.md +2 -2
  11. package/templates/gitignore-defaults.txt +2 -0
  12. package/templates/scaffold/chief-of-staff/README.md +16 -24
  13. package/templates/scaffold/chief-of-staff/agent.md +22 -32
  14. package/templates/scaffold/chief-of-staff/plans/audit-agent.yaml +4 -4
  15. package/templates/scaffold/chief-of-staff/plans/audit-repo.yaml +5 -4
  16. package/templates/scaffold/chief-of-staff/plans/create-agent.yaml +5 -34
  17. package/templates/scaffold/config/project.yaml.template +10 -0
  18. package/templates/scaffold/conventions.md +159 -171
  19. package/templates/scaffold/dreamer/README.md +2 -2
  20. package/templates/scaffold/dreamer/agent.md +0 -1
  21. package/templates/scaffold/dreamer/plans/nightly-reflection.yaml +23 -37
  22. package/templates/scaffold/dreamer/subagents/lesson-drafter.md +2 -7
  23. package/templates/scaffold/{projects/_demo/guidelines → guidelines}/asset-links.md +4 -0
  24. package/templates/scaffold/{projects/_demo/guidelines → guidelines}/brand-book.md +4 -0
  25. package/templates/scaffold/{projects/_demo/guidelines → guidelines}/messaging.md +4 -0
  26. package/templates/scaffold/{projects/_demo/guidelines → guidelines}/voice.md +4 -0
  27. package/templates/scaffold/scripts/audit-agent.sh +74 -47
  28. package/templates/scaffold/scripts/audit-repo.sh +27 -49
  29. package/templates/scaffold/scripts/create-function.sh +1 -1
  30. package/templates/scaffold/scripts/lib/README.md +1 -1
  31. package/templates/scaffold/scripts/lib/bindings-prompt.sh +41 -124
  32. package/templates/scaffold/scripts/new-agent.sh +97 -91
  33. package/templates/scaffold/scripts/rename-agent.sh +91 -0
  34. package/templates/scaffold/scripts/save-state.sh +32 -0
  35. package/agents/critic.md +0 -74
  36. package/agents/enricher.md +0 -56
  37. package/agents/promotion-arbiter.md +0 -71
  38. package/agents/prospector.md +0 -51
  39. package/agents/writer.md +0 -58
  40. package/skills/sdr/SKILL.md +0 -147
  41. package/templates/scaffold/chief-of-staff/plans/add-agent-to-project.yaml +0 -45
  42. package/templates/scaffold/chief-of-staff/plans/archive-project.yaml +0 -51
  43. package/templates/scaffold/chief-of-staff/plans/audit-project.yaml +0 -34
  44. package/templates/scaffold/chief-of-staff/plans/create-project.yaml +0 -65
  45. package/templates/scaffold/chief-of-staff/plans/remove-agent-from-project.yaml +0 -50
  46. package/templates/scaffold/chief-of-staff/plans/rename-project.yaml +0 -62
  47. package/templates/scaffold/chief-of-staff/plans/unarchive-project.yaml +0 -41
  48. package/templates/scaffold/dreamer/subagents/promotion-arbiter.md +0 -64
  49. package/templates/scaffold/gtm/sdr/.claude/settings.json +0 -3
  50. package/templates/scaffold/gtm/sdr/.mcp.json +0 -21
  51. package/templates/scaffold/gtm/sdr/README.md +0 -41
  52. package/templates/scaffold/gtm/sdr/agent.md +0 -136
  53. package/templates/scaffold/gtm/sdr/plans/cold-outreach.yaml +0 -92
  54. package/templates/scaffold/gtm/sdr/projects/_demo/asset-references.md +0 -7
  55. package/templates/scaffold/gtm/sdr/projects/_demo/config/default.yaml +0 -69
  56. package/templates/scaffold/gtm/sdr/projects/_demo/log/feedback/.gitkeep +0 -0
  57. package/templates/scaffold/gtm/sdr/projects/_demo/log/runs/.gitkeep +0 -0
  58. package/templates/scaffold/gtm/sdr/projects/_demo/playbook/.gitkeep +0 -0
  59. package/templates/scaffold/gtm/sdr/subagents/critic.md +0 -67
  60. package/templates/scaffold/gtm/sdr/subagents/enricher.md +0 -49
  61. package/templates/scaffold/gtm/sdr/subagents/prospector.md +0 -44
  62. package/templates/scaffold/gtm/sdr/subagents/writer.md +0 -51
  63. package/templates/scaffold/projects/_demo/CLAUDE.md +0 -35
  64. package/templates/scaffold/projects/_demo/README.md +0 -16
  65. package/templates/scaffold/projects/_demo/assets/.gitkeep +0 -0
  66. package/templates/scaffold/projects/_demo/config/default.yaml +0 -28
  67. package/templates/scaffold/projects/_demo/state.md +0 -11
  68. package/templates/scaffold/scripts/archive-project.sh +0 -98
  69. package/templates/scaffold/scripts/audit-project.sh +0 -361
  70. package/templates/scaffold/scripts/new-agent-instance.sh +0 -114
  71. package/templates/scaffold/scripts/new-project.sh +0 -125
  72. package/templates/scaffold/scripts/remove-agent-from-project.sh +0 -67
  73. package/templates/scaffold/scripts/rename-project.sh +0 -118
  74. package/templates/scaffold/scripts/unarchive-project.sh +0 -115
  75. /package/templates/scaffold/gtm/{sdr/playbook/.gitkeep → .gitkeep} +0 -0
  76. /package/templates/scaffold/{projects/_demo/guidelines → guidelines}/icps/_persona-template.md +0 -0
package/README.md CHANGED
@@ -2,276 +2,133 @@
2
2
 
3
3
 
4
4
  [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
5
+ [![npm](https://img.shields.io/npm/v/@firatcand/roster.svg)](https://www.npmjs.com/package/@firatcand/roster)
5
6
 
6
7
  # Roster
7
8
 
8
- > A CLI that installs and scaffolds an opinionated multi-agent workspace for Claude Code today, with Codex CLI and Gemini support landing in v0.2 — role-based agents for GTM, product, design, and ops, with a reinforcement loop that compounds learning.
9
+ > **A lightweight operator agent framework.** A CLI that scaffolds role-based agents GTM, product, design, ops — into your existing AI coding tool, and runs them on schedules with human approval before anything ships.
9
10
 
10
- ## What is this?
11
-
12
- `@firatcand/roster` is an npm CLI. You run it once and it does two things:
13
-
14
- 1. **`roster install`** copies a curated set of skills and agent definitions into your AI coding tool's config dir. Detects and installs to `~/.claude/`, `~/.codex/`, and `~/.gemini/`.
15
- 2. **`roster init`** scaffolds a structured agent-team workspace in any directory. v0.1 produces the minimal scaffold (`CLAUDE.md` + `projects/_demo/`); v0.2 adds the full tree (function dirs, role-based agents, maintenance agent, reinforcement agent).
16
-
17
- The workspace it scaffolds separates **substrate** (strategic context: brand voice, ICPs, messaging) from **artifacts** (daily output: emails, posts, components), and runs work through named YAML **plans** that are deterministic, auditable, and schedule-friendly.
11
+ ```
12
+ ● 7am Monday. Three agents have already run while you slept.
13
+
14
+ ● gtm/sdr last night's signups triaged · 5 personalized intros queued
15
+ ● product/pm 3 competitor changelogs summarized · LinkedIn post drafted
16
+ ● design/critic yesterday's PR screenshots audited · 2 contrast issues flagged
17
+
18
+ All parked in your approval queue. You approve, edit, or reject over coffee.
19
+ ```
18
20
 
19
- If you're a solo founder or ≤5-person team using Claude Code (or Codex / Gemini) and you need outbound, content, design, and ops work done without losing context between sessions — this might fit.
21
+ | Pillar | What it means |
22
+ |---|---|
23
+ | **Lightweight** | One npm install. No servers, no databases, no SaaS layer. Tiny tarball, no proprietary DSL — your workspace is just markdown and YAML you own and can hand-edit. |
24
+ | **Subscription-safe** | Runs on the flat-rate [Claude Code](https://claude.com/code) or [Codex CLI](https://github.com/openai/codex) subscription you already pay for. No per-token API bills, no third-party agent platform. |
25
+ | **Operator-first** | Built by someone running a real business. GTM, product, design, and ops are first-class roles — not a chatbot wrapped in marketing copy. |
26
+ | **Schedule-native** | Agents run on cron-like schedules through your host tool's native scheduler. Daily morning runs, weekly competitor sweeps, PR-triggered design QA. |
27
+ | **HITL by default** | Risky outputs (emails, PR comments, social posts) land in `pending/` queues. Nothing ships until you say so. |
20
28
 
21
- ## Getting started
29
+ ---
22
30
 
23
- First-time install and first run — under 10 minutes on a Mac with Node ≥ 22.
31
+ ## Quick Install
24
32
 
25
33
  ```bash
26
- # 1. Install skills + agents into your AI tool's config dir
27
34
  npx @firatcand/roster install
35
+ ```
28
36
 
29
- # 2. Scaffold a workspace in a fresh directory
30
- mkdir my-team && cd my-team
31
- npx @firatcand/roster init
37
+ Detects Claude Code, Codex CLI, and Gemini, then copies skills + agents into each tool's config dir. macOS, Linux, and Windows.
32
38
 
33
- # 3. Open Claude Code in that directory
34
- claude
39
+ ## Setup prompt
35
40
 
36
- # 4. Run the demo SDR plan
37
- /sdr run cold-outreach for _demo
41
+ Want the agent to do the install for you? Paste this into Claude Code, Codex, or Cursor:
38
42
 
39
- # 5. Read the run log and provide feedback — lessons surface
40
- # in dreamer/pending/ on the next nightly reinforcement pass.
41
43
  ```
42
-
43
- [docs/HOWTO.md](docs/HOWTO.md) has the long-form step-by-step.
44
-
45
- ### What `roster install` looks like
46
-
44
+ Set up https://github.com/firatcand/roster for me. Read install.md and follow
45
+ the steps to install roster and scaffold a workspace in this directory.
47
46
  ```
48
- $ npx --yes @firatcand/roster install --all
49
47
 
50
- roster v0.1.0
51
- Multi-agent workspace scaffolder for Claude Code, Codex CLI, and Gemini.
48
+ The agent reads [install.md](install.md), runs the install, scaffolds your workspace, verifies with `roster doctor`, and tells you the next command.
49
+
50
+ ---
52
51
 
53
- Claude Code — 3 skills → ~/.claude/skills, 7 agents → ~/.claude/agents
54
- ✓ Codex CLI — 4 skills → ~/.codex/skills, 7 agents → ~/.codex/agents
55
- ✓ Gemini CLI — 3 skills → ~/.gemini/extensions, 7 agents → ~/.gemini/agents
52
+ ## Getting Started
56
53
 
57
- Next: roster init to scaffold a workspace.
54
+ ```bash
55
+ mkdir my-team && cd my-team
56
+ npx @firatcand/roster init my-team # scaffold workspace (config/, guidelines/, function dirs)
57
+ $EDITOR config/project.yaml # fill workspace identity (stage, audience, motion)
58
+ $EDITOR guidelines/voice.md # plus messaging.md, brand-book.md, icps/<persona>.md
59
+ cp templates/env.example .env # then chmod 600 .env and fill secrets
60
+ claude # or `codex`, or open Cursor
61
+ /chief-of-staff create-agent gtm sdr
58
62
  ```
59
63
 
60
- Without `--all`, you'll get an interactive checkbox to pick which tools to receive the skills + agents. Exit codes: 0 success, 1 error, 2 cancelled, 3 no tools detected.
64
+ The guided dialogue reads your `config/project.yaml` + `guidelines/` and interviews you for the gaps a stub can't fill subagents, tools, plan names, failure modes then writes a populated `agent.md`. Worked example in [docs/HOWTO.md](docs/HOWTO.md).
61
65
 
62
- ## Subcommands
66
+ ### Common commands
63
67
 
64
68
  | Command | What it does |
65
69
  |---|---|
66
- | `roster install` | Detect installed AI tools, prompt for selection, copy skills + agents into each tool's config dir. Idempotent. |
67
- | `roster install --all` | Install to every detected tool, non-interactive (good for CI / scripted migration). |
68
- | `roster install --tool <name>` | Install to a single named tool (`claude`, `codex`, or `gemini`), non-interactive. |
69
- | `roster init [name]` | Scaffold the agent-team workspace into CWD. Substitutes `{{PROJECT_NAME}}`. |
70
- | `roster doctor` | Audit installed skills/agents per AI tool; exits non-zero on drift. Includes a Scheduling section that runs `schedule validate` against the current workspace. |
71
- | `roster schedule validate` | Validate every `roster/<function>/schedules.yaml` file in the workspace. `--json` / `--silent` / `--cwd <dir>`. Exits non-zero on schema or cron errors. |
72
- | `roster review [function]` | Walk `roster/<function>/pending/*.md` HITL items interactively. Approve/reject/defer each; approved items move to the `target_on_approve:` path in their front-matter. `--json` for non-interactive listing. |
73
- | `roster hooks install` | Install SessionStart banner hooks into `~/.claude/settings.json` and `~/.codex/hooks.json` so any chat session in a roster workspace shows pending-HITL counts on start. Idempotent. `--tool claude\|codex\|all`. |
74
- | `roster migrate from-agent-team <dir>` | Migrate a legacy agent-team workspace into roster: walks discovered cron entries and emits `roster schedule install` commands to a reviewable shell script, copies pending HITL items, run logs, and `.env` (enforced 0600). Refuses with hint if `.env` is more permissive. `--dest <dir>` / `--dry-run` / `--force-resync` / `--json` / `--silent`. Idempotent via a per-source manifest at `.roster/migration-manifests/`. |
75
- | `roster --help` / `--version` | Usage + version from `package.json`. |
76
-
77
- Scheduling primitives (Phase 2.5) — see [docs/SCHEDULING.md](docs/SCHEDULING.md) for the platform × tool matrix, UI hand-off flows for Claude Desktop and Codex Automations, `codex --via cron` install, the Linux Claude gap, the Codex Windows subagent workaround, and the subscription-billing rules (including why `claude -p` is banned).
78
-
79
- ## Tool support
80
-
81
- | Tool | Status | Skills installed to | Agents installed to |
82
- |---|---|---|---|
83
- | Claude Code | Supported | `~/.claude/skills/<skill>/` (directory per skill) | `~/.claude/agents/<agent>.md` |
84
- | Codex CLI | Supported | `~/.codex/skills/<skill>/` (directory per skill) | `~/.codex/agents/<agent>.md` |
85
- | Gemini CLI | Supported | `~/.gemini/extensions/<skill>/` (directory per skill) | `~/.gemini/agents/<agent>.md` |
86
- | Cursor | **Out of scope** — see [docs/roadmap.md](docs/roadmap.md) | — | — |
87
-
88
- Detection is presence-only: roster considers a tool installed if its config root exists. Override via `ROSTER_CLAUDE_HOME` / `ROSTER_CODEX_HOME` / `ROSTER_GEMINI_HOME` (used by the test suite).
89
-
90
- ## What roster installs
91
-
92
- `roster install` copies three skills and seven agents into each detected tool's config dir. Skills are the entry points (one per agent function); agents are the building blocks the skills call.
93
-
94
- **Skills**
95
-
96
- | Skill | Purpose |
97
- |---|---|
98
- | `chief-of-staff` | Repo maintenance for roster workspaces — create, archive, rename, and audit projects, agents, and functions. Wraps `scripts/` with confirmation gates for destructive operations. |
99
- | `dreamer` | Off-hours reflection. Reads recent runs + feedback, detects recurring patterns, drafts lesson candidates, and writes approved lessons to the right playbook scope. The only agent that writes to playbook files. |
100
- | `sdr` | Cold outreach for a project — find prospects matching an ICP, enrich, draft personalized first-touch messages in the project's voice, and route through HITL approval. |
101
-
102
- **Agents** (called by skills, not invoked directly)
103
-
104
- | Agent | Owner skill | Purpose |
105
- |---|---|---|
106
- | `critic` | `sdr` | Reviews drafts for tone, brand fit, risk, compliance. Returns pass/fail with specific feedback. Does not rewrite. |
107
- | `enricher` | `sdr` | Fills missing fields on prospects (recent posts, company news) via Apollo, HeyReach, web search. Does not score or contact. |
108
- | `prospector` | `sdr` | Finds prospects matching ICP criteria. Read-only — no enrichment beyond search, no contact, no CRM writes. |
109
- | `writer` | `sdr` | Drafts a single first-touch message for a single prospect using enrichment context and lessons. Does not send. |
110
- | `lesson-drafter` | `dreamer` | Takes a candidate pattern and drafts a lesson file in the schema defined by `conventions.md`. One lesson per invocation. |
111
- | `pattern-detector` | `dreamer` | Reads runs + matched feedback, returns raw candidate patterns with cited evidence. Returns everything that recurs. |
112
- | `promotion-arbiter` | `dreamer` | Decides whether a project-validated lesson should be promoted to global, kept project-specific, or marked as conflicting. Decisions only. |
113
-
114
- Every skill and agent ships with version `0.1.0` (frontmatter pin). `roster doctor` will surface drift between installed and shipped versions in v0.2.
70
+ | `roster install` | Install skills + agents into detected AI tools (idempotent) |
71
+ | `roster init` | Scaffold an agent-team workspace in CWD |
72
+ | `roster doctor` | Audit installation; exits non-zero on drift |
73
+ | `roster schedule validate` | Validate every `roster/<function>/schedules.yaml` |
74
+ | `roster schedule install` | Install a schedule into your host tool's native scheduler |
75
+ | `roster review [function]` | Walk pending HITL items interactively (approve / reject / defer) |
76
+ | `roster hooks install` | Wire SessionStart banners so chat sessions surface pending counts |
115
77
 
116
- From **v0.4.0**, `/chief-of-staff create-agent <function> <agent>` runs an interactive five-phase dialogue by default in a TTY — it interviews you for the gaps a stub can't fill (subagents, tools, plan names, project-specific failure modes) and writes a fully populated `agent.md` instead of placeholders. CI / scripts / non-TTY contexts get the legacy stub mode automatically; force it explicitly with `AGENT_TEAM_NO_CONFIRM=1`. See [docs/HOWTO.md → Creating an agent](docs/HOWTO.md#creating-an-agent) for the worked example.
78
+ Full subcommand reference in [docs/HOWTO.md](docs/HOWTO.md). Scheduling rules, UI hand-off, and platform matrix in [docs/SCHEDULING.md](docs/SCHEDULING.md).
117
79
 
118
- ## What `init` scaffolds
80
+ ---
119
81
 
120
- `roster init` is non-destructive — re-running merges new files in without overwriting your edits. The full scaffold:
121
-
122
- ```
123
- my-team/ ← full layout
124
- ├── CLAUDE.md, conventions.md ← workspace-level context
125
- ├── gtm/, product/, design/, ops/ ← functions (top-level domains)
126
- │ ├── EXPERT.md ← function-level expert (substrate-shaping)
127
- │ └── <agent-role>/ ← role-based agents (sdr, ux-designer, ...)
128
- │ ├── agent.md ← contract: purpose, inputs, plans, outputs
129
- │ ├── plans/*.yaml ← named workflows the agent can run
130
- │ ├── subagents/*.md ← reusable building blocks
131
- │ └── projects/<project>/ ← per-project instance with config + logs
132
- ├── projects/<project>/ ← project-level shared substrate
133
- │ └── CLAUDE.md, guidelines/ ← voice, ICPs, messaging, brand-book
134
- ├── chief-of-staff/ ← cross-cutting maintenance agent
135
- ├── dreamer/ ← cross-cutting reinforcement agent
136
- ├── scripts/ ← backing scripts (create/archive/audit/rename)
137
- └── .claude/commands/ ← workspace-level slash commands
138
- ```
139
-
140
- The two big ideas behind the layout:
141
-
142
- 1. **Substrate vs artifacts**: experts shape substrate (project guidelines), agents produce artifacts (specific outputs). Don't conflate them.
143
- 2. **Plans**: each agent has named plans (YAML workflow recipes). Cron-friendly. Auditable. Reusable.
144
-
145
- ## Migrating from agent-team
146
-
147
- If you've been running the original `~/repos/agent-team` layout, here's the verbatim migration. Project substrate and `.env` carry over; the framework (skills, agents, scripts, conventions) comes from `roster init`.
148
-
149
- ```bash
150
- # 1. Install roster (locally until v0.1 publishes; npx after)
151
- npx @firatcand/roster install
82
+ ## How it works
152
83
 
153
- # 2. Scaffold a fresh workspace
154
- mkdir ~/repos/my-agent-team && cd ~/repos/my-agent-team
155
- npx @firatcand/roster init
84
+ Roster scaffolds an opinionated **function → agent → plan** tree. Functions are top-level domains (`gtm/`, `product/`, `design/`, `ops/`). Each function holds named agents (`gtm/sdr/`, `design/critic/`). Each agent has named YAML **plans** — the schedulable, auditable workflow recipes.
156
85
 
157
- # 3. Copy project-level substrate (guidelines, ICPs, brand voice)
158
- cp -r ~/repos/agent-team/projects/{athelea,firatdogan} projects/
86
+ The opinion that keeps it useful at week 12 is **substrate vs artifacts**: long-lived context (voice, ICPs, messaging, brand) lives at the workspace root in `guidelines/`. Daily tactical output (emails, posts, PR comments) lands in `<function>/<agent>/logs/runs/`; anything that needs human approval first lands in `<agent>/pending/`. Experts shape substrate. Agents produce artifacts. Don't conflate them.
159
87
 
160
- # 4. Copy per-agent project instances (run logs, configs)
161
- cp -r ~/repos/agent-team/gtm/sdr/projects/* gtm/sdr/projects/
88
+ A nightly **reinforcement** pass (the `dreamer` skill) reads runs + feedback, detects recurring patterns, and proposes lessons to the agent that produced them. You approve before anything is written. Quality compounds.
162
89
 
163
- # 5. Copy credentials
164
- cp ~/repos/agent-team/.env .env
90
+ ---
165
91
 
166
- # 6. Archive the old repo
167
- mv ~/repos/agent-team ~/repos/_archived/agent-team
168
- ```
92
+ ## Tool support
169
93
 
170
- Adjust the project names in step 3 to match what's actually under your `agent-team/projects/`, and extend step 4 for every function that has its own `projects/` dir (e.g. `gtm/content/projects/`, `product/pm/projects/`).
94
+ | Tool | Status | Skills | Agents |
95
+ |---|---|---|---|
96
+ | Claude Code | Supported | `~/.claude/skills/<skill>/` | `~/.claude/agents/<agent>.md` |
97
+ | Codex CLI | Supported | `~/.codex/skills/<skill>/` | `~/.codex/agents/<agent>.md` |
98
+ | Gemini CLI | Supported | `~/.gemini/extensions/<skill>/` | `~/.gemini/agents/<agent>.md` |
99
+ | Cursor | On the roadmap | — | — |
171
100
 
172
- Audit after migration:
101
+ Detection is presence-only — roster considers a tool installed if its config root exists. Override via `ROSTER_CLAUDE_HOME` / `ROSTER_CODEX_HOME` / `ROSTER_GEMINI_HOME` (used by the test suite).
173
102
 
174
- ```bash
175
- roster doctor # confirms skills + agents are in place
176
- ```
103
+ ---
177
104
 
178
105
  ## Security
179
106
 
180
- Three guarantees about what `npm install -g @firatcand/roster` and `npx @firatcand/roster` do and don't do on your machine.
181
-
182
- - **No `preinstall` / `install` / `postinstall` scripts.** The CLI runs only when you invoke it. `npm install -g @firatcand/roster` writes files to your global prefix and stops there. Asserted in `test/security.test.ts` ("no npm install lifecycle hooks in package.json").
183
- - **No telemetry.** v0.1 collects nothing no analytics, no error reporting, no usage pings. If telemetry is ever added it will be opt-in, gated behind a `--no-telemetry` flag, and disclosed here before the release that introduces it.
184
- - **npm provenance.** Releases are signed via `npm publish --provenance` from GitHub Actions on `v*` tag push. Verify the signature with `npm info @firatcand/roster dist.integrity` or the provenance badge on the npm page.
185
-
186
- Path-traversal guards on `install` / `init` were audited under ROS-30 — see `test/security.test.ts` for the regression suite.
187
-
188
- ## v0.2 roadmap
107
+ - **No `preinstall` / `install` / `postinstall` scripts.** `npm install -g @firatcand/roster` writes files and stops. Asserted in `test/security.test.ts`.
108
+ - **No telemetry.** Nothing is collected — no analytics, no error reporting, no usage pings. Any future telemetry will be opt-in, gated behind a flag, and disclosed here before the release that introduces it.
109
+ - **npm provenance.** Releases are signed via `npm publish --provenance` from GitHub Actions on tag push. Verify with `npm info @firatcand/roster dist.integrity` or the provenance badge on the npm page.
110
+ - **Path-traversal guards** on `install` / `init` audited under ROS-30 regression suite in `test/security.test.ts`.
189
111
 
190
- Items the SPEC deferred from v0.1, in roughly the order they're likely to land. Open to feedback on priority.
191
-
192
- - **Companion-skill installers.** Install GTM / product / design domain expertise alongside the framework, similar to forge's `companions`. Will point at `firatcand/founder-skills`.
193
- - **Per-skill versioning gate in `doctor`.** Skills already ship with `version:` in frontmatter; `roster doctor` will surface drift between installed and shipped versions, mirroring how npm handles outdated globals.
194
- - **`roster sync`.** Pull the latest skills from the installed roster package into existing tool config dirs without re-running the full `install` flow.
195
- - **`roster migrate <path>`.** Replace the manual `cp`-based migration documented in [Migrating from agent-team](#migrating-from-agent-team) with a single command that copies project substrate + `.env` and runs `roster init`.
196
- - **Cursor support.** Promoted from "out of scope" once the Cursor skill API stabilizes — the layout maps cleanly to `~/.cursor/`.
112
+ ---
197
113
 
198
114
  ## Documentation
199
115
 
200
- - [docs/HOWTO.md](docs/HOWTO.md) — recipes for common tasks (install, init, create project, run agent, audit, etc.)
201
- - [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) — design rationale, the substrate-vs-artifacts model, lessons protocol, dreamer reinforcement loop
202
- - [docs/API.md](docs/API.md) — every script, config schema, and convention
116
+ - [docs/HOWTO.md](docs/HOWTO.md) — install, init, create-agent, run a plan, audit
117
+ - [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) — substrate-vs-artifacts, lessons protocol, reinforcement loop
118
+ - [docs/SCHEDULING.md](docs/SCHEDULING.md) — schedule install/validate, UI hand-off, Codex subagent workaround, subscription-billing rules
119
+ - [docs/API.md](docs/API.md) — every script, config schema, convention
203
120
  - [docs/roadmap.md](docs/roadmap.md) — what's shipped, what's next
204
121
 
205
- ## Opinions you can replace
206
-
207
- The CLI ships a curated set of skills and agent definitions — these are starting points, not law.
122
+ ---
208
123
 
209
- - Function categories (`gtm/`, `product/`, `design/`, `ops/`) are defaults. Add your own with `/chief-of-staff create-function`.
210
- - The example experts reflect one founder's judgment. Replace freely.
211
- - The demo project (`projects/_demo/`) is safe to delete after init.
124
+ ## Contributing
212
125
 
213
- ## What this is NOT
126
+ Bug reports, fixes, and docs improvements welcome. Read [CONTRIBUTING.md](CONTRIBUTING.md) for the development setup, PR process, release pipeline, and the CI gates a PR has to clear. Contributors working on the CLI itself should also read [CLAUDE.md](CLAUDE.md) for build/test/layout conventions.
214
127
 
215
- - Not a hosted SaaS — you run it locally against your own AI coding tool.
216
- - Not a build/CI tool — for that, see [forge](https://github.com/firatcand/forge) (complementary, not bundled).
217
- - Not a substitute for thinking — it's a structure for organizing your thinking.
128
+ ---
218
129
 
219
130
  ## License
220
131
 
221
132
  MIT. See [LICENSE](LICENSE).
222
133
 
223
- ## Contributing
224
-
225
- See [CONTRIBUTING.md](CONTRIBUTING.md). Contributors working on the CLI itself should read [CLAUDE.md](CLAUDE.md) for build/test/layout conventions.
226
-
227
- ### CI / branch protection
228
-
229
- PRs into `main` run [`.github/workflows/ci.yml`](.github/workflows/ci.yml) — typecheck, test, build, `npm pack --dry-run`, `pnpm smoke`, `pnpm e2e`. Repo admins should enable branch protection on `main` (one-time manual step in **Settings → Branches → Branch protection rules → Add rule**):
230
-
231
- - Require status checks to pass before merging: `CI / verify`
232
- - Require branches to be up-to-date before merging
233
- - (Optional) Require linear history
234
-
235
- All third-party actions in `ci.yml` and `publish.yml` are pinned to 40-character commit SHAs (with a trailing `# vX.Y.Z` comment) and auto-updated weekly via [Dependabot](.github/dependabot.yml).
236
-
237
- ### Publishing / Releases
238
-
239
- Releases are triggered by pushing a version tag:
240
-
241
- ```bash
242
- git tag v0.1.0 && git push origin v0.1.0
243
- ```
244
-
245
- The [publish workflow](.github/workflows/publish.yml) runs the full quality gate (`typecheck`, `test`, `build`), asserts the tag matches `package.json` version, publishes to npm with provenance, and creates a GitHub Release with auto-generated notes.
246
-
247
- **One-time setup — `NPM_TOKEN` secret:**
248
-
249
- 1. Mint a Granular Access Token at [npmjs.com](https://www.npmjs.com/) → Account → Access Tokens → Generate New Token → Granular.
250
- - Permissions: **Read and write** scoped to `@firatcand/roster` (publish; deprecation is intentionally kept manual — see rollback note below).
251
- - Set an expiry (90–365 days recommended).
252
- 2. In this repo: **Settings → Secrets and variables → Actions → New repository secret**.
253
- - Name: `NPM_TOKEN`
254
- - Value: the token from step 1.
255
-
256
- No additional setup is needed for provenance — the workflow's `id-token: write` permission handles OIDC attestation automatically.
257
-
258
- **One-time setup — `production` environment (manual `workflow_dispatch` approval gate):**
259
-
260
- The publish workflow's `workflow_dispatch` trigger lets a maintainer manually run a publish against an existing tag (used for partial-publish recovery). To prevent anyone with `Actions: write` from triggering an unreviewed publish, manual dispatches are gated behind a GitHub environment named `production` that requires maintainer approval. Tag-push releases (the canonical `git tag vX.Y.Z && git push --tags` path) are **not** gated — they run immediately.
261
-
262
- 1. GitHub repo → **Settings → Environments → New environment**, name: `production`.
263
- 2. **Required reviewers:** add the maintainer (Firat). **Do NOT enable "Prevent self-review"** — this is a solo-maintainer project and enabling it would leave every dispatch permanently stuck.
264
- 3. **Wait timer:** 0.
265
- 4. **Deployment branches and tags:** leave on the default "All branches and tags." A `v*` tag rule sounds appealing as belt-and-suspenders but actually blocks `workflow_dispatch` — on dispatch, `github.ref` is the default branch, not the tag (which is supplied separately via the `tag` input and checked out later in the job).
266
-
267
- Because self-approval is allowed, the maintainer account becomes the only barrier between an `Actions: write` actor and an npm publish. **Enable TOTP-based 2FA on the GitHub account** (and on the npm account that owns `NPM_TOKEN`) as the compensating control.
268
-
269
- After this, any manual `workflow_dispatch` of the publish workflow will pause in "Waiting for review" state until approved in the Actions UI.
270
-
271
- **Pre-release tags** (e.g. `v0.1.0-rc.1`) are detected by suffix and automatically published to the `next` dist-tag on npm and marked as pre-release on GitHub. Stable tags publish to `latest`.
272
-
273
- If a bad version ships, `npm deprecate @firatcand/roster@<version> "<reason>"` and publish a fix as the next patch — never reuse a version number.
274
-
275
- ## Acknowledgments
276
-
277
- Built on top of [Claude Code](https://claude.com/code) and the broader AI-coding-tool ecosystem.
134
+ Built on top of [Claude Code](https://claude.com/code), [Codex CLI](https://github.com/openai/codex), and the broader AI-coding-tool ecosystem.
@@ -14,20 +14,17 @@ A focused subagent invoked by the **dreamer** skill during reflection passes. Gi
14
14
  - `pattern` (object): output from the dreamer's pattern-detector
15
15
  - `existing_lesson` (object, optional): if extending an existing lesson, the current version
16
16
  - `agent` (string): which agent generated the source signals
17
- - `project` (string): which project sourced the signals (or `—` for global lessons)
18
17
 
19
18
  ## Output
20
19
 
21
20
  ```yaml
22
21
  suggested_filename: L-2026-04-26-001.md
23
- suggested_path: <function>/<agent>/projects/<project>/playbook/ # or <function>/<agent>/playbook/
22
+ suggested_path: <function>/<agent>/playbook/
24
23
  status: candidate
25
24
  lesson_markdown: |
26
25
  ---
27
26
  id: L-2026-04-26-001
28
27
  source: dreamer
29
- scope: project # or global
30
- project: _demo # or "—" if scope=global
31
28
  agent: sdr
32
29
  ...full frontmatter per conventions...
33
30
  ---
@@ -36,7 +33,6 @@ lesson_markdown: |
36
33
 
37
34
  ## Pattern observed
38
35
  ## Recommendation
39
- ## Why this might be project-specific
40
36
  ## Retirement criteria
41
37
  ```
42
38
 
@@ -44,9 +40,8 @@ lesson_markdown: |
44
40
 
45
41
  - Use the exact schema in `conventions.md`. Do not invent fields.
46
42
  - Always set `source: dreamer`.
47
- - Default to `scope: project` unless explicitly handling a promotion case from the arbiter.
48
43
  - Cite evidence in the body, not just frontmatter.
49
- - The body has exactly four sections: pattern, recommendation, scope reasoning, retirement criteria.
44
+ - The body has exactly three sections: pattern, recommendation, retirement criteria.
50
45
 
51
46
  ## Quality bar
52
47
 
@@ -59,6 +54,6 @@ Every drafted lesson must be:
59
54
 
60
55
  ## What this subagent does NOT do
61
56
 
62
- - Promote project-scoped lessons to global. That's the promotion-arbiter's job.
57
+ - Promote lessons to a different scope. v1 has a single playbook per agent.
63
58
  - Write to `playbook/` directly. The orchestrator (dreamer) does that after HITL approval.
64
59
  - Edit existing lessons in place without a clear `existing_lesson` input.
@@ -23,7 +23,6 @@ Read a batch of runs and matched feedback files. Identify candidate patterns —
23
23
  patterns:
24
24
  - id: P-2026-04-26-001
25
25
  agent: sdr
26
- project: _demo
27
26
  pattern_type: success | failure | mixed | structural
28
27
  description: "..."
29
28
  evidence: