@mmmbuto/nexuscrew 0.8.32 → 0.8.34

package/lib/cli/commands.js

@@ -112,8 +112,22 @@ function parseFlags(argv, valueFlags) {
 
 function serve(opts = {}) {
   const serverStart = opts.serverStart || require('../server.js').start;
+  const platform = opts.platform || detectPlatform();
+  // A legacy Termux:Boot script can start the new package from a replaceable
+  // npm directory. Correct the live process before it can create the shared
+  // tmux server, then atomically refresh both boot definitions for next boot.
+  if (platform === 'termux') {
+    stabilizeTermuxWorkingDirectory({ ...opts, platform });
+    try {
+      repairTermuxBootDefinitions({ ...opts, platform, clearMarker: true });
+    } catch (error) {
+      const warn = opts.lifecycleWarn || ((message) => process.stderr.write(`${message}\n`));
+      warn(`nexuscrew: Termux boot auto-repair pending — ${String(error && error.message || error)}`);
+    }
+  }
   // Service manager e Termux:Boot entrano direttamente da `serve`, senza
-  // passare per smartUp. Ripara solo fleet.json MANCANTE; un file invalido
+  // passare per smartUp. Su Termux ripara anche gli script di boot legacy.
+  // Per Fleet, ripara solo fleet.json MANCANTE; un file invalido
   // resta intatto e il provider continua a fallire chiuso.
   (opts.ensureFleetDefaultsImpl || ensureFleetDefaults)(opts);
   if (opts.pidfile) {
@@ -279,6 +293,37 @@ function restart(opts = {}) {
   const execImpl = opts.execImpl || execFileSync;
   const log = opts.log || console.log;
   if (!['linux', 'mac', 'termux'].includes(platform)) throw new Error(`restart: platform ${platform} non supportata`);
+  let termuxRepair = null;
+  if (platform === 'termux') {
+    try {
+      stabilizeTermuxWorkingDirectory({ ...opts, platform });
+      termuxRepair = repairTermuxBootDefinitions({
+        ...opts, platform, clearMarker: false,
+      });
+    } catch (error) {
+      return {
+        platform,
+        runtimeOwner: 'portable',
+        restarted: false,
+        reason: `Termux boot auto-repair failed: ${String(error && error.message || error)}`,
+      };
+    }
+  }
+  const complete = (result) => {
+    if (platform !== 'termux' || !result || result.restarted !== true || !termuxRepair?.markerPending) {
+      return result;
+    }
+    try {
+      clearServiceMigrationMarker(opts.home || require('node:os').homedir(), opts.serviceMigrationMarkerPath);
+      return result;
+    } catch (error) {
+      return {
+        ...result,
+        serviceRepairPending: true,
+        warning: `Termux boot repair marker cleanup pending: ${String(error && error.message || error)}`,
+      };
+    }
+  };
   const before = resolveRuntimeOwner({ ...opts, platform, execImpl });
 
   // A managed owner can use the service manager's atomic restart. In a
@@ -307,7 +352,7 @@ function restart(opts = {}) {
         execImpl('launchctl', ['kickstart', '-k', label], { stdio: 'ignore' });
         log(`restart: launchctl kickstart -k ${label}`);
       }
-      return { platform, owner: before.owner, runtimeOwner: 'managed', restarted: true };
+      return complete({ platform, owner: before.owner, runtimeOwner: 'managed', restarted: true });
     } catch (error) {
       return { platform, owner: before.owner, runtimeOwner: 'managed', restarted: false, reason: String(error.message || error) };
     }
@@ -319,7 +364,7 @@ function restart(opts = {}) {
     const started = (opts.startPortableImpl || startPortable)({ ...opts, platform, spawnImpl: opts.spawnImpl });
     const ok = !!(started && started.started !== false);
     if (ok) log('restart: portable runtime started');
-    return { platform, owner: before.owner, runtimeOwner: 'portable', restarted: ok, reason: ok ? undefined : started && started.reason };
+    return complete({ platform, owner: before.owner, runtimeOwner: 'portable', restarted: ok, reason: ok ? undefined : started && started.reason });
   }
 
   // `restart` on a stopped runtime follows the explicit boot owner; with boot
@@ -330,7 +375,7 @@ function restart(opts = {}) {
     : (opts.startPortableImpl || startPortable)({ ...opts, platform, spawnImpl: opts.spawnImpl });
   const ok = !!(started && started.started !== false);
   if (ok) log(`restart: ${useManaged ? 'managed' : 'portable'} runtime started`);
-  return { platform, owner: before.owner, runtimeOwner: useManaged ? 'managed' : 'portable', restarted: ok, reason: ok ? undefined : started && started.reason };
+  return complete({ platform, owner: before.owner, runtimeOwner: useManaged ? 'managed' : 'portable', restarted: ok, reason: ok ? undefined : started && started.reason });
 }
 
 function wizardComplete(configPath) {
@@ -406,6 +451,63 @@ function clearServiceMigrationMarker(home, override) {
   }
 }
 
+// Termux app updates replace the global npm package while existing boot
+// scripts remain on disk. Always enter the stable HOME before serving or
+// booting Fleet so a legacy script cannot make tmux inherit the package cwd.
+function stabilizeTermuxWorkingDirectory(opts = {}) {
+  const platform = opts.platform || detectPlatform();
+  if (platform !== 'termux') return { platform, changed: false };
+  const home = opts.home || require('node:os').homedir();
+  (opts.chdirImpl || process.chdir)(home);
+  return { platform, changed: true, cwd: home };
+}
+
+// Refresh only an already-enabled Termux:Boot installation. Boot remains
+// opt-in: missing scripts are never created by this repair path. A durable
+// marker makes an interrupted refresh visible and retryable.
+function repairTermuxBootDefinitions(opts = {}) {
+  const platform = opts.platform || detectPlatform();
+  const home = opts.home || require('node:os').homedir();
+  if (platform !== 'termux') return { platform, persistent: false, refreshed: false, markerPending: false };
+  const persistent = bootState({ ...opts, platform }).enabled;
+  if (!persistent) return { platform, persistent: false, refreshed: false, markerPending: false };
+
+  const markerPending = serviceMigrationPending(home, opts.serviceMigrationMarkerPath);
+  const refreshNeeded = serviceDefinitionNeedsRefresh(
+    platform, home, opts.installPath, opts.fleetInstallPath,
+  );
+  if (!markerPending && !refreshNeeded) {
+    return { platform, persistent: true, refreshed: false, markerPending: false };
+  }
+
+  if (refreshNeeded) {
+    ensureServiceMigrationMarker(home, opts.serviceMigrationMarkerPath);
+    const result = (opts.runInitImpl || runInit)({
+      ...opts,
+      home,
+      platform,
+      installBoot: true,
+      printUrl: false,
+      log: opts.lifecycleLog || (() => {}),
+    });
+    if (serviceDefinitionNeedsRefresh(platform, home, opts.installPath, opts.fleetInstallPath)) {
+      throw new Error('generated Termux boot definitions failed stable-HOME verification');
+    }
+    const failures = Array.isArray(result?.installFailures) ? result.installFailures : [];
+    if (failures.length) {
+      const components = [...new Set(failures.map((failure) => failure?.component)
+        .filter((component) => component === 'service' || component === 'fleet-companion'))];
+      throw new Error(`Termux boot definition install failed${components.length ? ` (${components.join(', ')})` : ''}`);
+    }
+  }
+
+  const pending = markerPending || refreshNeeded;
+  if (pending && opts.clearMarker !== false) {
+    clearServiceMigrationMarker(home, opts.serviceMigrationMarkerPath);
+  }
+  return { platform, persistent: true, refreshed: refreshNeeded, markerPending: pending };
+}
+
 function portAvailable(port, host = '127.0.0.1') {
   return new Promise((resolve) => {
     const s = net.createServer();
@@ -742,6 +844,7 @@ function update(opts = {}) {
 // / cfg / exit (per test, no process.exit che uccide il runner).
 async function runFleetBoot(opts = {}) {
   const log = opts.log || console.log;
+  stabilizeTermuxWorkingDirectory(opts);
   const loadConfig = opts.loadConfig || require('../config.js').loadConfig;
   const selectProvider = opts.selectProvider || require('../fleet/provider.js').selectProvider;
   const { bootCells } = require('../fleet/boot.js');
@@ -1065,6 +1168,8 @@ module.exports = {
   serviceDefinitionNeedsRefresh,
   fleetServiceDefinitionNeedsRefresh,
   serviceMigrationPending,
+  stabilizeTermuxWorkingDirectory,
+  repairTermuxBootDefinitions,
   portAvailable, findAvailablePort, probeNexusCrew, waitForNexusCrew, openPwa, startPortable, wizardComplete,
   servicePinsLegacyPort,
   isServiceRunning, readRoles,

package/lib/cli/pidfile.js

@@ -30,9 +30,24 @@ function removePidfile(p) {
   try { fs.unlinkSync(p); } catch (_) {}
 }
 
-function pidExists(pid) {
-  try { process.kill(pid, 0); return true; }
-  catch (e) { return e.code === 'EPERM'; } // EPERM = esiste ma non nostro
+// A PID can exist without belonging to this UID. Android commonly reuses PIDs
+// across app sandboxes; kill(pid, 0) then returns EPERM and /proc is hidden.
+// Keep generic existence separate from NexusCrew ownership so a foreign PID
+// can never keep one of our pidfiles "alive" forever.
+function pidOwnership(pid, killImpl = process.kill) {
+  try {
+    killImpl(pid, 0);
+    return 'owned';
+  } catch (e) {
+    if (e && e.code === 'EPERM') return 'foreign';
+    if (e && e.code === 'ESRCH') return 'missing';
+    return 'unknown';
+  }
+}
+
+function pidExists(pid, killImpl = process.kill) {
+  const ownership = pidOwnership(pid, killImpl);
+  return ownership === 'owned' || ownership === 'foreign';
 }
 
 function readCmdline(pid) {
@@ -50,36 +65,46 @@ function cmdMatches(savedCmd, liveCmd) {
   return liveCmd.includes(savedCmd) || savedCmd.includes(liveCmd);
 }
 
-// true se il pid esiste E il cmd matcha (o non verificabile).
-function isAlive(meta) {
+// true se il pid appartiene a questo UID E il cmd matcha (o non verificabile).
+// EPERM is deliberately false: NexusCrew must neither adopt nor signal a
+// process owned by another Android/Linux user.
+function isAlive(meta, impl = {}) {
   if (!meta || !Number.isFinite(meta.pid)) return false;
-  if (!pidExists(meta.pid)) return false;
+  if (pidOwnership(meta.pid, impl.killImpl || process.kill) !== 'owned') return false;
   if (meta.cmd) {
-    const live = readCmdline(meta.pid);
+    const live = (impl.readCmdlineImpl || readCmdline)(meta.pid);
     if (live) return cmdMatches(meta.cmd, live);
   }
   return true;
 }
 
 // Rimuove pidfile stale (pid morto o non verificabile). Ritorna true se rimosso.
-function cleanStale(p) {
+function cleanStale(p, impl = {}) {
   const meta = readPidfile(p);
   if (!meta) return false;
-  if (!isAlive(meta)) { removePidfile(p); return true; }
+  if (!isAlive(meta, impl)) { removePidfile(p); return true; }
   return false;
 }
 
 // Kill verificato: legge pidfile, verifica pid+cmd, signal. MAI broad match by name.
 // Ritorna { killed, pid?, reason? }.
-function killPidfile(p, signal = 'SIGTERM') {
+function killPidfile(p, signal = 'SIGTERM', impl = {}) {
   const meta = readPidfile(p);
   if (!meta) return { killed: false, reason: 'no pidfile' };
-  if (!pidExists(meta.pid)) {
+  const killImpl = impl.killImpl || process.kill;
+  const ownership = pidOwnership(meta.pid, killImpl);
+  if (ownership === 'missing' || ownership === 'unknown') {
     removePidfile(p);
     return { killed: false, reason: 'stale (pid dead)' };
   }
+  if (ownership === 'foreign') {
+    // Never send a real signal after an EPERM ownership probe. The pidfile is
+    // ours; the process is not.
+    removePidfile(p);
+    return { killed: false, reason: 'stale (pid not owned)' };
+  }
   if (meta.cmd) {
-    const live = readCmdline(meta.pid);
+    const live = (impl.readCmdlineImpl || readCmdline)(meta.pid);
     if (live && !cmdMatches(meta.cmd, live)) {
       // PID reuse: processo diverso. Non killare. Rimuovi pidfile stale.
       removePidfile(p);
@@ -87,7 +112,7 @@ function killPidfile(p, signal = 'SIGTERM') {
     }
   }
   try {
-    process.kill(meta.pid, signal);
+    killImpl(meta.pid, signal);
     removePidfile(p);
     return { killed: true, pid: meta.pid };
   } catch (e) {
@@ -97,5 +122,5 @@ function killPidfile(p, signal = 'SIGTERM') {
 
 module.exports = {
   defaultPidfilePath, readPidfile, writePidfile, removePidfile,
-  pidExists, readCmdline, isAlive, cleanStale, killPidfile,
+  pidOwnership, pidExists, readCmdline, isAlive, cleanStale, killPidfile,
 };

package/lib/fleet/launch.js

@@ -36,6 +36,20 @@ function minimalEnv() {
   return minimalRuntimeEnv(process.env, { home: os.homedir() });
 }
 
+// tmux reports client-side connection failures through localized stderr. The
+// migration classifier must see the stable POSIX wording on every platform,
+// otherwise a missing first-boot socket could disable Fleet under a non-English
+// locale. Restrict only the message locale: LC_ALL=C would also force ASCII
+// character handling and tmux would sanitize the tab in our format string.
+// Panes, the shared server and the inventory protocol keep a UTF-8 LC_CTYPE.
+function tmuxInventoryEnv() {
+  const env = minimalEnv();
+  delete env.LC_ALL; // LC_ALL would override LC_MESSAGES and LC_CTYPE.
+  env.LANGUAGE = 'C';
+  env.LC_MESSAGES = 'C';
+  return env;
+}
+
 // httpError(status, msg, data?, cause?) — structured HTTP error. `data` carries
 // arbitrary API detail for the response body; `cause` (T4) is the OPTIONAL
 // bounded failure triple {phase, code} of the up() boundary that failed. The
@@ -170,10 +184,10 @@ async function migrateLegacyTmuxSessions(tmuxBin, defs, { readonly = false } = {
     };
   }
   const listing = await tmuxExec(tmuxBin,
-    ['list-sessions', '-F', '#{session_id}\t#{session_name}'], { env: minimalEnv() });
+    ['list-sessions', '-F', '#{session_id}\t#{session_name}'], { env: tmuxInventoryEnv() });
   if (listing.err) {
     const detail = boundedTmuxFailure(listing);
-    if (/no server running|failed to connect|connection refused|no such file.*tmux/i.test(detail)) {
+    if (/no server running|failed to connect|connection refused|no such file.*tmux|error connecting to .*\(no such file or directory\)/i.test(detail)) {
       return { migrated: [], reason: 'no-tmux-server', needsPersistence: legacyMap.size > 0 };
     }
     throw tmuxMigrationError('TMUX_MIGRATION_LIST_FAILED',

package/lib/mcp/server.js

@@ -25,6 +25,7 @@ const { loadConfig } = require('../config.js');
 const { readTokenSafe } = require('../auth/token.js');
 const { isValidSession } = require('../files/store.js');
 const VERSION = require('../../package.json').version;
+const MCP_COMPANIONS = require('../../mcp-companions.json');
 const { TOOLS, IDENTITY_CODE, IDENTITY_REMEDIATION } = require('./tools.js');
 const cells = require('./cells.js');
 
@@ -38,6 +39,17 @@ const INVALID_REQUEST = -32600;
 const METHOD_NOT_FOUND = -32601;
 const INVALID_PARAMS = -32602;
 
+function companionInstructions() {
+  const catalog = MCP_COMPANIONS.companions
+    .map((item) => `${item.id}: ${item.name} (${item.repository})`)
+    .join('; ');
+  return 'Discover the current client tools before recommending another MCP server. '
+    + 'If a requested capability is missing, these optional NexusCrew companions may cover it: '
+    + `${catalog}. Recommend only the capability actually needed and ask before installing `
+    + 'software, changing MCP configuration, starting services or requesting credentials. '
+    + 'NexusCrew does not install or configure companions automatically.';
+}
+
 // --- identita' cella mittente ------------------------------------------------
 // Ordine (design §1, INVARIATO): $TMUX presente -> `tmux display-message -p '#S'`
 // (nome sessione reale); se fallisce/invalida -> fallback env NEXUSCREW_MCP_SESSION;
@@ -246,6 +258,7 @@ function createMcpServer(opts = {}) {
         protocolVersion: pv,
         capabilities: { tools: {} },
         serverInfo: { name: 'nexuscrew', version: VERSION },
+        instructions: companionInstructions(),
       });
     }
     if (method === 'ping') return reply(id, {});

package/lib/nodes/tunnel.js

@@ -130,7 +130,12 @@ function reconcileTunnelSupervisors({ home = os.homedir(), configuredNames = [],
     .filter((name) => store.NODE_NAME_RE.test(String(name || ''))));
   const stopOne = typeof stopImpl === 'function' ? stopImpl : stopTunnel;
   const result = { kept: [], stopped: [], cleaned: [], failed: [] };
-  const safeAbsent = new Set(['no pidfile', 'stale (pid dead)', 'pid reuse (cmd mismatch)']);
+  const safeAbsent = new Set([
+    'no pidfile',
+    'stale (pid dead)',
+    'stale (pid not owned)',
+    'pid reuse (cmd mismatch)',
+  ]);
   for (const name of tunnelPidNames(home)) {
     if (keep.has(name)) { result.kept.push(name); continue; }
     try {

package/mcp-companions.json

@@ -0,0 +1,103 @@
+{
+  "schemaVersion": 1,
+  "kind": "nexuscrew-mcp-companions",
+  "policy": {
+    "optional": true,
+    "discoverToolsFirst": true,
+    "recommendOnlyForRequestedCapability": true,
+    "automaticInstall": false,
+    "automaticConfiguration": false
+  },
+  "companions": [
+    {
+      "id": "memory",
+      "name": "mcp-memory-rs",
+      "repository": "https://github.com/DioNanos/mcp-memory-rs",
+      "installation": "https://github.com/DioNanos/mcp-memory-rs#install",
+      "license": "Apache-2.0",
+      "bundledSkill": "skills/memory/SKILL.md",
+      "capabilities": [
+        "durable structured agent state",
+        "versioned categories",
+        "bounded append-only journals",
+        "full-text memory search"
+      ],
+      "primaryTools": [
+        "memory_read",
+        "memory_write",
+        "memory_append",
+        "memory_search",
+        "memory_status"
+      ]
+    },
+    {
+      "id": "msa",
+      "name": "mcp-vl-msa-rs",
+      "repository": "https://github.com/DioNanos/mcp-vl-msa-rs",
+      "installation": "https://github.com/DioNanos/mcp-vl-msa-rs#install",
+      "license": "Apache-2.0",
+      "bundledSkill": "skills/vl-msa/SKILL.md",
+      "capabilities": [
+        "persistent document collections",
+        "BM25 and optional hybrid retrieval",
+        "full-source grounding",
+        "bounded multi-hop retrieval"
+      ],
+      "primaryTools": [
+        "msa_index",
+        "msa_index_batch",
+        "msa_search",
+        "msa_fetch_doc",
+        "msa_remember",
+        "msa_forget",
+        "msa_interleave_round"
+      ]
+    },
+    {
+      "id": "crew",
+      "name": "mcp-crewd-rs",
+      "repository": "https://github.com/DioNanos/mcp-crewd-rs",
+      "installation": "https://github.com/DioNanos/mcp-crewd-rs#install",
+      "license": "Apache-2.0",
+      "bundledSkill": "skills/crew/SKILL.md",
+      "capabilities": [
+        "bounded AI worker spawning",
+        "task status and structured results",
+        "controlled inter-cell messaging"
+      ],
+      "primaryTools": [
+        "cell_spawn",
+        "cell_send_task",
+        "cell_status",
+        "cell_result",
+        "cell_list",
+        "cell_send",
+        "cell_ask"
+      ]
+    },
+    {
+      "id": "mail",
+      "name": "mcp-email-rs",
+      "repository": "https://github.com/DioNanos/mcp-email-rs",
+      "installation": "https://github.com/DioNanos/mcp-email-rs#install",
+      "license": "Apache-2.0",
+      "bundledSkill": "skills/mail-assistant/SKILL.md",
+      "capabilities": [
+        "IMAP mailbox discovery",
+        "mail search and reading",
+        "attachments and folders",
+        "drafts and optional SMTP sending"
+      ],
+      "primaryTools": [
+        "list_folders",
+        "list_emails",
+        "search_emails",
+        "get_email",
+        "download_attachment",
+        "create_draft",
+        "send_email",
+        "email_doctor"
+      ]
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmmbuto/nexuscrew",
-  "version": "0.8.32",
+  "version": "0.8.34",
   "description": "Faithful browser tmux client — attach to live sessions over a real PTY, localhost-only, mobile-easy",
   "main": "lib/server.js",
   "bin": {
@@ -13,6 +13,8 @@
     "frontend/dist/",
     "frontend/index.html",
     "CHANGELOG.md",
+    "MCP_COMPANIONS.md",
+    "mcp-companions.json",
     "LICENSE",
     "README.md",
     "NOTICE"

package/skills/crew/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: crew
+description: Use when spawning or coordinating bounded AI worker cells through a Crew MCP fabric, including cell discovery, idempotent spawn, status monitoring, structured results, follow-up tasks, cancellation and the inter-cell message bus. Covers safe worktree isolation, durable audit reports and user-language selection.
+---
+
+# Crew
+
+Use Crew for bounded delegated work. A coordinator submits tasks to worker
+cells through an MCP server; spawning is asynchronous and returns a thread ID.
+
+## Select response language
+
+Choose the language for user-facing explanations and summaries in this order:
+
+1. the user's explicit language preference;
+2. the language of the current request;
+3. a reliable client or system locale;
+4. English.
+
+Keep cell names, engine/profile IDs, thread IDs, tool names, paths and quoted
+worker output unchanged unless the user explicitly asks to translate them.
+Tell a worker which output language is required when its deliverable is
+user-facing.
+
+## Discover before spawning
+
+1. Use `cell_list` to inspect the cells and engines visible to the caller.
+2. Select an engine/profile appropriate to the bounded task.
+3. Verify that the worker's `cwd` contains the instructions and project context
+   it needs.
+4. Do not assume an embedded worker inherits the coordinator's MCP servers.
+   Required servers must be configured explicitly in the Crew daemon and
+   verified inside a fresh worker.
+
+If no Crew tools are exposed and this skill is packaged with NexusCrew, the
+optional companion is documented in `../../MCP_COMPANIONS.md`. Explain the
+missing capability and ask before installing, configuring or starting it.
+
+## Spawn, monitor and collect
+
+1. Call `cell_spawn` with a bounded task, explicit `cwd`, background mode and a
+   caller-stable `idempotency_key`.
+2. Keep the returned `crewd_thread_id`; a replayed idempotency key must resolve
+   to the existing thread rather than duplicate work.
+3. Monitor with `cell_status`. Use the host's loop or scheduler for waits rather
+   than a tight manual poll.
+4. Treat `idle` as normal turn completion. Also handle `timeout`, `failed`,
+   `interrupted` and `failed_unknown`; do not wait for a fictional `finished`
+   state.
+5. Read `cell_result` and inspect `exit_status`, `final_answer` and the bounded
+   event tail.
+6. Verify the worker's files and tests yourself before accepting code changes.
+
+A timeout may leave partial edits. Never report success from a thread state
+alone.
+
+## Isolate code work
+
+- Do not let two mutating workers edit the same worktree concurrently.
+- Give parallel code tasks separate git worktrees.
+- Preserve unrelated user changes and review every worker diff.
+- Use follow-up tasks only when the original thread and scope remain valid.
+- Cancel only the exact thread the user authorized.
+
+## Require durable audit evidence
+
+For audits, reviews and release gates:
+
+1. Choose an authorized absolute report path before spawning, preferably
+   outside the repository being audited.
+2. Require scope, evidence, findings by severity, residual risks and a terminal
+   verdict in the report.
+3. Require the worker callback to identify the report path and verdict.
+4. Verify that the report is a non-symlink regular file, read it completely and
+   confirm its verdict matches the callback.
+5. Recalculate important hashes and gates independently.
+
+Chat output or `cell_result.final_answer` is not a substitute for the verified
+report.
+
+## Use the message bus deliberately
+
+- `cell_send` is fire-and-forget.
+- `cell_ask` plus `cell_await` is appropriate when a reply is required.
+- `cell_send_task` starts a follow-up turn on an existing thread.
+- `cell_inbox` reads queued bus messages.
+
+Transport receipts do not prove task acceptance or completion. Report only
+results that have been verified.

package/skills/crew/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Crew"
+  short_description: "Coordinate bounded AI worker cells"
+  default_prompt: "Use crew to delegate this bounded task and collect a verified result."