anycrew 0.0.0-stage → 0.1.1

package/models.json

@@ -0,0 +1,98 @@
+{
+  "$comment": "Model tiers are the portable way anycrew says how much model an agent needs. Each tool maps a tier to its own model name here. Override per project in .anycrew/config.json under \"models\". Keep aliases (not dated IDs) wherever the tool offers them so the mapping ages well.",
+  "tiers": {
+    "fast": {
+      "purpose": "Read, search, summarise, format, update status docs, mechanical edits. High volume, low stakes.",
+      "examples": [
+        "scout",
+        "doc-writer"
+      ]
+    },
+    "balanced": {
+      "purpose": "Implement a task, write tests, routine review, research with sources, infra and deploy work.",
+      "examples": [
+        "implementer",
+        "tester",
+        "researcher",
+        "designer",
+        "release-engineer"
+      ]
+    },
+    "strong": {
+      "purpose": "Decisions and judgement: brainstorm, product scope, architecture, specs, security, final review, hard debugging, LLM feature design.",
+      "examples": [
+        "brainstormer",
+        "product-manager",
+        "architect",
+        "spec-writer",
+        "reviewer",
+        "security-reviewer",
+        "debugger",
+        "ai-engineer",
+        "crew-lead"
+      ]
+    }
+  },
+  "tools": {
+    "claude": {
+      "$comment": "Claude Code subagent frontmatter: `model:` accepts haiku | sonnet | opus | fable | inherit | full ID; `effort:` accepts low | medium | high | xhigh | max.",
+      "fast": {
+        "model": "haiku",
+        "effort": "low"
+      },
+      "balanced": {
+        "model": "sonnet",
+        "effort": "medium"
+      },
+      "strong": {
+        "model": "opus",
+        "effort": "high"
+      }
+    },
+    "antigravity": {
+      "$comment": "Antigravity subagents (.agents/agents/*.md) accept `model: inherit | flash | pro` (tiers, not IDs). `flash_lite` exists only for run_workflow scripts, so fast and balanced both map to flash.",
+      "fast": "flash",
+      "balanced": "flash",
+      "strong": "pro"
+    },
+    "gemini": {
+      "$comment": "Gemini CLI model names. Adjust to the models your account can use.",
+      "fast": "gemini-flash-lite-latest",
+      "balanced": "gemini-flash-latest",
+      "strong": "gemini-pro-latest"
+    },
+    "codex": {
+      "$comment": "Codex custom agents (.codex/agents/*.toml) take `model` and `model_reasoning_effort` (low | medium | high | xhigh | max). `model` null keeps the user's default model and varies only the effort.",
+      "fast": {
+        "model": null,
+        "model_reasoning_effort": "low"
+      },
+      "balanced": {
+        "model": null,
+        "model_reasoning_effort": "medium"
+      },
+      "strong": {
+        "model": null,
+        "model_reasoning_effort": "high"
+      }
+    },
+    "cursor": {
+      "$comment": "Cursor subagents accept `model: inherit` or a model ID such as composer-2 or claude-opus-5[effort=high]. inherit keeps the chat's model; set IDs here to enforce tiers.",
+      "fast": "inherit",
+      "balanced": "inherit",
+      "strong": "inherit"
+    },
+    "opencode": {
+      "$comment": "OpenCode agents take `model: provider/model-id`. Defaults assume the Anthropic provider; change to your provider.",
+      "fast": "anthropic/claude-haiku-5-5",
+      "balanced": "anthropic/claude-sonnet-5-5",
+      "strong": "anthropic/claude-opus-5-5"
+    },
+    "copilot": {
+      "$comment": "GitHub Copilot custom agents accept `model:` as a string or a preference-ordered array; empty means inherit the chat's model.",
+      "fast": "",
+      "balanced": "",
+      "strong": ""
+    }
+  }
+}

package/package.json

@@ -1,6 +1,54 @@
 {
   "name": "anycrew",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "One crew of specialist AI agents for any coding assistant. Spec-driven, test-first, security-reviewed, and model-tiered. Installs into Claude Code, OpenAI Codex, Google Antigravity, Gemini CLI, Cursor, OpenCode and GitHub Copilot.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "anycrew": "bin/anycrew.mjs"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "agents",
+    "skills",
+    "rules",
+    "templates",
+    "presets",
+    "hooks",
+    "models.json",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "validate": "node scripts/validate.mjs",
+    "test": "node scripts/validate.mjs && node scripts/smoke.mjs",
+    "list": "node bin/anycrew.mjs list",
+    "test:parity": "python3 tests/test_parity.py",
+    "bump": "node scripts/bump.mjs",
+    "release:check": "node scripts/release-check.mjs",
+    "prepack": "cp README.md .README.repo.md && cp README.npm.md README.md",
+    "postpack": "mv .README.repo.md README.md"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "ai-agents",
+    "claude-code",
+    "codex",
+    "antigravity",
+    "gemini-cli",
+    "cursor",
+    "opencode",
+    "copilot",
+    "agent-skills",
+    "spec-driven-development",
+    "boilerplate",
+    "mvp"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fadlytanjung/anycrew.git"
+  }
+}

package/presets/generic.json

@@ -0,0 +1,28 @@
+{
+  "id": "generic",
+  "name": "Generic (any stack)",
+  "description": "No stack assumptions. Fill the commands in .anycrew/config.json after init.",
+  "languages": [],
+  "commands": {
+    "setup": "echo 'TODO: install dependencies'",
+    "dev": "echo 'TODO: run the app locally'",
+    "check": "echo 'TODO: lint + types + tests'",
+    "test": "echo 'TODO: run tests'",
+    "lint": "echo 'TODO: lint'"
+  },
+  "layout": {
+    "backend": "",
+    "frontend": "",
+    "docs": "docs",
+    "specs": "docs/specs",
+    "contracts": "contracts"
+  },
+  "rules": {
+    "backend_globs": [],
+    "frontend_globs": [],
+    "llm_globs": ["**/prompts/**", "**/agents/**"]
+  },
+  "hooks": {
+    "lint_after_edit": true
+  }
+}

package/presets/go-service.json

@@ -0,0 +1,38 @@
+{
+  "id": "go-service",
+  "name": "Go service (API or worker)",
+  "description": "Go 1.23+ module with standard layout, chi or net/http, sqlc or pgx, golangci-lint, table-driven tests. Optional HTMX or a separate frontend.",
+  "languages": ["go"],
+  "commands": {
+    "setup": "go mod download",
+    "dev": "go run ./cmd/server",
+    "check": "gofmt -l . && go vet ./... && golangci-lint run && go test ./...",
+    "test": "go test ./...",
+    "lint": "gofmt -l . && go vet ./... && golangci-lint run"
+  },
+  "layout": {
+    "backend": ".",
+    "frontend": "",
+    "docs": "docs",
+    "specs": "docs/specs",
+    "contracts": "contracts"
+  },
+  "rules": {
+    "backend_globs": ["**/*.go"],
+    "frontend_globs": [],
+    "llm_globs": ["**/prompts/**", "internal/agents/**"]
+  },
+  "backend_conventions": [
+    "Go 1.23+, modules, `gofmt` and `golangci-lint` clean.",
+    "Layout: `cmd/<binary>` for entry points, `internal/<domain>` for business logic, `internal/adapters` for I/O; domain packages import no I/O packages.",
+    "Interfaces are defined where they are used (consumer side); adapters satisfy them.",
+    "Errors are wrapped with context (`fmt.Errorf(\"...: %w\", err)`) and checked with `errors.Is/As`; sentinel errors carry stable names.",
+    "Context is the first parameter of every function that does I/O.",
+    "Structured logging with `log/slog`; never log secrets or personal data.",
+    "Table-driven tests; fakes for interfaces; integration tests behind a build tag."
+  ],
+  "frontend_conventions": [],
+  "hooks": {
+    "lint_after_edit": true
+  }
+}

package/presets/node-typescript-next.json

@@ -0,0 +1,44 @@
+{
+  "id": "node-typescript-next",
+  "name": "TypeScript monorepo: Node API + Next.js",
+  "description": "pnpm workspace with a Node 22 TypeScript API (Hono or NestJS, Zod, Vitest) and a Next.js App Router frontend (React 19, Tailwind, Playwright). Prisma or Drizzle for data.",
+  "languages": ["typescript"],
+  "commands": {
+    "setup": "pnpm install",
+    "dev": "pnpm dev",
+    "check": "pnpm lint && pnpm typecheck && pnpm test",
+    "test": "pnpm test",
+    "lint": "pnpm lint && pnpm typecheck"
+  },
+  "layout": {
+    "backend": "apps/api",
+    "frontend": "apps/web",
+    "docs": "docs",
+    "specs": "docs/specs",
+    "contracts": "contracts"
+  },
+  "rules": {
+    "backend_globs": ["apps/api/**", "packages/**"],
+    "frontend_globs": ["apps/web/**"],
+    "llm_globs": ["**/prompts/**", "**/agents/**"]
+  },
+  "backend_conventions": [
+    "Node 22, TypeScript strict, ESM only; pnpm workspaces; commit `pnpm-lock.yaml`.",
+    "Validate every boundary with Zod schemas; derive types from schemas, never duplicate them.",
+    "Layers: `routes -> services -> domain + ports`; adapters implement ports; domain has no I/O.",
+    "Errors carry a stable `code`; HTTP layer maps them to problem+json.",
+    "Structured JSON logs with request IDs; never log secrets or personal data.",
+    "Database access only through the repository layer; migrations are versioned and forward-only.",
+    "Tests with Vitest; one in-memory fake per port; integration tests hit a disposable database."
+  ],
+  "frontend_conventions": [
+    "Next.js App Router, React 19, TypeScript strict; Server Components by default, client components only when needed.",
+    "Design tokens in one place; Tailwind utilities from tokens only; no arbitrary values.",
+    "Every data view has loading, empty and error states; responsive from 360 px to 1600 px.",
+    "Forms validate with the same Zod schemas the API uses.",
+    "Tests: Vitest + Testing Library; Playwright for flows and visual baselines."
+  ],
+  "hooks": {
+    "lint_after_edit": true
+  }
+}

package/presets/python-fastapi-react.json

@@ -0,0 +1,49 @@
+{
+  "id": "python-fastapi-react",
+  "name": "Python FastAPI backend + React/Vite frontend",
+  "description": "uv-managed Python 3.12 backend (FastAPI, Pydantic v2, pytest, ruff, pyright strict) and a React 19 + Vite + TypeScript frontend (Vitest, Playwright). Hexagonal backend layers enforced with import-linter.",
+  "languages": ["python", "typescript"],
+  "commands": {
+    "setup": "cd backend && uv sync && cd ../frontend && npm ci",
+    "dev": "make dev",
+    "check": "make check",
+    "test": "cd backend && uv run pytest -q && cd ../frontend && npm test -- --run",
+    "lint": "cd backend && uv run ruff check . && uv run ruff format --check . && uv run pyright && cd ../frontend && npm run lint && npx tsc --noEmit"
+  },
+  "layout": {
+    "backend": "backend",
+    "frontend": "frontend",
+    "docs": "docs",
+    "specs": "docs/specs",
+    "contracts": "contracts"
+  },
+  "rules": {
+    "backend_globs": ["backend/**/*.py"],
+    "frontend_globs": ["frontend/**"],
+    "llm_globs": ["backend/app/agents/**", "**/prompts/**"]
+  },
+  "backend_conventions": [
+    "Python 3.12, `uv` only (`uv sync`, `uv run`); commit `uv.lock`.",
+    "Type-checked with pyright strict; formatted and linted with ruff (line length 100).",
+    "`async` for I/O; wrap sync SDKs with `anyio.to_thread.run_sync`.",
+    "Pydantic v2 models at every boundary (API, LLM output, persistence).",
+    "Layers: `api -> services -> domain + ports`; `adapters` implement `ports`; `domain` is pure (no I/O, no SDKs, no clock). Enforced by import-linter in `backend/.importlinter`.",
+    "Errors: raise domain errors with a stable `code`; the API renders RFC 9457 problem+json.",
+    "Logging: structured JSON; bind request and entity IDs; never log secrets or personal data.",
+    "Money is `Decimal`, never float. Time is injected through a `Clock`; store UTC.",
+    "Tests in `backend/tests/{unit,integration,scenarios}`; an in-memory fake for every port in `backend/tests/fakes/`."
+  ],
+  "frontend_conventions": [
+    "React 19 + Vite + TypeScript strict (`noUncheckedIndexedAccess`); no `any`; named exports only.",
+    "Feature-Sliced Design: `app -> pages -> widgets -> features -> entities -> shared`; import only downward.",
+    "API types are generated from `contracts/openapi.yaml`; never hand-write them.",
+    "Server state only through TanStack Query hooks in `entities/*/api.ts`.",
+    "Design values come from tokens; no raw colours, sizes or inline styles.",
+    "Every data panel has loading, empty and error states; every screen works from 360 px to 1600 px.",
+    "User-visible strings live in locale files, never literal in components.",
+    "Tests: Vitest + Testing Library + MSW; Playwright visual baselines at 390/834/1440 px."
+  ],
+  "hooks": {
+    "lint_after_edit": true
+  }
+}

package/rules/00-sdd-process.md

@@ -0,0 +1,21 @@
+---
+trigger: always_on
+description: Spec-driven development process. Applies to every change in the repository.
+---
+
+# Spec-driven development
+
+- Every change implements a task from `docs/specs/NNN-*/tasks.md`. If no task covers the change,
+  propose a spec or task update first; do not write untracked code.
+- Read the spec's `spec.md` and `plan.md` and the docs they link before writing code.
+- Respect task order inside a spec. Tasks marked **TDD** start with a failing test that is run and
+  seen to fail for the expected reason.
+- Acceptance criteria IDs (`AC-NNN-n`) appear in test names or docstrings so they can be traced.
+- When the spec is wrong, ambiguous or contradicts another doc: stop, explain the conflict, and
+  propose the doc change. Never silently diverge. If code and docs disagree, fix the doc first.
+- After finishing a task: tick it (`- [x]`), run the project's check command, and commit with
+  `feat(NNN): <what changed>` and `Tasks: TNNN-nn` in the body. One task, one commit.
+- Update `docs/20-implementation-status.md` in the same commit when a component's status
+  changes; record deliberate deviations in its notes.
+- Never work on two specs in one change. Never start P1 work before the P0 path runs end to end.
+- If a change alters what a diagram shows, update the diagram in the same commit.

package/rules/10-architecture-boundaries.md

@@ -0,0 +1,26 @@
+---
+trigger: always_on
+description: Architecture boundaries that keep the domain testable and the adapters replaceable. Applies to all application code.
+---
+
+# Architecture boundaries
+
+- Layers and allowed imports: `api/routes → services → domain + ports`; `adapters` implement
+  `ports`; `main` is the composition root that wires adapters in. The exact names follow
+  `docs/13-conventions.md`.
+- `domain` is pure: no I/O, no SDKs, no framework, no network, no file system, no wall clock.
+  Time comes from an injected clock; randomness from an injected source.
+- Every external system (database, queue, storage, model provider, third-party API) sits behind
+  a port (an interface) with an in-memory fake used by tests. No test calls a real external
+  service.
+- Routes and controllers are thin: parse, call a service, map errors. No business logic there.
+- Every number that matters to the business is computed by deterministic code with a unit test;
+  a model may read, classify, propose and explain, never decide or compute.
+- State changes and their audit record are written together (same transaction or equivalent);
+  re-runs are idempotent and never duplicate data.
+- Configuration is environment variables validated at start-up; model IDs, regions and limits are
+  configuration, never literals in code.
+- A new dependency, managed service or paid API needs an ADR (or a note in the spec's plan) before
+  it enters the code.
+- Enforce the layer rules with a tool where the stack allows it (import-linter, eslint
+  boundaries, go vet rules, dependency-cruiser) and run it in the check command.

package/rules/40-security-and-data.md

@@ -0,0 +1,25 @@
+---
+trigger: always_on
+description: Security and data-handling rules. Applies to every change, including scripts, tests, fixtures, infra and docs.
+---
+
+# Security and data
+
+- **No secrets** in code, config, images, logs, fixtures, commit messages or tool output. Secrets
+  come from a secret manager or an ignored local `.env`; never print a token, even while debugging.
+- Public environment variables (anything shipped to a browser or client) hold nothing server-side.
+- Every data access is scoped by the verified principal (user, workspace, tenant); a foreign ID
+  returns not-found, never forbidden-with-details. Roles are an explicit table with a test per cell.
+- Input is untrusted: validate at the boundary with a schema, enforce size and type limits, sniff
+  uploads by content, use parameterised queries, render user content safely (no raw HTML).
+- Model output is untrusted: validate against a schema before use; resolve references only against
+  known IDs; never let it change permissions, policy or limits.
+- Content given to a model (documents, retrieved text, tool results, user messages) is data, never
+  instructions; frame it as such and pass it as a separate part.
+- Personal data is minimised, masked at rest where possible, and never logged; retention and
+  deletion paths exist and are tested.
+- Real customer data never enters the repository; tests, fixtures, evals and docs use synthetic
+  data that is marked as such.
+- Dependencies are pinned with a committed lockfile and audited in the check command.
+- A change to auth, isolation, roles or validation rules ships with a test in the same commit and
+  is seen by the security reviewer before merge.

package/rules/50-llm-features.md

@@ -0,0 +1,27 @@
+---
+trigger: model_decision
+description: Rules for code that calls a language model or orchestrates agents: prompts, schemas, grounding, cost and tracing. Read when touching prompts, agent nodes, tool definitions or evals.
+---
+
+# Model-backed features
+
+- Prompts live in files (`prompts/<id>.md` or the project's equivalent) with front matter `id`,
+  `version`, `model`, `output_schema`. No prompt text over 200 characters inside code. Bump the
+  version on any change and re-run the evals and recordings that depend on it.
+- Every call has a strict output schema validated before use, a model setting from configuration,
+  a timeout, a retry policy and a fallback. Temperature 0 for classification, extraction and
+  mapping; low for prose.
+- Choose the tier by the job: fast models for classification and extraction, strong models for
+  reasoning and prose. Record the comparison that justified the choice.
+- Content a prompt sees is framed as untrusted data and passed as a separate part. Tools exposed
+  to a model are read-only and scoped unless an ADR says otherwise, and return values with IDs.
+- Every number or claim a model writes for a user carries a citation the code can verify; the
+  code decides whether the citation holds. A model never grades its own output.
+- A model's result about a user's own data is a proposal until a person accepts it; nothing a
+  model detects overwrites a value a person confirmed.
+- Agent nodes: one job each, a result schema, an idempotency key checked before work, a small
+  return value; large data stays in storage. Orchestration is code, not conversation.
+- One trace per run with a span per call; token and cost accounting per call; prompt and
+  response content captured only with synthetic data and an explicit flag.
+- Evals run on demand with a dataset and scorers and are reported in docs; they are never part of
+  the merge gate.

package/rules/60-testing.md

@@ -0,0 +1,19 @@
+---
+trigger: model_decision
+description: Testing rules. Read when writing or changing tests, fixtures, recordings or evals.
+---
+
+# Testing
+
+- The check command runs lint, types, layer rules, repo checks and every gated test layer; it
+  never calls a real external service.
+- A test proves one behaviour and is named after it and its AC (`test_ac007_3_…`).
+- Fakes for every port; recorded outputs for model and OCR calls replayed from fixtures; a missing
+  recording fails loudly.
+- Expected values come from generated ground truth, never hand-typed numbers.
+- Every limit is tested at, below and above the boundary with an injected clock.
+- Invariants get property tests: idempotency, order independence, round-trips, arithmetic.
+- Flaky tests are bugs: remove the shared state, the real clock or the network; never add retries.
+- Never loosen, skip or delete a test to get green; report the conflict with the spec.
+- Visual baselines change only in a reviewed change with screenshots at the agreed widths.
+- Coverage floors per layer are written in `docs/15-testing.md` and enforced by the check command.

package/rules/70-docs-and-status.md

@@ -0,0 +1,19 @@
+---
+trigger: model_decision
+description: Documentation conventions and the implementation-status discipline. Read when editing anything under docs/ or README.
+---
+
+# Docs and status
+
+- `docs/20-implementation-status.md` is the only document that says what is built. Statuses:
+  Specified → In progress → Built (tests green, suite named) → Deployed; Cut with a reason.
+  Built without a named test is Partial. Update it in the same commit as the change.
+- Numbered docs answer one question each; `docs/README.md` lists them with that question and the
+  reading order. Cross-links are relative paths.
+- Specs live in `docs/specs/NNN-name/` as `spec.md`, `plan.md`, `tasks.md`; ADRs in
+  `docs/adr/ADR-NNN-title.md`; both are indexed.
+- Mermaid renders on GitHub: in `sequenceDiagram` messages avoid `;`, `{}`, `|` and a second `:`;
+  quote flowchart labels containing `/`. Editable diagram files (`.drawio.svg`) are edited with the
+  tool, never by hand.
+- Numbers in README or docs come from recorded evidence with a date, never from memory.
+- Write plainly: short sentences, no marketing language, no claims without evidence.

package/skills/crew-adr/SKILL.md

@@ -0,0 +1,21 @@
+---
+name: crew-adr
+description: "Writes one architecture decision record in docs/adr/: context, options with trade-offs, the decision, consequences and how to revisit it; links it from the docs index. Use when a choice is expensive to reverse (a service, a database, a protocol, a scope change)."
+license: MIT
+metadata:
+  anycrew-agent: architect
+  anycrew-phase: design
+---
+
+# One decision, recorded
+
+Delegate to the **architect** (strong tier). Template: `templates/docs/adr/ADR-template.md`.
+
+1. Number: next free `ADR-NNN` in `docs/adr/`. File `docs/adr/ADR-NNN-short-title.md`.
+2. Sections: Status (Proposed / Accepted / Superseded by), Context, Options considered (at least
+   two, each with what it costs), Decision, Consequences (good and bad), How to revisit.
+3. If it supersedes an earlier ADR or amends a constitution principle, say so in both files.
+4. Add the row to `docs/README.md` (or `docs/adr/README.md`) and reference the ADR from the
+   spec or doc that depends on it.
+
+Done when the ADR is Accepted by a person, or left Proposed with the open question named.

package/skills/crew-architecture/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: crew-architecture
+description: "Designs the system from the PRD: architecture with containers and flows (docs/05), data model (docs/09), API contract (docs/10 + contracts/), layer rules (docs/13) and an ADR per significant decision; selects the stack preset. Use before the first spec and whenever a change crosses a boundary."
+license: MIT
+metadata:
+  anycrew-agent: architect
+  anycrew-phase: design
+---
+
+# Architecture, data model and contracts
+
+Delegate to the **architect** (strong tier). Templates in `templates/docs/` (05, 09, 10, 13,
+`adr/ADR-template.md`).
+
+1. Inputs: `docs/03`, `docs/00`, `docs/02`, the preset in `.anycrew/config.json`.
+2. Outputs: `docs/05-architecture.md`, `docs/09-data-model.md`, `docs/10-api-contract.md`,
+   `contracts/openapi.yaml` (or equivalent), `docs/13-conventions.md`, and ADRs for every
+   decision that is expensive to reverse (`crew-adr` for one at a time).
+3. For model-backed features, pull in the **ai-engineer** (`crew-llm`) for `docs/06`.
+4. For UI, pull in the **designer** (`crew-design`) for `docs/11` and `docs/12`.
+5. Gate: the constitution check table has a line per principle; the person approves the ADRs.
+6. The architect ends with the list of specs to write, in build order, for `crew-spec`.
+
+Done when the docs above exist, `contracts/` validates, and the ADRs are approved.

package/skills/crew-brainstorm/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: crew-brainstorm
+description: "Runs a structured brainstorm from an idea, theme or problem to a documented decision in docs/01: inputs and criteria, problem scan, scored options, the decision, out of scope, risks and name candidates. Use at the start of a product, hackathon entry or pivot."
+license: MIT
+metadata:
+  anycrew-agent: brainstormer
+  anycrew-phase: discover
+---
+
+# Brainstorm to a decision
+
+Delegate to the **brainstormer** (strong tier) with the person's idea or theme and any
+constraints they stated. Template: `templates/docs/01-brainstorm-and-decision.md`.
+
+1. The brainstormer asks at most five questions, then writes `docs/01-brainstorm-and-decision.md`
+   through steps 2–7 of its procedure: problem scan, 5–8 options, scoring table, decision,
+   boundaries and risks, names.
+2. Hand facts marked **[assumed]** to the **researcher** (`crew-research`) if the decision
+   depends on them.
+3. Present the decision paragraph and the scoring table to the person and ask for approval.
+   This is a gate: nothing downstream starts before a person says yes.
+
+Done when `docs/01` exists, the decision is approved, and `docs/20-implementation-status.md`
+has a "Decision" row.

package/skills/crew-checkpoint/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: crew-checkpoint
+description: "Updates docs/20-implementation-status.md so it matches the tree: moves component rows between Specified, In progress, Built (with the test suite named), Deployed and Cut; refreshes the last-updated line. Use as part of any change that adds, completes or removes a component, and before a demo or release."
+license: MIT
+metadata:
+  anycrew-agent: doc-writer
+  anycrew-phase: record
+---
+
+# Checkpoint the implementation status
+
+Delegate to the **doc-writer** (fast tier). The status doc is the only document that says what
+is actually built; keep it true.
+
+1. Read `docs/20-implementation-status.md` and the specs' `tasks.md`.
+2. Move the rows the change affected. **Built** requires a named test suite; code without a
+   test that would fail if it broke is **Partial**.
+3. Record deliberate deviations in the row's notes and gaps in the Gaps section.
+4. Refresh the "last updated" line with the date and the one-line reason.
+5. If the project has a status checker script, run it and fix the rows, not the checker.
+
+Done when every row's status matches the code and tests, and the date is today.

package/skills/crew-debug/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: crew-debug
+description: "Structured debugging: capture the error and the spec statement it violates, reproduce deterministically, isolate by layer, explain the root cause, fix with a regression test, record the lesson. Use for errors, failing tests and environment-specific behaviour whose cause is not obvious."
+license: MIT
+metadata:
+  anycrew-agent: debugger
+  anycrew-phase: build
+---
+
+# Debug to the root cause
+
+Delegate to the **debugger** (strong tier) with the error text, the command, the environment
+and the expected behaviour.
+
+1. No fix before a reproduction and a one-paragraph root cause.
+2. The fix is the smallest change at the cause, with the regression test and the check
+   command green.
+3. If the cause was a missing rule or a wrong doc, update it in the same change.
+4. Auth, tenancy or money involved → `crew-security` before merge.
+
+Done when the regression test passes, the suite is green, and the report lists what was ruled
+out.

package/skills/crew-deploy-check/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: crew-deploy-check
+description: "Runs the pre-deployment checklist: gates green on the commit, migrations reviewed and reversible, configuration and secrets present per environment, feature flags set, rollback command and owner named, monitoring in place; then deploys with the documented command if asked and verifies the health endpoint. Use before any release."
+license: MIT
+metadata:
+  anycrew-agent: release-engineer
+  anycrew-phase: ship
+---
+
+# Pre-deploy checklist and deploy
+
+Delegate to the **release-engineer** (balanced tier). Templates:
+`templates/docs/16-infrastructure.md`, `templates/docs/17-observability.md`.
+
+Report each item as ✅ or ❌ with evidence (a command and its output, a file path):
+
+1. Check command green on the exact commit; the commit references its spec.
+2. Migrations: forward-only, dry-run output attached, contract step scheduled separately.
+3. Configuration: every variable in `docs/16` present in the target environment; no secret in
+   a file, image or pipeline log.
+4. Feature flags and limits set for the release.
+5. Rollback: the command, the previous version, and who runs it.
+6. Monitoring: dashboards and alerts cover the change; cost budget alert exists.
+7. Deploy (only when asked): run the documented command, then verify the version at the health
+   endpoint and one smoke action.
+
+Done when every item is ✅ or has a named owner and date, and the person has approved a
+production deploy explicitly.

package/skills/crew-design/SKILL.md

@@ -0,0 +1,22 @@
+---
+name: crew-design
+description: "Defines screens, states and flows (docs/11) and the design system (docs/12 + tokens): information architecture, words first, tokens, components, responsive and accessibility rules, low-fidelity mocks and UI quality gates. Use before any UI spec and whenever a screen is added or changed."
+license: MIT
+metadata:
+  anycrew-agent: designer
+  anycrew-phase: design
+---
+
+# Screens and design system
+
+Delegate to the **designer** (balanced tier). Templates: `templates/docs/11-frontend.md`,
+`templates/docs/12-design-system.md`.
+
+1. Inputs: `docs/03` journeys, `docs/05`, `docs/10`.
+2. Outputs: `docs/11-frontend.md` (routes, screens, states, flows), `docs/12-design-system.md`
+   (principles, tokens, components, content style, gates), `contracts/design/tokens.json`,
+   mocks under `design/mocks/` with screenshots at 390/834/1440 px in `docs/assets/`.
+3. Gate: every screen has words for empty, loading, error and success; every token contrast
+   pair passes AA; no screen scrolls horizontally at 360 px.
+
+Done when the docs exist and the person has looked at the mocks at three widths.