cocosuperintelligence 1.5.0

package/LICENSE

@@ -0,0 +1,29 @@
+MIT License
+
+Copyright (c) 2026 Coco Inc
+
+SCOPE: This MIT license governs the CoCo core — all contents of this
+repository EXCEPT the directory `systems/superintelligence/`. The Super
+Intelligence System in `systems/superintelligence/` is proprietary and is
+licensed separately under `systems/superintelligence/LICENSE`; the grant
+below does not apply to it. Certain vendored third-party components (for
+example, some skills under `skills/`) carry their own upstream licenses,
+which continue to govern those components; see `CREDITS.md`.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,791 @@
+<div align="center">
+
+<br>
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="assets/logo-si.svg">
+  <img src="assets/logo-si-light.svg" alt="CoCo Super Intelligence" width="300">
+</picture>
+
+# CoCo Super Intelligence
+
+### Summon an advisory board of 495 world-class minds — right inside your AI coding session.
+
+CoCo Super Intelligence is the orchestration layer that turns Claude Code, Cursor, or Codex into an entire engineering department: routed expert panels that deliberate and decide, then **226 skills**, **386 commands**, and disk-persistent state that ship what they decided.
+
+Open-core (MIT core · proprietary Super Intelligence) · installs in 90 seconds · 100% local · no telemetry
+
+<br>
+
+[![License: Open-core](https://img.shields.io/badge/License-Open--core-yellow.svg?style=for-the-badge)](LICENSE)
+[![Version](https://img.shields.io/badge/version-1.5.0-blue?style=for-the-badge)](CHANGELOG.md)
+[![Skills](https://img.shields.io/badge/skills-226-emerald?style=for-the-badge)](skills/)
+[![Commands](https://img.shields.io/badge/commands-386-indigo?style=for-the-badge)](commands/)
+[![Personas](https://img.shields.io/badge/personas-495-violet?style=for-the-badge)](systems/superintelligence/)
+[![CI](https://img.shields.io/github/actions/workflow/status/coco-research/coco/ci.yml?branch=main&style=for-the-badge&label=CI)](https://github.com/coco-research/coco/actions)
+
+<br>
+
+<p>
+&nbsp;&nbsp;<a href="#install"><kbd> &nbsp; Install &nbsp; </kbd></a>&nbsp;&nbsp;
+<a href="#the-board"><kbd> &nbsp; The Board &nbsp; </kbd></a>&nbsp;&nbsp;
+<a href="#the-framework-underneath"><kbd> &nbsp; Framework &nbsp; </kbd></a>&nbsp;&nbsp;
+<a href="#skills-catalog"><kbd> &nbsp; Skills &nbsp; </kbd></a>&nbsp;&nbsp;
+<a href="#system-bundles"><kbd> &nbsp; Systems &nbsp; </kbd></a>&nbsp;&nbsp;
+<a href="#see-it-run"><kbd> &nbsp; Demos &nbsp; </kbd></a>
+</p>
+
+<br>
+
+</div>
+
+<p align="center">
+  <img src="assets/demo.gif" alt="/SI-Decide --debate: a routed expert panel argues in reacting rounds before an attributed verdict" width="720" />
+</p>
+
+<div align="center"><sub><em>A real <code>/SI-Decide --debate</code> run — CoCo routes an expert panel, deliberates in reacting rounds, and returns an attributed verdict with named dissent.</em></sub></div>
+
+---
+
+<div align="center">
+
+> **One developer writing single prompts? That was last year.**
+>
+> CoCo Super Intelligence convenes a cross-team board of 495 named experts to pressure-test your hardest calls — then puts an orchestrated team of agents to work executing the verdict: parallel build waves, deterministic verification gates, and phase state that survives every `/clear`.
+
+</div>
+
+<a id="install"></a>
+
+```bash
+git clone https://github.com/coco-research/coco.git && cd coco && bash install.sh
+bash install.sh --systems superintelligence
+```
+
+<div align="center"><sub>90 seconds. Override with <code>--adapter cursor</code> or <code>--adapter claude-code</code>; narrow bundles with <code>--systems</code>. Per-adapter detail: <a href="docs/install.md">docs/install.md</a>.</sub></div>
+
+---
+
+## What CoCo Is (and Isn't)
+
+**CoCo is not a new AI model, and it is not another agent harness.** It doesn't run a model or an agent loop of its own. It's a portable layer of Markdown and YAML that installs *into* the agent harness you already use — Claude Code, Cursor, Codex CLI, or any `AGENTS.md`-compatible tool — and upgrades it with an expert advisory board, a skills library, persistent project memory, specialized subagents, and verification gates.
+
+Your model, your tool, your keys, your machine. When you see "parallel subagent waves," those subagents are executed by your host harness's own agent machinery; CoCo supplies the orchestration structure that makes it all behave like a coordinated team. That is exactly why CoCo is vendor-neutral: it's the operating layer, not the engine.
+
+---
+
+<a id="the-board"></a>
+
+## ⭐ The Board — CoCo Super Intelligence
+
+### A cross-team advisory board of 495 world-class minds
+
+Super Intelligence is CoCo's signature capability. It lets you summon custom, real-world expert panels directly inside your coding session to guide architectural, engineering, risk, finance, and business decisions — each contribution attributed to a named expert, grounded in cited public sources.
+
+```bash
+/SI-Decide "Should we migrate our database to pgvector?"
+/SI-AI-Decide "Which embedding model gives the best cost/performance?"
+/SI-Eng-Pre-Mortem "Review our zero-downtime cache migration strategy"
+/SI-GRC-Review "Check this customer onboarding flow for GDPR compliance"
+```
+
+**495 expert personas**, organized across 13 specialized departments:
+
+| Department | Experts | Focus |
+|---|---:|---|
+| **Engineering** | 70 | Software architecture, cloud systems, systems coding, compilers, infrastructure |
+| **AI** | 59 | Neural-network research, LLM optimization, safety, alignment, vector databases |
+| **Product & Design** | 56 | Design systems, UX, product strategy, growth loops |
+| **Finance** | 47 | Valuation, corporate finance, macro modeling, fintech infrastructure |
+| **Trading** | 46 | Quant analysis, market microstructure, derivatives pricing, crypto liquidity |
+| **Legal & IP** | 31 | Privacy law, antitrust, patent and copyright policy, digital rights |
+| **Risk & Compliance (GRC)** | 30 | GDPR, HIPAA, SOC 2, security auditing, international regulation |
+| **Strategy** | 29 | Platform economics, business models, competitive analysis |
+| **Data & Analytics** | 29 | Data engineering, pipeline optimization, predictive modeling |
+| **Climate & Energy** | 25 | Decarbonization policy, clean-energy economics, carbon markets, circular economy |
+| **Education & EdTech** | 25 | Learning science, curriculum design, education policy, assessment |
+| **Healthcare & Life Sciences** | 25 | Health economics, genomics, clinical medicine, public health policy |
+| **Sales / GTM / Marketing** | 23 | Product-market fit, sales ops, growth marketing, enterprise GTM |
+
+- **342 generated slash commands.** 17 cross-team meta commands (like `/SI-Decide` or `/SI-Tradeoff`, routing across domains) plus 325 per-team commands (25 verbs × 13 teams, such as `/SI-AI-Decide` or `/SI-Eng-Pre-Mortem`). These are generated locally at install time from the team registries — no command files are transmitted or stored remotely.
+- **70 expertise cells.** Each department is subdivided into focused cells (e.g. Engineering has 11, AI has 8) so the router can assemble a precise panel rather than a generic crowd.
+- **Cross-team meta-orchestration.** For complex queries spanning domains ("build and sell an AI audit tool"), a local router scores your prompt against team registries and cells, then greedily assembles a proportional 16–32-person panel.
+- **Citable and grounded.** Every stance is verified from public sources and carries a direct evidence URL. Personas are validated against a strict anti-fabrication gate.
+- **`--debate` deliberation.** Panels can argue in reacting rounds before returning a verdict, surfacing named dissent instead of false consensus.
+
+### The selection algorithm (two-stage routing + approval)
+
+The meta-orchestrator uses a staged algorithm so it never has to load the entire persona filesystem at runtime:
+
+1. **Stage A — team & cell routing (cheap).** Reads the meta-registry (`systems/superintelligence/registry.json`) and scans only team descriptions and cell definitions, scoring relevance by keyword and domain overlap to select the top 1–4 teams. If one team dominates, it delegates to that team's own orchestrator.
+2. **Stage B — scoped persona selection.** Loads compact persona records (slugs, cells, domains, stances, conflict mappings) for only the selected teams, allocates the 16–32-person budget proportionally, runs the greedy scorer (`0.40·domain + 0.30·cell-coverage + 0.30·conflict-pairing`), and applies a cross-team tension pass to pair opposing viewpoints (e.g. security vs. growth).
+3. **Stage C — approval & execution.** Presents the roster grouped by team with a one-line rationale. The action verb then consumes the approved roster and returns output with full line-by-line attribution (e.g. "Aswath Damodaran (Finance): …").
+
+### Persona build & validation pipeline
+
+The 495-persona roster was compiled with a systematic multi-tier workflow. Candidate generation was evaluated across local Qwen (via LM Studio), a hosted small model, and Gemini Flash, but **Claude research agents proved the quality winner** for resolving historical data and citing verifiable signal. Personas are checked by an advisory validation gate (`validate_persona.py`) that enforces five things: every required frontmatter field is present; at least 4 cited URLs resolve live (non-404); every `public_stance` carries an `evidence_url`, so no stance is uncited; at least 2 recent signals within 12 months (or 2 persistent signals for historical archetypes); and any `pairs_well_with` / `productive_conflict_with` slug refers to a real roster member. Two limits are worth stating plainly: the gate confirms that a stance is *cited*, not that a quotation is authentic, and `home_team` is only checked for presence, not validated against the list of real teams. A `NEEDS-TOPUP` verdict is advisory — it does not currently affect which personas a council selects at runtime.
+
+---
+
+<a id="the-framework-underneath"></a>
+
+## The Framework Underneath
+
+The board decides. The framework ships. Three pillars turn the verdict into merged, verified code.
+
+<table>
+<tr>
+<td width="33%" valign="top">
+
+### 1. Autonomous team execution
+`/team:ship` runs a fully coordinated build pipeline — 6 development stages, 7 hard verification gates, and 2 architecture conformance gates. Specialized agents act in their domains (Research, Architecture, Plan, Review, Build, QA). Code must clear the Test Evidence Protocol (independent re-runs, strict coverage, skip-prevention) **and land where the plan said it would** before a pull request is opened.
+
+</td>
+<td width="33%" valign="top">
+
+### 2. Disk-persistent state
+AI chat context is fragile and wipes on `/clear`. CoCo persists phase state, decisions, and progress logs to disk across resets, with atomic git commits for every successful step — so you can review history, roll back a bad design path, or resume a long-running migration from any checkpoint.
+
+</td>
+<td width="33%" valign="top">
+
+### 3. Vendor-neutral portability
+CoCo compiles its rules, templates, and agent definitions into pure Markdown and YAML frontmatter. Native IDE adapters inject the same library into Claude Code, Cursor, Codex CLI, PI-Desktop, VS Code, or any `AGENTS.md` tool — so your workflows follow you even if you switch AI editors.
+
+</td>
+</tr>
+</table>
+
+---
+
+## Architecture conformance: the gate tests cannot give you
+
+Every test suite in existence shares one blind spot. **Tests fail when behaviour breaks — not when your architecture quietly dissolves.** A component can be relocated, folded into another module, or deleted outright, and a green build will tell you nothing. Requirements pass. Coverage holds. The design you agreed to is gone.
+
+`/team` now closes that gap in both directions, and both are enforced by Python scripts with real exit codes — not by instructions an agent can narrate its way around.
+
+<table>
+<tr>
+<td width="50%" valign="top">
+
+### ◀ Backwards — drift detection
+
+A commit-pinned index at **`.arch/index.json`** maps every architectural component to the real directories and files that implement it. `/team:verify` gained failure mode **`(e)`**: structural drift against that index.
+
+Twelve validator checks run on every index. The central one is blunt and unfakeable: **every claimed path must resolve on disk.** A fabricated path exits non-zero and names itself.
+
+</td>
+<td width="50%" valign="top">
+
+### ▶ Forwards — built as declared
+
+`/team:ship` Stage 3 now declares its intended architecture to **`.team-ship/ARCH-PLAN.json`** — where each component will live, and what is explicitly out of scope.
+
+After the build, the **built-as-declared gate** checks it. A component you declared and then quietly dropped is a **BLOCK**. A file that lands in a path the plan ruled out of scope is a **BLOCK**. Neither appears in any test result.
+
+</td>
+</tr>
+</table>
+
+**Why this works.** Path existence cannot be checked at planning time, because nothing is built yet. So the plan is *written* when the knowledge exists and *tested* when the evidence exists. Deferring the check rather than weakening it is exactly what makes a forward architecture declaration enforceable.
+
+### Use it
+
+```bash
+/team arch build      # map this repository into a committed, commit-pinned index
+/team arch drift      # reconcile an existing index against the current tree
+/team arch check      # run the validator alone — no model calls, no writes to the index
+/team verify          # now includes failure mode (e): architecture abandoned
+/team ship            # declares intended architecture, then proves the build matches
+/team ship --no-arch  # opt out entirely; every gate reports DISABLED, never a silent pass
+```
+
+The approval gate now shows you the intended architecture as a table before the build starts. That is the cheapest moment to disagree with it.
+
+### What it does not do
+
+A gate that overstates its reach is worse than no gate, so these limits are stated in the artifacts themselves and are not marketing hedges.
+
+- **Structural drift only.** A component whose datastore was swapped *inside* its own already-claimed directory produces no drift. Every artifact says "structural drift only" in those words, deliberately.
+- **Not a work-allocation mechanism.** The index sits at C4-Container altitude, so one component can legitimately own thousands of files. Three separate design reviews rejected deriving per-agent file ownership from it.
+- **Currency is not yet mechanically enforced.** Comparing the index pin to `HEAD` is prose an agent follows, not a script. A stale index degrades every gate to `UNVERIFIED` rather than to a pass — but instrumenting this is the next piece of work, and it is named as such.
+- **A clean result licenses no claim** about whether the code at those paths does what the component promised. That remains a review judgement.
+
+Requires only Python 3 and `git`. No new dependencies. Design adapted from [lak7/devildev](https://github.com/lak7/devildev) (Apache-2.0); no upstream code was copied — see [`CREDITS.md`](CREDITS.md).
+
+---
+
+## The CoCo Asset Library
+
+A standard install equips your workspace with a lightweight core; full activation unlocks up to **947 total assets** to orchestrate any software-engineering workflow.
+
+<table align="center">
+<tr>
+<td align="center" width="20%"><h3>226</h3><sub>Skills</sub><br><small>74 Core + 152 Bundle</small></td>
+<td align="center" width="20%"><h3>386</h3><sub>Slash Commands</sub><br><small>44 Core + 342 Generated</small></td>
+<td align="center" width="20%"><h3>35</h3><sub>Specialized Agents</sub><br><small>11 Core + 24 Bundle</small></td>
+<td align="center" width="20%"><h3>495</h3><sub>Expert Personas</sub><br><small>Super Intelligence Board</small></td>
+<td align="center" width="20%"><h3>15</h3><sub>Cross-IDE Rules</sub><br><small>Cursor MDC Rules</small></td>
+</tr>
+</table>
+
+<div align="center">
+  <sub><strong>Core install:</strong> 144 active assets (74 Skills, 44 Commands, 11 Agents, 15 Rules)</sub><br>
+  <sub><strong>A plain install ships every bundle except the security-testing tooling</strong>, which stays opt-in via <code>--systems reverse-skill</code>.</sub><br>
+  <sub><strong>Orchestration bundles:</strong> <strong>+68 GSD skills</strong> · <strong>+24 GSD agents</strong> · <strong>+6 Brain skills</strong> · <strong>+13 Super Intelligence skills</strong> · <strong>+342 SI commands</strong> · <strong>3 Workflows</strong></sub>
+</div>
+
+---
+
+<a id="skills-catalog"></a>
+
+## Skills Catalog
+
+CoCo ships **226 skills** (74 core + 152 across bundles). These are not prompt snippets — each is a full agent instruction set with state management, verification logic, and error handling. A representative slice by category:
+
+### Visual design & styling
+`ui-ux-pro-max` (50 styles, 21 palettes, 50 font pairings, 9 stacks) · `frontend-design` · `design-taste-frontend` · `redesign-existing-projects` · `axiom-liquid-glass` (Apple Liquid Glass, WWDC 2025) · `swiftui-liquid-glass` · `web-design-guidelines` · `tailwind-patterns` (Tailwind v4) · `vercel-react-best-practices` · `clone-website` · `c4-architecture` · `arb-review` · `expo-api-routes` · `ai-product` · `scroll-world` (scroll-scrubbed, cut-free camera flythrough landing pages, generated end to end via Higgsfield).
+
+### Engineering discipline & quality
+`brainstorming` · `writing-plans` · `executing-plans` · `subagent-driven-development` · `dispatching-parallel-agents` · `test-driven-development` · `systematic-debugging` · `requesting-code-review` · `receiving-code-review` · `verification-before-completion` · `finishing-a-development-branch` · `using-git-worktrees` · `code-verification` (7 bug-vector audit) · `generate-tests` · `api-design-principles` · `cli-anything` · `workflow-routing`.
+
+### AI / LLM engineering
+`openai-agents` · `openai-api` · `openai-apps-mcp` · `openai-whisper` · `agent-lightning` (Microsoft Agent Lightning, RL) · `voice-ai` · `ai-marketing-videos`.
+
+### Product management & communication
+`prd-generator` · `prd-mastery` · `task-prd-creator` · `project-docs` · `pmstudio` · `nfr-tracker` · `stakeholder-comms` · `meeting-notes` · `change-log`.
+
+### Operations, safety & recovery
+`dr-plan` (RTO/RPO) · `irp` (incident response) · `recovery-plan`.
+
+### Media, memory & analysis
+`coco-ads` (launch videos via HyperFrames) · `media-memory` (multimodal embeddings) · `doc-sync` · `ultra-think` · `browser-automation`.
+
+### The CoCo platform itself
+`coco` (conversational router) · `coco-cli` · `coco-loop` (compiles a plain-language goal into a confirmed charter, then runs a bounded, propose-only autonomous loop) · `skill-creator` · `writing-skills` · `find-skills`.
+
+<details>
+<summary><strong>▸ Full catalog — every one of the 226 skills</strong></summary>
+
+<br>
+
+**Core skills (66)**
+
+`agent-lightning` · `ai-marketing-videos` · `ai-product` · `api-design-principles` · `arb-review` · `axiom-liquid-glass` · `brainstorming` · `browser-automation` · `c4-architecture` · `change-log` · `cli-anything` · `clone-website` · `coco` · `coco-ads` · `coco-cli` · `coco-loop` · `code-verification` · `design-taste-frontend` · `dispatching-parallel-agents` · `doc-sync` · `dr-plan` · `executing-plans` · `expo-api-routes` · `find-skills` · `finishing-a-development-branch` · `frontend-design` · `generate-tests` · `irp` · `media-memory` · `meeting-notes` · `nfr-tracker` · `openai-agents` · `openai-api` · `openai-apps-mcp` · `openai-whisper` · `pmstudio` · `prd-generator` · `prd-mastery` · `project-docs` · `receiving-code-review` · `recovery-plan` · `redesign-existing-projects` · `requesting-code-review` · `scroll-world` · `skill-creator` · `stakeholder-comms` · `subagent-driven-development` · `swiftui-liquid-glass` · `systematic-debugging` · `tailwind-patterns` · `task-prd-creator` · `test-driven-development` · `ui-ux-pro-max` · `ultra-think` · `using-git-worktrees` · `using-superpowers` · `vercel-react-best-practices` · `verification-before-completion` · `voice-ai` · `web-design-guidelines` · `workflow-routing` · `writing-plans` · `writing-skills`
+
+**GSD bundle skills (68)** — the full `gsd-*` project-orchestration lifecycle: `gsd-new-project`, `gsd-plan-phase`, `gsd-execute-phase`, `gsd-verify-work`, `gsd-autonomous`, `gsd-debug`, `gsd-ui-phase`, `gsd-secure-phase`, `gsd-workstreams`, `gsd-forensics`, `gsd-milestone-summary`, `gsd-map-codebase`, `gsd-profile-user`, and 55 more (see [`systems/gsd/skills/`](systems/gsd/skills/)).
+
+**Brain bundle skills (6)** — `brain` · `brain-init` · `brain-rescan` · `brain-update` · `brain-export` · `brain-wiki`.
+
+**Super Intelligence bundle (13)** — one orchestration skill per built team (ai, engineering, product-design, finance, trading, risk-compliance, strategy, data-analytics, gtm, climate-energy, education-edtech, healthcare-life-sciences, legal-ip), which generate the 342 `/SI-*` commands at install.
+
+</details>
+
+---
+
+<a id="system-bundles"></a>
+
+## System Bundles
+
+Bundles are opt-in packages that extend the workspace with specialized databases, pipelines, and rosters. Enable them with `--systems <name>`.
+
+One further bundle, `reverse-skill`, is deliberately not part of any default install and is not counted among the four below: it vendors reverse-engineering and penetration-testing methodology under [`systems/reverse-skill/`](systems/reverse-skill/), and it is security tooling that stays installed only when it is asked for by name, with `--systems reverse-skill`. See [`systems/reverse-skill/README.md`](systems/reverse-skill/README.md) for what it contains and how it was curated.
+
+### 1. GSD (Get Shit Done)
+An orchestration engine of **68 skills and 24 agents** that manages the lifecycle of complex codebases. A disk-backed phase database records goals, decisions, milestones, and blockers; **workstreams** spin up isolated git checkouts to test refactors without polluting main; **forensics** performs post-mortem root-cause audits when a phase fails; and **autonomous mode** runs parallel waves of subagents through plan milestones end-to-end.
+
+### 2. Brain
+A local knowledge-graph engine of **6 skills** connecting email, chat, code, and docs. A local SQLite store indexes code entities, business decisions, project terms, and stakeholder feedback; a **wiki generator** builds hyperlinked articles for every recorded entity; and mail sync links project email threads to related files.
+
+### 3. Team
+A multi-agent product-team pipeline (`/team:ship`, `/team:plan`, `/team:review`, `/team:verify`, and more). It spawns specialized subagents — Research, Architect, QA — to execute changes, review diffs, and write tests, with deterministic gates that intercept merges to run lints, import audits, reference checks, and verification suites.
+
+### 4. Super Intelligence
+The **495-persona advisory board** and its **342 generated `/SI-*` commands** across 13 teams — the hero capability described [above](#the-board).
+
+---
+
+## YOLO Mode: True Autonomy
+
+<table>
+<tr>
+<td valign="top">
+
+```bash
+/coco yolo
+```
+
+</td>
+<td valign="top">
+
+**Bypass approval gates and let the team run unattended.**<br>
+<sub>Activates autonomous multi-stage execution — pipelines advance phase to phase without manual confirmation. Combine with <code>/gsd-autonomous</code> and <code>--systems gsd</code> to run code migrations or test sweeps overnight. Revert to safety any time with <code>/coco careful</code> or <code>/coco normal</code>.</sub>
+
+</td>
+</tr>
+</table>
+
+---
+
+## Before CoCo vs. After CoCo
+
+<table>
+<tr>
+<th width="20%">Scenario</th>
+<th width="38%">Standard AI Assistant (Claude Code / Cursor / Codex)</th>
+<th width="42%">CoCo-Orchestrated Workspace</th>
+</tr>
+<tr>
+<td><strong>Hard decisions</strong></td>
+<td>One model's single opinion, no attribution, no dissent.</td>
+<td>A routed 16–32-person expert panel deliberates and returns an attributed verdict with named dissent.</td>
+</tr>
+<tr>
+<td><strong>Feature development</strong></td>
+<td>Generates a single component, misses side-effects, needs hand-holding.</td>
+<td>Scans repo, designs the interface, plans phases, runs parallel build agents, tests, and verifies.</td>
+</tr>
+<tr>
+<td><strong>Code auditing</strong></td>
+<td>Suggests basic syntax fixes; misses architectural constraints.</td>
+<td>Applies a 7-category audit (TDZ errors, import mismatches, dead code, CSS regressions, mock leaks).</td>
+</tr>
+<tr>
+<td><strong>System debugging</strong></td>
+<td>Repeats similar suggestions; loses track of prior attempts.</td>
+<td>Systematic loop (Reproduce → Isolate → Hypothesize → Fix → Verify) with saved checkpoints.</td>
+</tr>
+<tr>
+<td><strong>Context resets</strong></td>
+<td>Forgets the active plan; starts over from scratch.</td>
+<td>Reads workspace state from disk and resumes the active phase immediately.</td>
+</tr>
+</table>
+
+---
+
+<a id="see-it-run"></a>
+
+## High-Impact Command Demos
+
+<table>
+<tr>
+<td width="50%" valign="top">
+
+### Cross-team decision
+```bash
+/SI-Decide --debate "Buy vs. build our vector store"
+```
+> Routes a proportional expert panel, deliberates in reacting rounds, and returns an attributed verdict with named dissent.
+
+</td>
+<td width="50%" valign="top">
+
+### Code-integrity verification
+```bash
+/code-verification
+```
+> Audits fresh code against 7 bug vectors, preventing broken references, imports, and mock leakage.
+
+</td>
+</tr>
+<tr>
+<td valign="top">
+
+### Website re-engineering
+```bash
+/clone-website https://stripe.com
+```
+> Extracts colors, typography, spacing, shadows, and SVG assets from a live URL into a single-file responsive template.
+
+</td>
+<td valign="top">
+
+### Systematic debugging
+```bash
+/systematic-debugging
+```
+> Drives a methodical root-cause isolation workflow, preserving hypotheses and findings across API limits.
+
+</td>
+</tr>
+<tr>
+<td valign="top">
+
+### Spec & PRD generation
+```bash
+/prd-generator
+```
+> Produces a comprehensive PRD — user stories, metrics, risks, architecture.
+
+</td>
+<td valign="top">
+
+### Launch video
+```bash
+/coco-ads
+```
+> Turns the project you just shipped into a short, shareable launch video, rendered locally via HyperFrames.
+
+</td>
+</tr>
+</table>
+
+---
+
+## Power Features
+
+<table>
+<tr>
+<td width="50%" valign="top">
+
+### CoCo conversational router
+```bash
+/coco
+```
+> A central dashboard that routes plain-English asks — "what's blocking?", "summarize files", "run tests" — to the right sub-command.
+
+</td>
+<td width="50%" valign="top">
+
+### Multimodal memory
+```bash
+/media-memory
+```
+> A local embedding database (Gemini Embedding + ChromaDB) that indexes, searches, and associates diagrams, audio, and docs with your code.
+
+</td>
+</tr>
+<tr>
+<td valign="top">
+
+### Scheduled & loop agents
+```bash
+# Point your host CLI's scheduler at any CoCo command:
+/schedule run /team:review every Monday
+/loop 5m /team:verify
+```
+> CoCo ships no scheduler of its own. Where your host CLI provides scheduling or looping (such as Claude Code's `/schedule` and `/loop`), point it at any CoCo command to run reviews or watches unattended.
+
+</td>
+<td valign="top">
+
+### Email triage suite
+```bash
+/email:summary
+/email:today
+```
+> Reads your active Outlook instance (Legacy AppleScript or New Outlook MIME cache) to fetch, search, thread, and draft replies to project mail.
+
+</td>
+</tr>
+<tr>
+<td valign="top">
+
+### Workspace branching
+```bash
+/gsd-workstreams create feature-a
+/gsd-new-workspace
+```
+> Branch development workstreams within one repo — isolated, sandboxed checkouts with separate project state.
+
+</td>
+<td valign="top">
+
+### AGENTS.md compiler
+```bash
+bash adapters/codex/install.sh
+```
+> Compiles all active rules, skills, and command definitions into a standard `AGENTS.md` recognized by Aider, Cline, and Continue.
+
+</td>
+</tr>
+</table>
+
+---
+
+## How CoCo Works
+
+```mermaid
+flowchart LR
+  U["You<br/>(Slash command, plain English)"] --> AI["Your AI Harness<br/>(Claude Code, Cursor, Codex…)"]
+  AI --> A["IDE Adapter"]
+  A --> S["CoCo Assets<br/>skills · agents · commands · rules · personas"]
+  S -. Read at runtime .-> AI
+  AI --> Agents["Parallel Subagents<br/>(executed by your harness)"]
+  Agents --> AI
+```
+
+<div align="center"><sub>CoCo is the asset + orchestration layer. Your harness runs the model and executes the agents.</sub></div>
+
+---
+
+## Installation Matrix
+
+<table>
+<tr>
+<td width="50%" valign="top">
+
+**Standard 90-second setup**
+
+```bash
+git clone https://github.com/coco-research/coco.git
+cd coco
+bash install.sh
+```
+*The installer auto-detects your active IDE/CLI.*
+
+</td>
+<td width="50%" valign="top">
+
+**Via the npm CLI wrapper**
+
+```bash
+# The package name is reserved as `cocosuperintelligence` but is not published
+# on npmjs.com yet (registry 404). Until it is, run the wrapper from a clone:
+git clone --branch v1.5.0 --depth 1 https://github.com/coco-research/coco.git
+node coco/bin/coco.js --help
+```
+*Do not `npx cocosuperintelligence` until the name is published — npx would
+resolve whatever first claims that name. The wrapper clones the pinned
+release tag, not floating `main`.*
+
+</td>
+</tr>
+<tr>
+<td valign="top">
+
+**Narrow the install (optional)**
+
+```bash
+# Every bundle installs by default. To take a subset instead:
+bash install.sh --systems gsd,brain
+bash install.sh --systems superintelligence
+
+# Or the core set alone, with no bundles:
+bash install.sh --core-only
+```
+
+</td>
+<td valign="top">
+
+**Manual adapter overrides**
+
+```bash
+bash install.sh --adapter claude-code
+bash install.sh --adapter cursor
+bash install.sh --adapter grok
+bash install.sh --adapter vscode
+bash install.sh --adapter codex
+bash install.sh --adapter pi-desktop
+bash install.sh --adapter generic
+```
+
+</td>
+</tr>
+<tr>
+<td colspan="2" valign="top">
+
+**One-line remote install**
+
+```bash
+bash <(curl -fsSL https://raw.githubusercontent.com/coco-research/coco/main/bin/coco-bootstrap.sh)
+```
+*Clones the pinned release tag (currently `v1.5.0`, not floating `main`) to `~/.coco`, then pauses and prints the commit hash, date, and message so you can verify it against [that release](https://github.com/coco-research/coco/releases/tag/v1.5.0) before it runs `install.sh`. Type `y` to proceed. Pass `--yes` or set `COCO_BOOTSTRAP_YES=1` to skip the prompt for CI or scripted installs, and pass adapter/systems flags after `--`, e.g. `-- --adapter cursor --systems gsd`.*
+
+</td>
+</tr>
+</table>
+
+Adapter flags, bundle selection, and per-adapter targets: [`docs/install.md`](docs/install.md).
+
+The install paths above are deliberately conservative: the remote bootstrap never runs code before you have confirmed the commit it cloned, `install.sh` only ever reads and symlinks files already inside the repository, the CI workflows that build and publish Coco pin their `setup-node` and `setup-python` Actions to commit SHAs rather than mutable tags, and nothing Coco does locally or in CI sends data anywhere. See [`SECURITY.md`](SECURITY.md) for the full policy.
+
+---
+
+## Staying Current
+
+CoCo tells you when a newer version is available — it checks the GitHub repository at most once per day, prints a one-line banner, and sends **no telemetry**. Disable with `COCO_NO_UPDATE_CHECK=1`.
+
+<table>
+<tr>
+<td width="50%" valign="top">
+
+**git clones**
+
+```bash
+# print version + update status
+bash scripts/check-update.sh
+
+# apply an update
+git pull --ff-only && bash install.sh
+```
+
+</td>
+<td width="50%" valign="top">
+
+**CLI wrapper (from a clone)**
+
+```bash
+# print version + check for updates
+node bin/coco.js version
+
+# apply an update (checks out the pinned release tag)
+node bin/coco.js update
+```
+Until `cocosuperintelligence` is published on npmjs.com, do not use `npx` for this.
+
+</td>
+</tr>
+</table>
+
+<sub>Releases are tracked in [`CHANGELOG.md`](CHANGELOG.md) and on the <a href="https://github.com/coco-research/coco/releases">GitHub Releases</a> page.</sub>
+
+---
+
+## System Compatibility
+
+<table>
+<tr>
+<th>AI Tool / CLI</th>
+<th>Adapter Name</th>
+<th>Status</th>
+<th>Details</th>
+</tr>
+<tr>
+<td><strong><a href="https://docs.anthropic.com/en/docs/claude-code">Claude Code</a></strong></td>
+<td><code>claude-code</code></td>
+<td>Stable</td>
+<td>Full support for slash commands, agents, and local settings.</td>
+</tr>
+<tr>
+<td><strong><a href="https://cursor.com/">Cursor</a></strong></td>
+<td><code>cursor</code></td>
+<td>Stable</td>
+<td>Links MDC rules and custom workspace skills.</td>
+</tr>
+<tr>
+<td><strong>Grok Build / Grok CLI</strong></td>
+<td><code>grok</code></td>
+<td>Stable</td>
+<td>Links skills, commands, agents and rules into <code>~/.grok/</code>. Registers <code>coco-platform</code> MCP and m0 hooks when those binaries are present.</td>
+</tr>
+<tr>
+<td><strong><a href="https://github.com/openai/codex">Codex CLI</a></strong></td>
+<td><code>codex</code></td>
+<td>Stable</td>
+<td>Compiles assets into root context.</td>
+</tr>
+<tr>
+<td><strong>Aider / Cline / Windsurf</strong></td>
+<td><code>generic</code></td>
+<td>Stable</td>
+<td>Generates a portable, root-level <code>AGENTS.md</code> definition.</td>
+</tr>
+<tr>
+<td><strong><a href="https://code.visualstudio.com/">VS Code</a> / Copilot CLI</strong></td>
+<td><code>vscode</code></td>
+<td>Stable</td>
+<td>Links skills, agents and rules into <code>~/.copilot/</code> and commands into the VS Code prompts folder. No extension needed.</td>
+</tr>
+<tr>
+<td><strong>Antigravity (Google)</strong></td>
+<td><code>antigravity</code></td>
+<td>Planned</td>
+<td>Integration planned for the v0.2 release.</td>
+</tr>
+</table>
+
+---
+
+## Technical Specifications
+
+<table>
+<tr><td><strong>Spec Version</strong></td><td>1.5.0</td></tr>
+<tr><td><strong>License</strong></td><td>Open-core — <a href="LICENSE">MIT</a> core; Super Intelligence is <a href="systems/superintelligence/LICENSE">proprietary</a></td></tr>
+<tr><td><strong>Total Skills</strong></td><td>226 with all bundles installed (74 Core + 152 Bundle)</td></tr>
+<tr><td><strong>Slash Commands</strong></td><td>386 with all bundles — 44 Core (shipped) + 342 Super Intelligence (325 per-team + 17 cross-team, generated at install)</td></tr>
+<tr><td><strong>Specialized Agents</strong></td><td>35 (11 Core + 24 Bundle)</td></tr>
+<tr><td><strong>Expert Personas</strong></td><td>495 across 13 departments and 70 cells</td></tr>
+<tr><td><strong>System Bundles</strong></td><td>6 (GSD, Brain, Cognee, HyperFrames, Super Intelligence, M0) — installed by default. <code>reverse-skill</code>, the security-testing bundle, stays opt-in with <code>--systems reverse-skill</code>. <code>/team</code> is core and needs no flag.</td></tr>
+<tr><td><strong>Cross-IDE Rules</strong></td><td>15 (.mdc files)</td></tr>
+<tr><td><strong>Workflows Defined</strong></td><td>3 (.md pipelines)</td></tr>
+<tr><td><strong>Total Addressable Assets</strong></td><td>947 with all bundles enabled</td></tr>
+<tr><td><strong>Install Time</strong></td><td>&le; 90 seconds</td></tr>
+<tr><td><strong>Telemetry / SaaS</strong></td><td>None — 100% local files</td></tr>
+</table>
+
+<sub>Core install ships 74 skills + 44 commands + 11 agents + 15 rules (144 active assets). The totals above are what a plain <code>bash install.sh</code> delivers: every bundle in the default allow-list (GSD, Brain, Cognee, HyperFrames, Super Intelligence, M0) is installed by default. <code>--core-only</code> installs the core set alone, and <code>--systems &lt;list&gt;</code> installs an explicit subset — including <code>reverse-skill</code>, the security-testing bundle, which stays opt-in and is never part of the default set. Super Intelligence slash commands are generated locally at install time from the team registries — no command files are transmitted or stored remotely. <code>adapters/INDEX.md</code> records what each adapter actually delivers, measured by running it.</sub>
+
+---
+
+## Frequently Asked Questions
+
+<details>
+<summary><strong>Is CoCo an AI model or an agent harness?</strong></summary>
+Neither. CoCo is a portable layer of Markdown and YAML that installs into the agent harness you already use (Claude Code, Cursor, Codex CLI, or any AGENTS.md tool). Your host harness runs the model and executes the agents; CoCo supplies the skills, commands, agents, rules, and persona board that make it act like a coordinated team.
+</details>
+
+<details>
+<summary><strong>Is my codebase or data sent to a third party?</strong></summary>
+No. CoCo is entirely local — Markdown, configuration, and shell scripts on your machine. Your existing AI tool's privacy policy is unchanged, and CoCo adds no telemetry.
+</details>
+
+<details>
+<summary><strong>How do I modify or customize a skill?</strong></summary>
+Every skill lives at <code>skills/&lt;name&gt;/SKILL.md</code>. Edit it directly to refine instructions or add tools, then run <code>bash install.sh</code> to refresh the symlinks.
+</details>
+
+<details>
+<summary><strong>How do I cleanly uninstall CoCo?</strong></summary>
+Because CoCo uses symbolic links, removal is non-destructive:
+<pre>CLONE="$(pwd)"
+find ~/.claude ~/.cursor ~/.grok ~/.copilot -type l -lname "${CLONE}/*" -delete</pre>
+This removes only links whose target is inside this clone. A contains-match such as
+<code>*$(pwd)*</code> would also delete links into any path that merely contains the
+folder name (for example <code>coco-research</code> when the clone is <code>coco</code>).
+
+For the Hermes adapter, profiles live under <code>~/.hermes/profiles</code>:
+<pre>CLONE="$(pwd)"
+find ~/.hermes/profiles -type l -lname "${CLONE}/*" -delete</pre>
+The appended rules block between <code>&lt;!-- coco:rules-start --&gt;</code> and
+<code>&lt;!-- coco:rules-end --&gt;</code> in each profile's CLAUDE.md is stripped automatically on the next install run without the repo.
+</details>
+
+<details>
+<summary><strong>What happens if I switch my AI assistant later?</strong></summary>
+Re-run the installer with the new adapter flag (e.g. <code>bash install.sh --adapter cursor</code>). All your custom skills and workflows follow you.
+</details>
+
+---
+
+## Contributing & Community
+
+CoCo is open-core: the core is MIT-licensed and contributions are welcome. The Super Intelligence System (`systems/superintelligence/`) is proprietary — see [`systems/superintelligence/LICENSE`](systems/superintelligence/LICENSE).
+
+- **Start here:** [`CONTRIBUTING.md`](CONTRIBUTING.md) — how to add a skill, command, agent, or adapter.
+- **Good first issues:** [help wanted / good first issue](https://github.com/coco-research/coco/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22) — small, well-scoped tasks for newcomers.
+- **Report a bug / request a feature:** [open an issue](https://github.com/coco-research/coco/issues/new/choose).
+- **Security:** see [`SECURITY.md`](SECURITY.md) for responsible disclosure.
+- **Conduct:** see [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md).
+
+Before opening a PR, validate locally — CI runs a frontmatter linter, manifest validation, and an install-script syntax check.
+
+---
+
+## Built On
+
+CoCo Super Intelligence stands on the shoulders of excellent open-source work. Special thanks to:
+
+- **[obra/superpowers](https://github.com/obra/superpowers)** (Jesse Vincent) — the foundational engineering-discipline skills (brainstorming, systematic debugging, TDD, plan writing/execution, git worktrees, code-review flows, verification, and skill authoring).
+- **[gsd-build/get-shit-done](https://github.com/gsd-build/get-shit-done)** — the 68-skill / 24-agent GSD project-orchestration bundle.
+- **[heygen-com/hyperframes](https://github.com/heygen-com/hyperframes)** (HeyGen, Inc., Apache License 2.0) — the 20-skill HyperFrames video/motion bundle vendored under `systems/hyperframes/` (composition engine, CLI, animation, creative direction, registry, and the video-authoring suite).
+- **[JCodesMore/ai-website-cloner-template](https://github.com/JCodesMore/ai-website-cloner-template)** — the site-cloning structure behind `clone-website`.
+- **[agents.md](https://agents.md/)** community — the vendor-neutral agent-context standard CoCo's adapters follow.
+- **[nickwinder/synthteam](https://github.com/nickwinder/synthteam)** (Nick Winder) — the multi-agent debate protocol behind `--debate` deliberation.
+- **[latent-spaces/brag](https://github.com/latent-spaces/brag)** (Shunit Haviv) and **[HyperFrames](https://www.npmjs.com/package/hyperframes)** (HeyGen) — the launch-video flow and local render engine behind `coco-ads`.
+- **[leonxlnx/taste-skill](https://github.com/leonxlnx/taste-skill)** (Leon) — the design-taste enforcement behind `design-taste-frontend` and `redesign-existing-projects`.
+- **[HKUDS/CLI-Anything](https://github.com/HKUDS/CLI-Anything)** — the "wrap any CLI into a structured skill" methodology behind `cli-anything`.
+- **[Vercel](https://vercel.com/)** and **[vercel-labs/web-interface-guidelines](https://github.com/vercel-labs/web-interface-guidelines)** — the source material behind `vercel-react-best-practices` and `web-design-guidelines`.
+
+Full attributions — including feature-level inspirations, bundled audio ([ende.app](https://ende.app), [Kenney.nl](https://kenney.nl)), and licenses — live in [CREDITS.md](CREDITS.md). If something influenced CoCo and isn't listed, that's a bug: [open an issue](https://github.com/coco-research/coco/issues/new/choose).

package/bin/coco-bootstrap.sh

@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+# coco-bootstrap.sh — one-shot installer
+#
+# Usage:
+#   bash <(curl -fsSL https://raw.githubusercontent.com/coco-research/coco/main/bin/coco-bootstrap.sh)
+#   bash <(curl -fsSL ...) -- --adapter cursor --systems gsd
+#   bash <(curl -fsSL ...) -- --dry-run
+#   COCO_DIR=~/tools/coco bash <(curl -fsSL ...)
+#
+# Flags (passed through to install.sh after --, or set via env):
+#   --adapter <name>    claude-code | cursor | grok | vscode | codex | generic
+#   --systems <list>    e.g. gsd,brain,team
+#   --dry-run           preview only, no writes
+#   --yes               skip the commit-verification prompt (for CI/scripted installs)
+#
+# Security:
+#   This script does NOT execute anything from the network directly. It uses
+#   `git clone` to fetch the full repository (TLS-verified), then pauses so
+#   you can inspect the commit hash before proceeding.
+#   To skip the pause in CI, set COCO_BOOTSTRAP_YES=1 or pass --yes. Only the exact
+#   value 1 (or --yes) skips it; anything else, including 0, keeps the prompt.
+set -euo pipefail
+
+REPO_URL="https://github.com/coco-research/coco.git"
+# Keep in sync with package.json version. Clone the last tagged release, not floating main.
+PINNED_TAG="v1.5.0"
+INSTALL_DIR="${COCO_DIR:-$HOME/.coco}"
+YES="${COCO_BOOTSTRAP_YES:-}"
+PASS_THROUGH=()
+
+# Parse our own flags; collect the rest for install.sh
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --yes|-y) YES=1 ;;
+    --dry-run|--adapter|--systems)
+      PASS_THROUGH+=("$1")
+      [[ "$1" != "--dry-run" ]] && { shift; PASS_THROUGH+=("$1"); }
+      ;;
+    --) shift; PASS_THROUGH+=("$@"); break ;;
+    *) PASS_THROUGH+=("$1") ;;
+  esac
+  shift
+done
+
+detect_adapter() {
+  if [[ -n "${CLAUDECODE:-}" || -d "$HOME/.claude/skills" ]]; then
+    echo "claude-code"
+  elif [[ -d "$HOME/.cursor" ]]; then
+    echo "cursor"
+  elif [[ -d "$HOME/.grok" ]]; then
+    echo "grok"
+  elif command -v codex >/dev/null 2>&1; then
+    echo "codex"
+  else
+    echo "generic"
+  fi
+}
+
+# Inject --adapter if not already in pass-through args
+if ! printf '%s\0' "${PASS_THROUGH[@]+"${PASS_THROUGH[@]}"}" | grep -qz -- '--adapter'; then
+  PASS_THROUGH=("--adapter" "$(detect_adapter)" "${PASS_THROUGH[@]+"${PASS_THROUGH[@]}"}")
+fi
+
+echo "Coco bootstrap"
+echo "Install directory: $INSTALL_DIR"
+echo "Adapter: $(printf '%s\n' "${PASS_THROUGH[@]+"${PASS_THROUGH[@]}"}" | grep -A1 '\-\-adapter' | tail -1 || echo auto)"
+
+if ! command -v git >/dev/null 2>&1; then
+  echo "Error: git is required but not installed." >&2
+  exit 1
+fi
+
+# ── Clone or update ──────────────────────────────────────────────────────────
+if [ -d "$INSTALL_DIR/.git" ]; then
+  # Detached HEAD is the tagged install. A branch checkout (typical prior bootstrap
+  # of main) must not be force-moved onto an older pin.
+  if git -C "$INSTALL_DIR" symbolic-ref -q HEAD >/dev/null; then
+    echo "Coco already exists at $INSTALL_DIR. Pulling latest..."
+    git -C "$INSTALL_DIR" pull --ff-only
+  else
+    echo "Coco already exists at $INSTALL_DIR (detached). Updating to $PINNED_TAG..."
+    git -C "$INSTALL_DIR" fetch --tags --force --depth 1 origin "refs/tags/${PINNED_TAG}:refs/tags/${PINNED_TAG}"
+    git -C "$INSTALL_DIR" checkout --force "$PINNED_TAG"
+  fi
+else
+  if [ -e "$INSTALL_DIR" ]; then
+    echo "Error: $INSTALL_DIR exists but is not a Coco clone." >&2
+    echo "Remove it manually or set COCO_DIR to a different path." >&2
+    exit 1
+  fi
+  echo "Cloning Coco $PINNED_TAG..."
+  git clone --quiet --branch "$PINNED_TAG" --depth 1 "$REPO_URL" "$INSTALL_DIR"
+fi
+
+# ── Commit verification gate ─────────────────────────────────────────────────
+COMMIT_HASH="$(git -C "$INSTALL_DIR" rev-parse HEAD)"
+COMMIT_DATE="$(git -C "$INSTALL_DIR" log -1 --format='%ci' HEAD)"
+COMMIT_MSG="$(git -C "$INSTALL_DIR" log -1 --format='%s' HEAD)"
+
+echo ""
+echo "┌─ Verify before you run ──────────────────────────────────────────────┐"
+echo "│  Commit : $COMMIT_HASH"
+echo "│  Date   : $COMMIT_DATE"
+echo "│  Message: $COMMIT_MSG"
+echo "│"
+echo "│  Confirm this matches the $PINNED_TAG release on GitHub:"
+echo "│  https://github.com/coco-research/coco/releases/tag/$PINNED_TAG"
+echo "└──────────────────────────────────────────────────────────────────────┘"
+echo ""
+
+if [[ "$YES" != "1" ]]; then
+  read -r -p "Proceed with installation? [y/N] " REPLY
+  case "$REPLY" in
+    [yY][eE][sS]|[yY]) ;;
+    *)
+      echo "Aborted. The clone is at $INSTALL_DIR — inspect it, then run:"
+      echo "  bash \"$INSTALL_DIR/install.sh\" ${PASS_THROUGH[*]+"${PASS_THROUGH[*]}"}"
+      exit 0
+      ;;
+  esac
+fi
+
+# ── Install ──────────────────────────────────────────────────────────────────
+if [ ! -f "$INSTALL_DIR/install.sh" ]; then
+  echo "Error: install.sh not found in cloned repo." >&2
+  exit 1
+fi
+
+bash "$INSTALL_DIR/install.sh" "${PASS_THROUGH[@]+"${PASS_THROUGH[@]}"}"
+
+echo ""
+echo "Coco installed successfully at $INSTALL_DIR"
+echo "Commit: $COMMIT_HASH"

package/bin/coco.js

@@ -0,0 +1,258 @@
+#!/usr/bin/env node
+// Coco CLI — clones Coco into a target dir and runs the installer.
+//
+// Usage:
+//   npx cocosuperintelligence               # clones to ./coco and installs (auto-detect adapter)
+//   npx cocosuperintelligence install       # same as above
+//   npx cocosuperintelligence install --adapter cursor
+//   npx cocosuperintelligence install --systems gsd,brain,m0
+//   npx cocosuperintelligence update        # checkout the pinned release tag
+//   npx cocosuperintelligence uninstall     # remove symlinks + clone
+//   npx cocosuperintelligence --help
+
+'use strict';
+
+const { execSync, spawnSync } = require('child_process');
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+
+const https = require('https');
+
+const REPO = 'https://github.com/coco-research/coco.git';
+const DEFAULT_DIR = path.join(process.cwd(), 'coco');
+
+// ── Update notifier ─────────────────────────────────────────────────────────
+// Privacy: contacts only github.com (the source), no analytics/telemetry. Result
+// is cached for 24h in ~/.coco/.update-check.json. Disable with COCO_NO_UPDATE_CHECK=1.
+const PKG_VERSION = (() => {
+  try { return require('../package.json').version || '0.0.0'; } catch (_) { return '0.0.0'; }
+})();
+const PINNED_TAG = 'v' + PKG_VERSION;
+const UPDATE_CACHE = path.join(os.homedir(), '.coco', '.update-check.json');
+const LATEST_URL = 'https://raw.githubusercontent.com/coco-research/coco/main/package.json';
+
+function semverGt(a, b) {
+  const pa = String(a).split('.').map(n => parseInt(n, 10) || 0);
+  const pb = String(b).split('.').map(n => parseInt(n, 10) || 0);
+  for (let i = 0; i < 3; i++) { if ((pa[i] || 0) > (pb[i] || 0)) return true; if ((pa[i] || 0) < (pb[i] || 0)) return false; }
+  return false;
+}
+
+function readCache() {
+  try { return JSON.parse(fs.readFileSync(UPDATE_CACHE, 'utf8')); } catch (_) { return null; }
+}
+function writeCache(latest) {
+  try {
+    fs.mkdirSync(path.dirname(UPDATE_CACHE), { recursive: true });
+    fs.writeFileSync(UPDATE_CACHE, JSON.stringify({ checkedAt: Date.now(), latest }));
+  } catch (_) { /* best-effort */ }
+}
+
+function fetchLatestVersion(cb) {
+  let done = false;
+  const finish = (v) => { if (!done) { done = true; cb(v); } };
+  try {
+    const req = https.get(LATEST_URL, { headers: { 'User-Agent': 'coco-cli' } }, (res) => {
+      if (res.statusCode !== 200) { res.resume(); return finish(null); }
+      let body = '';
+      res.on('data', (d) => { body += d; });
+      res.on('end', () => { try { finish(JSON.parse(body).version || null); } catch (_) { finish(null); } });
+    });
+    req.setTimeout(2500, () => { req.destroy(); finish(null); });
+    req.on('error', () => finish(null));
+  } catch (_) { finish(null); }
+}
+
+function banner(latest) {
+  if (latest && semverGt(latest, PKG_VERSION)) {
+    console.log(`\n  ⬆  Coco ${latest} is available (you have ${PKG_VERSION}).`);
+    console.log(`     Update:  node bin/coco.js update     (or: git -C <clone> pull --ff-only && bash install.sh)\n`);
+  }
+}
+
+// Non-blocking: prints a one-line banner if a newer version exists. Silent on
+// offline/error. `force` bypasses the 24h cache (used by the `version` command).
+function checkForUpdate(force) {
+  if (process.env.COCO_NO_UPDATE_CHECK) return;
+  const cache = readCache();
+  const fresh = cache && (Date.now() - (cache.checkedAt || 0) < 24 * 3600 * 1000);
+  if (fresh && !force) { banner(cache.latest); return; }
+  fetchLatestVersion((latest) => {
+    if (latest) { writeCache(latest); banner(latest); }
+    else if (cache) { banner(cache.latest); }
+  });
+}
+
+function cmdVersion() {
+  console.log(`cocosuperintelligence v${PKG_VERSION}`);
+  checkForUpdate(true);
+}
+
+function help() {
+  console.log(`Coco — open-source AI workflow framework
+
+Usage:
+  npx cocosuperintelligence                   clone + install (auto-detect)
+  npx cocosuperintelligence install [flags]   clone + install with flags
+  npx cocosuperintelligence update [dir]      checkout the pinned release tag
+  npx cocosuperintelligence uninstall [dir]   remove symlinks + clone
+  npx cocosuperintelligence version           show version + check for updates
+  npx cocosuperintelligence --help            this message
+
+Update checks contact only github.com (no telemetry); disable with COCO_NO_UPDATE_CHECK=1.
+
+Install flags (passed to install.sh):
+  --adapter <name>                      claude-code | cursor | grok | vscode | codex | generic
+  --systems <list>                      gsd | brain | cognee | hyperframes | m0 |
+                                        superintelligence   (comma-separated)
+  --dry-run                             preview, no writes
+
+Examples:
+  npx cocosuperintelligence
+  npx cocosuperintelligence install --adapter cursor
+  npx cocosuperintelligence install --systems gsd,brain --adapter claude-code
+  npx cocosuperintelligence update
+  npx cocosuperintelligence uninstall
+
+Repo: https://github.com/coco-research/coco
+Install clones the ${PINNED_TAG} release tag, not floating main.
+The npm name cocosuperintelligence is reserved; until it is published, prefer
+git clone or bin/coco-bootstrap.sh over npx.
+`);
+}
+
+function which(cmd) {
+  const r = spawnSync('which', [cmd], { encoding: 'utf8' });
+  return r.status === 0 ? r.stdout.trim() : null;
+}
+
+function run(cmd, args, opts = {}) {
+  const r = spawnSync(cmd, args, { stdio: 'inherit', ...opts });
+  if (r.status !== 0) {
+    process.exit(r.status || 1);
+  }
+}
+
+function cloneOrUpdate(dir) {
+  if (fs.existsSync(dir) && fs.existsSync(path.join(dir, '.git'))) {
+    // Detached HEAD is the tagged install. A branch checkout (typical `git clone` of
+    // main) must not be force-moved onto an older pin.
+    const head = spawnSync('git', ['symbolic-ref', '-q', 'HEAD'], { cwd: dir });
+    if (head.status !== 0) {
+      console.log(`Coco already at ${dir} (detached). Updating to ${PINNED_TAG}...`);
+      run('git', ['fetch', '--tags', '--force', '--depth', '1', 'origin', `refs/tags/${PINNED_TAG}:refs/tags/${PINNED_TAG}`], { cwd: dir });
+      run('git', ['checkout', '--force', PINNED_TAG], { cwd: dir });
+    } else {
+      console.log(`Coco already at ${dir}. Pulling latest...`);
+      run('git', ['pull', '--ff-only'], { cwd: dir });
+    }
+  } else {
+    if (fs.existsSync(dir)) {
+      console.error(`Error: ${dir} exists but is not a git repo. Move it or pick a different location.`);
+      process.exit(1);
+    }
+    console.log(`Cloning Coco ${PINNED_TAG} to ${dir}...`);
+    run('git', ['clone', '--branch', PINNED_TAG, '--depth', '1', REPO, dir]);
+  }
+}
+
+function cmdInstall(argv) {
+  if (!which('git')) {
+    console.error('Error: git is required. Install git first.');
+    process.exit(1);
+  }
+  if (!which('bash')) {
+    console.error('Error: bash is required. Install bash first.');
+    process.exit(1);
+  }
+
+  const dir = DEFAULT_DIR;
+  cloneOrUpdate(dir);
+
+  const installScript = path.join(dir, 'install.sh');
+  if (!fs.existsSync(installScript)) {
+    console.error(`Error: ${installScript} not found.`);
+    process.exit(1);
+  }
+
+  console.log(`Running ${installScript}...`);
+  run('bash', [installScript, ...argv]);
+
+  console.log(`\nDone. Coco installed at ${dir}.`);
+  console.log(`Re-run install / update later with:\n  npx cocosuperintelligence update`);
+}
+
+function cmdUpdate(argv) {
+  const dir = argv[0] && !argv[0].startsWith('--') ? argv[0] : DEFAULT_DIR;
+  if (!fs.existsSync(path.join(dir, '.git'))) {
+    console.error(`Error: ${dir} is not a Coco clone. Run \`npx cocosuperintelligence install\` first.`);
+    process.exit(1);
+  }
+  cloneOrUpdate(dir);
+  console.log(`\nCoco updated at ${dir}. Re-run install if you want to refresh symlinks:\n  bash ${path.join(dir, 'install.sh')}`);
+}
+
+function cmdUninstall(argv) {
+  const dir = path.resolve(argv[0] && !argv[0].startsWith('--') ? argv[0] : DEFAULT_DIR);
+  // Prefix match on the resolved clone path plus a trailing slash, so a clone
+  // named `coco` cannot also delete links into `coco-research` / `coco-connect`.
+  const prefix = dir.endsWith(path.sep) ? dir : dir + path.sep;
+  console.log(`Removing symlinks pointing into ${dir}...`);
+  const homes = [
+    path.join(os.homedir(), '.claude'),
+    path.join(os.homedir(), '.cursor'),
+    path.join(os.homedir(), '.grok'),
+    path.join(os.homedir(), '.copilot'),
+  ];
+  for (const home of homes) {
+    if (!fs.existsSync(home)) continue;
+    run('find', [home, '-type', 'l', '-lname', `${prefix}*`, '-delete']);
+  }
+  console.log(`Removing clone at ${dir}...`);
+  if (fs.existsSync(dir)) {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+  console.log('Uninstalled.');
+}
+
+function main() {
+  const argv = process.argv.slice(2);
+  if (argv.length === 0) {
+    cmdInstall([]);
+    return;
+  }
+
+  const sub = argv[0];
+  const rest = argv.slice(1);
+
+  switch (sub) {
+    case '--help':
+    case '-h':
+    case 'help':
+      help();
+      checkForUpdate(false);
+      break;
+    case 'version':
+    case '--version':
+    case '-v':
+      cmdVersion();
+      break;
+    case 'install':
+      cmdInstall(rest);
+      checkForUpdate(false);
+      break;
+    case 'update':
+      cmdUpdate(rest);
+      break;
+    case 'uninstall':
+      cmdUninstall(rest);
+      break;
+    default:
+      // any unknown subcommand → pass through to install (e.g., npx cocosuperintelligence --adapter cursor)
+      cmdInstall(argv);
+      checkForUpdate(false);
+  }
+}
+
+main();

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "cocosuperintelligence",
+  "version": "1.5.0",
+  "description": "CoCo Super Intelligence \u2014 summon an advisory board of 495 world-class minds inside your AI coding session. A vendor-neutral orchestration layer for Claude Code, Cursor, and Codex: 226 skills, 386 commands, 35 agents, and disk-persistent state. 100% local, no telemetry. Open-core: MIT core, proprietary Super Intelligence.",
+  "bin": {
+    "coco": "bin/coco.js"
+  },
+  "files": [
+    "bin/",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "test": "node bin/coco.js --help"
+  },
+  "keywords": [
+    "ai",
+    "ai-agents",
+    "agent-skills",
+    "agents-md",
+    "claude-code",
+    "cursor",
+    "codex",
+    "mcp",
+    "llm-tools",
+    "developer-tools",
+    "productivity"
+  ],
+  "author": "Coco Inc",
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://github.com/coco-research/coco",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/coco-research/coco.git"
+  },
+  "bugs": {
+    "url": "https://github.com/coco-research/coco/issues"
+  },
+  "engines": {
+    "node": ">=14"
+  }
+}