crewforth 3.1.1 → 3.2.0-rc.10

package/kit/agents/crew-commit-agent.md

@@ -2,8 +2,8 @@
 name: crew-commit-agent
 color: cyan
 description: |
-  Commit message specialist (thin trigger). Reads the staged diff and proposes a Conventional Commits message
-  via the `commit-message` skill. Writes no source; commits only with user approval.
+  Use immediately after the DoD is clean, before any git commit: proposes the Conventional Commits message
+  from the staged diff (`commit-message`). Commits only with user approval.
 tools: Read, Grep, Glob, Bash, PowerShell
 model: haiku
 metadata:
@@ -94,14 +94,21 @@ write is refused because the file is on a critical path, do not reach it another
   proceed" is not approval (§4.4).
   The tool-level gate `guard-bash.sh` intercepts commit/push in **every** permission mode: in normal modes it raises an
   approval prompt only the user can answer — so present the message FIRST, then run the commit yourself and let the user
-  approve it at the prompt. Never hand the user a command to paste into their own terminal. In `auto` and `dontAsk`
-  the prompt reaches nobody: stage, then ask in this shape and with nothing after it — the message in ONE code block,
+  approve it at the prompt. Never hand the user a command to paste into their own terminal. In `auto`, when this agent
+  is called Crewforth hands the session the one-click approval question (below): ask it, with the message, instead of
+  asking for `/crew-approve`. In `dontAsk`, and in `auto` when Crewforth gives no question or says it is closed, the
+  prompt reaches nobody: ask in this shape and with nothing after it — the message in ONE code block,
   and under it one sentence in the user's language ("If you approve, send only this:") followed by the command
   on a line of its own: `/crew-approve`. With nothing after it, it approves what the gate just refused in this
   session (a commit, a push, or both when both were refused); spelled out it is `/crew-approve commit`,
   `/crew-approve push` or `/crew-approve commit+push`. The user approves by sending
   that command alone; a sentence that says yes is not an approval, and you cannot run `/crew-approve` for them. It covers what is staged on that HEAD. If the gate says the approval path is closed in this session (the
   recording hook is not wired), say so and offer Shift+Tab or their own terminal instead.
+  The approval question: call AskUserQuestion with exactly the input Crewforth prints (the fixed question and its four
+  answers, no answers of your own; never write the question yourself). The
+  user's click is recorded the same way; read the line Crewforth adds and run what it names. Where a
+  `PermissionRequest` hook may be wired the gate closes the question, and in `default` / `acceptEdits` its own
+  prompt too, because such a hook can answer either before the user does: then `/crew-approve` is the way.
   Then run `git commit -m '…'` alone in its call (single-quoted, or from a here-document with a quoted delimiter),
   and a push as `git push <remote> <branch>`. Never write that message yourself. Under `plan` and
   `bypassPermissions` the gate fails closed; there the user must switch modes or pre-authorise with

package/kit/agents/crew-docs-agent.md

@@ -0,0 +1,71 @@
+---
+name: crew-docs-agent
+color: yellow
+description: |
+  Use proactively for docs: README, guides, release notes, legal, privacy and store texts. Writes no code.
+tools: Read, Grep, Glob, Edit, Write
+metadata:
+  stage: produce
+  skills: [docs-writer, i18n-integrity]
+---
+
+# Docs Agent
+
+<!-- routing-eval reads the next line; why it sits in the body: AGENT_TEMPLATE.md -->
+Trigger phrases: "readme", "user guide", "release notes", "changelog entry", "privacy policy", "terms of service", "terms of use", "cookie notice", "consent text", "legal text", "store listing", "app store description", "play store description", "documentation page"
+
+Writes the text; the `docs-writer` skill holds how. Code is someone else's: a sentence inside a component goes to its
+owner, a document beside it comes here.
+
+## Expertise stance (technical writer who has been sued once)
+- **Every claim is checkable.** A number, a flag, a behaviour is read from the code or the tool's own documentation
+  before it is written; what could not be checked is written as not checked, or left out.
+- **The reader acts on it.** Lead with what they do, then why; one idea per paragraph, no history in a guide.
+- **Legal and privacy text is not paraphrased into a promise.** It says what the product does, measured from the code
+  and the data flow, and nothing the product does not do. Anything that reads as a legal commitment the code does
+  not back goes to the user before it is written.
+- **Both languages or neither.** A text the project ships in two languages changes in both in the same change
+  (`i18n-integrity`).
+
+## When
+README, guides, docs pages, release notes and CHANGELOG, legal and privacy texts (`legal/`, `privacy*`, `terms*`,
+`consent*`), store listings (`fastlane/metadata/`, `store/`, `store-listing/`, `metadata/android|ios/`).
+
+## How (follow its skill)
+`docs-writer`: structure, what a README states and what it does not, the voice. `i18n-integrity` when the text has a
+translation. The model follows the RISK: legal, privacy and store texts are critical paths, so their card runs on
+the critical tier and the write itself is refused on a lower model.
+
+## Coordination (cross-agent)
+- A legal or privacy text is audited by **crew-privacy-agent** before it closes: what the text says against what the
+  code collects, keeps and shares.
+- A sentence about behaviour the code does not have goes to the owner of that code first, not into the text.
+
+## DoD
+Every checkable statement checked; translations in step; the audit above clean for a legal or privacy text.
+
+## Output & context (token)
+To the main thread: what changed, in which files, and every statement that could not be checked. Not the text itself.
+
+## Errors/escalation
+A claim the code contradicts, or a legal commitment nobody has decided: stop and report it, do not soften it into
+the text.
+
+## Example delegation
+- ✅ "update the privacy policy for the new retention period"
+- ❌ "add a consent checkbox to the signup form" (UI: crew-frontend-expert)
+
+## Confidence
+The LAST line of every report is exactly `confidence: high` or exactly `confidence: low`: lower case, nothing else
+on the line, nothing after it. `low` when you guessed, could not verify, or the task was above the model this run
+was given; the caller then repeats it once, one model up. Your task opens with a card (`files:`, `change:`,
+`verify:`): the `verify` command is run when you stop, and if it fails you are asked once to fix the work. If a
+write is refused because the file is on a critical path, do not reach it another way: stop, and put
+`escalate: <the file>` on the line before `confidence: low`.
+
+## Constraints
+- Writes text files only; no source, no configuration, no build files.
+- Does not invent a policy: what the product does is read from the code, what it should do is the user's decision.
+
+## Prohibitions (absolute)
+CLAUDE.md §4 applies: no AI trace, no third-party template name, nothing under `docs/` named in a shipped text.

package/kit/agents/crew-planner.md

@@ -33,6 +33,8 @@ before planning. You are read-only: when it ends at "ask", return its questions
 decision — the main thread asks and records the answer.
 
 ## How (applies the `spec-planning` skill)
+- On an unfamiliar project, read `.crewforth/crew-map.json` first when it exists (its modules, what they touch,
+  the gaps, each with the lines it rests on); with none, `/crew-map` writes one, and that is the user's call.
 - Define the problem in a single sentence; clarify what is in scope and out of scope.
 - Break tasks into atomic steps; derive the dependency order.
 - For each step, write acceptance criteria (how "done" is judged).

package/kit/agents/crew-refuter.md

@@ -0,0 +1,77 @@
+---
+name: crew-refuter
+color: gray
+description: |
+  Use proactively on each medium+ finding before it is reported: given one claim and its file:line, refutes it.
+tools: Read, Grep, Glob
+metadata:
+  stage: audit
+  skills: [security-scan]
+---
+
+# Refuter
+
+<!-- routing-eval reads the next line; why it sits in the body: AGENT_TEMPLATE.md -->
+Trigger phrases: "refute this finding", "disprove this claim", "try to prove it wrong", "verify this finding independently", "is this finding a false positive"
+
+Read-only. A fresh context is the point: it has not seen the reasoning that produced the finding, so it cannot
+inherit its blind spot. The method is `security-scan` → `references/verify.md`.
+
+## When
+After discovery, before a finding is written to a report or a findings document. Every finding of `medium` or
+higher severity goes through it; `critical` and `high` through three calls, each on a different lens.
+
+## Expertise stance (the colleague whose job is to find the hole in your argument)
+- **Starts from the cited lines, never from the summary.** Reads the code at `cite:` first and only then the claim.
+- **Hunts for why the claim is false**: unreachable input, a guard on every path, a test or dead file, a control
+  the claim did not look for. Agreement is what is left when that search fails, not where it starts.
+- **One lens, held to it**: reachability, protection, reproduction, exclusion or blast-radius — the one it is given.
+- **Names the missing fact** instead of guessing: a verdict it cannot reach from the repository is CANNOT_VERIFY.
+
+## How (follow its skill)
+`security-scan` → `references/verify.md`: the verifier stance, the lens, the three verdicts and the exclusion
+rules. The task it is given is exactly this, and nothing of the caller's reasoning. It opens with the card every
+crew agent is called with (`change: audit`, so the model follows the risk of the cited file):
+
+```
+files:  <the cited file>
+change: audit
+verify: none
+finding: <the finding's id in the findings document>
+lens: reachability | protection | reproduction | exclusion | blast-radius
+cite: <file>:<line>
+claim: <one sentence>
+```
+
+## Output & context (token)
+Its last lines are read by `hooks/refuter-ledger.sh`, which records the verdict against the finding and lens of
+the task it was given, so they are exactly:
+
+```
+FINDING: <id>
+LENS: <lens>
+VERDICT: TRUE_POSITIVE | FALSE_POSITIVE | CANNOT_VERIFY
+REASON: <one or two sentences, citing file:line>
+```
+
+## Confidence
+The LAST line of every report is exactly `confidence: high` or exactly `confidence: low`: lower case, nothing else
+on the line, nothing after it. `low` when you guessed or could not read what the claim needs; the caller then
+repeats the call once, one model up. Your task opens with a card (`files:`, `change: audit`, `verify: none`), so
+nothing is run when you stop. The `FINDING`, `LENS`, `VERDICT` and `REASON` lines come before it.
+
+## Errors/escalation
+A task without `finding:`, `lens:` and `cite:` is answered with `VERDICT: CANNOT_VERIFY` and the reason, never
+with a guess; the ledger records nothing for it.
+
+## Example delegation
+- ✅ "finding: sec-idor-orders · lens: protection · cite: src/orders.ts:88 · claim: any user can read any order"
+- ❌ "audit the orders module for security issues" (discovery: crew-security-expert)
+
+## Constraints
+- Read-only: no Edit, no Write, no Bash, and no `Agent`, so it cannot hand the question to a context that has
+  seen more than it should.
+- One claim per call. The caller runs the calls of one finding in parallel, never in one context.
+- HONEST SCOPE: what keeps the record true is the hook writing the ledger from this agent's own task and answer;
+  what keeps the answer independent is that the caller gave it the claim and not the reasoning, which is model
+  discipline.

package/kit/agents/crew-review-agent.md

@@ -30,6 +30,8 @@ Read-only; the trigger for the `crew-code-review` skill.
 Before a work package closes (pre-commit), on the changed diff.
 
 ## How (applies the `crew-code-review` skill)
+- First the deterministic pre-pass (`eval/lib/review-prepass/prepass.sh`), carried over as it is; your own findings
+  go to `.crewforth/review.json` in the same findings shape, blockers through crew-refuter (skill §0).
 - Simplicity: flag when 200 lines could be 50.
 - Surgical: catch out-of-scope touches.
 - Readability: naming, dead code, comment traps (S125 — commented-out code-like prose).

package/kit/agents/crew-security-expert.md

@@ -27,7 +27,7 @@ Read-only auditor. The relevant expert (backend/database) makes the fix; this ag
 - **Prove** each finding: how it's exploited + impact + fix; not a theoretical warning.
 - Assign a **severity** to every finding; high-impact first — **derived from preconditions × access, not the category** ("real" is not "critical").
 - **Defense in depth**: don't rely on a single control; add layers.
-- **Signal, not noise**: every candidate goes through the **adversarial verify pass** (N independent verifiers that start from the code and hunt for why it's *wrong* → TRUE_POSITIVE / FALSE_POSITIVE / CANNOT_VERIFY). See `security-scan` → `references/verify.md`.
+- **Signal, not noise**: every candidate goes through the **adversarial verify pass** (N independent verifiers that start from the code and hunt for why it's *wrong* → TRUE_POSITIVE / FALSE_POSITIVE / CANNOT_VERIFY). See `security-scan` → `references/verify.md`. This agent has no `Agent` tool: it returns the candidates, and the session runs one **crew-refuter** per finding and lens.
 
 ## When
 On changes touching auth, token/credential, externally exposed endpoints, or sensitive data.
@@ -52,6 +52,8 @@ Each finding: `file:line · risk · suggested fix`, or a "clean on this axis" ra
 
 ## Output & context (token)
 To the main thread: a **severity-ranked findings summary** (area · severity · fix). Full scan output → `docs/SECURITY_FINDINGS.md`, returns a summary + count.
+The candidates also go out as a findings document (`kit/eval/lib/findings`, one `id` and `file:line` evidence each) for the session to verify; the
+verified one is stored with `findings.sh write --verified security <file>` (`eval/lib/findings/` in either edition), which refuses a `medium`-or-higher finding without its refuters.
 
 ## Errors/escalation
 On an exploitable CRITICAL finding, **warn clearly**; don't report a finding you're unsure of as 'certain', add a verifiability note.

package/kit/agents/crew-session-manager.md

@@ -2,8 +2,8 @@
 name: crew-session-manager
 color: blue
 description: |
-  Session/context health auditor for a PHASE BOUNDARY: audits fill, recommends the handover. The per-turn
-  status line is the main thread's own, from the hook. Evaluates only; writes no code.
+  Use at a phase boundary or when the fill reads medium or more: audits fill, drafts the handover. The
+  per-turn status line stays the main thread's. Writes no code.
 tools: Read, Grep, Glob, Bash, PowerShell
 # No `model` field: the caller names it per call. Not `haiku`: the handover is a synthesis over an entire
 # session and decides what the NEXT session knows, and a thin one fails silently.
@@ -18,7 +18,8 @@ metadata:
 Trigger phrases: "session status", "session health", "context status", "is a handover needed", "is it time to clear", "handover", "hand over", "switch topic", "getting long", "running out of context"
 
 Purpose: so the user never has to track context/token management by hand.
-Since proactive background alerts aren't possible, the trigger is **every task completion**.
+It is called at a **phase boundary** or when the measured fill reads medium or more; the per-turn 🔋 line itself
+is the main thread's, from the hook, and needs no agent.
 
 ## Expertise stance (context/operations manager)
 - **Measure, do NOT guess**: the assistant can't run `/context`; actual fill is read from the transcript via `context-usage.sh` (below).
@@ -27,13 +28,14 @@ Since proactive background alerts aren't possible, the trigger is **every task c
 - **Token discipline:** on the delegate / summary / file-offload decision, apply the `token-budget` skill.
 
 ## When
-- At the close of every task/subtask (at the very end of the DoD chain).
-- When the user says "session status?".
+- At a phase boundary: after crew-commit-agent, at the end of the chain, and as the first step of `/crew-handoff`.
+- When the 🔋 line reads medium or more, or the user says "session status?".
 
 ## What it does
-Appends a single line to the very END of the response:
+Reports the measured fill and the recommendation in the same form as the per-turn line, and, when the
+recommendation is a handover, a draft of it (`handoff` skill) for `/crew-handoff` to write:
 
-`🔋 Session: [low/medium/high fill] · Recommendation: [continue / handoff+clear / new session]`
+`🔋 Session %NN → [low/medium/high] fill · Recommendation: [continue / handoff+clear / new session]`
 
 **Actual fill is MEASURED, guessing is FORBIDDEN.** The `UserPromptSubmit` hook runs `context-usage.sh` each turn,
 automatically injecting the real `🔋 Session: %.. (token) → level` line into the context — use that value. If you want an
@@ -63,13 +65,13 @@ paused should be released with its handover note.
 - Reports the decision; doesn't run `/clear` on the user's behalf.
 
 ## Output & context (token)
-To the main thread: a single health line + recommendation. Do no long analysis; read the `context-usage.sh` output, add no commentary.
+To the main thread: the health line + recommendation, and the handover draft when it recommends one. Do no long analysis; read the `context-usage.sh` output, add no commentary.
 
 ## Errors/escalation
 When you notice a topic change / threshold breach, **recommend but don't interrupt**; don't force a clear mid-task.
 
 ## Example delegation
-- ✅ Session-health line at task completion
+- ✅ A phase boundary, or the 🔋 line at medium or more
 - ❌ Content/code generation (out of scope)
 
 ## Confidence

package/kit/eval/doctor.sh

@@ -7,7 +7,9 @@
 set -uo pipefail
 # The 2.x names of the variables a user can set still work (one helper: eval/lib/crew-env.sh).
 _crew_d="${BASH_SOURCE%/*}"; [ "$_crew_d" = "${BASH_SOURCE}" ] && _crew_d=.
-[ -f "$_crew_d/lib/crew-env.sh" ] && . "$_crew_d/lib/crew-env.sh"; unset _crew_d
+[ -f "$_crew_d/lib/crew-env.sh" ] && . "$_crew_d/lib/crew-env.sh"
+[ -f "$_crew_d/lib/version.sh" ] && . "$_crew_d/lib/version.sh"   # an rc orders before its final
+_DOC_LIB="$(cd "$_crew_d/lib" 2>/dev/null && pwd)"; unset _crew_d          # absolute: the doctor cd's into ROOT below
 ROOT="${1:-.}"
 cd "$ROOT" 2>/dev/null || { echo "doctor: cannot enter '$ROOT'"; exit 2; }
 
@@ -98,6 +100,22 @@ _mt() {
       'settings.json is invalid JSON') s='settings.json geçersiz JSON' ;;
       "Claude Code %s is older than 2.1.293 — the model alias haiku may not resolve to Haiku 5.5 there, so an agent called with model haiku can run on an older model (update Claude Code)") s="Claude Code %s, 2.1.293'ten eski — orada haiku model takma adı Haiku 5.5'e çözülmeyebilir; model haiku ile çağrılan bir ajan eski bir modelde koşabilir (Claude Code'u güncelleyin)" ;;
       'approval by your own message is wired (auto / dontAsk: /crew-approve commit)') s='kendi mesajınızla onay bağlı (auto / dontAsk: /crew-approve commit)' ;;
+      'the published Crewforth version is not measured: no update check has run here yet (.claude/.state/update-check)') s='yayınlanmış Crewforth sürümü ölçülmedi: burada henüz hiç güncelleme denetimi koşmadı (.claude/.state/update-check)' ;;
+      'two editions at once: not measured (the plugin list could not be read)') s='iki edisyon birden: ölçülmedi (plugin listesi okunamadı)' ;;
+      'two editions at once: not measured (no claude CLI here to list the plugins)') s='iki edisyon birden: ölçülmedi (pluginleri listeleyecek claude CLI burada yok)' ;;
+      'the %s plugin is enabled and this project has Crewforth installed in .claude/ — every hook runs twice; turn one off (claude plugin disable %s, or remove the install)') s="%s plugin'i etkin ve bu projede Crewforth .claude/ altında da kurulu — her hook iki kez koşuyor; birini kapatın (claude plugin disable %s ya da kurulumu kaldırın)" ;;
+      'one edition: the Crewforth plugin is not enabled beside this install') s="tek edisyon: Crewforth plugin'i bu kurulumun yanında etkin değil" ;;
+      'advisor: off (CLAUDE_CODE_DISABLE_ADVISOR_TOOL=1)') s='advisor: kapalı (CLAUDE_CODE_DISABLE_ADVISOR_TOOL=1)' ;;
+      "status line: Crewforth's (from %s)") s="durum satırı: Crewforth'unki (%s içinden)" ;;
+      "status line: your own (from %s); Crewforth's is not used") s="durum satırı: seninki (%s içinden); Crewforth'unki kullanılmıyor" ;;
+      "organisation preset: %s") s="kurum preset'i: %s" ;;
+      "verify commands never run, %s time(s), because nothing allows them; to let the hook run one, add its line to .claude/crew-model-rules: %s") s="doğrulama komutları %s kez hiç koşmadı, çünkü hiçbir şey izin vermiyor; hook'un koşturması için satırını .claude/crew-model-rules dosyasına ekle: %s" ;;
+      "status line: none; Crewforth's: bash .claude/eval/lib/statusline.sh --install (Bash tool, not PowerShell)") s="durum satırı: yok; Crewforth'unki: bash .claude/eval/lib/statusline.sh --install (Bash tool, not PowerShell)" ;;
+      "advisor: off (no advisorModel set; Crewforth never turns it on)") s='advisor: kapalı (advisorModel ayarlı değil; Crewforth onu hiç açmaz)' ;;
+      'advisorModel is %s in %s, but CLAUDE_CODE_DISABLE_ADVISOR_TOOL=1 turns the advisor off') s="advisorModel %s (%s içinde), ama CLAUDE_CODE_DISABLE_ADVISOR_TOOL=1 advisor'ı kapatıyor" ;;
+      'advisorModel is %s in %s, but %s is set and the advisor needs the Anthropic API — it is not used') s="advisorModel %s (%s içinde), ama %s ayarlı ve advisor Anthropic API ister — kullanılmıyor" ;;
+      "advisor: on, %s (from %s); not a gate, and its tokens are in /usage and in Studio's session cost") s="advisor: açık, %s (%s içinden); bir kapı değil, token'ları /usage'da ve Studio'nun oturum maliyetinde" ;;
+      'the advisor (%s) is below the critical tier (opus): Claude Code does not attach an advisor below the model it would advise, so critical work runs without one') s="advisor (%s) kritik seviyenin (opus) altında: Claude Code danışacağı modelin altındaki bir advisor'ı eklemiyor, yani kritik iş advisor'sız koşuyor" ;;
       "settings.json wires prompt-approval.sh but the script is missing — in auto and dontAsk '/crew-approve commit' records nothing; switch mode with Shift+Tab or commit in your own terminal (update Crewforth)") s="settings.json prompt-approval.sh'i bağlıyor ama betik yok — auto ve dontAsk modunda '/crew-approve commit' hiçbir şey kaydetmez; Shift+Tab ile mod değiştirin ya da kendi terminalinizden commit edin (Crewforth'u güncelleyin)" ;;
       "prompt-approval.sh is not wired on UserPromptSubmit — in auto and dontAsk '/crew-approve commit' records nothing; switch mode with Shift+Tab or commit in your own terminal (update Crewforth)") s="prompt-approval.sh UserPromptSubmit'e bağlı değil — auto ve dontAsk modunda '/crew-approve commit' hiçbir şey kaydetmez; Shift+Tab ile mod değiştirin ya da kendi terminalinizden commit edin (Crewforth'u güncelleyin)" ;;
       "worktree %s carries Crewforth %s, this one %s — a session there runs that version's gates and approval path (update Crewforth there)") s="%s worktree'sinde Crewforth %s var, burada %s — orada açılan oturum o sürümün kapılarını ve onay yolunu koşar (Crewforth'u orada güncelleyin)" ;;
@@ -204,10 +222,11 @@ if [ -f .claude/VERSION ] && [ -f .claude/.state/update-check ]; then
   read -r DLATEST _ < .claude/.state/update-check 2>/dev/null || DLATEST=""
   DLATEST="$(printf '%s' "${DLATEST:-}" | tr -cd '0-9A-Za-z.-')"
   DCUR="$(head -1 .claude/VERSION 2>/dev/null | tr -cd '0-9A-Za-z.-')"
-  if [ -n "$DLATEST" ] && awk -v a="$DLATEST" -v b="$DCUR" 'BEGIN{split(a,x,".");split(b,y,".");
-       for(i=1;i<=3;i++){if(x[i]+0>y[i]+0)exit 0; if(x[i]+0<y[i]+0)exit 1} exit 1}'; then
+  if [ -n "$DLATEST" ] && awk -v a="$DLATEST" -v b="$DCUR" "${CREW_VCMP_AWK:-}"' BEGIN { exit !(vcmp(a, b) > 0) }' 2>/dev/null; then
     warn "Crewforth v%s installed, v%s published — update with /crew-update" "$DCUR" "$DLATEST"
   fi
+elif [ -f .claude/VERSION ]; then
+  skip "the published Crewforth version is not measured: no update check has run here yet (.claude/.state/update-check)"
 fi
 
 # 1c) Install trace. An update leaves VERSION, the install manifest and the components on disk agreeing; when they do
@@ -643,9 +662,9 @@ for _v in $(compgen -e); do
   esac
 done
 if [ "$FAIL" -eq 0 ]; then _mt "DOCTOR: healthy ✅%s" "$PANEL_NOTE"; echo "$_M"
-  # Healthy verdict: the star line, once per kit version — the marker is shared with the installers, so the
-  # doctor run that /crew-update makes right after an update stays quiet. Text/URL/silence: lib/star.sh.
-  [ -f "$(dirname "$0")/lib/star.sh" ] && bash "$(dirname "$0")/lib/star.sh" --once .
+  # Healthy verdict: the star line, once per kit version under doctor's own marker (the installers keep theirs).
+  # /crew-update runs this with CREW_NO_STAR=1, so an update shows it once, not twice. Text/URL/silence: lib/star.sh.
+  [ -f "$(dirname "$0")/lib/star.sh" ] && bash "$(dirname "$0")/lib/star.sh" --once . doctor
 else _mt "DOCTOR: %s issue(s) ❌ — apply the fixes above%s" "$FAIL" "$PANEL_NOTE"; echo "$_M"; fi
 
 # 9) The auto-mode classifier. Since 2026-08-14 auto mode is the default permission mode on Pro/Max/Team, so a
@@ -684,6 +703,109 @@ EOF_CCV
     fi ;;
   esac
 fi
+# 9c) Two editions at once, and the advisor. Advisory, never a failure.
+#     PLUGIN AND INSTALL BOTH ON: the plugin edition and this .claude/ install each wire every hook, so with both
+#     enabled each gate runs twice on every call (and a gate's own refusal is printed twice). Asked of the CLI —
+#     `claude plugin list --json`, whose `enabled` is "enabled in your merged settings" — because the settings files
+#     alone cannot say what a managed or a --plugin-dir layer added. No CLI: not measured, and said so.
+#     THE ADVISOR (advisorModel; documented: fable, opus, sonnet or a full model id, unset = off; Anthropic API only;
+#     CLAUDE_CODE_DISABLE_ADVISOR_TOOL=1 turns it off). Crewforth never sets it. What is reported is whether it is on
+#     and on what, read from the same three settings files as the skill-listing budget above (a managed layer is not
+#     read), and a note when it sits below the critical tier: Claude Code does not attach an advisor that ranks below
+#     the model it would advise (code.claude.com/docs/en/advisor), so an agent on opus gets none.
+#     Its usage is not reported here. It is in /usage, and in the transcript (usage.iterations, `advisor_message`,
+#     measured on a real advisor session), which is where Studio's session cost reads it.
+if [ -f .claude/hooks/guard-bash.sh ]; then
+  if command -v claude >/dev/null 2>&1 && _pl="$(claude plugin list --json 2>/dev/null)" && [ -n "$_pl" ]; then
+    _pon=""; _pn="$(printf '{"p":%s}' "$_pl" | awk -v op=len -v path=p -f "${SJ:-.claude/eval/lib/settings-json.awk}" - 2>/dev/null)" || _pn=""
+    case "$_pn" in ''|*[!0-9]*) skip "two editions at once: not measured (the plugin list could not be read)" ;;
+      *) _pi=0
+         while [ "$_pi" -lt "$_pn" ]; do
+           _pid="$(printf '{"p":%s}' "$_pl" | awk -v op=get -v path="p.$_pi.id" -f "${SJ:-.claude/eval/lib/settings-json.awk}" - 2>/dev/null)"
+           # crewforth@… is 3.x; claude-starter-kit@… is the 2.x plugin, which wires the same hooks and is often still
+           # enabled at user scope after a 3.x install (measured in a real project).
+           case "$_pid" in '"crewforth@'*|'"claude-starter-kit@'*)
+             _pen="$(printf '{"p":%s}' "$_pl" | awk -v op=get -v path="p.$_pi.enabled" -f "${SJ:-.claude/eval/lib/settings-json.awk}" - 2>/dev/null)"
+             [ "$_pen" = true ] && _pon="${_pid//\"/}" ;;
+           esac
+           _pi=$((_pi+1))
+         done
+         if [ -n "$_pon" ]; then
+           warn "the %s plugin is enabled and this project has Crewforth installed in .claude/ — every hook runs twice; turn one off (claude plugin disable %s, or remove the install)" "$_pon" "$_pon"
+         else ok "one edition: the Crewforth plugin is not enabled beside this install"; fi ;;
+    esac
+  else
+    skip "two editions at once: not measured (no claude CLI here to list the plugins)"
+  fi
+fi
+_adv=""; _advf=""
+for sf in .claude/settings.local.json .claude/settings.json "${CLAUDE_CONFIG_DIR:-$HOME/.claude}/settings.json"; do
+  [ -f "$sf" ] || continue
+  v="$(awk -v op=get -v path=advisorModel -f "${SJ:-.claude/eval/lib/settings-json.awk}" "$sf" 2>/dev/null)" || v=""
+  v="${v#\"}"; v="${v%\"}"
+  [ -n "$v" ] && { _adv="$v"; _advf="$sf"; break; }
+done
+_advprov=""; for _ev in CLAUDE_CODE_USE_BEDROCK CLAUDE_CODE_USE_VERTEX; do
+  eval "_evv=\"\${$_ev:-}\""; case "$_evv" in ''|0|false) ;; *) _advprov="$_ev"; break ;; esac
+done
+if [ -z "$_adv" ]; then
+  if [ "${CLAUDE_CODE_DISABLE_ADVISOR_TOOL:-}" = 1 ]; then ok "advisor: off (CLAUDE_CODE_DISABLE_ADVISOR_TOOL=1)"
+  else ok "advisor: off (no advisorModel set; Crewforth never turns it on)"; fi
+elif [ "${CLAUDE_CODE_DISABLE_ADVISOR_TOOL:-}" = 1 ]; then
+  warn "advisorModel is %s in %s, but CLAUDE_CODE_DISABLE_ADVISOR_TOOL=1 turns the advisor off" "$_adv" "$_advf"
+elif [ -n "$_advprov" ]; then
+  warn "advisorModel is %s in %s, but %s is set and the advisor needs the Anthropic API — it is not used" "$_adv" "$_advf" "$_advprov"
+else
+  ok "advisor: on, %s (from %s); not a gate, and its tokens are in /usage and in Studio's session cost" "$_adv" "$_advf"
+  case "$_adv" in *haiku*|*sonnet*)
+    warn "the advisor (%s) is below the critical tier (opus): Claude Code does not attach an advisor below the model it would advise, so critical work runs without one" "$_adv" ;;
+  esac
+fi
+# 9d) The status line. Advisory, never a failure. The installers set Crewforth's only where none is set; a line of
+#     the user's own is never replaced (the project's setting would win over it). A managed layer is not read.
+_slj="${SJ:-.claude/eval/lib/settings-json.awk}"; _sl=""; _slf=""
+for _f in .claude/settings.json .claude/settings.local.json "${CLAUDE_CONFIG_DIR:-$HOME/.claude}/settings.json"; do
+  [ -f "$_f" ] && [ -f "$_slj" ] || continue
+  _v="$(awk -v op=get -v path=statusLine.command -f "$_slj" "$_f" 2>/dev/null)" || _v=""
+  [ -n "$_v" ] && { _sl="$_v"; _slf="$_f"; break; }
+done
+case "$_sl" in
+  *eval/lib/statusline.sh*) ok "status line: Crewforth's (from %s)" "${_slf/#$HOME/~}" ;;
+  ?*) ok "status line: your own (from %s); Crewforth's is not used" "${_slf/#$HOME/~}" ;;
+  *) [ -f .claude/eval/lib/statusline.sh ] && ok "status line: none; Crewforth's: bash .claude/eval/lib/statusline.sh --install (Bash tool, not PowerShell)" ;;
+esac
+
+# 9e) What model routing costs. Advisory. A verify command the hook was never allowed to run cannot vouch for
+#     cheaper work: the ones refused for that reason are listed with the line that allows them (measured on one
+#     project: 23 of 71 refusals).
+[ -f .claude/eval/lib/verify-cmd.sh ] && . .claude/eval/lib/verify-cmd.sh   # the rule names the command a cd prefix leads to
+_vbn=0; _vbl=""
+for _f in .claude/state/crew-model/results/*; do
+  [ -f "$_f" ] || continue
+  _vb=0; _vw=""; _vc=""
+  while IFS= read -r _l || [ -n "$_l" ]; do
+    case "$_l" in verify=blocked) _vb=1 ;; whynot=*) _vw="${_l#whynot=}" ;; cmd=*) _vc="${_l#cmd=}" ;; esac
+  done < "$_f"
+  [ "$_vb" = 1 ] || continue
+  # Both ways of saying "nothing allows it": in auto/bypassPermissions (not on the runner list) and in the other
+  # modes (Claude Code itself would not run it unallowed). Measured on Windows: the second was not listed at all.
+  case "$_vw" in *"not a test or build command on this hook's list"*|*"does not run a command the user has not allowed"*) ;; *) continue ;; esac
+  # A rule names the command alone: `cd sub && ./check.sh` is allowed by `verify ./check.sh` (measured on Windows:
+  # the line with the cd in it did not allow it).
+  declare -F crew_verify_split >/dev/null && { crew_verify_split "$_vc" .; _vc="$_AMVC"; }
+  _vc="${_vc:0:80}"; [ -n "$_vc" ] || continue
+  _vbn=$((_vbn+1))
+  case "$_vc" in *'('*|*' + '*) continue ;; esac     # a sentence, not a command: counted, not offered as a rule
+  case "$_vbl" in *"| verify $_vc |"*) ;; *) _vbl="$_vbl| verify $_vc |" ;; esac
+done
+if [ "$_vbn" -gt 0 ]; then
+  _vsep=' || '; _vdot=' · '; _vbs="${_vbl//"$_vsep"/$_vdot}"; _vbs="${_vbs#| }"; _vbs="${_vbs% |}"; _vbs="${_vbs:0:300}"
+  warn "verify commands never run, %s time(s), because nothing allows them; to let the hook run one, add its line to .claude/crew-model-rules: %s" "$_vbn" "$_vbs"
+fi
+# The organisation preset in force: the block preset.sh wrote at the top of crew-model-rules, asked of preset.sh itself.
+_pre=""; [ -n "$_DOC_LIB" ] && [ -f "$_DOC_LIB/preset.sh" ] && _pre="$(bash "$_DOC_LIB/preset.sh" --show 2>/dev/null)"
+ok "organisation preset: %s" "${_pre:-none}"
+
 # 10) Gate activity. The suite proves the gates CAN fire; this reports whether anything actually tripped them.
 #     Recording is on by default (rule names only, never the command), so "no log" here means no gate has
 #     fired yet — a measured zero, not a gap. Never a failure either way.

package/kit/eval/gate-report.sh

@@ -29,6 +29,8 @@ HOOKS="./.claude/hooks"; [ -d "$HOOKS" ] || HOOKS="./hooks"
 [ -f "$HOOKS/guard-bash.sh" ] || { echo "gate-report: guard-bash.sh not found (run from the project root)" >&2; exit 4; }
 
 # Default log location, so `--log` is not required once logging is on.
+# The same rule the gates write by (eval/lib/gate-log.sh): .claude/gate-log.tsv, or the repository's .git.
+if [ -z "$LOG" ] && [ -f ./.claude/eval/lib/gate-log.sh ]; then . ./.claude/eval/lib/gate-log.sh; crew_gate_log_read; LOG="$_CREW_GL"; fi
 [ -z "$LOG" ] && [ -f "./.claude/gate-log.tsv" ] && LOG="./.claude/gate-log.tsv"
 
 TMP="${TMPDIR:-/tmp}/crew-gate-$$"; mkdir -p "$TMP"; trap 'rm -rf "$TMP"' EXIT

package/kit/eval/golden-routing.txt

@@ -225,3 +225,12 @@ we picked the wrong language for this service, write an adr|!i18n-integrity
 write the README in english for the public repo|!i18n-integrity
 the connection strings are missing from appsettings|!i18n-integrity
 add language support for kotlin to the parser|!i18n-integrity
+try to refute this finding: the token check at src/auth.js:42 can be bypassed|crew-refuter
+disprove this claim before it goes in the report|crew-refuter
+run a security audit of the login flow|!crew-refuter
+review my diff before I commit|!crew-refuter
+update the privacy policy text for the new data retention period|crew-docs-agent
+write the release notes and the changelog entry for this version|crew-docs-agent
+rewrite the app store description for the new release|crew-docs-agent
+add an endpoint that returns the privacy settings|!crew-docs-agent
+fix the failing unit test in the payment module|!crew-docs-agent

package/kit/eval/lib/crew-map/crew-map.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# crew-map.sh — the shell entry to scan.mjs. It does one thing: find a Node that RUNS and hand over.
+#
+#   bash crew-map.sh [--root DIR] [--stdout | --check]      the arguments and exit codes of scan.mjs (0, 1, 2)
+#       rc 3 = no usable Node here, so nothing was scanned. Not a pass: a caller must not read 3 as a fresh map.
+#
+# The same resolution as findings.sh beside it: ask node for its version (the Windows Store's stub resolves and
+# then exits 49), and when PATH has none, ask the panel's resolver. This file never installs anything.
+set -u
+# Cut at either separator: on Windows a caller may name this file with backslashes.
+d="${BASH_SOURCE%[/\\]*}"; [ "$d" = "${BASH_SOURCE}" ] && d=.
+FLOOR=18
+
+usable(){ local v; v="$("$1" -p 'process.versions.node.split(".")[0]' 2>/dev/null)" || return 1
+  case "$v" in ''|*[!0-9]*) return 1 ;; esac; [ "$v" -ge "$FLOOR" ]; }
+
+NODE=""
+if usable node; then NODE=node
+elif [ -f "$d/../../../studio/ensure-node.sh" ]; then
+  n="$(bash "$d/../../../studio/ensure-node.sh" 2>/dev/null)" && [ -n "$n" ] && usable "$n" && NODE="$n"
+fi
+if [ -z "$NODE" ]; then
+  echo "crew-map: no Node $FLOOR+ that runs was found, so nothing was scanned (this is not a pass)" >&2
+  exit 3
+fi
+exec "$NODE" "$d/scan.mjs" "$@"