crewly 1.20.153 → 1.20.154

package/config/skills/agent/core/split-ticket/execute.test.sh

@@ -0,0 +1,77 @@
+#!/bin/bash
+# Tests for split-ticket — run with: bash execute.test.sh
+# A python HTTP stub plays the backend; asserts the calls and the output.
+set -u
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+EXEC="$HERE/execute.sh"
+PASS=0; FAIL=0
+check() {
+  local name="$1"; local got="$2"; local want="$3"
+  if [ "$got" = "$want" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); echo "FAIL: $name"; echo "  want: $want"; echo "  got:  $got"; fi
+}
+
+PORT=18832
+STUB_LOG="$(mktemp)"; export STUB_LOG; export STUB_PORT="$PORT"
+python3 -u <<'PY' >/dev/null 2>&1 &
+from http.server import BaseHTTPRequestHandler, HTTPServer
+import json, os
+LOG = os.environ['STUB_LOG']; PORT = int(os.environ['STUB_PORT'])
+TICKET = {'id': 'tid-39', 'title': '开issue', 'discussion': [
+  {'ref': 'slackch-C1-2.0', 'at': '2026-09-26T14:59:36Z', 'author': 'U1', 'text': '可以去研究一下opus做视频那个吗'},
+  {'ref': 'slackch-C1-3.0', 'at': '2026-09-26T15:03:01Z', 'author': 'U1', 'text': 'hindsight那个要写到一起吗？'}]}
+class H(BaseHTTPRequestHandler):
+    def reply(self, code, obj):
+        self.send_response(code); self.send_header('Content-Type', 'application/json'); self.end_headers()
+        self.wfile.write(json.dumps(obj).encode())
+    def do_GET(self):
+        if self.path == '/api/tickets/TKT-039':
+            return self.reply(200, {'success': True, 'data': {'ticket': TICKET, 'board': {'tkt': 'TKT-039'}}})
+        return self.reply(404, {'success': False, 'error': 'Ticket not found'})
+    def do_POST(self):
+        n = int(self.headers.get('content-length', '0')); body = json.loads(self.rfile.read(n).decode() or '{}')
+        open(LOG, 'w').write(json.dumps({'path': self.path, 'body': body, 'agent': self.headers.get('X-Agent-Session')}))
+        if self.path != '/api/tickets/TKT-039/split':
+            return self.reply(404, {'success': False, 'error': 'Ticket not found', 'code': 'not_found'})
+        if body.get('discussionRef') == 'nope':
+            return self.reply(404, {'success': False, 'error': 'No discussion entry nope on that ticket', 'code': 'discussion_not_found'})
+        new = {'id': 'tid-41', 'ticketNumber': 41, 'title': body.get('title', 'opus 视频'), 'parentTicketId': 'tid-39',
+               'origin': {'threadRef': 'slack:C1:1.0'}}
+        return self.reply(201, {'success': True, 'data': {'ticket': new, 'source': TICKET, 'moved': 'discussionRef' in body}})
+    def log_message(self, *a, **k): pass
+HTTPServer(('127.0.0.1', PORT), H).serve_forever()
+PY
+STUB_PID=$!
+disown "$STUB_PID" 2>/dev/null || true
+trap 'kill "$STUB_PID" >/dev/null 2>&1; rm -f "$STUB_LOG"' EXIT
+for i in $(seq 1 30); do curl -s -o /dev/null -m 0.2 "http://127.0.0.1:${PORT}/" 2>/dev/null && break; sleep 0.1; done
+
+run() { CREWLY_SESSION_NAME=atlas CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" "$@" 2>/dev/null; }
+run_err() { CREWLY_SESSION_NAME=atlas CREWLY_API_URL="http://127.0.0.1:${PORT}" bash "$EXEC" "$@" 2>&1 >/dev/null; }
+
+# --- list mode shows the follow-ups with their refs, and how many ---
+OUT=$(run --ticket TKT-039 --list)
+check "list: count" "$(printf '%s' "$OUT" | jq -r .count)" "2"
+check "list: refs" "$(printf '%s' "$OUT" | jq -c '[.followUps[].ref]')" '["slackch-C1-2.0","slackch-C1-3.0"]'
+
+# --- move a follow-up out (as the agent) ---
+OUT=$(run --ticket TKT-039 --discussion-ref slackch-C1-2.0)
+check "move: path" "$(jq -r .path "$STUB_LOG")" "/api/tickets/TKT-039/split"
+check "move: body" "$(jq -c .body "$STUB_LOG")" '{"question":false,"discussionRef":"slackch-C1-2.0"}'
+check "move: agent header" "$(jq -r .agent "$STUB_LOG")" "atlas"
+check "move: new ticket keeps the thread and parent" "$(printf '%s' "$OUT" | jq -c '[.success, .moved, .newTicket.ticketNumber, .newTicket.parentTicketId, .newTicket.threadRef]')" '[true,true,41,"tid-39","slack:C1:1.0"]'
+
+# --- split from text, with title / assignee / question ---
+run --ticket TKT-039 --text "Turing 的另一个测试是什么" --title "other Turing test" --assignee think-tank-atlas --question >/dev/null
+check "text: body" "$(jq -c .body "$STUB_LOG")" '{"question":true,"text":"Turing 的另一个测试是什么","title":"other Turing test","assignee":"think-tank-atlas"}'
+
+# --- JSON input ---
+run '{"ticket":"TKT-039","discussionRef":"slackch-C1-3.0"}' >/dev/null
+check "json: body" "$(jq -c .body "$STUB_LOG")" '{"question":false,"discussionRef":"slackch-C1-3.0"}'
+
+# --- errors ---
+check "unknown ref fails loudly" "$(run_err --ticket TKT-039 --discussion-ref nope | grep -c 'No discussion entry')" "1"
+check "nothing to split" "$(run_err --ticket TKT-039 | grep -c 'discussion-ref')" "1"
+check "missing ticket" "$(run_err --text x | grep -ci 'ticket')" "1"
+
+echo "split-ticket: ${PASS} passed, ${FAIL} failed ($((PASS+FAIL)) checks)"
+[ "$FAIL" -eq 0 ] && [ $((PASS+FAIL)) -gt 0 ]

package/config/skills/agent/core/standing-update/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: Standing Update
+description: Write, replace or remove one section of a standing-answer page (decisions in force, open gotchas, owner preferences, or your own unfinished work), citing the memory entries it is built from.
+natural_language_description: Update the standing answer for a recurring question from the memory entries listed in a refresh WorkItem.
+version: 1.0.0
+category: memory
+skillType: claude-skill
+assignableRoles:
+  - developer
+  - qa
+  - tpm
+  - designer
+  - frontend-developer
+  - backend-developer
+  - fullstack-dev
+  - qa-engineer
+  - product-manager
+  - architect
+  - generalist
+  - sales
+  - support
+  - team-lead
+  - orchestrator
+triggers:
+  - standing answer
+  - refresh standing page
+  - update standing answers
+tags:
+  - memory
+  - standing-answers
+  - knowledge
+execution:
+  type: script
+  script:
+    file: execute.sh
+    interpreter: bash
+    timeoutMs: 15000
+---
+
+# Standing Update
+
+Standing-answer pages hold the settled answer to a recurring question, so
+agents see it at boot (`## Standing Answers` in the prompt) without calling
+`recall`. You normally run this skill while working a **Standing Answer
+Refresh** WorkItem: its brief lists the question, the current sections, and
+the memory entries to use, each with a citation token such as `dec:<id>`.
+
+| Page id | Scope | Question | Cites |
+|---|---|---|---|
+| `decisions-in-force` | project | What decisions are in force? | `dec:` |
+| `open-gotchas` | project | Which gotchas are still open? | `got:` |
+| `owner-preferences` | project | What does the owner prefer? | `pref:` |
+| `unfinished-work` | agent | What is my unfinished work, and what is blocking it? | `mem:` |
+
+Rules the backend enforces:
+
+- One section per call. Same heading (case-insensitive) replaces; a new one appends.
+- **An empty body removes the section.** Use it when a decision was superseded or a gotcha resolved.
+- Every non-empty section needs at least one citation, and every citation must name an entry in that page's sources.
+- Body ≤ 1500 characters, with no `#`/`##` headings, no `---` lines and no `Sources:` line. `###` is fine.
+- Anything that looks like a secret is masked before the page is written.
+
+Write the answer as it stands now, not a log of what happened.
+
+## Parameters
+
+| Flag | JSON Field | Required | Description |
+|------|-----------|----------|-------------|
+| `--page` / `-P` | `page` | Yes | Page id (table above) |
+| `--project` / `-p` | `projectPath` | Project pages | Project path (default: `$CREWLY_PROJECT_PATH`) |
+| `--session` / `-s` | `sessionName` | Agent page | Your session (default: `$CREWLY_SESSION_NAME`) |
+| `--heading` / `-H` | `heading` | Yes | Section heading, one line, ≤ 80 chars |
+| `--body` / `-b`, `--body-file` | `body` | Yes | Section body; `""` removes the section |
+| `--cites` / `-c` | `cites` | Unless removing | Comma-separated citations (JSON: array or string) |
+
+## Examples
+
+```bash
+bash config/skills/agent/core/standing-update/execute.sh --page decisions-in-force --project /path/to/project \
+  --heading "Prompt assembly" --body-file /tmp/section.md --cites "dec:0f3c...,dec:9a1b..."
+
+bash config/skills/agent/core/standing-update/execute.sh --page unfinished-work --session dev-1 \
+  --heading "PR #818" --body "Waiting on Steve to merge; nothing blocking." --cites "mem:k1..."
+
+# Remove a section that is no longer true
+bash config/skills/agent/core/standing-update/execute.sh --page open-gotchas --project /path --heading "Shell globbing" --body ""
+```
+
+## Output
+
+`{ success: true, data: { filePath, watermark, removed, masked } }`. A rejected
+write returns HTTP 400 with `code`: `unknown_page`, `invalid_input`,
+`missing_cite` or `unknown_cite`, plus a message saying what to fix.
+
+To see the pages, whether each is stale, and how many newer memories exist:
+`GET /api/standing?projectPath=<path>&sessionName=<session>`.

package/config/skills/agent/core/standing-update/execute.sh

@@ -0,0 +1,107 @@
+#!/bin/bash
+# Write one section of a standing-answer page (#816).
+# Supports CLI flags (preferred) and legacy JSON.
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/../../_common/lib.sh"
+
+AGENT_PAGE_ID="unfinished-work"
+
+print_usage() {
+  cat <<'EOF_USAGE'
+Usage:
+  execute.sh --page decisions-in-force --project /path --heading "Prompt assembly" \
+             --body-file /tmp/section.md --cites "dec:<id>,dec:<id>"
+  execute.sh --page unfinished-work --session dev-1 --heading "PR #818" \
+             --body "Waiting on review." --cites "mem:<id>"
+  execute.sh --page open-gotchas --project /path --heading "Shell" --body ""   # remove the section
+
+Options:
+  --page     | -P   Page id: decisions-in-force, open-gotchas, owner-preferences, unfinished-work (required)
+  --project  | -p   Project path for project pages (default: $CREWLY_PROJECT_PATH)
+  --session  | -s   Session name for the unfinished-work page (default: $CREWLY_SESSION_NAME)
+  --heading  | -H   Section heading, one line (required)
+  --body     | -b   Section body; an empty body removes the section
+  --body-file       Read the body from a file
+  --cites    | -c   Comma-separated citations from the refresh brief (required unless removing)
+  --json     | -j   Raw JSON payload
+  --help     | -h   Show this help
+EOF_USAGE
+}
+
+INPUT_JSON=""
+PAGE=""
+PROJECT_PATH=""
+SESSION=""
+HEADING=""
+BODY=""
+BODY_SET="false"
+CITES=""
+
+if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
+  INPUT_JSON="$1"
+  shift || true
+fi
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --page|-P) PAGE="$2"; shift 2 ;;
+    --project|-p) PROJECT_PATH="$2"; shift 2 ;;
+    --session|-s) SESSION="$2"; shift 2 ;;
+    --heading|-H) HEADING="$2"; shift 2 ;;
+    --body|-b) BODY="$2"; BODY_SET="true"; shift 2 ;;
+    --body-file)
+      [ -f "$2" ] || error_exit "Body file not found: $2"
+      BODY="$(cat "$2")"; BODY_SET="true"; shift 2 ;;
+    --cites|-c) CITES="$2"; shift 2 ;;
+    --json|-j) INPUT_JSON="$2"; shift 2 ;;
+    --help|-h) print_usage; exit 0 ;;
+    --) shift; break ;;
+    *)
+      if [[ -z "$INPUT_JSON" && ${1:0:1} == '{' ]]; then
+        INPUT_JSON="$1"; shift
+      else
+        error_exit "Unknown argument: $1. Use --help for usage."
+      fi
+      ;;
+  esac
+done
+
+if [ -n "$INPUT_JSON" ]; then
+  INPUT=$(read_json_input "$INPUT_JSON")
+  [ -z "$PAGE" ] && PAGE=$(printf '%s' "$INPUT" | jq -r '.page // .pageId // empty')
+  [ -z "$PROJECT_PATH" ] && PROJECT_PATH=$(printf '%s' "$INPUT" | jq -r '.projectPath // empty')
+  [ -z "$SESSION" ] && SESSION=$(printf '%s' "$INPUT" | jq -r '.sessionName // empty')
+  [ -z "$HEADING" ] && HEADING=$(printf '%s' "$INPUT" | jq -r '.heading // empty')
+  if [ "$BODY_SET" = "false" ] && printf '%s' "$INPUT" | jq -e 'has("body")' >/dev/null; then
+    BODY=$(printf '%s' "$INPUT" | jq -r '.body'); BODY_SET="true"
+  fi
+  [ -z "$CITES" ] && CITES=$(printf '%s' "$INPUT" | jq -r 'if (.cites | type) == "array" then (.cites | join(",")) else (.cites // empty) end')
+fi
+
+require_param "page (--page)" "$PAGE"
+require_param "heading (--heading)" "$HEADING"
+[ "$BODY_SET" = "true" ] || error_exit "body is required (--body, --body-file, or --body \"\" to remove the section)"
+[[ "$PAGE" =~ ^[a-z][a-z-]*$ ]] || error_exit "Invalid page id: $PAGE"
+
+# The agent page is keyed by session; every other page by project.
+if [ "$PAGE" = "$AGENT_PAGE_ID" ]; then
+  [ -z "$SESSION" ] && SESSION="${CREWLY_SESSION_NAME:-}"
+  require_param "session (--session, or CREWLY_SESSION_NAME)" "$SESSION"
+else
+  [ -z "$PROJECT_PATH" ] && PROJECT_PATH="${CREWLY_PROJECT_PATH:-}"
+  require_param "project (--project, or CREWLY_PROJECT_PATH)" "$PROJECT_PATH"
+fi
+
+BODY_JSON=$(jq -n \
+  --arg projectPath "$PROJECT_PATH" \
+  --arg sessionName "$SESSION" \
+  --arg heading "$HEADING" \
+  --arg body "$BODY" \
+  --arg cites "$CITES" \
+  '{heading: $heading, body: $body,
+    cites: ($cites | split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length > 0)))}
+   + (if $projectPath != "" then {projectPath: $projectPath} else {} end)
+   + (if $sessionName != "" then {sessionName: $sessionName} else {} end)')
+
+api_call PUT "/standing/${PAGE}/section" "$BODY_JSON"

package/config/skills/agent/onboarding/materialize-team/SKILL.md

@@ -51,7 +51,7 @@ This skill is callable **only when orc is in `'onboarding'` mode**.
 cat <<'EOF' | bash execute.sh
 {
   "recommendation": {
-    "templateId": "dtc-viral-content-team",
+    "templateId": "growth-marketing-team",
     "agents": [
       { "role": "content-drafter", "responsibilities": "...", "skillIds": ["content-drafter"] },
       { "role": "support-triage",  "responsibilities": "...", "skillIds": ["support-triage"]  }

package/config/skills/agent/onboarding/recommend-team/SKILL.md

@@ -70,7 +70,7 @@ bash execute.sh '{
 {
   "success": true,
   "recommendation": {
-    "templateId": "dtc-viral-content-team",
+    "templateId": "growth-marketing-team",
     "agents": [
       { "role": "content-drafter", "responsibilities": "...", "skillIds": [...] },
       { "role": "support-triage",  "responsibilities": "...", "skillIds": [...] }

package/config/skills/orchestrator/delegate-task/SKILL.md

@@ -42,7 +42,7 @@ The script auto-resolves `config/skills/...` references to absolute paths so del
 | `--task-file` | — | No | Read task description from a file path |
 | `--priority` / `-P` | `priority` | No | Priority: `low`, `normal`, `high` (default: `normal`) |
 | `--context` / `-c` | `context` | No | Additional context for the task. Scanned for the Request Contract alongside `--task` |
-| `--project` / `-p` | `projectPath` | No | Project path; creates task file in `.crewly/tasks/` |
+| `--project` / `-p` | `projectPath` | No | Project path; recorded on the WorkItem (`metadata.projectPath`) |
 | `--team` / `-g` | `teamId` | No | Team ID for cross-team validation |
 | `--task-type` | `taskType` | No | Task type: `general`, `technical` (default: `general`) |
 | `--force-cross-team` | `forceCrossTeam` | No | Allow cross-team delegation |
@@ -93,7 +93,7 @@ It does NOT set up a recurring check — the reconciler escalates stalled or unv
 ```bash
 bash config/skills/orchestrator/delegate-task/execute.sh '{"to":"agent-joe","task":"Implement user auth","priority":"high","projectPath":"/path/to/project"}'
 ```
-Also creates a task file in the project's `.crewly/tasks/` directory.
+The WorkItem carries the project path. For work that belongs in the project's own backlog, create a project ticket instead (`project-tickets create`) and let the team pick it up or assign it.
 
 ### Example 3: Cross-team delegation with a longer fallback (2× an 8 h ETA)
 ```bash
@@ -135,7 +135,8 @@ Error messages are output to **stdout** (JSON format) so the orchestrator can re
 
 ## Related Skills
 
-- `assign-task` — for formal task tracking in the management system (file-based kanban)
+- `assign-task` — hand an existing WorkItem to another agent
+- `project-tickets` — the project's own backlog (`<project>/.crewly/tickets/`): create, assign, claim
 - `send-message` — for simple messages without task structure
 - `watch-for-event` — the `agent:idle_after_task` watch that completes the §3.0 loop (not created by this skill)
 - `cancel-followup` — cancel the fallback trigger once the deliverable is verified

package/config/skills/orchestrator/render-verdict/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: Render Verdict
+description: Record a review verdict (verified/rejected) on a done_by_worker WorkItem, with the caller's identity attached so the backend accepts it.
+version: 1.0.0
+category: management
+skillType: claude-skill
+assignableRoles:
+  - orchestrator
+triggers:
+  - render verdict
+  - verify workitem
+  - reject workitem
+  - verdict needed
+tags:
+  - task-pool
+  - verification
+  - escalation
+execution:
+  type: script
+  script:
+    file: execute.sh
+    interpreter: bash
+    timeoutMs: 15000
+---
+
+# Render Verdict
+
+Record an explicit review verdict on a `done_by_worker` WorkItem — the step
+the escalation chain (#813/#819) asks the orchestrator to take once a
+worker's completion has gone unverified by its Team Leader for too long.
+
+## Why not `curl` directly?
+
+`POST /api/task-pool/items/:id/verdict` identifies its caller from the
+`X-Agent-Session` request header (never from the request body — see
+`resolveTransitionActor` in `backend/src/utils/agent-caller.utils.ts`). A raw
+`curl` sends no such header, so the backend cannot tell who is calling and
+refuses with `403 { code: "transition_not_reviewer" }`. This skill runs the
+same POST through `api_call` (`config/skills/_common/lib.sh`), which always
+attaches `X-Agent-Session: $CREWLY_SESSION_NAME` — run it with
+`CREWLY_SESSION_NAME` set to your own session (`crewly-orc` for the
+orchestrator) and the backend recognizes the caller correctly.
+
+## Usage
+
+```bash
+CREWLY_SESSION_NAME=crewly-orc bash config/skills/orchestrator/render-verdict/execute.sh \
+  '{"workItemId":"abc-123","verdict":"verified","comment":"Meets the acceptance criteria"}'
+```
+
+## Parameters
+
+- `workItemId` (required, alias `taskId`) — the `done_by_worker` WorkItem to verdict.
+- `verdict` (required) — `"verified"` or `"rejected"`.
+- `comment` (optional) — reviewer's note; required in practice for a rejection so the worker knows what to fix.
+
+## Output
+
+The raw JSON response of `POST /api/task-pool/items/:workItemId/verdict`:
+`{"success":true,"data":<WorkItem>}` on success, or a JSON error object on
+stderr (400 invalid verdict, 403 not the reviewer, 404 not found, 409 not
+`done_by_worker`).

package/config/skills/orchestrator/render-verdict/execute.sh

@@ -0,0 +1,47 @@
+#!/bin/bash
+# Render a review verdict on a `done_by_worker` WorkItem via the V3 task-pool
+# (#819 — replaces the raw-curl instruction in the escalation-router's 2h
+# orchestrator message).
+#
+# Why this skill exists: the escalation message used to tell the orchestrator
+# to `curl -X POST .../verdict` directly. A raw curl carries no
+# `X-Agent-Session` header, so the backend cannot identify the caller and
+# refuses the verdict with `403 not_reviewer` — the orchestrator was being
+# told to do something that could never work. `api_call` (config/skills/
+# _common/lib.sh) already attaches `X-Agent-Session: $CREWLY_SESSION_NAME` to
+# every request, so routing the same POST through it is the fix: run this
+# skill with CREWLY_SESSION_NAME set to the orchestrator's own session
+# (normally `crewly-orc`) and the backend recognizes it as the orchestrator,
+# which the transition gate always allows to render a verdict once an item is
+# escalated to it (or when the item has no reviewer of record).
+#
+# Input shape:
+#   { "workItemId": "abc-123", "verdict": "verified"|"rejected", "comment"?: "..." }
+#
+# Backwards-compat: `taskId` is accepted as an alias for `workItemId`, same
+# convention as complete-task/execute.sh.
+
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "${SCRIPT_DIR}/../_common/lib.sh"
+
+INPUT=$(read_json_input "${1:-}")
+[ -z "$INPUT" ] && error_exit "Usage: execute.sh '{\"workItemId\":\"abc-123\",\"verdict\":\"verified\",\"comment\":\"...\"}'"
+
+WORK_ITEM_ID=$(printf '%s' "$INPUT" | jq -r '.workItemId // .taskId // empty')
+VERDICT=$(printf '%s' "$INPUT" | jq -r '.verdict // empty')
+COMMENT=$(printf '%s' "$INPUT" | jq -r '.comment // empty')
+
+require_param "workItemId" "$WORK_ITEM_ID"
+
+if [ "$VERDICT" != "verified" ] && [ "$VERDICT" != "rejected" ]; then
+  error_exit "verdict must be \"verified\" or \"rejected\" (got: \"${VERDICT}\")"
+fi
+
+if [ -n "$COMMENT" ]; then
+  BODY=$(jq -n --arg verdict "$VERDICT" --arg comment "$COMMENT" '{verdict: $verdict, comment: $comment}')
+else
+  BODY=$(jq -n --arg verdict "$VERDICT" '{verdict: $verdict}')
+fi
+
+api_call POST "/task-pool/items/${WORK_ITEM_ID}/verdict" "$BODY"

package/config/skills/orchestrator/render-verdict/execute.test.sh

@@ -0,0 +1,121 @@
+#!/bin/bash
+# Tests for ORC render-verdict execute.sh (#819)
+#
+# The harness runs a COPY of the real execute.sh under a stubbed api_call
+# (source real lib.sh + override api_call — the pattern used by
+# delegate-task/execute.test.sh), so production logic is exercised verbatim.
+#
+# Coverage:
+#   1. happy path — POSTs to the verdict endpoint with the right body
+#   2. comment is included when given, omitted when not
+#   3. an invalid verdict is rejected BEFORE any HTTP call (this is the
+#      whole point of the skill: never let a malformed request reach the
+#      backend and produce a confusing error)
+#   4. workItemId is required
+#   5. taskId is accepted as an alias for workItemId
+
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PASS=0
+FAIL=0
+
+CALL_LOG=$(mktemp)
+SKILL_PARENT=$(mktemp -d)
+trap 'rm -rf "$SKILL_PARENT" "$CALL_LOG"' EXIT
+
+mkdir -p "$SKILL_PARENT/_common" "$SKILL_PARENT/render-verdict"
+
+REAL_LIB="$(cd "$SCRIPT_DIR/../.." && pwd)/_common/lib.sh"
+cat > "$SKILL_PARENT/_common/lib.sh" <<EOF
+source "$REAL_LIB"
+api_call() {
+  local method="\$1" path="\$2" body="\${3:-}"
+  echo "\${method} \${path} \${body}" >> "${CALL_LOG}"
+  echo '{"success":true,"data":{"id":"wi-stub-id","status":"verified"}}'
+}
+EOF
+
+cp "$SCRIPT_DIR/execute.sh" "$SKILL_PARENT/render-verdict/execute.sh"
+chmod +x "$SKILL_PARENT/render-verdict/execute.sh"
+
+assert_log_contains() {
+  local desc="$1" pattern="$2"
+  if grep -q "$pattern" "$CALL_LOG"; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc (expected log entry matching '$pattern')"
+    echo "  Call log was:"
+    sed 's/^/    /' "$CALL_LOG"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+assert_log_empty() {
+  local desc="$1"
+  if [ -s "$CALL_LOG" ]; then
+    echo "  FAIL: $desc (expected NO api_call, got:)"
+    sed 's/^/    /' "$CALL_LOG"
+    FAIL=$((FAIL + 1))
+  else
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  fi
+}
+
+echo "=== ORC render-verdict ==="
+
+# --- Test 1: happy path, no comment ---
+> "$CALL_LOG"
+OUT=$(bash "${SKILL_PARENT}/render-verdict/execute.sh" '{"workItemId":"wi-1","verdict":"verified"}' 2>&1 || true)
+assert_log_contains "POSTs to the verdict endpoint" "POST /task-pool/items/wi-1/verdict"
+assert_log_contains "body carries verdict=verified" '"verdict": "verified"'
+if echo "$OUT" | grep -q '"comment"'; then
+  echo "  FAIL: body should omit comment when none was given"
+  FAIL=$((FAIL + 1))
+else
+  echo "  PASS: no comment field sent when none was given"
+  PASS=$((PASS + 1))
+fi
+
+# --- Test 2: comment is included when given (rejection path) ---
+> "$CALL_LOG"
+bash "${SKILL_PARENT}/render-verdict/execute.sh" \
+  '{"workItemId":"wi-2","verdict":"rejected","comment":"Missing tests"}' >/dev/null 2>&1 || true
+assert_log_contains "POSTs to the verdict endpoint" "POST /task-pool/items/wi-2/verdict"
+assert_log_contains "body carries verdict=rejected" '"verdict": "rejected"'
+assert_log_contains "body carries the comment" '"comment": "Missing tests"'
+
+# --- Test 3: an invalid verdict never reaches api_call ---
+> "$CALL_LOG"
+OUT=$(bash "${SKILL_PARENT}/render-verdict/execute.sh" '{"workItemId":"wi-3","verdict":"approved"}' 2>&1 || true)
+assert_log_empty "invalid verdict makes no HTTP call"
+if echo "$OUT" | grep -qi "verdict must be"; then
+  echo "  PASS: error names the accepted values"
+  PASS=$((PASS + 1))
+else
+  echo "  FAIL: expected an error naming accepted verdict values, got: $OUT"
+  FAIL=$((FAIL + 1))
+fi
+
+# --- Test 4: workItemId is required ---
+> "$CALL_LOG"
+OUT=$(bash "${SKILL_PARENT}/render-verdict/execute.sh" '{"verdict":"verified"}' 2>&1 || true)
+assert_log_empty "missing workItemId makes no HTTP call"
+if echo "$OUT" | grep -qi "workItemId"; then
+  echo "  PASS: error names the missing param"
+  PASS=$((PASS + 1))
+else
+  echo "  FAIL: expected an error naming workItemId, got: $OUT"
+  FAIL=$((FAIL + 1))
+fi
+
+# --- Test 5: taskId is accepted as an alias for workItemId ---
+> "$CALL_LOG"
+bash "${SKILL_PARENT}/render-verdict/execute.sh" '{"taskId":"wi-4","verdict":"verified"}' >/dev/null 2>&1 || true
+assert_log_contains "taskId alias resolves to the same endpoint" "POST /task-pool/items/wi-4/verdict"
+
+# --- Summary ---
+echo ""
+echo "=== Results: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]

package/config/skills/orchestrator/wiki-migrate/SKILL.md

@@ -27,7 +27,6 @@ For users who installed Crewly BEFORE the v2.1 LLM-wiki landed (2026-05-22+). Th
 | `~/.crewly/agents/<id>/memory.json roleKnowledge[]` | `<project>/.crewly/wiki/llm-curated/{patterns,decisions}/<date>-<slug>.md` (copy; original retained) |
 | `<crewly-src>/config/sops/<role>/*.md` (OSS-distributed) | `~/.crewly/global-wiki/llm-curated/sops/<role>/<slug>.md` (via `migrate/oss-sops`) |
 | `<crewly-src>/config/domain-sops/*.sop.md` | `~/.crewly/global-wiki/llm-curated/sops/domain/<slug>.md` |
-| `<crewly-src>/config/templates/pro-sops/norms/*.md` | `~/.crewly/global-wiki/llm-curated/sops/pro-norms/<slug>.md` |
 
 Per spec §6 the agent's `memory.json` stays put — this skill **copies** its `roleKnowledge` entries to the wiki rather than moving them, so private agent memory keeps working unchanged.
 

package/config/skills/team-leader/aggregate-results/SKILL.md

@@ -38,7 +38,7 @@ Compiles results from all worker sub-tasks into a structured markdown report for
 ## Usage
 
 ```bash
-bash {{SKILLS_PATH}}/team-leader/aggregate-results/execute.sh '{"teamId":"team-123","objective":"Build auth module","reportType":"final","taskPaths":["/project/.crewly/tasks/m1/done/task1.md","/project/.crewly/tasks/m1/done/task2.md"],"projectPath":"/path/to/project"}'
+bash {{SKILLS_PATH}}/team-leader/aggregate-results/execute.sh '{"teamId":"team-123","objective":"Build auth module","reportType":"final","taskPaths":["/path/to/report-1.md","/path/to/report-2.md"],"projectPath":"/path/to/project"}'
 ```
 
 ## Parameters

package/config/skills/team-leader/assign-ticket/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: Assign Ticket (TL)
+description: Assign a project ticket (<project>/.crewly/tickets/) to one of your workers; the worker gets a linked WorkItem and is dispatched.
+version: 1.0.0
+category: task-management
+skillType: claude-skill
+assignableRoles:
+  - team-leader
+triggers:
+  - assign ticket
+  - give this ticket to
+  - backlog assignment
+tags:
+  - tickets
+  - backlog
+  - delegation
+execution:
+  type: script
+  script:
+    file: execute.sh
+    interpreter: bash
+    timeoutMs: 15000
+---
+
+# Assign Ticket (Team Leader)
+
+Project tickets are the project's own backlog (see the `project-tickets`
+skill). Workers take `ready` tickets themselves when they are idle; use this
+when you want a specific worker on a specific ticket.
+
+```bash
+# Start work now: the ticket goes in_progress and the worker gets a WorkItem
+bash {{TL_SKILLS_PATH}}/assign-ticket/execute.sh --project /path/to/project --id APP-12 --to worker-session
+
+# Only record who will do it (no WorkItem yet)
+bash {{TL_SKILLS_PATH}}/assign-ticket/execute.sh --project /path/to/project --id APP-12 --to worker-session --no-start
+```
+
+Rules the backend enforces:
+- You must lead a team that works on the project.
+- The worker must be on a team of that project (and on the ticket's `team`, if
+  it names one).
+- A ticket that is already in progress must be released first
+  (`project-tickets release`), so two workers never hold one ticket.
+
+When the worker completes the WorkItem, you review it through the normal
+verification item; once you verify it the ticket moves to `done` by itself.