crewly 1.20.158 → 1.20.160

package/config/constants.ts

@@ -1483,6 +1483,19 @@ export const PROJECT_TICKET_CONSTANTS = {
 	SYNC_SWEEP_INTERVAL_MS: 60 * 1000,
 	/** Successor hops followed from a ticket's WorkItem before giving up */
 	MAX_SUCCESSOR_HOPS: 8,
+	/**
+	 * Delegation through tickets (spec §11): the task-pool body field naming the
+	 * project ticket a delegated WorkItem works (`delegate-task --ticket`).
+	 */
+	DELEGATION_TICKET_BODY_KEY: 'projectTicketId',
+	/** WorkItem metadata key a delegating skill uses to name the delegator when no X-Agent-Session header is sent */
+	DELEGATION_CALLER_METADATA_KEY: 'delegatedBy',
+	/** WorkItem types that are delegations of work to someone (the only ones routed through tickets) */
+	DELEGATION_WORK_ITEM_TYPES: ['delegate'] as const,
+	/** Max characters of a ticket title derived from a delegation's title */
+	DELEGATION_TITLE_MAX_CHARS: 120,
+	/** Error `code` of a task-pool add refused by the ticket rules (skills stop instead of delivering) */
+	DELEGATION_REFUSED_CODE: 'project_ticket_refused',
 } as const;
 
 /**

package/config/roles/orchestrator/prompt.md

@@ -878,6 +878,7 @@ Every project keeps its own backlog in `<project>/.crewly/tickets/` — one mark
 - **Owner says "put this in the backlog" / "add a ticket for …"** → `project-tickets create --project <path> --title "…" --acceptance "…" --source request:<TKT id>` and tell the owner the new ticket id. It starts in `backlog`; do not start the work unless the owner also asked for that.
 - **Owner says a ticket should be done now** → `project-tickets update --project <path> --id <ID> --status ready`. Idle members of the project's teams pick up `ready` tickets themselves (highest priority first).
 - **A specific person must do it** → `project-tickets assign --project <path> --id <ID> --to <session>`.
+- **Delegating project work** (`delegate-task` to an agent whose team works on a project) always runs through a ticket: pass `--ticket <ID>` when one exists, otherwise one is created and returned as `projectTicket`. Work already running without a ticket → `project-tickets link --project <path> --id <ID> --work-item <WorkItem id>`.
 - A ticket moves to `done` by itself when its WorkItem is verified (or to `review` when the owner wants to check it personally — then the owner closes it).
 
 ### Task Routing

package/config/roles/team-leader/prompt.md

@@ -52,6 +52,7 @@ Use when: Orchestrator sends a new objective. Creates one WorkItem per sub-task
 bash {{TL_SKILLS_PATH}}/delegate-task/execute.sh '{"to":"worker-session","task":"implement feature","priority":"high","teamId":"{{TEAM_ID}}","tlMemberId":"{{MEMBER_ID}}","projectPath":"{{PROJECT_PATH}}"}'
 ```
 Use when: After decompose-goal, or when handle-failure says reassign. Validates hierarchy before delegation.
+Project work for a worker always runs through a project ticket: add `"ticket":"APP-12"` (or `--ticket APP-12`) when a ticket exists; otherwise one is created for you and printed. Refused (nothing delivered) when that ticket is already being worked or closed.
 
 ### 3. verify-output — Check completed work quality
 ```bash
@@ -103,6 +104,8 @@ Use when: A specific worker should take a specific ticket of the project backlog
 
 Each project keeps its own backlog in `<project>/.crewly/tickets/` (one markdown file per ticket, tracked in git). Use the `project-tickets` skill (`{{AGENT_SKILLS_PATH}}/core/project-tickets/execute.sh`) to list, read, create and update tickets. Workers pick up `ready` tickets by themselves when idle; you decide what is `ready` (`update --status ready`), you may assign (`assign-ticket`), and you review the work through the normal verification item. Worker-created tickets land in `backlog` until you or the owner make them ready.
 
+**Every piece of project work for a worker has a ticket.** Delegate with `--ticket <ID>` when the ticket exists (or `assign-ticket`); without it `delegate-task` creates one for you. Work already running without a ticket: `project-tickets link --project {{PROJECT_PATH}} --id <ID> --work-item <WorkItem id>`. Backlog tickets that should be picked up next: `update --status ready`. Reminders you set for yourself get no ticket.
+
 ---
 
 ## Brief Reception Protocol

package/config/roles/team-leader/tl-addon.md

@@ -33,6 +33,7 @@ Use when: Orchestrator sends a new objective. Creates one WorkItem per sub-task
 bash {{TL_SKILLS_PATH}}/delegate-task/execute.sh '{"to":"worker-session","task":"implement feature","priority":"high","teamId":"{{TEAM_ID}}","tlMemberId":"{{MEMBER_ID}}","projectPath":"{{PROJECT_PATH}}"}'
 ```
 Use when: After decompose-goal, or when handle-failure says reassign. Validates hierarchy before delegation.
+Project work for a worker always runs through a project ticket: add `"ticket":"APP-12"` (or `--ticket APP-12`) when a ticket exists; otherwise one is created for you and printed. Refused (nothing delivered) when that ticket is already being worked or closed.
 
 #### 3. verify-output — Check completed work quality
 ```bash
@@ -89,6 +90,8 @@ Use when: A specific worker should take a specific ticket of the project backlog
 #### Project backlog (project tickets)
 Each project keeps its own backlog in `<project>/.crewly/tickets/` (one markdown file per ticket, tracked in git). Use the `project-tickets` skill to list, read, create and update tickets. Workers pick up `ready` tickets by themselves when idle; you decide what is `ready`, you may assign (`assign-ticket`), and you review the work through the normal verification item. Worker-created tickets land in `backlog` until you or the owner make them ready.
 
+**Every piece of project work for a worker has a ticket.** Delegate with `--ticket <ID>` when the ticket exists (or `assign-ticket`); without it `delegate-task` creates one for you. Work already running without a ticket: `project-tickets link --project {{PROJECT_PATH}} --id <ID> --work-item <WorkItem id>`. Backlog tickets that should be picked up next: `update --status ready`. Reminders you set for yourself get no ticket.
+
 ---
 
 ### Standard Operating Procedure (5-Step SOP)

package/config/skills/agent/core/project-tickets/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: Project Tickets
-description: A project's own backlog — list, read, create, update, claim, release and log project tickets (markdown files in <project>/.crewly/tickets/, tracked in git).
+description: A project's own backlog — list, read, create, update, claim, release, assign, link and log project tickets (markdown files in <project>/.crewly/tickets/, tracked in git).
 version: 1.0.0
 category: task-management
 skillType: claude-skill
@@ -125,3 +125,19 @@ bash execute.sh assign --project P --id APP-12 --to worker-session --no-start
 Only the owner, the orchestrator or a lead of a team on the project may
 assign, and only to members of those teams (a person's name is recorded
 without a WorkItem). Team leads also have the `assign-ticket` skill.
+
+## Link work already in flight (orchestrator / team lead)
+
+```bash
+bash execute.sh link --project P --id APP-12 --work-item <WorkItem id>
+```
+
+For a WorkItem that is already queued or running without a ticket (e.g. it was
+delegated before tickets were used). The ticket becomes `in_progress` (a ticket
+in `review` stays there), its assignee is the WorkItem's target, and it closes
+by itself when that WorkItem is verified. Refused when the ticket is done or
+cancelled, the WorkItem is finished or already works another ticket, or the
+ticket already has another live WorkItem.
+
+New delegations need no `link`: `delegate-task` puts work for a teammate on a
+project through a ticket by itself (pass `--ticket APP-12` to use an existing one).

package/config/skills/agent/core/project-tickets/execute.sh

@@ -16,6 +16,7 @@
 #   bash execute.sh release --project P --id APP-12 [--note "why"]
 #   bash execute.sh assign  --project P --id APP-12 --to <session> [--no-start]   (owner / orc / lead)
 #   bash execute.sh log     --project P --id APP-12 --note "progress"
+#   bash execute.sh link    --project P --id APP-12 --work-item <WorkItem id>   (owner / orc / lead)
 #   bash execute.sh '{"action":"create","project":"P","title":"…"}'
 #
 # P = project id, name, or absolute path.
@@ -39,6 +40,9 @@ Usage:
   bash execute.sh assign  --project P --id APP-12 --to <session> [--no-start]
                                                               Orchestrator / team lead: put someone on it
   bash execute.sh log     --project P --id APP-12 --note "…"  Add a progress note to the ticket's Log
+  bash execute.sh link    --project P --id APP-12 --work-item <id>
+                                                              Orchestrator / team lead: tie work already in
+                                                              flight (a live WorkItem) to this ticket
 
 P = project id, name or absolute path. Workers' new tickets start in backlog;
 the owner, the orchestrator or a team lead makes them ready.
@@ -46,7 +50,7 @@ EOF_USAGE
 }
 
 ACTION=""; PROJECT=""; ID=""; TITLE=""; DESCRIPTION=""; PRIORITY=""; LABELS=""; TEAM=""
-STATUS=""; SOURCE=""; REQUEST_ID=""; NOTE=""; OWNER_REVIEW=""; ASSIGNEE=""; START="true"
+STATUS=""; SOURCE=""; REQUEST_ID=""; NOTE=""; OWNER_REVIEW=""; ASSIGNEE=""; START="true"; WORK_ITEM=""
 ACCEPTANCE_JSON="null"
 HAS_DESCRIPTION=0
 
@@ -70,6 +74,7 @@ if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
   ACCEPTANCE_JSON=$(printf '%s' "$J" | jq -c 'if (.acceptance|type) == "array" then .acceptance else null end')
   ASSIGNEE=$(printf '%s' "$J" | jq -r '.to // .assignee // empty')
   START=$(printf '%s' "$J" | jq -r 'if .start == false then "false" else "true" end')
+  WORK_ITEM=$(printf '%s' "$J" | jq -r '.workItemId // .workItem // empty')
 fi
 if [[ -z "$ACTION" && $# -gt 0 && ${1:0:1} != '-' ]]; then ACTION="$1"; shift; fi
 
@@ -91,13 +96,15 @@ while [[ $# -gt 0 ]]; do
     --owner-review)  OWNER_REVIEW="true"; shift ;;
     --to|--assignee) [ $# -ge 2 ] || error_exit "--to requires a value";         ASSIGNEE="$2"; shift 2 ;;
     --no-start)      START="false"; shift ;;
+    --work-item|--work-item-id|--workItemId)
+                     [ $# -ge 2 ] || error_exit "--work-item requires a value";   WORK_ITEM="$2"; shift 2 ;;
     --full)          shift ;;
     --help|-h)       print_usage; exit 0 ;;
     *) error_exit "Unknown option: $1" ;;
   esac
 done
 
-[ -n "$ACTION" ] || { print_usage >&2; error_exit "Missing action: list | show | create | update | claim | release | assign | log"; }
+[ -n "$ACTION" ] || { print_usage >&2; error_exit "Missing action: list | show | create | update | claim | release | assign | log | link"; }
 
 # URL-encode a path segment (project paths contain slashes).
 enc() { jq -rn --arg v "$1" '$v|@uri'; }
@@ -176,7 +183,13 @@ case "$ACTION" in
     BODY=$(jq -n --arg note "$NOTE" '{note: $note}')
     api_call POST "/project-tickets/$(enc "$PROJECT")/$(enc "$ID")/log" "$BODY" | jq '{success, lastLog: (.data.log | last)}'
     ;;
+  link)
+    require_param "project" "$PROJECT"; require_param "id" "$ID"; require_param "work-item" "$WORK_ITEM"
+    BODY=$(jq -n --arg wi "$WORK_ITEM" '{workItemId: $wi}')
+    api_call POST "/project-tickets/$(enc "$PROJECT")/$(enc "$ID")/link" "$BODY" \
+      | jq "{success, workItemId: .data.workItem.id, ticket: (.data.ticket | ${TICKET_ROW})}"
+    ;;
   *)
-    error_exit "Unknown action: $ACTION (use list | show | create | update | claim | release | assign | log)"
+    error_exit "Unknown action: $ACTION (use list | show | create | update | claim | release | assign | log | link)"
     ;;
 esac

package/config/skills/agent/core/project-tickets/execute.test.sh

@@ -37,6 +37,8 @@ class H(BaseHTTPRequestHandler):
     def do_POST(self):
         n = int(self.headers.get('content-length', '0')); body = json.loads(self.rfile.read(n).decode() or '{}')
         self.record(body)
+        if self.path.endswith('/link'):
+            return self.reply(200, {'success': True, 'data': {'workItem': {'id': body.get('workItemId')}, 'ticket': dict(T, status='in_progress', assignee='dev-bo', workItemId=body.get('workItemId'))}})
         if self.path.endswith('/claim'):
             return self.reply(200, {'success': True, 'data': {'claimed': True, 'workItem': {'id': 'wi-9'}, 'ticket': dict(T, status='in_progress', assignee='dev-ann', workItemId='wi-9')}})
         if 'forbidden' in self.path:
@@ -106,6 +108,15 @@ OUT=$(run log --project p1 --id APP-1 --note "halfway")
 check "log: body" "$(last '.body | tostring')" '{"note":"halfway"}'
 check "log: last line" "$(printf '%s' "$OUT" | jq -r .lastLog)" "b · dev · note"
 
+# --- link (orchestrator / lead): tie a live WorkItem to a ticket ---
+OUT=$(run link --project p1 --id APP-1 --work-item wi-42)
+check "link: path" "$(last .path)" "/api/project-tickets/p1/APP-1/link"
+check "link: body" "$(last '.body | tostring')" '{"workItemId":"wi-42"}'
+check "link: output" "$(printf '%s' "$OUT" | jq -c '[.workItemId, .ticket.status, .ticket.workItemId]')" '["wi-42","in_progress","wi-42"]'
+run '{"action":"link","project":"p1","id":"APP-1","workItemId":"wi-43"}' >/dev/null
+check "link json" "$(last '.body | tostring')" '{"workItemId":"wi-43"}'
+check "link: missing work item" "$(run_err link --project p1 --id APP-1 | grep -c 'work-item')" "1"
+
 # --- errors ---
 check "missing action" "$(run_err | grep -c 'Missing action')" "1"
 check "unknown action" "$(run_err explode | grep -c 'Unknown action')" "1"

package/config/skills/orchestrator/delegate-task/SKILL.md

@@ -47,8 +47,26 @@ The script auto-resolves `config/skills/...` references to absolute paths so del
 | `--task-type` | `taskType` | No | Task type: `general`, `technical` (default: `general`) |
 | `--force-cross-team` | `forceCrossTeam` | No | Allow cross-team delegation |
 | `--request-id` / `-R` | `requestId` | No | Ticket (Request) this work is for — the id or `TKT-123` from the `[TICKET:TKT-123 <id>]` line of the message you are acting on. Links the WorkItem into `Request.workItemIds[]`. Omit it and the WorkItem is still linked when your current turn has exactly one ticket |
+| `--ticket` | `ticket` | No | Project ticket this work is for (e.g. `APP-12`). Without it a ticket is created for you when the target works on a project — see Project tickets |
 | `--fallback-minutes` | — | No | Minutes until the ONE §3.0 fallback check fires for this delegation (default `120` ≈ 2× a TL milestone ETA). `0` disables it. Not cancelled on completion — keep it at 2× ETA, never a poll interval |
 
+## Project tickets
+
+Work for a teammate on a project always runs through a project ticket
+(`<project>/.crewly/tickets/`, spec `2026-09-28-project-tickets.md` §11):
+
+- `--ticket APP-12` — that ticket (must be `backlog` or `ready`, with no other
+  live WorkItem) is assigned to `--to` and this WorkItem becomes its work. A
+  ticket that is already being worked, done, cancelled or unknown is refused:
+  nothing is delivered and the reason is printed.
+- no `--ticket` — a ticket is created from this delegation (title, brief,
+  the target's team, priority) and set `in_progress` for the target. The
+  output names it (`projectTicket`).
+
+No ticket is made for work you target at yourself, review/verify items,
+system or scheduled items, or targets whose team has no project. Work already
+in flight without a ticket: `project-tickets link --project P --id APP-12 --work-item <id>`.
+
 ## Usage — CLI Flags (preferred)
 
 ```bash

package/config/skills/orchestrator/delegate-task/execute.sh

@@ -17,6 +17,7 @@ TASK_TYPE="general"
 TEAM_ID=""
 FORCE_CROSS_TEAM="false"
 REQUEST_ID=""
+PROJECT_TICKET=""
 # Self-heal fix #3 (2026-05-20): default fallback timer. Per the
 # orchestrator prompt §3.0 the orc is supposed to set 2× ETA manually
 # for every dispatch, but the convention was unenforced — observable in
@@ -54,11 +55,13 @@ while [[ $# -gt 0 ]]; do
     --task-type)     TASK_TYPE="$2";        shift 2 ;;
     --team|-g)       TEAM_ID="$2";          shift 2 ;;
     --request-id|-R) REQUEST_ID="$2";       shift 2 ;;
+    --ticket)        PROJECT_TICKET="$2";   shift 2 ;;
     --force-cross-team) FORCE_CROSS_TEAM="true"; shift ;;
     --fallback-minutes) FALLBACK_MINUTES="$2"; shift 2 ;;
     --json|-j)       INPUT_JSON="$2";       shift 2 ;;
     --help|-h)
-      echo "Usage: execute.sh --to agent-session --task 'implement feature' --priority high --project /path [--team teamId] [--context 'extra info']"
+      echo "Usage: execute.sh --to agent-session --task 'implement feature' --priority high --project /path [--team teamId] [--context 'extra info'] [--ticket <project ticket id, e.g. APP-12>]"
+      echo "Work for an agent on a project always runs through a project ticket: --ticket uses that backlog/ready ticket, otherwise one is created for you."
       exit 0
       ;;
     --)              shift; break ;;
@@ -94,6 +97,7 @@ if [ -n "$INPUT_JSON" ]; then
   [ -z "$TEAM_ID" ] && TEAM_ID=$(printf '%s' "$INPUT" | jq -r '.teamId // empty')
   [ "$FORCE_CROSS_TEAM" = "false" ] && FORCE_CROSS_TEAM=$(printf '%s' "$INPUT" | jq -r '.forceCrossTeam // "false"')
   [ -z "$REQUEST_ID" ] && REQUEST_ID=$(printf '%s' "$INPUT" | jq -r '.requestId // empty')
+  [ -z "$PROJECT_TICKET" ] && PROJECT_TICKET=$(printf '%s' "$INPUT" | jq -r '.ticket // .projectTicketId // empty')
 fi
 
 require_param "to (--to)" "$TO"
@@ -292,17 +296,29 @@ POOL_BODY=$(jq -n \
   --arg priority "$WI_PRIORITY" \
   --arg projectPath "${PROJECT_PATH:-}" \
   --arg requestId "${REQUEST_ID:-}" \
-  '{type: $type, owner: $owner, target: $target, title: $title, description: $description, briefMarkdown: $briefMarkdown, metadata: ({priority: $priority} + (if $projectPath != "" then {projectPath: $projectPath} else {} end))} + (if $requestId != "" then {requestId: $requestId} else {} end)')
+  --arg projectTicketId "${PROJECT_TICKET:-}" \
+  --arg delegatedBy "${CREWLY_SESSION_NAME:-}" \
+  '{type: $type, owner: $owner, target: $target, title: $title, description: $description, briefMarkdown: $briefMarkdown, metadata: ({priority: $priority} + (if $projectPath != "" then {projectPath: $projectPath} else {} end) + (if $delegatedBy != "" then {delegatedBy: $delegatedBy} else {} end))} + (if $requestId != "" then {requestId: $requestId} else {} end) + (if $projectTicketId != "" then {projectTicketId: $projectTicketId} else {} end)')
+# projectTicketId / metadata.delegatedBy: work for an agent on a project runs
+# through a project ticket (specs/2026-09-28-project-tickets.md §11). The
+# backend uses --ticket, or creates a ticket and links this WorkItem to it.
 
 # Pipeline-#4 fix (spec 2026-05-05-request-decompose-pipeline-gap.md, Patch B):
 # Route is /api/task-pool/add (not /api/pool/add — that endpoint does not exist
 # and previously returned 404, silently swallowed by the || fallback below).
-POOL_RESULT=$(api_call POST "/task-pool/add" "$POOL_BODY" 2>/dev/null || echo '{"success":false}')
+POOL_ERR_FILE="$(mktemp)"
+POOL_RESULT=$(api_call POST "/task-pool/add" "$POOL_BODY" 2>"$POOL_ERR_FILE" || echo '{"success":false}')
+POOL_ERR="$(cat "$POOL_ERR_FILE" 2>/dev/null || true)"
+rm -f "$POOL_ERR_FILE"
 POOL_OK=$(echo "$POOL_RESULT" | jq -r '.success // "false"' 2>/dev/null)
 WI_ID=$(echo "$POOL_RESULT" | jq -r '.data.id // .workItemId // empty' 2>/dev/null || true)
+PROJECT_TICKET_INFO=$(echo "$POOL_RESULT" | jq -c '.data.projectTicket // null' 2>/dev/null || echo 'null')
+[ -n "$PROJECT_TICKET_INFO" ] || PROJECT_TICKET_INFO='null'
 
 if [ "$POOL_OK" != "true" ]; then
-  echo "{\"error\":\"Failed to create WorkItem in TaskPool\",\"details\":$(echo "$POOL_RESULT" | jq -c . 2>/dev/null || echo '{}')}"
+  # Surface the backend's reason (e.g. a --ticket refused by the project-ticket rules).
+  ERR_DETAILS=$(printf '%s' "$POOL_ERR" | grep '"error":true' | tail -1 | jq -c '.details // .' 2>/dev/null || true)
+  echo "{\"error\":\"Failed to create WorkItem in TaskPool\",\"details\":${ERR_DETAILS:-$(echo "$POOL_RESULT" | jq -c . 2>/dev/null || echo '{}')}}"
   exit 1
 fi
 
@@ -400,5 +416,7 @@ jq -n \
   --arg message "$RESULT_MESSAGE" \
   --arg fallbackTriggerId "${FALLBACK_TRIGGER_ID:-}" \
   --arg fallbackMinutes "${FALLBACK_MINUTES:-0}" \
+  --argjson projectTicket "$PROJECT_TICKET_INFO" \
   '{success: true, workItemId: $workItemId, target: $target, priority: $priority, title: $title, state: $state, message: $message}
-   + (if $fallbackTriggerId != "" then {fallbackTriggerId: $fallbackTriggerId, fallbackMinutes: ($fallbackMinutes|tonumber)} else {} end)'
+   + (if $fallbackTriggerId != "" then {fallbackTriggerId: $fallbackTriggerId, fallbackMinutes: ($fallbackMinutes|tonumber)} else {} end)
+   + (if $projectTicket != null then {projectTicket: $projectTicket} else {} end)'

package/config/skills/orchestrator/delegate-task/execute.test.sh

@@ -47,7 +47,15 @@ api_call() {
   echo "\${method} \${path} \${body}" >> "${CALL_LOG}"
   case "\${path}" in
     /task-pool/add)
-      echo '{"success":true,"data":{"id":"wi-stub-id"}}'
+      if [ "\${TEST_ADD_REFUSE:-0}" = "1" ]; then
+        # Mirrors the real api_call on a 4xx: error envelope on stderr, exit 1.
+        echo '{"error":true,"status":409,"details":{"success":false,"error":"APP-3 is already being worked in WorkItem wi-9","code":"project_ticket_refused"}}' >&2
+        return 1
+      elif [ "\${TEST_ADD_TICKET:-0}" = "1" ]; then
+        echo '{"success":true,"data":{"id":"wi-stub-id","projectTicket":{"id":"APP-4","status":"in_progress","projectPath":"/p","project":"App","created":true}}}'
+      else
+        echo '{"success":true,"data":{"id":"wi-stub-id"}}'
+      fi
       ;;
     /task-pool/claim)
       if [ "\${TEST_CLAIM_FAIL:-0}" = "1" ]; then
@@ -386,6 +394,41 @@ else
 fi
 assert_log_contains "add still fires without a quoted Request" "POST /task-pool/add"
 
+# ---------------------------------------------------------------------------
+# Test 9: delegation through project tickets (spec 2026-09-28 §11)
+# ---------------------------------------------------------------------------
+echo ""
+echo "=== ORC delegate-task — project tickets ==="
+> "$CALL_LOG"
+OUT=$(CALL_LOG="$CALL_LOG" CREWLY_ROOT=/tmp/crewly-test CREWLY_SESSION_NAME=crewly-orc \
+  bash "${SKILL_PARENT}/delegate-task/execute.sh" --to crewly-test-bob --task "Ship it" --ticket APP-3 --fallback-minutes 0 2>&1 || true)
+assert_log_contains "--ticket travels as projectTicketId" '"projectTicketId": "APP-3"'
+assert_log_contains "the delegator is stamped as metadata.delegatedBy" '"delegatedBy": "crewly-orc"'
+
+> "$CALL_LOG"
+OUT=$(CALL_LOG="$CALL_LOG" CREWLY_ROOT=/tmp/crewly-test TEST_ADD_TICKET=1 \
+  bash "${SKILL_PARENT}/delegate-task/execute.sh" --to crewly-test-bob --task "Ship it" --fallback-minutes 0 2>&1 || true)
+assert_output_contains "result names the ticket the work is tracked under" '"id": "APP-4"' "$OUT"
+if grep -q 'projectTicketId' "$CALL_LOG"; then
+  echo "  FAIL: projectTicketId sent without --ticket"; FAIL=$((FAIL + 1))
+else
+  echo "  PASS: no projectTicketId without --ticket"; PASS=$((PASS + 1))
+fi
+
+> "$CALL_LOG"
+set +e
+OUT=$(CALL_LOG="$CALL_LOG" CREWLY_ROOT=/tmp/crewly-test TEST_ADD_REFUSE=1 \
+  bash "${SKILL_PARENT}/delegate-task/execute.sh" --to crewly-test-bob --task "Ship it" --ticket APP-3 --fallback-minutes 0 2>/dev/null)
+RC=$?
+set -e
+if [ "$RC" -ne 0 ]; then echo "  PASS: a refused --ticket fails the skill"; PASS=$((PASS + 1)); else echo "  FAIL: refused --ticket exited 0"; FAIL=$((FAIL + 1)); fi
+assert_output_contains "the refusal reason is shown" 'already being worked' "$OUT"
+if grep -q "POST /task-pool/claim" "$CALL_LOG"; then
+  echo "  FAIL: claim attempted after a refusal"; FAIL=$((FAIL + 1))
+else
+  echo "  PASS: nothing claimed after a refusal"; PASS=$((PASS + 1))
+fi
+
 # --- Summary ---
 echo ""
 echo "=== Results: $PASS passed, $FAIL failed ==="

package/config/skills/registry.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 2,
-  "lastUpdated": "2026-09-25T15:19:59.383Z",
+  "lastUpdated": "2026-09-29T01:47:07.718Z",
   "cdnBaseUrl": "https://raw.githubusercontent.com/stevehuang0115/crewly/main",
   "source": "github",
   "items": [
@@ -903,12 +903,12 @@
       "downloads": 0,
       "rating": 0,
       "createdAt": "2026-02-22T23:57:06.027Z",
-      "updatedAt": "2026-09-25T15:19:59.383Z",
+      "updatedAt": "2026-09-29T01:43:29.904Z",
       "source": "config/skills/agent/marketplace/nano-banana-image",
       "assets": {
         "archive": "config/skills/agent/marketplace/nano-banana-image",
         "checksum": "",
-        "sizeBytes": 4048
+        "sizeBytes": 3944
       },
       "metadata": {
         "skillType": "claude-skill",
@@ -923,7 +923,6 @@
           "ai image"
         ],
         "files": [
-          ".env",
           ".env.example",
           "generate.sh",
           "SKILL.md"
@@ -1407,6 +1406,58 @@
         ]
       }
     },
+    {
+      "id": "seo-ops",
+      "type": "skill",
+      "name": "SEO Ops",
+      "description": "Search Console-driven SEO operations for any site: query patterns (low-CTR top-3, near-miss 4-20, rising queries, keyword cannibalization), per-URL report cards, pre-publish SEO/AEO checks, a gated programmatic-page queue, and a live-diff gate that stops agents from removing things from live pages. Use when auditing organic search, deciding what to rewrite, or before changing a live page. For writing posts use seo-blog-writer instead.",
+      "author": "Crewly",
+      "version": "1.0.0",
+      "category": "development",
+      "tags": [
+        "seo",
+        "aeo",
+        "search-console",
+        "marketing",
+        "content"
+      ],
+      "license": "MIT",
+      "downloads": 0,
+      "rating": 0,
+      "createdAt": "2026-09-29T01:43:29.904Z",
+      "updatedAt": "2026-09-29T01:47:07.718Z",
+      "source": "config/skills/agent/marketplace/seo-ops",
+      "assets": {
+        "archive": "config/skills/agent/marketplace/seo-ops",
+        "checksum": "",
+        "sizeBytes": 95495
+      },
+      "metadata": {
+        "skillType": "claude-skill",
+        "assignableRoles": [
+          "marketing",
+          "content-strategist",
+          "generalist",
+          "developer",
+          "fullstack-dev"
+        ],
+        "triggers": [
+          "seo report",
+          "search console",
+          "keyword cannibalization",
+          "pre-publish seo check",
+          "programmatic seo pages",
+          "live page diff"
+        ],
+        "files": [
+          "execute.sh",
+          "pattern-template.example.md",
+          "seo_ops.py",
+          "seo-ops.config.example.json",
+          "SKILL.md"
+        ]
+      }
+    },
     {
       "id": "social-media-post",
       "type": "skill",

package/config/skills/team-leader/delegate-task/SKILL.md

@@ -48,6 +48,24 @@ Assigns a task to a worker within the Team Leader's subordinate scope. Validates
 | `--tl-member` | `tlMemberId` | No | TL's member ID for hierarchy validation |
 | `--from` | `fromSession` | No | Delegating TL's session name (for monitoring) |
 | `--request-id` / `-R` | `requestId` | No | Ticket this work is for: the id (or `TKT-123`) from the `[TICKET:TKT-123 <id>]` line of the message you are acting on. Omit it and the task is still linked when your current turn has exactly one ticket |
+| `--ticket` | `ticket` | No | Project ticket this work is for (e.g. `APP-12`). Without it a ticket is created for you when the target works on a project — see Project tickets |
+
+## Project tickets
+
+Work for a teammate on a project always runs through a project ticket
+(`<project>/.crewly/tickets/`, spec `2026-09-28-project-tickets.md` §11):
+
+- `--ticket APP-12` — that ticket (must be `backlog` or `ready`, with no other
+  live WorkItem) is assigned to `--to` and this WorkItem becomes its work. A
+  ticket that is already being worked, done, cancelled or unknown is refused:
+  nothing is delivered and the reason is printed.
+- no `--ticket` — a ticket is created from this delegation (title, brief,
+  the target's team, priority) and set `in_progress` for the target. The
+  output names it (`projectTicket`).
+
+No ticket is made for work you target at yourself, review/verify items,
+system or scheduled items, or targets whose team has no project. Work already
+in flight without a ticket: `project-tickets link --project P --id APP-12 --work-item <id>`.
 
 ## Request Contract check
 

package/config/skills/team-leader/delegate-task/execute.sh

@@ -17,6 +17,7 @@ TEAM_ID=""
 TL_MEMBER_ID=""
 FROM_SESSION=""
 REQUEST_ID=""
+PROJECT_TICKET=""
 
 # Detect legacy JSON argument
 if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
@@ -36,9 +37,11 @@ while [[ $# -gt 0 ]]; do
     --tl-member)   TL_MEMBER_ID="$2";   shift 2 ;;
     --from)        FROM_SESSION="$2";   shift 2 ;;
     --request-id|-R) REQUEST_ID="$2";   shift 2 ;;
+    --ticket)      PROJECT_TICKET="$2"; shift 2 ;;
     --json|-j)     INPUT_JSON="$2";     shift 2 ;;
     --help|-h)
-      echo "Usage: execute.sh --to worker-session --task 'implement feature' --priority high --project /path [--team teamId] [--tl-member memberId] [--request-id <ticket id from the [TICKET:TKT-123 <id>] line>]"
+      echo "Usage: execute.sh --to worker-session --task 'implement feature' --priority high --project /path [--team teamId] [--tl-member memberId] [--request-id <ticket id from the [TICKET:TKT-123 <id>] line>] [--ticket <project ticket id, e.g. APP-12>]"
+      echo "Work for a teammate on a project always runs through a project ticket: --ticket uses that backlog/ready ticket, otherwise one is created for you."
       exit 0
       ;;
     --)            shift; break ;;
@@ -75,6 +78,7 @@ if [ -n "$INPUT_JSON" ]; then
   [ -z "$TL_MEMBER_ID" ] && TL_MEMBER_ID=$(printf '%s' "$INPUT" | jq -r '.tlMemberId // empty')
   [ -z "$FROM_SESSION" ] && FROM_SESSION=$(printf '%s' "$INPUT" | jq -r '.fromSession // empty')
   [ -z "$REQUEST_ID" ] && REQUEST_ID=$(printf '%s' "$INPUT" | jq -r '.requestId // empty')
+  [ -z "$PROJECT_TICKET" ] && PROJECT_TICKET=$(printf '%s' "$INPUT" | jq -r '.ticket // .projectTicketId // empty')
 fi
 
 require_param "to (--to)" "$TO"
@@ -212,15 +216,38 @@ POOL_BODY=$(jq -n \
   --arg priority "$WI_PRIORITY" \
   --arg projectPath "${PROJECT_PATH:-}" \
   --arg requestId "${REQUEST_ID:-}" \
-  '{type: $type, owner: $owner, target: $target, title: $title, description: $description, briefMarkdown: $briefMarkdown, metadata: ({priority: $priority, directDelivery: true} + (if $projectPath != "" then {projectPath: $projectPath} else {} end))} + (if $requestId != "" then {requestId: $requestId} else {} end)')
+  --arg projectTicketId "${PROJECT_TICKET:-}" \
+  --arg delegatedBy "${CREWLY_SESSION_NAME:-${FROM_SESSION:-}}" \
+  '{type: $type, owner: $owner, target: $target, title: $title, description: $description, briefMarkdown: $briefMarkdown, metadata: ({priority: $priority, directDelivery: true} + (if $projectPath != "" then {projectPath: $projectPath} else {} end) + (if $delegatedBy != "" then {delegatedBy: $delegatedBy} else {} end))} + (if $requestId != "" then {requestId: $requestId} else {} end) + (if $projectTicketId != "" then {projectTicketId: $projectTicketId} else {} end)')
 # metadata.directDelivery: this script delivers the brief itself (below), so
 # the backend's workitem:queued push holds off and only fires if that
 # delivery never lands — the task reaches the worker once.
-
-POOL_RESULT=$(api_call POST "/task-pool/add" "$POOL_BODY" 2>/dev/null || echo '{"success":false}')
+# projectTicketId / metadata.delegatedBy: work for a teammate on a project runs
+# through a project ticket (specs/2026-09-28-project-tickets.md §11). The
+# backend uses --ticket, or creates a ticket and links this WorkItem to it.
+
+POOL_ERR_FILE="$(mktemp)"
+POOL_RESULT=$(api_call POST "/task-pool/add" "$POOL_BODY" 2>"$POOL_ERR_FILE" || echo '{"success":false}')
+POOL_ERR="$(cat "$POOL_ERR_FILE" 2>/dev/null || true)"
+rm -f "$POOL_ERR_FILE"
 POOL_OK=$(echo "$POOL_RESULT" | jq -r '.success // "false"' 2>/dev/null)
 TASK_ID=$(echo "$POOL_RESULT" | jq -r '.data.id // .workItemId // empty' 2>/dev/null || true)
 
+# A refusal by the project-ticket rules (e.g. --ticket already being worked,
+# done, or unknown) means the delegation must NOT go out: stop here instead
+# of the deliver-anyway path below.
+if [ "$POOL_OK" != "true" ] && printf '%s' "$POOL_ERR" | grep -q 'project_ticket_refused'; then
+  REFUSAL=$(printf '%s' "$POOL_ERR" | grep 'project_ticket_refused' | tail -1 | jq -r '.details.error // empty' 2>/dev/null || true)
+  jq -n --arg error "${REFUSAL:-Delegation refused by the project-ticket rules}" --arg to "$TO" --arg ticket "${PROJECT_TICKET:-}" \
+    '{success: false, error: $error, to: $to, hint: "Nothing was delivered. Fix the ticket (project-tickets show / update --status ready) or delegate without --ticket."} + (if $ticket != "" then {ticket: $ticket} else {} end)'
+  exit 1
+fi
+
+TICKET_INFO=$(echo "$POOL_RESULT" | jq -c '.data.projectTicket // empty' 2>/dev/null || true)
+if [ -n "$TICKET_INFO" ]; then
+  echo "$TICKET_INFO" | jq -c '{projectTicket: ., info: ("Tracked as project ticket " + .id + " (" + .status + (if .created then ", created for this delegation" else "" end) + ")")}'
+fi
+
 # The delivered text names the WorkItem id: the worker needs it for
 # report-status, and after a fresh-conversation clear the backend finds the
 # new conversation by it. The deliver body carries it too (workItemId), so

package/config/skills/team-leader/delegate-task/execute.test.sh

@@ -662,6 +662,65 @@ else
   PASS=$((PASS + 1))
 fi
 
+# -----------------------------------------------------------------------
+# Scenario 24: delegation through project tickets (spec 2026-09-28 §11).
+#
+# Runs a COPY of the real execute.sh next to a lib.sh whose api_call is
+# stubbed (the same layout trick as the ORC delegate-task test), so the
+# production --ticket handling is exercised verbatim.
+# -----------------------------------------------------------------------
+echo "Scenario 24: --ticket, the ticket report, and a refused ticket"
+TK_PARENT=$(mktemp -d)
+TK_LOG=$(mktemp)
+mkdir -p "$TK_PARENT/_common" "$TK_PARENT/delegate-task"
+cat > "$TK_PARENT/_common/lib.sh" <<LIBEOF
+source "$(cd "$SCRIPT_DIR/../.." && pwd)/_common/lib.sh"
+api_call() {
+  local method="\$1" path="\$2" body="\${3:-}"
+  printf '%s %s %s\n' "\$method" "\$path" "\$(printf '%s' "\$body" | tr -d '\n')" >> "$TK_LOG"
+  case "\$path" in
+    /task-pool/add)
+      if [ "\${TEST_ADD_REFUSE:-0}" = "1" ]; then
+        echo '{"error":true,"status":409,"details":{"success":false,"error":"CE-2 is already being worked in WorkItem wi-9","code":"project_ticket_refused"}}' >&2
+        return 1
+      fi
+      echo '{"success":true,"data":{"id":"wi-tl","projectTicket":{"id":"CE-14","status":"in_progress","projectPath":"/p","project":"ce-core","created":true}}}'
+      ;;
+    *) echo '{"success":true}' ;;
+  esac
+}
+LIBEOF
+cp "$SKILL_DIR/execute.sh" "$TK_PARENT/delegate-task/execute.sh"
+
+OUT=$(CREWLY_SESSION_NAME=ce-owen bash "$TK_PARENT/delegate-task/execute.sh" --to ce-vera --task "Goal: a. Expected Outcome: b. Eval Criteria: c." --ticket CE-9 2>/dev/null || true)
+if grep -q '"projectTicketId": *"CE-9"' "$TK_LOG" && grep -q '"delegatedBy": *"ce-owen"' "$TK_LOG"; then
+  echo "  PASS: --ticket and the delegator travel to /task-pool/add"; PASS=$((PASS + 1))
+else
+  echo "  FAIL: projectTicketId/delegatedBy missing: $(cat "$TK_LOG")"; FAIL=$((FAIL + 1))
+fi
+if printf '%s' "$OUT" | grep -q 'Tracked as project ticket CE-14'; then
+  echo "  PASS: output names the project ticket"; PASS=$((PASS + 1))
+else
+  echo "  FAIL: no ticket line in output: $OUT"; FAIL=$((FAIL + 1))
+fi
+
+: > "$TK_LOG"
+set +e
+OUT=$(TEST_ADD_REFUSE=1 CREWLY_SESSION_NAME=ce-owen bash "$TK_PARENT/delegate-task/execute.sh" --to ce-vera --task "Goal: a. Expected Outcome: b. Eval Criteria: c." --ticket CE-2 2>/dev/null)
+RC=$?
+set -e
+if [ "$RC" -ne 0 ] && printf '%s' "$OUT" | grep -q 'already being worked'; then
+  echo "  PASS: a refused --ticket fails with the reason"; PASS=$((PASS + 1))
+else
+  echo "  FAIL: refused --ticket: rc=$RC out=$OUT"; FAIL=$((FAIL + 1))
+fi
+if grep -q '/deliver' "$TK_LOG"; then
+  echo "  FAIL: the brief was delivered despite the refusal"; FAIL=$((FAIL + 1))
+else
+  echo "  PASS: nothing delivered after a refusal"; PASS=$((PASS + 1))
+fi
+rm -rf "$TK_PARENT" "$TK_LOG"
+
 # Cleanup
 rm -f "$REAL_FN_FILE"
 rm -rf "$MOCK_DIR"