crewly 1.20.186 → 1.20.188

package/config/skills/agent/core/project-tickets/SKILL.md

@@ -177,14 +177,15 @@ answered.
 ```bash
 bash execute.sh autopilot --project P                       # show settings + status
 bash execute.sh autopilot --project P --on                  # switch on (the owner said so)
-bash execute.sh autopilot --project P --on --daily-budget 20 --max-in-flight 1
+bash execute.sh autopilot --project P --on --daily-budget 20M --max-in-flight 1   # budget in tokens
 bash execute.sh autopilot --project P --driver <lead session>   # or --driver default
 bash execute.sh autopilot --project P --off
 ```
 
 Off by default. While on, Crewly wakes the project's team lead to triage the
 backlog when someone on the team is idle (make tickets ready and assign them,
-split, ask the owner, or cancel), pauses for the day at the daily budget, and
+split, ask the owner, or cancel), pauses for the day at the daily token budget
+(input incl. cached + output; a usage boost on the team raises it for the day), and
 sends the owner the batched questions plus one evening digest. Only switch it
 on when the owner asked for it. Refused for anyone but the owner and the
 orchestrator.

package/config/skills/agent/core/project-tickets/execute.sh

@@ -22,7 +22,7 @@
 #                                                                               (owner / orc / lead / assignee)
 #   bash execute.sh ask-owner --project P --id APP-12 --clear [--note "answer"]
 #   bash execute.sh autopilot --project P [--on|--off] [--driver <session>|--driver default]
-#                             [--daily-budget <usd>] [--max-in-flight <n>]      (owner / orchestrator)
+#                             [--daily-budget <tokens, e.g. 20M>] [--max-in-flight <n>]      (owner / orchestrator)
 #   bash execute.sh '{"action":"create","project":"P","title":"…"}'
 #
 # P = project id, name, or absolute path.
@@ -58,7 +58,7 @@ Usage:
   bash execute.sh ask-owner --project P --id APP-12 --clear [--note "answer"]
                                                               The owner answered: remove the needs-owner mark
   bash execute.sh autopilot --project P [--on|--off] [--driver <session>|default]
-                          [--daily-budget <usd>] [--max-in-flight <n>]
+                          [--daily-budget <tokens, e.g. 20M>] [--max-in-flight <n>]
                                                               Owner / orchestrator: show or change the ticket
                                                               autopilot (no flags = show)
 
@@ -102,7 +102,7 @@ if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
   SENSITIVE=$(printf '%s' "$J" | jq -r '.sensitive // empty')
   AP_ENABLED=$(printf '%s' "$J" | jq -r 'if (.enabled|type) == "boolean" then (.enabled|tostring) else empty end')
   AP_DRIVER=$(printf '%s' "$J" | jq -r '.driver // empty')
-  AP_BUDGET=$(printf '%s' "$J" | jq -r '.dailyBudgetUsd // empty')
+  AP_BUDGET=$(printf '%s' "$J" | jq -r '.dailyBudgetTokens // empty')
   AP_MAX=$(printf '%s' "$J" | jq -r '.maxInFlightPerMember // empty')
 fi
 if [[ -z "$ACTION" && $# -gt 0 && ${1:0:1} != '-' ]]; then ACTION="$1"; shift; fi
@@ -257,7 +257,7 @@ case "$ACTION" in
         '{}
          + (if $enabled != "" then {enabled: ($enabled == "true")} else {} end)
          + (if $driver == "default" then {driver: null} elif $driver != "" then {driver: $driver} else {} end)
-         + (if $budget == "default" then {dailyBudgetUsd: null} elif $budget != "" then {dailyBudgetUsd: ($budget | tonumber? // $budget)} else {} end)
+         + (if $budget == "default" then {dailyBudgetTokens: null} elif $budget != "" then {dailyBudgetTokens: ($budget | tonumber? // $budget)} else {} end)
          + (if $max == "default" then {maxInFlightPerMember: null} elif $max != "" then {maxInFlightPerMember: ($max | tonumber? // $max)} else {} end)')
       api_call POST "/project-ticket-autopilot/$(enc "$PROJECT")" "$BODY" | jq '{success, autopilot: .data}'
     fi

package/config/skills/agent/core/project-tickets/execute.test.sh

@@ -139,9 +139,9 @@ check "ask-owner: missing question" "$(run_err ask-owner --project p1 --id APP-1
 OUT=$(run autopilot --project p1)
 check "autopilot show: GET" "$(last '[.method, .path] | tostring')" '["GET","/api/project-ticket-autopilot/p1"]'
 check "autopilot show: output" "$(printf '%s' "$OUT" | jq -c '.autopilot.settings')" '{"enabled":false}'
-run autopilot --project p1 --on --daily-budget 12.5 --max-in-flight 2 >/dev/null
+run autopilot --project p1 --on --daily-budget 12.5M --max-in-flight 2 >/dev/null
 check "autopilot on: POST" "$(last '[.method, .path] | tostring')" '["POST","/api/project-ticket-autopilot/p1"]'
-check "autopilot on: body" "$(last '.body | tostring')" '{"enabled":true,"dailyBudgetUsd":12.5,"maxInFlightPerMember":2}'
+check "autopilot on: body" "$(last '.body | tostring')" '{"enabled":true,"dailyBudgetTokens":"12.5M","maxInFlightPerMember":2}'
 run autopilot --project p1 --off --driver default >/dev/null
 check "autopilot off: body" "$(last '.body | tostring')" '{"enabled":false,"driver":null}'
 run '{"action":"autopilot","project":"p1","enabled":true,"driver":"ce-owen"}' >/dev/null

package/config/skills/agent/core/remember/SKILL.md

@@ -49,6 +49,7 @@ Store a memory entry for future recall. Use this to persist important context, d
 | `--category` / `-C` | `category` | Yes | See category × scope matrix below |
 | `--scope` / `-s` | `scope` | Yes | Scope: `agent` or `project` |
 | `--project` / `-p` | `projectPath` | No | Project path (required for `project` scope) |
+| `--supersedes` | `supersedes` | No | Decision id(s) this decision replaces, comma-separated (`dec:<id>`). When a decision changes an earlier one, always pass it: the old entry is marked superseded and leaves the standing answers. |
 
 ### Valid `category` × `scope` matrix
 

package/config/skills/agent/core/remember/execute.sh

@@ -31,6 +31,8 @@ Options:
                       'workflow' is NOT a public category — use 'pattern' instead.
   --scope    | -s   Scope: project or agent (required)
   --project  | -p   Project path (required for project scope)
+  --supersedes      Decision id(s) this decision replaces, comma-separated
+                    (e.g. "dec:03ce4dda"); they leave standing answers (#884)
   --json     | -j   Raw JSON payload
   --help     | -h   Show this help
 EOF_USAGE
@@ -42,6 +44,7 @@ CONTENT=""
 CATEGORY=""
 SCOPE=""
 PROJECT_PATH=""
+SUPERSEDES=""
 
 # Detect legacy JSON argument
 if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
@@ -75,6 +78,10 @@ while [[ $# -gt 0 ]]; do
       PROJECT_PATH="$2"
       shift 2
       ;;
+    --supersedes)
+      SUPERSEDES="$2"
+      shift 2
+      ;;
     --json|-j)
       INPUT_JSON="$2"
       shift 2
@@ -116,6 +123,7 @@ if [ -n "$INPUT_JSON" ]; then
   [ -z "$CATEGORY" ] && CATEGORY=$(printf '%s' "$INPUT" | jq -r '.category // empty')
   [ -z "$SCOPE" ] && SCOPE=$(printf '%s' "$INPUT" | jq -r '.scope // empty')
   [ -z "$PROJECT_PATH" ] && PROJECT_PATH=$(printf '%s' "$INPUT" | jq -r '.projectPath // empty')
+  [ -z "$SUPERSEDES" ] && SUPERSEDES=$(printf '%s' "$INPUT" | jq -r '(.supersedes // .metadata.supersedes // empty) | if type == "array" then join(",") else . end')
 fi
 
 require_param "agentId (--agent)" "$AGENT_ID"
@@ -143,4 +151,8 @@ else
 fi
 unset _MEM_AGENT _MEM_CONTENT _MEM_CATEGORY _MEM_SCOPE
 
+if [ -n "$SUPERSEDES" ]; then
+  BODY=$(printf '%s' "$BODY" | jq --arg s "$SUPERSEDES" '. + {metadata: {supersedes: ($s | split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length > 0)))}}')
+fi
+
 api_call POST "/memory/remember" "$BODY"

package/config/skills/agent/core/report-status/SKILL.md

@@ -57,7 +57,7 @@ Pass the `workItemId` of the work you are reporting on (from your `[CREWLY-DISPA
 | `--task-id` | `taskId` | No | Task ID (for structured StatusReport format) |
 | `--progress` | `progress` | No | Progress percentage 0-100 |
 | `--structured` | `structured` | No | Use structured StatusReport format |
-| `--work-item-id` / `--wi-id` | `workItemId` | **Pass this when `status=done`** | Which WorkItem to complete. See below — without it the skill infers, and refuses when the choice is ambiguous |
+| `--work-item-id` / `--wi-id` | `workItemId` | **Pass this when `status` is `done`, `blocked` or `failed`** | Which WorkItem to complete, block or fail. See below — without it the skill infers, and refuses when the choice is ambiguous |
 
 ## This skill COMPLETES a WorkItem, not just reports
 
@@ -84,6 +84,12 @@ had never happened.
 If the completion itself fails, the skill says so explicitly — a reported
 status never implies the WorkItem actually closed.
 
+**`blocked` and `failed` move the WorkItem too**, with the same resolution
+order: the item is marked `blocked` (claim released, it waits until someone
+unblocks it) or `failed`, your summary is stored on it as the reason, and its
+team lead is told. Pass `workItemId` here as well; with several items running
+the skill refuses instead of guessing.
+
 ## Examples — CLI Flags (preferred)
 
 ```bash

package/config/skills/agent/core/report-status/execute.sh

@@ -311,6 +311,47 @@ if [ "$STATUS" = "done" ]; then
   fi
 fi
 
+# A blocked or failed report moves the WorkItem too (#842). It used to reach
+# only the orchestrator's chat: the WorkItem stayed `running` with its claim
+# held, the team lead got no task:blocked / task:failed event, and the reason
+# lived only in a chat message. Same resolution rules as `done` above:
+# explicit workItemId, else the single running item, else refuse.
+if [ "$STATUS" = "blocked" ] || [ "$STATUS" = "failed" ]; then
+  STOP_WI_ID="${WORK_ITEM_ID:-}"
+  STOP_RESOLUTION="explicit"
+
+  if [ -z "$STOP_WI_ID" ]; then
+    POOL_RESP=$(api_call_full GET "/task-pool/items?status=running&target=${SESSION_NAME}" 2>/dev/null || echo '{}')
+    RUNNING_IDS=$(printf '%s' "$POOL_RESP" | jq -r '((.workItems // .data // []) | map(.id)) | .[]' 2>/dev/null || true)
+    RUNNING_COUNT=$(printf '%s' "$RUNNING_IDS" | grep -c . || true)
+
+    if [ "$RUNNING_COUNT" -gt 1 ]; then
+      CANDIDATES=$(printf '%s' "$RUNNING_IDS" | tr '\n' ' ')
+      error_exit "Status reported, but report-status will not guess which WorkItem is ${STATUS}: ${RUNNING_COUNT} are running for ${SESSION_NAME} (${CANDIDATES}). Run it again with workItemId so the right item is marked ${STATUS} and its team lead is told."
+    fi
+
+    STOP_WI_ID=$(printf '%s' "$RUNNING_IDS" | head -1)
+    STOP_RESOLUTION="inferred"
+  fi
+
+  if [ -n "$STOP_WI_ID" ]; then
+    if [ "$STATUS" = "blocked" ]; then
+      STOP_BODY=$(jq -n --arg agentId "$SESSION_NAME" --arg reason "$SUMMARY" '{agentId: $agentId, reason: $reason}')
+      STOP_PATH="/task-pool/block/${STOP_WI_ID}"
+    else
+      STOP_BODY=$(jq -n --arg agentId "$SESSION_NAME" --arg error "$SUMMARY" '{agentId: $agentId, error: $error}')
+      STOP_PATH="/task-pool/fail/${STOP_WI_ID}"
+    fi
+    if STOP_RESULT=$(api_call POST "$STOP_PATH" "$STOP_BODY" 2>&1); then
+      jq -n --arg id "$STOP_WI_ID" --arg how "$STOP_RESOLUTION" --arg status "$STATUS" \
+        '{workItem: $id, markedAs: $status, resolvedBy: $how}' >&2
+    else
+      jq -n --arg id "$STOP_WI_ID" --arg err "$STOP_RESULT" --arg status "$STATUS" \
+        '{warning: ("status reported, but marking the WorkItem " + $status + " FAILED — it is still open"), workItemId: $id, error: $err}' >&2
+    fi
+  fi
+fi
+
 # record_task_learning <label> <summary>
 #
 # Records the report as a project learning via POST /memory/record-learning.

package/config/skills/agent/core/slack-post/SKILL.md

@@ -111,6 +111,7 @@ two are told apart. Write ids exactly as Slack shows them.
 | `--text` | `-m` | Message text (required unless piped or `--text-file`) |
 | `--text-file` | | Read the text from a file |
 | `--thread` | `-t` | Slack thread timestamp to reply inside, or the `[SLACK-THREAD:<key>]` key from your prompt |
+| `--new-topic` | | A new top-level message. Use it for scheduled output (a briefing, a triage summary): without it, a post into a conversation where you still owe an answer from the last 30 minutes goes into that thread as the answer |
 | `--json` | `-j` | Raw JSON payload |
 
 ## Environment

package/config/skills/agent/core/slack-post/execute.sh

@@ -12,7 +12,7 @@ source "${SCRIPT_DIR}/../../_common/lib.sh"
 print_usage() {
   cat <<'EOF_USAGE'
 Usage:
-  bash execute.sh --target <#channel|@user|C…|D…|U…> --text "message" [--thread <ts>]
+  bash execute.sh --target <#channel|@user|C…|D…|U…> --text "message" [--thread <ts> | --new-topic]
 
   echo "message" | bash execute.sh --target "#general"
   bash execute.sh --target "@steve" --text-file /tmp/report.md
@@ -23,6 +23,7 @@ Options:
   --text      | -m   Message text (required unless piped or --text-file)
   --text-file        Read the message text from a file
   --thread    | -t   Slack thread timestamp to reply inside
+  --new-topic        A new top-level post (scheduled output), never an answer to an open question
   --json      | -j   Raw JSON payload
   --help      | -h   Show this help
 EOF_USAGE
@@ -32,6 +33,7 @@ INPUT_JSON=""
 TARGET=""
 TEXT=""
 THREAD_TS=""
+NEW_TOPIC=""
 
 # Legacy JSON as the first positional argument
 if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
@@ -45,6 +47,7 @@ while [[ $# -gt 0 ]]; do
     --text|-m) TEXT="$2"; shift 2 ;;
     --text-file) TEXT="$(cat "$2")"; shift 2 ;;
     --thread|-t) THREAD_TS="$2"; shift 2 ;;
+    --new-topic) NEW_TOPIC="1"; shift ;;
     --json|-j) INPUT_JSON="$2"; shift 2 ;;
     --help|-h) print_usage; exit 0 ;;
     *) echo "Unknown argument: $1" >&2; print_usage >&2; exit 2 ;;
@@ -65,6 +68,7 @@ except Exception as e:
     print("PARSE_ERROR:" + str(e)); sys.exit(0)
 print("TARGET=" + str(d.get("target", "")))
 print("THREAD=" + str(d.get("threadTs", d.get("thread", ""))))
+print("NEW_TOPIC=" + ("1" if d.get("newTopLevel") is True else ""))
 print("TEXT_B64=" + base64.b64encode(str(d.get("text", "")).encode("utf-8")).decode("ascii"))
 ')
   if echo "$EXTRACTED" | grep -q '^PARSE_ERROR'; then
@@ -75,6 +79,7 @@ print("TEXT_B64=" + base64.b64encode(str(d.get("text", "")).encode("utf-8")).dec
     case "$line" in
       TARGET=*) [ -z "$TARGET" ] && TARGET="${line#TARGET=}" ;;
       THREAD=*) [ -z "$THREAD_TS" ] && THREAD_TS="${line#THREAD=}" ;;
+      NEW_TOPIC=*) [ -z "$NEW_TOPIC" ] && NEW_TOPIC="${line#NEW_TOPIC=}" ;;
       TEXT_B64=*) [ -z "$TEXT" ] && TEXT="$(echo "${line#TEXT_B64=}" | base64 -d 2>/dev/null)" ;;
     esac
   done <<< "$EXTRACTED"
@@ -96,12 +101,14 @@ fi
 # Convert literal \n to real newlines, matching the other comm skills
 _NL=$'\n'; TEXT="${TEXT//\\n/$_NL}"
 
-BODY=$(TARGET="$TARGET" TEXT="$TEXT" THREAD_TS="$THREAD_TS" python3 -c '
+BODY=$(TARGET="$TARGET" TEXT="$TEXT" THREAD_TS="$THREAD_TS" NEW_TOPIC="$NEW_TOPIC" python3 -c '
 import json, os
 p = {"target": os.environ["TARGET"], "text": os.environ["TEXT"]}
 ts = os.environ.get("THREAD_TS", "")
 if ts:
     p["threadTs"] = ts
+elif os.environ.get("NEW_TOPIC"):
+    p["newTopLevel"] = True
 print(json.dumps(p))
 ')
 

package/config/skills/team-leader/_common/lib.sh

@@ -2,3 +2,48 @@
 # Team Leader Skills Common Library - delegates to shared library
 SHARED_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/_common"
 source "${SHARED_LIB_DIR}/lib.sh"
+
+# tl_require_member_scope <team-json> <member-id> <tl-member-id>
+#
+# Exits with an error unless the team lead may start or stop the member.
+# Allowed when:
+#   1. the member reports to this lead (parentMemberId == tlMemberId), or
+#   2. the member has no parent at all, and this lead is a leader of the same
+#      team (listed in leaderIds/leaderId, or canDelegate on its member record).
+# Refused: members of another team (not in <team-json>), members whose parent
+# is someone else, and any lead that does not lead this team.
+#
+# Rule 2 exists because many teams were created without a hierarchy: every
+# Marketing member had parentMemberId=null, so the lead could not start a
+# single one of its own members and the orchestrator had to (#930).
+tl_require_member_scope() {
+  local team_json="$1" member_id="$2" tl_member_id="$3"
+  local verdict
+  verdict=$(printf '%s' "$team_json" | jq -r --arg mid "$member_id" --arg tl "$tl_member_id" '
+    (.data // .) as $team
+    | ($team.members // []) as $members
+    | ($members | map(select(.id == $mid)) | first) as $member
+    | ($members | map(select(.id == $tl)) | first) as $lead
+    | (($team.leaderIds // []) + (if $team.leaderId then [$team.leaderId] else [] end)) as $leaders
+    | if $member == null then "not_found"
+      elif ($member.parentMemberId // "") == $tl then "ok"
+      elif ($member.parentMemberId // "") != "" then "other_parent:" + $member.parentMemberId
+      elif $lead == null then "not_in_team"
+      elif (($leaders | index($tl)) != null) or ($lead.canDelegate == true) then "ok"
+      else "not_leader"
+      end' 2>/dev/null || echo "unreadable")
+
+  case "$verdict" in
+    ok) return 0 ;;
+    not_found)
+      error_exit "Member ${member_id} is not in this team. A team lead can only start or stop members of its own team." ;;
+    other_parent:*)
+      error_exit "Hierarchy violation: member ${member_id} (parentMemberId=${verdict#other_parent:}) reports to someone else, not to TL ${tl_member_id}" ;;
+    not_in_team)
+      error_exit "TL ${tl_member_id} is not a member of this team, so it cannot manage member ${member_id}" ;;
+    not_leader)
+      error_exit "Member ${member_id} has no parent, and TL ${tl_member_id} does not lead this team (not in leaderIds, canDelegate not set)" ;;
+    *)
+      error_exit "Could not read the team data to check whether TL ${tl_member_id} may manage member ${member_id}" ;;
+  esac
+}

package/config/skills/team-leader/start-agent/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: Start Agent (TL)
-description: "Start a worker agent within the Team Leader's subordinate scope. Validates that the target worker's parentMemberId matches the TL's memberId before starting."
+description: "Start a worker agent within the Team Leader's scope: a member whose parentMemberId is the TL, or a parentless member of a team the TL leads."
 version: 1.0.0
 category: management
 skillType: claude-skill
@@ -50,18 +50,18 @@ bash {{TL_SKILLS_PATH}}/start-agent/execute.sh '{"teamId":"{{TEAM_ID}}","memberI
 
 ## Hierarchy Validation
 
-The script fetches team data and validates:
-- The target member exists in the team
-- The member's `parentMemberId` matches the TL's `memberId`
+The script fetches team data and allows the start when:
+- the member's `parentMemberId` is the TL's `memberId` (a subordinate), or
+- the member has no `parentMemberId`, and the TL is a leader of the same team (listed in the team's `leaderIds`, or `canDelegate` on its own member record).
 
-If validation fails, the start is rejected with a hierarchy violation error. TLs can only start their own subordinates — not agents in other teams or under other TLs.
+It refuses members of other teams, members whose parent is someone else, and parentless members of a team the TL does not lead.
 
 ## Differences from Orchestrator start-agent
 
 | Aspect | Orchestrator | Team Leader |
 |--------|-------------|-------------|
 | Scope | Any agent in any team | Only subordinates |
-| Hierarchy check | None | Validates parentMemberId |
+| Hierarchy check | None | Subordinates, or parentless members of the TL's own team |
 | Extra parameter | None | `tlMemberId` required |
 
 ## Output

package/config/skills/team-leader/start-agent/execute.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 # Start a worker agent within this Team Leader's subordinate scope.
-# Validates hierarchy (worker.parentMemberId == TL.memberId) before starting.
+# Validates scope before starting.
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../_common/lib.sh"
@@ -23,17 +23,8 @@ if [ "$TEAM_SUCCESS" != "true" ]; then
   error_exit "Failed to fetch team data for team ${TEAM_ID}"
 fi
 
-# Find the target member and check parentMemberId
-WORKER_PARENT=$(echo "$TEAM_DATA" | jq -r --arg mid "$MEMBER_ID" \
-  '.data.members[] | select(.id == $mid) | .parentMemberId // empty' 2>/dev/null || true)
-
-if [ -z "$WORKER_PARENT" ]; then
-  error_exit "Member ${MEMBER_ID} not found in team ${TEAM_ID} or has no parentMemberId set"
-fi
-
-if [ "$WORKER_PARENT" != "$TL_MEMBER_ID" ]; then
-  error_exit "Hierarchy violation: member ${MEMBER_ID} (parentMemberId=${WORKER_PARENT}) is not a subordinate of TL ${TL_MEMBER_ID}"
-fi
+# The member must report to this TL, or be parentless in a team this TL leads (#930)
+tl_require_member_scope "$TEAM_DATA" "$MEMBER_ID" "$TL_MEMBER_ID"
 
 # Hierarchy validated — start the agent
 api_call POST "/teams/${TEAM_ID}/members/${MEMBER_ID}/start"

package/config/skills/team-leader/stop-agent/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: Stop Agent (TL)
-description: "Stop a worker agent within the Team Leader's subordinate scope. Validates that the target worker's parentMemberId matches the TL's memberId before stopping."
+description: "Stop a worker agent within the Team Leader's scope: a member whose parentMemberId is the TL, or a parentless member of a team the TL leads."
 version: 1.0.0
 category: management
 skillType: claude-skill
@@ -50,18 +50,18 @@ bash {{TL_SKILLS_PATH}}/stop-agent/execute.sh '{"teamId":"{{TEAM_ID}}","memberId
 
 ## Hierarchy Validation
 
-The script fetches team data and validates:
-- The target member exists in the team
-- The member's `parentMemberId` matches the TL's `memberId`
+The script fetches team data and allows the stop when:
+- the member's `parentMemberId` is the TL's `memberId` (a subordinate), or
+- the member has no `parentMemberId`, and the TL is a leader of the same team (listed in the team's `leaderIds`, or `canDelegate` on its own member record).
 
-If validation fails, the stop is rejected with a hierarchy violation error. TLs can only stop their own subordinates — not agents in other teams or under other TLs.
+It refuses members of other teams, members whose parent is someone else, and parentless members of a team the TL does not lead.
 
 ## Differences from Orchestrator stop-agent
 
 | Aspect | Orchestrator | Team Leader |
 |--------|-------------|-------------|
 | Scope | Any agent in any team | Only subordinates |
-| Hierarchy check | None | Validates parentMemberId |
+| Hierarchy check | None | Subordinates, or parentless members of the TL's own team |
 | Extra parameter | None | `tlMemberId` required |
 
 ## Output

package/config/skills/team-leader/stop-agent/execute.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 # Stop a worker agent within this Team Leader's subordinate scope.
-# Validates hierarchy (worker.parentMemberId == TL.memberId) before stopping.
+# Validates scope before stopping.
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../_common/lib.sh"
@@ -23,17 +23,8 @@ if [ "$TEAM_SUCCESS" != "true" ]; then
   error_exit "Failed to fetch team data for team ${TEAM_ID}"
 fi
 
-# Find the target member and check parentMemberId
-WORKER_PARENT=$(echo "$TEAM_DATA" | jq -r --arg mid "$MEMBER_ID" \
-  '.data.members[] | select(.id == $mid) | .parentMemberId // empty' 2>/dev/null || true)
-
-if [ -z "$WORKER_PARENT" ]; then
-  error_exit "Member ${MEMBER_ID} not found in team ${TEAM_ID} or has no parentMemberId set"
-fi
-
-if [ "$WORKER_PARENT" != "$TL_MEMBER_ID" ]; then
-  error_exit "Hierarchy violation: member ${MEMBER_ID} (parentMemberId=${WORKER_PARENT}) is not a subordinate of TL ${TL_MEMBER_ID}"
-fi
+# The member must report to this TL, or be parentless in a team this TL leads (#930)
+tl_require_member_scope "$TEAM_DATA" "$MEMBER_ID" "$TL_MEMBER_ID"
 
 # Hierarchy validated — stop the agent
 api_call POST "/teams/${TEAM_ID}/members/${MEMBER_ID}/stop"

package/dist/backend/backend/src/constants.d.ts

@@ -91,8 +91,8 @@ export declare const TICKET_AUTOPILOT_CONSTANTS: {
     readonly DIGEST_HOUR_LOCAL: 21;
     /** Max tickets named per digest section (the rest are counted) */
     readonly DIGEST_MAX_ITEMS_PER_SECTION: 8;
-    /** Default daily budget (USD) of the project's team agents when the owner sets none */
-    readonly DEFAULT_DAILY_BUDGET_USD: 20;
+    /** Default daily budget (tokens) of the project's team agents when the owner sets none */
+    readonly DEFAULT_DAILY_BUDGET_TOKENS: 20000000;
     /** Default and bounds of in-progress tickets per member */
     readonly DEFAULT_MAX_IN_FLIGHT_PER_MEMBER: 1;
     readonly MAX_IN_FLIGHT_PER_MEMBER_LIMIT: 5;
@@ -1205,6 +1205,9 @@ export declare const EVENT_BUS_CONSTANTS: {
     readonly EVENT_MESSAGE_PREFIX: "EVENT";
     /** Threshold for cleaning stale entries from recentPublishMap */
     readonly DEDUP_MAP_CLEANUP_THRESHOLD: 100;
+    /** How long a delivered event id is remembered per subscription, so a
+     *  replayed publish of the same event is not delivered twice (#926) */
+    readonly DELIVERED_EVENT_TTL_MS: number;
 };
 /**
  * Constants for Slack thread file storage.
@@ -1378,6 +1381,8 @@ export declare const STANDING_ANSWERS_CONSTANTS: {
     readonly BRIEF_MAX_ENTRIES: 30;
     /** Characters of each entry shown in a refresh brief. */
     readonly BRIEF_ENTRY_MAX_CHARS: 240;
+    /** Shared topic words that flag two same-day entries as a possible supersede pair (#884). */
+    readonly SUPERSEDE_MIN_SHARED_WORDS: 2;
     /** Refresh tick interval when CREWLY_WIKI_REFLECT_INTERVAL_MS is unset (the reflect default). */
     readonly REFRESH_INTERVAL_MS: number;
     /** Minimum time between two refresh WorkItems for the same page. */
@@ -1474,6 +1479,12 @@ export declare const SLACK_TYPING_CONSTANTS: {
     readonly TIMEOUT_MS: number;
     /** A timed-out placeholder is still removed by a reply arriving within this long (ms) */
     readonly EXPIRED_KEEP_MS: number;
+    /**
+     * A `slack-post` that names no thread answers an owed placeholder only if
+     * that placeholder went up this recently. Older ones belong to questions
+     * from another turn; a scheduled post was captured into those threads (#808).
+     */
+    readonly UNTHREADED_ANSWER_MAX_AGE_MS: number;
     /** A placeholder younger than this is not taken down when the turn ends (race with delivery) */
     readonly SETTLE_MIN_AGE_MS: number;
     /**
@@ -1825,6 +1836,8 @@ export declare const OWNER_MESSAGE_WATCHDOG_CONSTANTS: {
     readonly NOTE_SILENT_TEXT: "⏳ {name} got your message but hasn't replied in {waited} min; I've sent a reminder.";
     /** Shown in a note when a failed delivery left no error detail */
     readonly NOTE_UNKNOWN_DETAIL: "reason unknown";
+    /** The agent hit a daily token cap (specs/2026-10-02-spend-cap.md) */
+    readonly NOTE_SPEND_CAP_TEXT: "⏳ Still waiting on {name} — {name} hit its daily token cap ({cap}). Your message is kept and delivered when the cap resets at midnight or you boost it (reply `boost {who} by 10M today` or `unlimited today for {who}`).";
 };
 /**
  * The single `reply` entry point (specs/2026-09-30-owner-message-guarantee.md §B).
@@ -5118,6 +5131,8 @@ export declare const OPEN_ITEMS_CONSTANTS: {
     readonly DEFAULT_DUE_MS: number;
     /** The same words by the same agent this close together are one item (a reply recorded twice) (ms) */
     readonly DUPLICATE_WINDOW_MS: number;
+    /** The same agent's two promises this close together, about the same deliverable, are one (the newer stands) (ms) */
+    readonly PROMISE_DUPLICATE_WINDOW_MS: number;
     /** Max commitments and max questions taken from one reply */
     readonly MAX_ITEMS_PER_REPLY: 3;
     /** Max characters stored for an item's text */
@@ -5136,6 +5151,13 @@ export declare const OPEN_ITEMS_CONSTANTS: {
     readonly EXPIRE_AFTER_MS: number;
     /** Requests looked at by the sweep and the backfill: updated within (ms) */
     readonly LOOKBACK_MS: number;
+    /** The backfill only looks at promises and questions made within this long before it runs (ms) */
+    readonly BACKFILL_MAX_AGE_MS: number;
+    /**
+     * A post made up to this long before the child work's recorded finish still delivers it: a verify
+     * pass overwrites `completedAt` after the agent has already posted (ms)
+     */
+    readonly DELIVERY_FINISH_GRACE_MS: number;
     /** Sweep cadence (ms) */
     readonly SWEEP_INTERVAL_MS: number;
     /** An ask-owner decision this close in time to the reply, by the same agent, is the same question (ms) */
@@ -5165,6 +5187,96 @@ export declare const WORK_ITEM_DESTINATION_CONSTANTS: {
     /** The one line every prompt carries about where to answer */
     readonly PROMPT_LINE: "Answer where you were asked; a new topic goes in a new thread.";
 };
+/**
+ * Daily token caps with a hard stop, team caps and temporary boosts
+ * (specs/2026-10-02-spend-cap.md). The unit is TOKENS, not dollars (owner,
+ * 2026-10-02): total tokens = input (fresh + cached) + output — see
+ * `eventTokens` in token-usage.service. Caps are OFF until the owner sets
+ * one. All owner-facing text is English.
+ */
+export declare const SPEND_CAP_CONSTANTS: {
+    /** Caps + boosts + today's bookkeeping, under CREWLY_HOME (tokens) */
+    readonly STORE_FILE: "usage-caps.json";
+    /** The pre-token (USD) store; migrated once with USAGE_CONSTANTS.TOKENS_PER_USD */
+    readonly LEGACY_USD_STORE_FILE: "spend-caps.json";
+    /** Default / max window of GET /api/system/usage and /api/system/spend */
+    readonly DEFAULT_DAYS: 7;
+    readonly MAX_DAYS: 31;
+    /** Fraction of a cap that sends the one heads-up */
+    readonly WARN_FRACTION: 0.8;
+    /** Enforcement tick */
+    readonly TICK_MS: 60000;
+    /** How long the all-agents total is cached for the delivery gate */
+    readonly TOTAL_CACHE_MS: 15000;
+    /** How often the orc's held message queue re-checks the cap */
+    readonly QUEUE_RECHECK_MS: 60000;
+    /** The "Boost +X today" card offers the cap times this (rounded to a whole million) */
+    readonly BOOST_FACTOR: 1;
+    /** Target key of the all-agents total cap / an everyone boost */
+    readonly TOTAL_TARGET: "*";
+    /** Prefix of a team target (`team:<teamId>`) */
+    readonly TEAM_TARGET_PREFIX: "team:";
+    /** Error code of a refused wake */
+    readonly ERROR_CODE: "SPEND_CAP_REACHED";
+    /** Queued-delivery marker in sendMessageToAgent results */
+    readonly QUEUED_MARKER: "[SPEND_CAP]";
+    /** Decision kind of the "cap reached" card */
+    readonly DECISION_KIND: "spend_cap";
+    readonly OPTIONS: {
+        readonly KEEP: "Keep stopped";
+        readonly UNLIMITED: "Unlimited today";
+    };
+};
+/**
+ * Token usage: the unit, the stats endpoint, and the Codex / Antigravity
+ * ledgers (specs/2026-10-02-spend-cap.md).
+ */
+export declare const USAGE_CONSTANTS: {
+    /**
+     * Tokens per US dollar, used ONCE to convert settings written in USD
+     * (the ticket autopilot's `dailyBudgetUsd`, pre-token spend caps) to
+     * tokens; each conversion is logged. A round migration default, not a
+     * price: the owner's Mac blended ~0.66M tokens per API-equivalent $ in the
+     * 7 days to 2026-10-01 (Opus 0.51M/$, Sonnet 2–3M/$, DeepSeek ~11M/$;
+     * cache reads are >99% of the tokens), so a converted budget is within
+     * 1.5× of what the dollar figure bought.
+     */
+    readonly TOKENS_PER_USD: 1000000;
+    /** groupBy values of GET /api/system/usage */
+    readonly GROUP_BY: readonly string[];
+    /** Rows returned for groupBy=workItem (highest first) */
+    readonly MAX_WORK_ITEM_ROWS: 50;
+    /** Label of usage no team / project / work item can be attributed to */
+    readonly UNATTRIBUTED: "(unattributed)";
+};
+/** Codex rollout usage sync (`~/.codex/sessions/**\/rollout-*.jsonl`). */
+export declare const CODEX_USAGE_SYNC_CONSTANTS: {
+    /** Poll interval (ms) */
+    readonly SYNC_INTERVAL_MS: 60000;
+    /** Cursor file under CREWLY_HOME */
+    readonly CURSOR_FILE: "codex-rollout-cursors.json";
+    /** Model recorded when a rollout names none */
+    readonly DEFAULT_MODEL: "codex-cli-default";
+    /** Directory entries visited when looking a rollout up by id */
+    readonly MAX_SCAN_ENTRIES: 20000;
+};
+/** Antigravity (`agy`) usage sync — best effort, see the spec. */
+export declare const ANTIGRAVITY_USAGE_SYNC_CONSTANTS: {
+    /** Poll interval (ms) */
+    readonly SYNC_INTERVAL_MS: 60000;
+    /** Cursor file under CREWLY_HOME */
+    readonly CURSOR_FILE: "antigravity-usage-cursors.json";
+    /** Model recorded (agy stores its model as an enum, not a name) */
+    readonly MODEL: "antigravity-cli-default";
+    /**
+     * Protobuf path of the usage message in a `steps.metadata` blob (field 9),
+     * and its input / output token fields. Undocumented — read from agy 1.x
+     * conversation databases; a blob without them is skipped, never guessed.
+     */
+    readonly USAGE_FIELD: 9;
+    readonly INPUT_FIELD: 2;
+    readonly OUTPUT_FIELD: 3;
+};
 /**
  * Runtime fallback: switch an agent to another runtime when its runtime runs
  * out of usage, and back when the limit resets.