crewly 1.20.195 → 1.20.196

package/config/constants.ts

@@ -202,6 +202,14 @@ export const SAFE_RESTART_CONSTANTS = {
 	DRAIN_TIMEOUT_MS: 120_000,
 	/** Env var overriding DRAIN_TIMEOUT_MS; `0` disables the wait */
 	DRAIN_ENV_VAR: 'CREWLY_RESTART_DRAIN_MS',
+	/**
+	 * Hard cap on the drain while an agent it waits on has a tool call or a
+	 * subagent / background task still running (ms). Such work routinely
+	 * outlasts DRAIN_TIMEOUT_MS (2026-10-02, Eve).
+	 */
+	BACKGROUND_DRAIN_TIMEOUT_MS: 600_000,
+	/** Env var overriding BACKGROUND_DRAIN_TIMEOUT_MS */
+	BACKGROUND_DRAIN_ENV_VAR: 'CREWLY_RESTART_DRAIN_BACKGROUND_MS',
 	/**
 	 * Time allowed after the drain for the rest of the shutdown (session state
 	 * save, PTY teardown, queue flush) before a supervisor may SIGKILL (ms).
@@ -358,6 +366,66 @@ export const API_SECURITY_CONSTANTS = {
 	LOOPBACK_ADDRESSES: ['127.0.0.1', '::1', '::ffff:127.0.0.1'],
 } as const;
 
+/**
+ * Owner authentication (#999, specs/2026-10-03-owner-auth.md).
+ *
+ * Who a caller is comes from credentials, never from a missing header:
+ * - agents carry a per-session **agent badge** minted by the harness at launch;
+ * - the dashboard holds an owner session cookie plus a CSRF token;
+ * - the phone / portal relay and Cloud-forwarded Slack envelopes carry an
+ *   in-memory internal credential;
+ * - remote dashboards, the phone on the LAN and the CLI present the owner API token.
+ */
+export const OWNER_AUTH_CONSTANTS = {
+	/**
+	 * Environment variable holding the agent badge in every agent process.
+	 * Deliberately free of TOKEN / KEY / SECRET: Codex's default
+	 * `shell_environment_policy` strips variables whose names contain those
+	 * words from the shells it runs, so the skills would never see it.
+	 */
+	AGENT_BADGE_ENV: 'CREWLY_AGENT_BADGE',
+	/** Request header carrying the agent badge */
+	AGENT_BADGE_HEADER: 'x-agent-badge',
+	/** Version prefix of a badge (`cab1.<base64url session>.<hmac>`) */
+	AGENT_BADGE_PREFIX: 'cab1',
+	/** Owner session cookie name prefix; the backend port is appended (cookies ignore ports) */
+	OWNER_SESSION_COOKIE_PREFIX: 'crewly_owner_',
+	/** Version prefix of an owner session value */
+	OWNER_SESSION_PREFIX: 'cos1',
+	/** Lifetime of an owner session cookie (seconds). The signing secret is in memory, so a restart ends it sooner. */
+	OWNER_SESSION_MAX_AGE_S: 30 * 24 * 60 * 60,
+	/** Header the dashboard sends the CSRF token in on every write */
+	CSRF_HEADER: 'x-crewly-csrf',
+	/** Header carrying the in-memory internal credential (relay / cloud) */
+	INTERNAL_HEADER: 'x-crewly-internal',
+	/** Path (under `/api`) that issues the owner session and returns the CSRF token */
+	SESSION_ROUTE: '/auth/session',
+	/** HTTP methods that change state and therefore need CSRF / a header-borne token */
+	MUTATING_METHODS: ['POST', 'PUT', 'PATCH', 'DELETE'] as readonly string[],
+	/**
+	 * What a browser without a session (a dashboard tab opened before the
+	 * upgrade) is told in the 401's `error`, which that old tab shows as is.
+	 */
+	RELOAD_MESSAGE: 'Reload this page — Crewly was updated.',
+	/** Response header naming the dashboard build the backend serves (its hashed entry script) */
+	BUILD_HEADER: 'x-crewly-dashboard-build',
+	/** socket.io event announcing the served dashboard build on each connection */
+	BUILD_EVENT: 'dashboard_build',
+	/** Error codes in `{ success: false, error }` */
+	ERRORS: {
+		/** No owner credential (401). The dashboard refreshes its session and retries once. */
+		OWNER_AUTH_REQUIRED: 'owner_auth_required',
+		/** An agent called an owner-only route (403) */
+		OWNER_ONLY: 'owner_only',
+	},
+	/** Give up looking up a local client's process after this long (fail open) */
+	PEER_LOOKUP_TIMEOUT_MS: 3000,
+	/** Longest parent chain walked from a client process */
+	PEER_MAX_ANCESTRY_DEPTH: 64,
+	/** `X-Agent-Session` without a badge (migration window) is logged at most this often per session */
+	LEGACY_WARN_THROTTLE_MS: 10 * 60 * 1000,
+} as const;
+
 // ========================= TIMING CONSTANTS =========================
 
 /**

package/config/hooks/agent-status/report.sh

@@ -1,19 +1,23 @@
 #!/usr/bin/env bash
 # Crewly agent-status hook — tells the backend when Claude Code is waiting on
-# the user (a permission prompt or a question) and when it stops waiting.
+# the user (a permission prompt or a question) and when it stops waiting, and
+# where it is in its turn (turn start/end, tool calls, subagents).
 #
-# Spec: specs/2026-09-26-agent-waiting-on-human.md (#815, hook ingestion).
+# Spec: specs/2026-09-26-agent-waiting-on-human.md (#815, hook ingestion);
+# specs/2026-10-02-restart-busy-and-resume.md (runtime turn state).
 #
 # Wired by the backend into the per-session settings file it already passes
 # with `claude --settings <file>` (the control-plane guard's file) for:
-#   Notification, PermissionRequest, Stop, UserPromptSubmit, PostToolUse
+#   Notification, PermissionRequest, Stop, UserPromptSubmit, PreToolUse,
+#   PostToolUse, SubagentStart, SubagentStop, SessionStart
 #
 # Usage: bash report.sh            # hook JSON on stdin
 #
 # PRIVACY: the stdin JSON can hold tool_input, file contents, prompts and a
 # transcript path, any of which may contain secrets. This script extracts
-# exactly two TOP-LEVEL fields — hook_event_name and notification_type — keeps them only
-# if they are plain identifiers ([A-Za-z_], max 64 chars), and sends those plus
+# exactly five TOP-LEVEL fields — hook_event_name, notification_type and
+# source (kept only as plain identifiers, [A-Za-z_], max 64 chars), tool_use_id and
+# agent_id (kept only as [A-Za-z0-9_-], max 128 chars) — and sends those plus
 # the session name. Nothing else from stdin is sent, printed or logged.
 #
 # It never blocks or slows the agent: every path exits 0, and the POST has a
@@ -34,8 +38,9 @@ API_URL="${CREWLY_API_URL:-http://localhost:${WEB_PORT:-8787}}"
 # tool_input (a regex cannot: `"hook_event_name":"Stop"` inside a command would
 # spoof the event). So: jq, else node's JSON.parse, else nothing — the event is
 # dropped and the backend's screen detection still covers the state.
+NAME_PATTERN='^[A-Za-z_]{1,64}$'
 field() {
-	local name="$1" value=""
+	local name="$1" pattern="${2:-$NAME_PATTERN}" value=""
 	if command -v jq >/dev/null 2>&1; then
 		value="$(printf '%s' "$INPUT" | jq -r --arg k "$name" 'if type == "object" then (.[$k] // empty | select(type == "string")) else empty end' 2>/dev/null)"
 	elif command -v node >/dev/null 2>&1; then
@@ -51,7 +56,7 @@ field() {
 			});' "$name" 2>/dev/null)"
 	fi
 	# Keep only a plain identifier; anything else is discarded, not sanitised.
-	if printf '%s' "$value" | grep -Eq '^[A-Za-z_]{1,64}$'; then
+	if printf '%s' "$value" | grep -Eq "$pattern"; then
 		printf '%s' "$value"
 	fi
 }
@@ -59,17 +64,31 @@ field() {
 EVENT="$(field hook_event_name)"
 [ -z "$EVENT" ] && exit 0
 NOTIFICATION_TYPE="$(field notification_type)"
+ID_PATTERN='^[A-Za-z0-9_-]{1,128}$'
+TOOL_USE_ID=""
+AGENT_ID=""
+SOURCE=""
+case "$EVENT" in
+	PreToolUse|PostToolUse) TOOL_USE_ID="$(field tool_use_id "$ID_PATTERN")" ;;
+	SubagentStart|SubagentStop) AGENT_ID="$(field agent_id "$ID_PATTERN")" ;;
+	SessionStart) SOURCE="$(field source)" ;;
+esac
 
-if [ -n "$NOTIFICATION_TYPE" ]; then
-	BODY="{\"event\":\"$EVENT\",\"notificationType\":\"$NOTIFICATION_TYPE\"}"
-else
-	BODY="{\"event\":\"$EVENT\"}"
-fi
+BODY="{\"event\":\"$EVENT\""
+[ -n "$NOTIFICATION_TYPE" ] && BODY="$BODY,\"notificationType\":\"$NOTIFICATION_TYPE\""
+[ -n "$TOOL_USE_ID" ] && BODY="$BODY,\"toolUseId\":\"$TOOL_USE_ID\""
+[ -n "$AGENT_ID" ] && BODY="$BODY,\"agentId\":\"$AGENT_ID\""
+[ -n "$SOURCE" ] && BODY="$BODY,\"source\":\"$SOURCE\""
+BODY="$BODY}"
 
 ARGS=(-s -o /dev/null --max-time 2 -X POST "$API_URL/api/agent-hooks"
 	-H "Content-Type: application/json"
 	-H "User-Agent: crewly-agent-status-hook/1"
 	-H "X-Agent-Session: $SESSION")
+# The agent badge (#999): the credential behind X-Agent-Session.
+if [ -n "${CREWLY_AGENT_BADGE:-}" ]; then
+	ARGS+=(-H "X-Agent-Badge: $CREWLY_AGENT_BADGE")
+fi
 if [ -n "${CREWLY_AGENT_AUTHORIZATION:-}" ]; then
 	ARGS+=(-H "X-Agent-Authorization: b64:$(printf '%s' "$CREWLY_AGENT_AUTHORIZATION" | base64 | tr -d '\n')")
 fi

package/config/hooks/subagent-guard/subagent.sh

@@ -108,6 +108,30 @@ process.stdin.on("end", () => {
 JS
 )"
 
-printf '%s' "$INPUT" | MARKER_DIR="$MARKER_DIR" node -e "$PROGRAM" 2>/dev/null
+OUT="$(printf '%s' "$INPUT" | MARKER_DIR="$MARKER_DIR" node -e "$PROGRAM" 2>/dev/null)"
+printf '%s' "$OUT"
+
+# A subagent was sent back: tell the backend so the run's trace records it
+# (autonomy metrics, #984). Only a fixed event name and the session leave the
+# machine's hook; nothing from the transcript or stdin is sent. Backgrounded
+# (2-second ceiling, failures ignored), so the stop never waits on it.
+case "$OUT" in
+	*'"decision":"block"'*)
+		SESSION="${CREWLY_SESSION_NAME:-}"
+		if [ -n "$SESSION" ] && command -v curl >/dev/null 2>&1; then
+			API_URL="${CREWLY_API_URL:-http://localhost:${WEB_PORT:-8787}}"
+			ARGS=(-s -o /dev/null --max-time 2 -X POST "$API_URL/api/agent-hooks"
+				-H "Content-Type: application/json"
+				-H "User-Agent: crewly-subagent-guard-hook/1"
+				-H "X-Agent-Session: $SESSION")
+			if [ -n "${CREWLY_AGENT_AUTHORIZATION:-}" ]; then
+				ARGS+=(-H "X-Agent-Authorization: b64:$(printf '%s' "$CREWLY_AGENT_AUTHORIZATION" | base64 | tr -d '\n')")
+			fi
+			# In the background: a subagent stop never waits on the backend.
+			curl "${ARGS[@]}" --data '{"event":"SubagentSendBack"}' >/dev/null 2>&1 &
+			disown 2>/dev/null || true
+		fi
+		;;
+esac
 
 exit 0

package/config/roles/orchestrator/fragments/lifecycle.md

@@ -12,7 +12,7 @@ Do NOT create monitoring WorkItems for yourself. Delegations are already covered
 |----------|---------------|----------|
 | 🔴 **Critical** — Notify IMMEDIATELY | Agent crash, task failure, blocked, error | Runtime exited, build failed, agent stuck >15min |
 | 🟡 **Important** — Notify within 1 min | Task completed, needs user decision, milestone reached | Agent finished feature, needs review approval |
-| ⚪ **Info** — Log only, include in next summary | Agent started working, routine status change, heartbeat | idle→in_progress, scheduled check with no changes |
+| ⚪ **Info** — Log only, do not notify (mention it only if the owner asks, or in the daily summary when Onboarding Mode is on) | Agent started working, routine status change, heartbeat | idle→in_progress, scheduled check with no changes |
 
 ### Decision Rules for Events
 

package/config/roles/orchestrator/prompt.md

@@ -1136,7 +1136,7 @@ Not every event deserves a user notification. Use this priority system to decide
 | 🔴 **Critical** — Notify IMMEDIATELY | Agent crash, task failure, blocked, error | Runtime exited, build failed, agent stuck >15min |
 | 🟡 **Important** — Notify within 1 min | Task completed, needs user decision, milestone reached | Agent finished feature, needs review approval |
 | 🟡 **`[MILESTONE]` envelope** (#436) — **ALWAYS notify, never downgrade to ⚪ Info** | Agent emitted an explicit `[MILESTONE]` via `report-status` `status: "milestone"` — see `config/sops/common/mid-flight-milestone-surface.md` | "PR #420 merged — agent state file is now corruption-resistant", "Spec finalized + handed off to Atlas" |
-| ⚪ **Info** — Log only, include in next summary | Agent started working, routine status change, heartbeat | idle→in_progress, scheduled check with no changes |
+| ⚪ **Info** — Log only, do not notify (mention it only if the owner asks, or in the daily summary when Onboarding Mode is on) | Agent started working, routine status change, heartbeat | idle→in_progress, scheduled check with no changes |
 
 **Rule at ALL trust levels (never skip)**: when an agent surfaces a
 `[MILESTONE]` envelope, you forward it to the owner. The agent
@@ -1203,7 +1203,7 @@ When you receive one, you MUST:
 3. **Decide whether to notify** — Use the Smart Event Notification Protocol above:
    - 🔴 Critical → notify immediately via `[NOTIFY]` + `reply-slack`
    - 🟡 Important → notify with summary, batch if multiple events within 60s
-   - ⚪ Info → skip notification, include in next scheduled summary
+   - ⚪ Info → do not notify. Mention it only if the owner asks, or in the daily summary when Onboarding Mode is on
 
 4. **Never output plain text for status updates** — it won't reach the user. Always use `[NOTIFY]` markers
 
@@ -1336,7 +1336,7 @@ All actions are performed by running bash scripts. Each script outputs JSON to s
 
 **IMPORTANT: Always use skill scripts instead of raw `curl` commands.** The skill scripts use `api_call()` from the common library which:
 - Automatically resolves the correct API URL (falls back to `http://localhost:8787`)
-- Includes the `X-Agent-Session` header for heartbeat tracking
+- Includes your identity headers (`X-Agent-Session` and your agent badge `X-Agent-Badge`)
 - Handles error formatting and HTTP status code checking
 - Uses the correct HTTP methods for each endpoint
 

package/config/skills/_common/lib.sh

@@ -224,6 +224,13 @@ api_call() {
   local args=(-s -w '\n%{http_code}' -X "$method" -H "Content-Type: application/json")
   # Include agent session identity header for heartbeat tracking
   # Use ${VAR:-} pattern to avoid 'unbound variable' error under set -u (nounset)
+  # The agent badge (#999): the credential that makes the backend treat this
+  # call as this agent. Injected by the harness at launch; without it the
+  # session header alone is accepted for one release only. Never the owner
+  # either way.
+  if [ -n "${CREWLY_AGENT_BADGE:-}" ]; then
+    args+=(-H "X-Agent-Badge: $CREWLY_AGENT_BADGE")
+  fi
   if [ -n "${CREWLY_SESSION_NAME:-}" ]; then
     args+=(-H "X-Agent-Session: $CREWLY_SESSION_NAME")
     # This shell's pid: the backend walks its parents to the agent PTY it
@@ -433,11 +440,27 @@ auto_remember() {
 # The background curl is non-blocking (~5ms) and errors are silently ignored.
 # -----------------------------------------------------------------------------
 _skill_heartbeat() {
-  curl -s -X POST "${CREWLY_API_URL}/api/heartbeat" \
-    -H "X-Agent-Session: ${CREWLY_SESSION_NAME:-}" \
-    -H "X-Agent-Pid: $$" \
-    -H "Content-Type: application/json" \
-    -d '{"source":"skill-start"}' >/dev/null 2>&1 &
+  local hb_args=(-s -X POST "${CREWLY_API_URL}/api/heartbeat"
+    -H "X-Agent-Session: ${CREWLY_SESSION_NAME:-}"
+    -H "X-Agent-Pid: $$"
+    -H "Content-Type: application/json")
+  [ -n "${CREWLY_AGENT_BADGE:-}" ] && hb_args+=(-H "X-Agent-Badge: $CREWLY_AGENT_BADGE")
+  curl "${hb_args[@]}" -d '{"source":"skill-start"}' >/dev/null 2>&1 &
+}
+
+# -----------------------------------------------------------------------------
+# agent_auth_curl_args
+#
+# For a skill that calls the backend with its own `curl` instead of api_call:
+# prints the identity headers as curl arguments, one per line, so they can be
+# read into an array without word-splitting surprises:
+#   mapfile -t AUTH < <(agent_auth_curl_args)   # bash 4+
+#   while IFS= read -r a; do AUTH+=("$a"); done < <(agent_auth_curl_args)  # bash 3.2
+#   curl "${AUTH[@]}" ...
+# -----------------------------------------------------------------------------
+agent_auth_curl_args() {
+  if [ -n "${CREWLY_AGENT_BADGE:-}" ]; then printf '%s\n' -H "X-Agent-Badge: $CREWLY_AGENT_BADGE"; fi
+  if [ -n "${CREWLY_SESSION_NAME:-}" ]; then printf '%s\n' -H "X-Agent-Session: $CREWLY_SESSION_NAME"; fi
 }
 
 # Auto-heartbeat on skill entry when running inside a Crewly agent session

package/config/skills/_common/lib.test.sh

@@ -3,7 +3,7 @@
 # Tests for lib.sh — shared skills library
 # Covers: --file preprocessor, read_json_input, require_param, error_exit,
 #         api_call output cap (CREWLY_SKILL_MAX_OUTPUT_BYTES),
-#         CREWLY_API_URL default (#777)
+#         CREWLY_API_URL default (#777), agent badge header (#999)
 # =============================================================================
 set -euo pipefail
 
@@ -88,6 +88,11 @@ SKILL_EOF
 chmod +x "$TEMP_DIR/test_read_json.sh"
 
 export LIB_PATH="$SCRIPT_DIR/lib.sh"
+# Sourcing lib.sh with CREWLY_SESSION_NAME set fires a real skill-start
+# heartbeat (curl in the background). Point it at a closed port so a test
+# run never writes to a Crewly backend running on this machine — it used to
+# post heartbeats for the fake sessions here to the live :8787.
+export CREWLY_API_URL="http://127.0.0.1:9"
 
 echo "=== lib.sh Test Suite ==="
 echo ""
@@ -315,6 +320,32 @@ assert_eq "lib.sh: default API URL without WEB_PORT is 8787" "http://localhost:8
 RESULT=$(CREWLY_API_URL=http://localhost:9001 WEB_PORT=8797 bash -c 'source "$1"; echo "$CREWLY_API_URL"' _ "$SCRIPT_DIR/lib.sh")
 assert_eq "lib.sh: CREWLY_API_URL set by the backend wins" "http://localhost:9001" "$RESULT"
 
+# ---- Test 28: api_call sends the agent badge (#999) ----
+mkdir -p "$TEMP_DIR/skills/fake-badge"
+cat > "$TEMP_DIR/skills/fake-badge/execute.sh" << 'SKILL_EOF'
+#!/bin/bash
+set -euo pipefail
+source "$LIB_PATH"
+# Record every argument curl got, one per line, then answer 200.
+curl() {
+  printf '%s\n' "$@" > "$ARGS_OUT"
+  printf '%s\n%s' '{"ok":true}' 200
+}
+api_call POST "/decisions" '{}'
+SKILL_EOF
+chmod +x "$TEMP_DIR/skills/fake-badge/execute.sh"
+export ARGS_OUT="$TEMP_DIR/curl-args.txt"
+CREWLY_SESSION_NAME=dev-1 CREWLY_AGENT_BADGE=cab1.ZGV2LTE.sig bash "$TEMP_DIR/skills/fake-badge/execute.sh" >/dev/null 2>&1
+assert_contains "api_call: sends X-Agent-Badge when the harness set CREWLY_AGENT_BADGE" "X-Agent-Badge: cab1.ZGV2LTE.sig" "$(cat "$ARGS_OUT")"
+assert_contains "api_call: still sends X-Agent-Session" "X-Agent-Session: dev-1" "$(cat "$ARGS_OUT")"
+env -u CREWLY_AGENT_BADGE CREWLY_SESSION_NAME=dev-1 bash "$TEMP_DIR/skills/fake-badge/execute.sh" >/dev/null 2>&1
+assert_eq "api_call: no badge header when there is no badge" "0" "$(grep -c 'X-Agent-Badge' "$ARGS_OUT" || true)"
+
+# ---- Test 29: agent_auth_curl_args for skills that run their own curl ----
+RESULT=$(CREWLY_SESSION_NAME=dev-1 CREWLY_AGENT_BADGE=b1 bash -c 'source "$1"; agent_auth_curl_args' _ "$SCRIPT_DIR/lib.sh" 2>/dev/null)
+assert_eq "agent_auth_curl_args: badge and session as curl args" "$(printf '%s\n' -H 'X-Agent-Badge: b1' -H 'X-Agent-Session: dev-1')" "$RESULT"
+unset ARGS_OUT
+
 echo ""
 echo "=== Results: $PASS/$TOTAL passed, $FAIL failed ==="
 

package/config/skills/agent/core/create-intent-tasks/execute.sh

@@ -73,6 +73,8 @@ API_URL="${CREWLY_API_URL:-http://localhost:${CREWLY_PORT}}"
 RESPONSE=$(curl -s -w "\n%{http_code}" \
   -X POST \
   -H "Content-Type: application/json" \
+  -H "X-Agent-Badge: ${CREWLY_AGENT_BADGE:-}" \
+  -H "X-Agent-Session: ${CREWLY_SESSION_NAME:-}" \
   -d "$BODY" \
   "${API_URL}/api/intent-tasks/batch" 2>&1) || {
   echo "{\"success\":false,\"error\":\"Failed to connect to backend at ${API_URL}\"}"

package/config/skills/agent/core/decompose-intent/execute.sh

@@ -88,6 +88,8 @@ API_URL="${CREWLY_API_URL:-http://localhost:${CREWLY_PORT}}"
 RESPONSE=$(curl -s -w "\n%{http_code}" \
   -X POST \
   -H "Content-Type: application/json" \
+  -H "X-Agent-Badge: ${CREWLY_AGENT_BADGE:-}" \
+  -H "X-Agent-Session: ${CREWLY_SESSION_NAME:-}" \
   -d "$BODY" \
   "${API_URL}/api/intent-tasks/decompose" 2>&1) || {
   echo "{\"success\":false,\"error\":\"Failed to connect to backend at ${API_URL}\"}"

package/config/skills/agent/core/experiment-card/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: Experiment Card
 description: Attach an experiment to an optimisation ticket — hypothesis ("change X → metric Y from a to b"), a Search Console or GA4 metric (via seo-ops), an observation window (default 14 days). Crewly captures the baseline when the change ships, measures it when the window ends, labels it worked / didn't / inconclusive, resolves your prediction, writes the wiki experiment log and tells the owner.
-version: 1.1.0
+version: 1.2.0
 category: analysis
 skillType: claude-skill
 assignableRoles:
@@ -87,6 +87,34 @@ bash execute.sh create --hypothesis "3-field inquiry form → submissions from 8
 - One experiment per change: two changes on the same page in one window
   can't be told apart.
 
+## Measure a ticket-autopilot period (owner / orchestrator / team lead)
+
+When the owner lets a project's ticket autopilot drive a feature, one card
+measures both the business number and how autonomous the run was:
+
+```bash
+bash execute.sh create --autopilot --project <project id> --label feed \
+  --hypothesis "Autopilot drives /feed for 4 weeks → feed card clicks up" \
+  --source ga4 --measure events --event feed_card_click --channel all \
+  --config /abs/path/ce.seo-ops.json --metric-label "Feed card clicks" \
+  --metric "ga4:sessions:page=/feed,pageMatch=contains,channel=all" \
+  --window-days 28 [--started-at ISO]
+```
+
+- **Start** is now (or `--started-at`); the baseline is the equal window
+  before it. The card is `running` right away.
+- `--label` (with `--autopilot`): only tickets carrying that label count in
+  the process numbers. Use `--metric-label` to name the metric.
+- `--metric "source:measure:key=value,…"` (repeatable): more outcome
+  metrics, each with its own baseline, result and verdict. Keys: `page`,
+  `pageMatch`, `query`, `queryMatch`, `event`, `channel`, `label`, `config`
+  (default: `--config`). The primary metric gives the verdict.
+- **Process**: tickets shipped, owner touches per ticket, stall time and $
+  per shipped ticket, from the autopilot stats of the same windows.
+- The owner gets one short note a week while it runs, and the full result
+  (outcome verdicts + process) at the end. Everything is in the timeline.
+- While it runs, the team lead's daily autopilot retro is on by default.
+
 ## Follow it
 
 ```bash

package/config/skills/agent/core/experiment-card/execute.sh

@@ -11,6 +11,8 @@
 #                          [--event NAME] [--channel all] [--label "…"] [--title "…"]
 #                          [--from A] [--to B] [--direction increase|decrease] [--window-days 14]
 #                          [--confidence 0.6] [--project P --ticket ID | --tkt TKT-12] [--shipped-at ISO]
+#   bash execute.sh create --autopilot --project P [--label feed] [--started-at ISO] --hypothesis "…"
+#                          --source … --measure … --config … [--metric "ga4:sessions:page=/feed,pageMatch=contains"] …
 #   bash execute.sh ship    --id EXP-3 [--shipped-at ISO]
 #   bash execute.sh show    --id EXP-3
 #   bash execute.sh list    [--status planned|running|done|cancelled] [--ticket ID]
@@ -29,6 +31,13 @@ Usage:
                          --config /abs/path/seo-ops.config.json [filters] [--from A] [--to B]
                          [--window-days 14] [--confidence 0.6] [--project P --ticket ID | --tkt TKT-12]
                          [--shipped-at ISO]   (required when the ticket is already done but has no recorded done time)
+  bash execute.sh create --autopilot --project P [--label feed] [--started-at ISO] --hypothesis "…"
+                         --source S --measure M --config /abs/seo-ops.config.json [filters]
+                         [--metric "source:measure:key=value,key=value" …] [--window-days 28]
+                                      Measure a period of ticket-autopilot work on project P: the primary metric
+                                      (and each --metric) before vs after the start, plus the process (tickets
+                                      shipped, owner touches per ticket, stall time, $ per shipped ticket).
+                                      --label: only tickets with this label; --metric-label names the metric
       gsc measures: clicks impressions ctr position   (filters: --page URL --query Q, --page-match/--query-match exact|contains)
       ga4 measures: sessions events conversions       (filters: --page /path, --event NAME, --channel all)
   bash execute.sh ship    --id EXP-3 [--shipped-at ISO]   The change is live (automatic when the ticket is done)
@@ -43,6 +52,7 @@ ACTION=""; ID=""; JSON_BODY=""
 HYPOTHESIS=""; TITLE=""; SOURCE=""; MEASURE=""; CONFIG=""; PAGE=""; PAGE_MATCH=""; QUERY=""; QUERY_MATCH=""
 EVENT=""; CHANNEL=""; LABEL=""; FROM=""; TO=""; DIRECTION=""; WINDOW=""; CONFIDENCE=""; PROJECT=""; TICKET=""; TKT=""
 SHIPPED_AT=""; STATUS=""; REASON=""
+AUTOPILOT=""; STARTED_AT=""; METRIC_LABEL=""; EXTRA_METRICS="[]"
 
 if [[ $# -gt 0 && ${1:0:1} == '{' ]]; then
   J=$(read_json_input "$1"); shift
@@ -80,6 +90,16 @@ while [[ $# -gt 0 ]]; do
     --ticket)        [ $# -ge 2 ] || error_exit "--ticket requires a value"; TICKET="$2"; shift 2 ;;
     --tkt)           [ $# -ge 2 ] || error_exit "--tkt requires a value"; TKT="$2"; shift 2 ;;
     --shipped-at)    [ $# -ge 2 ] || error_exit "--shipped-at requires a value"; SHIPPED_AT="$2"; shift 2 ;;
+    --autopilot)     AUTOPILOT=1; shift ;;
+    --started-at)    [ $# -ge 2 ] || error_exit "--started-at requires a value"; STARTED_AT="$2"; shift 2 ;;
+    --metric-label)  [ $# -ge 2 ] || error_exit "--metric-label requires a value"; METRIC_LABEL="$2"; shift 2 ;;
+    --metric)        [ $# -ge 2 ] || error_exit "--metric requires \"source:measure:key=value,…\""
+                     M=$(jq -cn --arg s "$2" '($s | capture("^(?<source>[^:]+):(?<measure>[^:]+)(:(?<rest>.*))?$")) as $c
+                       | {source: $c.source, measure: $c.measure}
+                         + (($c.rest // "") | split(",") | map(select(length > 0) | capture("^(?<k>[^=]+)=(?<v>.*)$") | {(.k): .v}) | add // {})') \
+                       || M=""
+                     [ -n "$M" ] || error_exit "--metric must look like ga4:sessions:page=/feed,pageMatch=contains"
+                     EXTRA_METRICS=$(jq -c --argjson m "$M" '. + [$m]' <<<"$EXTRA_METRICS"); shift 2 ;;
     --status)        [ $# -ge 2 ] || error_exit "--status requires a value"; STATUS="$2"; shift 2 ;;
     --reason)        [ $# -ge 2 ] || error_exit "--reason requires a value"; REASON="$2"; shift 2 ;;
     --help|-h)       print_usage; exit 0 ;;
@@ -88,7 +108,8 @@ while [[ $# -gt 0 ]]; do
 done
 
 enc() { jq -rn --arg v "$1" '$v|@uri'; }
-CARD='{id, status, title, hypothesis, metric: (.metric | {source, measure, page, query, event, label} | with_entries(select(.value != null))), windowDays, ticket, shippedAt, dueAt, baseline: (.baseline.total // null), result: (.result.total // null), verdict, verdictReason, lastError, traceId}'
+CARD='{id, status, title, hypothesis, metric: (.metric | {source, measure, page, query, event, label} | with_entries(select(.value != null))), windowDays, ticket, shippedAt, dueAt, baseline: (.baseline.total // null), result: (.result.total // null), verdict, verdictReason, lastError, traceId}
+  + (if .autopilot then {autopilot: (.autopilot | {projectName, label, outcomes: [.outcomes[]? | {metric: (.metric | {source, measure, page, event}), baseline: (.baseline.total // null), result: (.result.total // null), verdict}], processBaseline, processResult, checkIns})} else {} end)'
 
 case "$ACTION" in
   create)
@@ -100,6 +121,14 @@ case "$ACTION" in
       require_param "measure (--measure)" "$MEASURE"
       require_param "config (--config, the seo-ops site config)" "$CONFIG"
       if [ -n "$TICKET" ] && [ -z "$PROJECT" ]; then error_exit "--ticket needs --project (or use --tkt TKT-n for a harness ticket)"; fi
+      if [ -n "$AUTOPILOT" ]; then
+        require_param "project (--project, the autopilot project)" "$PROJECT"
+        [ -z "$TICKET" ] || error_exit "--autopilot measures a period of the project's work; leave out --ticket"
+        AP_LABEL="$LABEL"; LABEL="$METRIC_LABEL"; AP_PROJECT="$PROJECT"; PROJECT=""
+      else
+        [ "$EXTRA_METRICS" = "[]" ] || error_exit "--metric (extra outcome metrics) needs --autopilot"
+        [ -z "$METRIC_LABEL" ] || LABEL="$METRIC_LABEL"
+      fi
       BODY=$(jq -cn \
         --arg h "$HYPOTHESIS" --arg t "$TITLE" --arg s "$SOURCE" --arg m "$MEASURE" --arg c "$CONFIG" \
         --arg page "$PAGE" --arg pm "$PAGE_MATCH" --arg q "$QUERY" --arg qm "$QUERY_MATCH" --arg ev "$EVENT" \
@@ -117,6 +146,11 @@ case "$ACTION" in
            elif $tic != "" then {ticket: {kind: "project", project: $proj, id: $tic}}
            else {} end)')
     fi
+    if [ -n "$AUTOPILOT" ] && [ -n "${AP_PROJECT:-}" ]; then
+      BODY=$(printf '%s' "$BODY" | jq -c --arg p "$AP_PROJECT" --arg l "${AP_LABEL:-}" --argjson m "$EXTRA_METRICS" \
+        '. + {autopilot: ({project: $p} + (if $l != "" then {label: $l} else {} end))} + (if ($m | length) > 0 then {metrics: $m} else {} end)')
+    fi
+    if [ -n "$STARTED_AT" ]; then BODY=$(printf '%s' "$BODY" | jq -c --arg at "$STARTED_AT" '. + {startedAt: $at}'); fi
     if [ -n "$SHIPPED_AT" ]; then BODY=$(printf '%s' "$BODY" | jq -c --arg at "$SHIPPED_AT" '. + {shippedAt: $at}'); fi
     api_call POST "/experiments" "$BODY" | jq "{success, experiment: (.data | ${CARD})}"
     ;;

package/config/skills/agent/core/experiment-card/execute.test.sh

@@ -70,6 +70,17 @@ check "create shipped-at: body" "$(last '.body.shippedAt')" "2026-10-01T10:00:00
 run '{"action":"create","hypothesis":"J","metric":{"source":"gsc","measure":"ctr","config":"/c.json"},"shippedAt":"2026-10-01T10:00:00Z"}' >/dev/null
 check "create json shipped-at: body" "$(last '.body.shippedAt')" "2026-10-01T10:00:00Z"
 
+# --- autopilot scope: project + label, extra outcome metrics, start time ---
+run create --autopilot --project 7667a919 --label feed --started-at 2026-10-03T00:00:00Z \
+  --hypothesis "Autopilot on /feed → feed clicks up" --source ga4 --measure events --event feed_card_click --channel all --config /c.json \
+  --metric "ga4:sessions:page=/feed,pageMatch=contains,channel=all" --metric "gsc:clicks:page=https://visa.careerengine.us/feed,pageMatch=contains" \
+  --metric-label "Feed card clicks" --window-days 28 >/dev/null
+check "autopilot: body" "$(last '.body | tostring')" '{"hypothesis":"Autopilot on /feed → feed clicks up","metric":{"source":"ga4","measure":"events","config":"/c.json","event":"feed_card_click","channel":"all","label":"Feed card clicks"},"windowDays":"28","autopilot":{"project":"7667a919","label":"feed"},"metrics":[{"source":"ga4","measure":"sessions","page":"/feed","pageMatch":"contains","channel":"all"},{"source":"gsc","measure":"clicks","page":"https://visa.careerengine.us/feed","pageMatch":"contains"}],"startedAt":"2026-10-03T00:00:00Z"}'
+check "autopilot: needs project" "$(run_err create --autopilot --hypothesis h --source gsc --measure clicks --config /c | grep -c 'project')" "1"
+check "autopilot: no ticket" "$(run_err create --autopilot --project p --ticket T-1 --hypothesis h --source gsc --measure clicks --config /c | grep -c 'leave out --ticket')" "1"
+check "metric needs autopilot" "$(run_err create --hypothesis h --source gsc --measure clicks --config /c --metric gsc:clicks | grep -c 'needs --autopilot')" "1"
+check "bad metric spec" "$(run_err create --autopilot --project p --hypothesis h --source gsc --measure clicks --config /c --metric nonsense | grep -c 'must look like')" "1"
+
 # --- missing params / a ticket without its project ---
 check "create: missing" "$(run_err create --hypothesis h --source gsc --measure clicks | grep -c 'config')" "1"
 check "create: ticket w/o project" "$(run_err create --hypothesis h --source gsc --measure clicks --config /c --ticket T-1 | grep -c 'needs --project')" "1"

package/config/skills/agent/core/project-tickets/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: Project Tickets
-description: A project's own backlog — list, read, create, update, claim, release, assign, link, log and ask-owner (structured decision cards) on project tickets (markdown files in <project>/.crewly/tickets/, tracked in git), plus the per-project ticket autopilot switch.
-version: 1.0.0
+description: A project's own backlog — list, read, create, update, claim, release, assign, link, log and ask-owner (structured decision cards) on project tickets (markdown files in <project>/.crewly/tickets/, tracked in git), plus the per-project ticket autopilot switch, its stats and the daily retro.
+version: 1.1.0
 category: task-management
 skillType: claude-skill
 assignableRoles:
@@ -189,3 +189,36 @@ split, ask the owner, or cancel), pauses for the day at the daily token budget
 sends the owner the batched questions plus one evening digest. Only switch it
 on when the owner asked for it. Refused for anyone but the owner and the
 orchestrator.
+
+`--retro on|off|default` switches the team lead's daily retro (default: on
+while an autopilot experiment on the project is running).
+
+## Autopilot numbers and retro (owner / orchestrator / team lead)
+
+```bash
+bash execute.sh stats --project P [--days 14] [--label feed]   # per day + total
+bash execute.sh runs  --project P [--days 7]  [--label feed]   # run trace + ticket traces per day
+```
+
+`stats` counts tickets triaged / started / done (worker finished) / verified
+(ticket done) / sent back / stalled, cycle times, owner touches by kind,
+stalls by cause, harness interventions, traced tokens and $ against the daily
+budget, and time paused on the budget. Read a day's run with `trace-read
+--trace <runTraceId>`.
+
+Once a day (09:00) the driver gets an `autopilot_retro` WorkItem for the
+previous day. File it with:
+
+```bash
+bash execute.sh retro --project P --day 2026-10-02 \
+  --summary "Shipped CE-12 and CE-14. CE-15 stalled 3h waiting on the owner for the copy." \
+  --problem "owner_dependency|CE-15 waited 3h for copy approval|Decision D-40 open 3h|tr-20261002-ab12cd34" \
+  --problem "harness_gap|Triage brief listed a stopped member as busy"
+```
+
+`--problem "class|title|detail|evidence"`, class one of `agent_judgment`,
+`missing_skill`, `harness_gap`, `owner_dependency`. Crewly writes the retro to
+the project wiki (`llm-curated/autopilot-retros/<day>.md`); harness gaps
+become backlog tickets on the Crewly project, deduplicated and at most 3 a
+day, and the owner approves them with one card. Never file harness gaps as
+tickets yourself.