teamcast 0.9.3 → 1.0.1

package/README.md

@@ -1,8 +1,8 @@
 # TeamCast
 
-CLI to design, generate, and validate Claude Code subagents from a single manifest.
+CLI to design, generate, and validate multi-target agent teams for Claude Code and Codex from a single manifest.
 
-Define your subagents in one `teamcast.yaml` file. TeamCast generates Claude Code config files, validates the configuration, and keeps generated output in sync with the manifest.
+Define your agent team in one `teamcast.yaml` file. TeamCast validates the manifest, generates `.claude/` and/or `.codex/` config files, and keeps generated output in sync with the source config.
 
 ## Install
 
@@ -23,56 +23,68 @@ npx teamcast <command>
 teamcast init
 
 # Or skip the wizard and use a preset directly
-teamcast init --preset feature-team
+teamcast init --preset feature-team --target both
 
-# Generate Claude Code config files from teamcast.yaml
+# Generate files for the targets defined in teamcast.yaml
 teamcast generate
 
 # Validate the manifest
 teamcast validate
 ```
 
-After `generate`, your project will have:
-- `.claude/agents/<name>.md` - one file per agent
-- `.claude/skills/<skill>/SKILL.md` - one stub file per unique skill
-- `.claude/settings.json` - permissions and sandbox config
-- `.claude/settings.local.json` - local Claude settings when enabled
-- `CLAUDE.md` - team documentation for Claude Code
-- `AGENTS.md` - universal AI agent documentation
+After `generate`, your project will have files for the selected target(s):
 
-## Native Claude Code Model
+- Claude target:
+  - `.claude/agents/<name>.md` - one file per agent
+  - `.claude/skills/<skill>/SKILL.md` - one stub file per unique skill
+  - `.claude/settings.json` - permissions and sandbox config
+  - `.claude/settings.local.json` - local Claude settings when enabled
+  - `CLAUDE.md` - team documentation for Claude Code
+- Codex target:
+  - `.codex/config.toml` - workspace-level Codex config
+  - `.codex/agents/<name>.toml` - one TOML config per agent
+  - `AGENTS.md` - team-level instructions for Codex agents
 
-TeamCast now uses a canonical agent shape that separates:
+Use `teamcast init --target claude|codex|both` to choose which outputs are generated up front.
 
-- `agents.<name>.claude` - native Claude Code subagent runtime fields
-- `agents.<name>.forge` - TeamCast-only metadata such as delegation graph
+## Target Model
+
+TeamCast now uses a canonical manifest shape with target-specific blocks:
+
+- `claude.agents.<name>` - native Claude Code runtime fields and doc outputs
+- `codex.agents.<name>` - native Codex runtime fields and TOML outputs
+- `<target>.agents.<name>.forge` - TeamCast-only metadata such as delegation graph
+- `project.environments` - active project environments such as `node`, `python` — auto-detected or explicit
+
+TeamCast includes a built-in registry of capabilities, traits, instruction fragments, policy fragments, models, and skills. These are not serialized into `teamcast.yaml`.
 
 Legacy flat manifests are still accepted and normalized automatically, but new writes use the canonical shape.
 
 ## Command Summary
 
-| Command | Description |
-|---------|-------------|
-| `init` | Initialize `teamcast.yaml` and generate files |
-| `generate` | Generate Claude Code files from `teamcast.yaml` |
-| `validate` | Validate the team configuration |
-| `validate --format json` | Machine-readable validation output for CI pipelines |
-| `explain` | Print a human-readable view of the team architecture |
-| `diff` | Show what generated files would change |
-| `add agent <name>` | Add a new agent |
-| `edit agent <name>` | Edit an existing agent |
-| `remove agent <name>` | Remove an agent and clean up handoffs |
-| `create skill <name>` | Create a new skill and assign it to one agent |
-| `assign skill <name>` | Assign an existing skill to more agents |
-| `import` | Import an existing `.claude/` setup into `teamcast.yaml` |
-| `reset` | Delete generated files, keep `teamcast.yaml` |
-| `clean` | Delete generated files and `teamcast.yaml` |
+| Command                  | Description                                              |
+| ------------------------ | -------------------------------------------------------- |
+| `init`                   | Initialize `teamcast.yaml` and generate files            |
+| `generate`               | Generate target files from `teamcast.yaml`               |
+| `validate`               | Validate the team configuration                          |
+| `validate --format json` | Machine-readable validation output for CI pipelines      |
+| `explain`                | Print a human-readable view of the team architecture     |
+| `diff`                   | Show what generated files would change                   |
+| `add agent <name>`       | Add a new agent                                          |
+| `edit agent <name>`      | Edit an existing agent                                   |
+| `remove agent <name>`    | Remove an agent and clean up handoffs                    |
+| `create skill <name>`    | Create a new skill and assign it to one agent            |
+| `assign skill <name>`    | Assign an existing skill to more agents                  |
+| `import`                 | Import an existing `.claude/` setup into `teamcast.yaml` |
+| `reset`                  | Delete generated files, keep `teamcast.yaml`             |
+| `clean`                  | Delete generated files and `teamcast.yaml`               |
 
 Useful options:
 
 ```bash
 teamcast init --preset <name>   # skip wizard and use a preset
 teamcast init --from <path>     # initialize from an existing YAML file
+teamcast init --target <name>   # generate claude, codex, or both
 teamcast init --yes             # non-interactive init, uses defaults
 teamcast generate --dry-run     # preview generated files without writing
 teamcast validate --strict      # fail on warnings as well as errors
@@ -84,12 +96,12 @@ teamcast clean --yes            # skip clean confirmation
 
 ## Presets
 
-| Preset | Description |
-|--------|-------------|
-| `feature-team` | orchestrator -> planner -> developer -> reviewer |
-| `solo-dev` | single developer agent with broad tool access |
-| `research-and-build` | orchestrator -> researcher -> planner -> developer |
-| `secure-dev` | orchestrator -> planner -> developer -> security-auditor -> reviewer |
+| Preset               | Agents | Workflow |
+| -------------------- | ------ | -------- |
+| `feature-team`       | orchestrator, planner, developer, reviewer | orchestrator triages and delegates; planner reads code and produces step-by-step plans; developer implements with tests; reviewer checks quality |
+| `solo-dev`           | developer | single full-stack agent handles end-to-end: plan, implement, test, verify |
+| `research-and-build` | orchestrator, researcher, planner, developer | research-first: orchestrator routes to researcher for external info, planner integrates findings, developer implements |
+| `secure-dev`         | orchestrator, planner, developer, security-auditor, reviewer | mandatory security pipeline: planner includes threat model, developer follows OWASP, security-auditor gates every change, reviewer checks quality |
 
 The built-in preset files live in `templates/presets/` and are valid TeamCast YAML. Use them as a reference when creating custom presets, or copy one as a starting point:
 
@@ -109,27 +121,36 @@ Interactive wizard flow:
 1. `Project name:`
    - default is auto-detected from the current directory
    - must match lowercase letters, numbers, and hyphens
-2. `How do you want to set up your agent team?`
+2. `Which target configs should TeamCast generate?`
+   - `Claude`
+   - `Codex`
+   - `Both`
+3. `How do you want to set up your agent team?`
    - `Use a preset`
    - `Custom team`
    - `Single agent`
-3. If you choose `Use a preset`:
+4. If you choose `Use a preset`:
    - `Select a preset:`
-4. If you choose `Custom team`:
+5. If you choose `Custom team`:
    - `Select roles for your team:`
    - available roles: `orchestrator`, `planner`, `researcher`, `developer`, `tester`, `reviewer`, `security-auditor`
    - if `orchestrator` is selected with other roles, handoffs are auto-wired to the other selected agents
-5. `Customize agents before generating?`
+6. `Customize agents before generating?`
    - if yes, each agent gets:
    - `Model for <agent>:`
-6. Preview:
+   - `Reasoning effort [codex]:` for Codex agents
+7. `Select project environments:`
+   - detected environments (e.g. Node.js, Python) are pre-selected
+   - environments inject policies and workflow instructions into capable agents
+8. Preview:
    - shows the files that will be created
    - asks `Generate these files?`
 
 Important limitations of the wizard:
 
 - It does not let you rename individual agents.
-- It does not ask for custom `claude.instructions`.
+- It does not ask for custom `instruction_blocks` or `instruction_fragments`.
+- It does not ask for environment-specific configuration prompts.
 - It does not ask for custom `claude.skills`, `forge.handoffs`, `claude.max_turns`, or exact tool lists.
 - Those values come from built-in presets or role templates.
 - If you want deeper customization, edit `teamcast.yaml` after init and run `teamcast generate`.
@@ -139,6 +160,7 @@ Non-interactive `init` flows:
 - `teamcast init --preset <name>`
   - skips the wizard
   - loads the preset
+  - uses the selected `--target` value, or `claude` if omitted
   - uses the detected directory name as `project.name`
   - writes `teamcast.yaml`
   - generates files immediately
@@ -188,6 +210,7 @@ How those answers map into the manifest:
 What `add agent` does not ask for:
 
 - `claude.instructions`
+- `instruction_blocks`
 - `claude.skills`
 - `forge.handoffs`
 - `claude.max_turns`
@@ -195,7 +218,7 @@ What `add agent` does not ask for:
 - `claude.mcp_servers`
 - a fully custom `claude.tools` / `claude.disallowed_tools` list
 
-That means a custom agent added this way starts with a minimal prompt. To make it useful, edit `teamcast.yaml` and add fields such as `claude.instructions`, `claude.skills`, and `forge.handoffs`.
+That means a custom agent added this way starts with a minimal prompt. To make it useful, edit `teamcast.yaml` and add fields such as `instruction_blocks`, `instruction_fragments`, `skills`, and `forge.handoffs`.
 
 ### `edit agent <name>`
 
@@ -233,7 +256,7 @@ Interactive questions:
 
 Important limitations:
 
-- `edit agent` does not edit `claude.instructions`, `claude.skills`, `forge.handoffs`, `claude.permission_mode`, or `claude.mcp_servers`.
+- `edit agent` does not edit `instruction_blocks`, `instruction_fragments`, `skills`, `forge.handoffs`, `permission_mode`, or `mcp_servers`.
 - If you pass any direct flags such as `--description`, `--model`, or `--max-turns`, the command updates only those fields and skips the interactive tool editor.
 
 ### `remove agent <name>`
@@ -343,16 +366,16 @@ policies:
 
 Available rules:
 
-| Rule | Parameters | Description |
-|------|-----------|-------------|
-| `require_sandbox_with_execute` | — | Any agent with `execute` skill must have sandbox enabled |
-| `no_unrestricted_execute` | — | `execute` skill must have a permission scope (e.g. `Bash(npm *)`) |
-| `require_skill` | `skill` | All agents must have the specified skill |
-| `deny_skill_for_role` | `agent`, `skill` | A named agent must not have the specified skill |
-| `forbid_skill_combination` | `skills[]` | No single agent may hold all listed skills at once |
-| `max_agents` | `count` | Team must not exceed the given number of agents |
-| `require_instruction_block` | `kind` | All agents must include an instruction block of the given kind |
-| `require_delegation_chain` | — | At least one agent must have the `delegate` skill |
+| Rule                           | Parameters       | Description                                                       |
+| ------------------------------ | ---------------- | ----------------------------------------------------------------- |
+| `require_sandbox_with_execute` | —                | Any agent with `execute` skill must have sandbox enabled          |
+| `no_unrestricted_execute`      | —                | `execute` skill must have a permission scope (e.g. `Bash(npm *)`) |
+| `require_skill`                | `skill`          | All agents must have the specified skill                          |
+| `deny_skill_for_role`          | `agent`, `skill` | A named agent must not have the specified skill                   |
+| `forbid_skill_combination`     | `skills[]`       | No single agent may hold all listed skills at once                |
+| `max_agents`                   | `count`          | Team must not exceed the given number of agents                   |
+| `require_instruction_block`    | `kind`           | All agents must include an instruction block of the given kind    |
+| `require_delegation_chain`     | —                | At least one agent must have the `delegate` skill                 |
 
 The `secure-dev` preset includes several security assertions by default.
 
@@ -409,6 +432,8 @@ It targets:
 - `.claude/settings.json`
 - `.claude/settings.local.json`
 - `CLAUDE.md`
+- `.codex/agents`
+- `.codex/config.toml`
 - `AGENTS.md`
 
 Flow:
@@ -440,7 +465,11 @@ Use `--yes` to skip confirmation.
 
 Everything is defined in `teamcast.yaml` at the root of your project.
 
-For each agent, TeamCast renders `.claude/agents/<name>.md` from `agents.<name>.claude`.
+For Claude targets, TeamCast renders `.claude/agents/<name>.md` and `CLAUDE.md` from `claude.agents.<name>`.
+
+For Codex targets, TeamCast renders `.codex/agents/<name>.toml` plus `.codex/config.toml` from `codex.agents.<name>`.
+
+`.codex/config.toml` is the workspace-level agent index. Concrete agent runtime config lives in `.codex/agents/<name>.toml`.
 
 Native Claude Code fields are rendered into frontmatter:
 
@@ -454,15 +483,49 @@ Native Claude Code fields are rendered into frontmatter:
 - `mcpServers`
 - `background`
 
-`claude.instructions` becomes the markdown body.
+`instruction_blocks` and `instruction_fragments` compose the markdown body for Claude agents and the instruction sections embedded in Codex `developer_instructions`.
 
 `forge` metadata is not rendered into the agent markdown. It is used by TeamCast for validation, workflow docs, and delegation modeling.
 
-This is important for custom agents:
+Codex agent TOML uses these native fields:
+
+- `model`
+- `model_reasoning_effort`
+- `sandbox_mode`
+- `developer_instructions`
+
+`tools`, `disallowed_tools`, `skills`, and `forge.handoffs` are encoded as structured sections inside `developer_instructions`.
+
+### Environment Instructions
+
+Project environments inject capability-gated instructions into agent prompts at generation time. Each environment fragment specifies which capabilities an agent must have to receive it:
 
-- role templates and presets come with built-in `claude.instructions`
-- `add agent <name>` without `--template` does not ask for `claude.instructions`
-- a custom agent created from `add agent` therefore starts with a very minimal prompt until you edit `teamcast.yaml`
+| Fragment | Requires | Example content |
+|----------|----------|----------------|
+| `node_code_patterns` | `read_files` | ESM imports, TypeScript strict mode, named exports |
+| `node_development` | `write_files` | `npm install`, async/await, error handling patterns |
+| `node_testing` | `execute` + `write_files` | `npm test`, vitest/jest commands, test conventions |
+
+This means a **reviewer** (read + execute, no write) gets code patterns but NOT testing instructions. A **developer** (read + write + execute) gets everything. An **orchestrator** (read + delegate only) gets only code patterns.
+
+Custom agents work the same way — a `react-dev` with `write_files` + `execute` automatically gets the right fragments without any role-name matching.
+
+### Instruction Layers
+
+Agent prompts are composed from three layers:
+
+| Layer | Source | Scope |
+|-------|--------|-------|
+| **instruction_blocks** | `teamcast.yaml` or preset | Project-specific behavior, workflow rules |
+| **instruction_fragments** | Built-in registry | Reusable role patterns (e.g. `feature-developer-workflow`) |
+| **environment instructions** | Built-in environments | Toolchain best practices, injected by capability |
+
+Presets provide sensible defaults for `instruction_blocks` and `instruction_fragments`. For deeper customization, edit `teamcast.yaml` and run `teamcast generate`.
+
+Note for `add agent`:
+
+- `add agent <name> --template <role>` inherits the role template's blocks and fragments
+- `add agent <name>` without `--template` starts with a minimal prompt until you edit `teamcast.yaml`
 
 ## Configuration
 
@@ -471,113 +534,121 @@ Everything is defined in `teamcast.yaml` at the root of your project.
 ### Minimal Example
 
 ```yaml
-version: "1"
+version: "2"
 project:
   name: my-project
 
-agents:
-  developer:
-    claude:
+claude:
+  agents:
+    developer:
       description: Implements features and fixes bugs
       model: sonnet
       tools: [Read, Write, Edit, Bash, Grep, Glob]
       disallowed_tools: [WebFetch, WebSearch]
-      instructions: |
-        Implement the requested changes.
-        Write tests when behavior changes.
+      instruction_blocks:
+        - kind: behavior
+          content: |
+            Implement the requested changes.
+            Write tests when behavior changes.
 ```
 
 ### Full Example
 
 ```yaml
-version: "1"
+version: "2"
 project:
   name: my-project
   description: TypeScript/Node.js web app
 
-agents:
-  orchestrator:
-    claude:
+claude:
+  agents:
+    orchestrator:
       description: Coordinates the team and delegates tasks
       model: opus
       tools: [Read, Grep, Glob, Agent]
       disallowed_tools: [Edit, Write, Bash]
       max_turns: 30
-      instructions: |
-        You are the coordinator for the project.
-        Read the request, break it into subtasks, and delegate to the right agents.
-        Never modify files yourself.
-    forge:
-      handoffs: [planner, developer, reviewer]
-
-  planner:
-    claude:
+      instruction_blocks:
+        - kind: behavior
+          content: |
+            You are the coordinator for the project.
+            Read the request, break it into subtasks, and delegate to the right agents.
+            Never modify files yourself.
+      forge:
+        handoffs: [planner, developer, reviewer]
+
+    planner:
       description: Analyzes codebase and produces implementation plans
       model: sonnet
       tools: [Read, Grep, Glob, WebFetch, WebSearch]
       disallowed_tools: [Edit, Write, Bash]
-      instructions: |
-        Read the codebase and produce a step-by-step implementation plan.
-        Never modify files.
+      instruction_blocks:
+        - kind: behavior
+          content: |
+            Read the codebase and produce a step-by-step implementation plan.
+            Never modify files.
 
-  developer:
-    claude:
+    developer:
       description: Implements features based on the plan
       model: sonnet
       tools: [Read, Write, Edit, Bash, Grep, Glob]
       disallowed_tools: [WebFetch, WebSearch]
       skills: [test-first, clean-code]
-      instructions: |
-        Implement the plan, write tests, and verify the result.
+      instruction_blocks:
+        - kind: behavior
+          content: |
+            Implement the plan, write tests, and verify the result.
 
-  reviewer:
-    claude:
+    reviewer:
       description: Reviews code for quality and security issues
       model: sonnet
       tools: [Read, Grep, Glob, Bash]
       disallowed_tools: [Edit, Write]
-      instructions: |
-        Review the implementation for correctness, style, and security.
-        Do not modify files yourself.
-
-policies:
-  permissions:
-    allow:
-      - "Bash(npm run *)"
-      - "Bash(npm test)"
-      - "Bash(git status)"
-      - "Bash(git diff *)"
-      - "Bash(git commit *)"
-    ask:
-      - "Bash(git push *)"
-    deny:
-      - "Bash(rm -rf *)"
-      - "Bash(git push --force *)"
-      - "Write(.env*)"
-  sandbox:
-    enabled: true
-    auto_allow_bash: true
-
-settings:
-  default_model: sonnet
-  generate_docs: true
-  generate_local_settings: true
+      instruction_blocks:
+        - kind: behavior
+          content: |
+            Review the implementation for correctness, style, and security.
+            Do not modify files yourself.
+
+  policies:
+    permissions:
+      allow:
+        - "Bash(npm run *)"
+        - "Bash(npm test)"
+        - "Bash(git status)"
+        - "Bash(git diff *)"
+        - "Bash(git commit *)"
+      ask:
+        - "Bash(git push *)"
+      deny:
+        - "Bash(rm -rf *)"
+        - "Bash(git push --force *)"
+        - "Write(.env*)"
+    sandbox:
+      enabled: true
+      auto_allow_bash: true
+
+  settings:
+    generate_docs: true
+    generate_local_settings: true
 ```
 
 ### Agent Fields
 
-| Field | Type | Description |
-|-------|------|-------------|
-| `claude.description` | string | Required. Shown in the Claude Code subagent picker |
-| `claude.model` | `opus \| sonnet \| haiku \| inherit` | Model alias to use |
-| `claude.tools` | string[] | Native Claude Code tool allow-list |
-| `claude.disallowed_tools` | string[] | Native Claude Code tool deny-list |
-| `claude.skills` | string[] | Skill names. Each unique skill generates `.claude/skills/<skill>/SKILL.md` |
-| `claude.max_turns` | number | Maximum agentic turns |
-| `claude.mcp_servers` | object[] | MCP server definitions |
-| `claude.permission_mode` | `default \| acceptEdits \| bypassPermissions \| plan \| dontAsk` | Claude Code permission mode |
-| `claude.instructions` | string | Freeform instructions used as the markdown body |
-| `forge.handoffs` | string[] | Other agents this agent can delegate to. Requires `Agent` in `claude.tools` |
+| Field                     | Type                                                             | Description                                                                                    |
+| ------------------------- | ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
+| `claude.description`      | string                                                           | Required. Shown in the Claude Code subagent picker                                             |
+| `claude.model`            | `opus \| sonnet \| haiku \| inherit`                             | Model alias to use                                                                             |
+| `claude.tools`            | string[]                                                         | Native Claude Code tool allow-list                                                             |
+| `claude.disallowed_tools` | string[]                                                         | Native Claude Code tool deny-list                                                              |
+| `claude.skills`           | string[]                                                         | Skill names. Each unique skill generates `.claude/skills/<skill>/SKILL.md`                     |
+| `claude.max_turns`        | number                                                           | Maximum agentic turns                                                                          |
+| `claude.mcp_servers`      | object[]                                                         | MCP server definitions                                                                         |
+| `claude.permission_mode`  | `default \| acceptEdits \| bypassPermissions \| plan \| dontAsk` | Claude Code permission mode                                                                    |
+| `capability_traits`       | string[]                                                         | High-level capability profiles that expand to `tools` + `disallowed_tools`                     |
+| `instruction_blocks`      | object[]                                                         | Structured instruction blocks rendered into Claude markdown and Codex `developer_instructions` |
+| `instruction_fragments`   | string[]                                                         | Named instruction fragments composed with `instruction_blocks`                                 |
+| `forge.handoffs`          | string[]                                                         | Other agents this agent can delegate to. Requires `Agent` in `claude.tools`                    |
 
 Available Claude Code tools:
 
@@ -587,16 +658,16 @@ Available Claude Code tools:
 
 Instead of listing raw tool names, you can specify platform-agnostic skills in `claude.tools`. TeamCast expands each skill to the appropriate Claude Code tools automatically.
 
-| Skill | Expands to |
-|-------|-----------|
-| `read_files` | `Read`, `Grep`, `Glob` |
-| `write_files` | `Write`, `Edit`, `MultiEdit` |
-| `execute` | `Bash` |
-| `search` | `Glob`, `Grep` |
-| `web` | `WebFetch`, `WebSearch` |
-| `delegate` | `Agent` |
-| `interact` | `AskUserQuestion`, `TodoWrite`, `TodoRead` |
-| `notebook` | `NotebookEdit` |
+| Skill         | Expands to                                 |
+| ------------- | ------------------------------------------ |
+| `read_files`  | `Read`, `Grep`, `Glob`                     |
+| `write_files` | `Write`, `Edit`, `MultiEdit`               |
+| `execute`     | `Bash`                                     |
+| `search`      | `Glob`, `Grep`                             |
+| `web`         | `WebFetch`, `WebSearch`                    |
+| `delegate`    | `Agent`                                    |
+| `interact`    | `AskUserQuestion`, `TodoWrite`, `TodoRead` |
+| `notebook`    | `NotebookEdit`                             |
 
 Example:
 
@@ -608,6 +679,39 @@ developer:
 
 Raw tool names and skills can be mixed in the same `tools` array.
 
+### Capability Traits
+
+Capability traits are high-level profiles that compose `tools` and `disallowed_tools` from named capability sets. They are the recommended way to define agent permissions in presets and custom manifests — more readable than raw tool lists and safer than manual assembly.
+
+| Trait                | Grants                          | Denies          |
+| -------------------- | ------------------------------- | --------------- |
+| `base-read`          | `read_files`, `search`          | —               |
+| `file-authoring`     | `write_files`                   | —               |
+| `command-execution`  | `execute`                       | —               |
+| `web-research`       | `web`                           | —               |
+| `delegation`         | `delegate`                      | —               |
+| `interaction`        | `interact`                      | —               |
+| `notebook-editing`   | `notebook`                      | —               |
+| `no-file-edits`      | —                               | `write_files`   |
+| `no-commands`        | —                               | `execute`       |
+| `no-web`             | —                               | `web`           |
+| `full-access`        | all capabilities                | —               |
+
+Grant traits expand to the corresponding abstract skills (see table above). Deny traits add the expanded tools to `disallowed_tools`.
+
+Traits are combined in order. If you need a read-only planner that can browse the web but cannot edit files or run commands:
+
+```yaml
+planner:
+  capability_traits:
+    - base-read
+    - web-research
+    - no-file-edits
+    - no-commands
+```
+
+Traits merge with explicit `tools` and `disallowed_tools` — you can use both in the same agent definition. Explicit tool lists take precedence for additions; deny traits always add to the disallow list.
+
 ### Policy Fields
 
 ```yaml
@@ -645,10 +749,16 @@ preset_meta:
 
 ## Validation
 
-`teamcast validate` checks:
-
-- handoff graph correctness
-- tool allow or deny conflicts
-- role-based warnings
-- security baseline configuration
-- policy assertions (when defined in `policies.assertions`)
+`teamcast validate` runs 10 validation phases:
+
+- Registry references — all fragments, traits, skills, and environments resolve
+- Trait and capability composition — no grant/deny conflicts
+- Capability-to-tool mapping — abstract capabilities map to target tools
+- Policy coherence — no allow/deny contradictions
+- Capability-policy cross-check — capabilities align with policies
+- Skill requirements — capabilities, MCP servers, and target compatibility
+- Instruction validation — fragment conflicts, heuristic contradiction detection
+- Team graph — handoff targets exist, no orphans, reachability verified
+- Environment checks — detected and declared environments valid
+- MCP server configuration — required servers present, no duplicates
+- Policy assertions (when defined in `policies.assertions`)

package/dist/application/team.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"team.d.ts","sourceRoot":"","sources":["../../src/application/team.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAe,gBAAgB,EAAgB,MAAM,sBAAsB,CAAC;AACxF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAQ/D,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAChD,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,MAAM,CAAC;AAE1D,wBAAgB,kBAAkB,CAAC,SAAS,GAAE,mBAA8B,GAAG,cAAc,EAAE,CAE9F;AA0JD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,mBAA8B,GACxC,gBAAgB,CA8BlB;AAED,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,UAAU,GAAE,cAAyB,GACpC,QAAQ,CAGV;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,YAAY,EAAE,EACrB,UAAU,GAAE,cAAyB,GACpC,QAAQ,CA0BV;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,YAAY,EAAE,EACrB,SAAS,GAAE,mBAA8B,GACxC,gBAAgB,CAOlB;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,QAAQ,CA2BlE;AAED,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,UAAU,GAAE,cAAyB,GACpC,QAAQ,CAmCV;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,mBAA8B,GACxC,gBAAgB,CAOlB;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,KAAK,CAAC;IAAE,UAAU,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GAC3D,gBAAgB,CAWlB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,QAAQ,CAWvF;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,QAAQ,CAWxF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAoB1E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,QAAQ,CAsBjG;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE;IACP,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,iBAAiB,CAAC,CAAC;CAC3D,GACA,SAAS,CAkBX"}
+{"version":3,"file":"team.d.ts","sourceRoot":"","sources":["../../src/application/team.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAe,gBAAgB,EAAgB,MAAM,sBAAsB,CAAC;AACxF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAO/D,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,CAAC;AAChD,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,MAAM,CAAC;AAE1D,wBAAgB,kBAAkB,CAAC,SAAS,GAAE,mBAA8B,GAAG,cAAc,EAAE,CAE9F;AA0JD,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,mBAA8B,GACxC,gBAAgB,CA6BlB;AAED,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,UAAU,GAAE,cAAyB,GACpC,QAAQ,CAGV;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,YAAY,EAAE,EACrB,UAAU,GAAE,cAAyB,GACpC,QAAQ,CA0BV;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,YAAY,EAAE,EACrB,SAAS,GAAE,mBAA8B,GACxC,gBAAgB,CAOlB;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,QAAQ,CA2BlE;AAED,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,MAAM,EACnB,UAAU,GAAE,cAAyB,GACpC,QAAQ,CAmCV;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,mBAA8B,GACxC,gBAAgB,CAOlB;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,KAAK,CAAC;IAAE,UAAU,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GAC3D,gBAAgB,CAWlB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,QAAQ,CAWvF;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,QAAQ,CAWxF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAoB1E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,QAAQ,CAsBjG;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,SAAS,EAChB,OAAO,EAAE;IACP,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,eAAe,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,iBAAiB,CAAC,CAAC;CAC3D,GACA,SAAS,CAkBX"}

package/dist/application/team.js

@@ -158,7 +158,6 @@ export function buildManifestFromPreset(presetName, projectName, selection = 'cl
     return {
         version: '2',
         project: { ...manifest.project },
-        plugins: manifest.plugins ? [...manifest.plugins] : undefined,
         preset_meta: manifest.preset_meta ? { ...manifest.preset_meta } : undefined,
         claude: targetNames.includes('claude')
             ? cloneTargetConfig(manifest.claude ?? sourceTarget, {