Project coordination — Phase 1: project_group_id plumb + projects.json store

.gitattributes

@@ -9,24 +9,27 @@
 # file non-text disables newline conversion entirely.
 *.pem -text
 
+# Screenshots and other PNG assets are binary even when their compressed prefix
+# happens not to contain a NUL byte. Git's heuristic otherwise renders some PNGs
+# as text and applies whitespace/newline checks to compressed image bytes.
+*.png binary
+*.gif binary
+
 # Shell scripts and the data files they parse must keep LF on every checkout.
 # `core.autocrlf=true` is the Git-for-Windows default, so without this a Windows
 # clone rewrites these to CRLF and two things break there and only there:
 #
 #   - A `#!/usr/bin/env bash` script whose lines end in CRLF fails outright: the
 #     CR becomes part of the interpreter path or of every command argument.
 #   - A script that READS a line-oriented data file gets a trailing CR on every
-#     value. scrub-lint.sh reads scripts/scrub-allowlist.txt line by line and
-#     uses each line as a grep pattern; a trailing CR makes every pattern match
-#     nothing, so the entire allowlist silently goes dead and the gate reports
-#     failures for the exact references it is configured to permit. Silent
-#     because the file is only ever consumed as patterns -- nothing validates
-#     that an allowlist entry still matches anything.
+#     value, which silently changes the meaning of each one. Pin eol=lf on any
+#     such data file you add: the gate that used to be the worked example here
+#     read a pattern list this way, and a trailing CR made every pattern match
+#     nothing while still reporting success.
 #
 # eol=lf (not just `text`) pins the working-tree ending, so this holds regardless
 # of the user's core.autocrlf.
 *.sh text eol=lf
-scripts/scrub-allowlist.txt text eol=lf
 *.nsh text eol=lf
 
 # The vendored-source integrity manifest hashes checkout bytes. Keep its text

.github/ISSUE_TEMPLATE/app-store-listing.yml

@@ -0,0 +1,148 @@
+name: App Store listing request
+description: Request that your Kiro Crew app be listed in the official App Store catalog.
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        The official App Store catalog is maintainer-curated: its repository is
+        not publicly writable, so outside authors do not open the listing pull
+        request themselves. This issue is how you request a listing — a
+        maintainer authors the catalog entry from what you provide here.
+
+        Before filing, self-run the review checklist in
+        [publishing-guide.md section 14](https://github.com/kirodotdev/KiroCrew/blob/main/docs/app-kit/publishing-guide.md).
+        Your app repository must be public and git-cloneable so the publish
+        pipeline can resolve and pin a commit. If your app has any **executable**
+        surface (install scripts, backend, hooks, lifecycle scripts,
+        `detectInstalled`, `openCommand`), your README must say so: a user who
+        has not set `agent.apps_allow_third_party` to `true` in `config.json`
+        will see `app_execution_denied` rather than a working install (see
+        section 9).
+
+  - type: checkboxes
+    id: search
+    attributes:
+      label: Existing issues
+      options:
+        - label: I searched open issues and this app is not already listed or requested.
+          required: true
+
+  - type: input
+    id: name
+    attributes:
+      label: App name
+      description: >-
+        kebab-case, and must match the `name` in your `app.json`.
+      placeholder: commit-oracle
+    validations:
+      required: true
+
+  - type: input
+    id: git-url
+    attributes:
+      label: Git repository URL
+      description: >-
+        A public, git-cloneable URL for the app source.
+      placeholder: https://github.com/you/your-app
+    validations:
+      required: true
+
+  - type: input
+    id: ref
+    attributes:
+      label: Ref to pin
+      description: >-
+        The branch, tag, or commit SHA the publish pipeline should resolve and
+        pin. A specific SHA is safest; a branch or tag is fine and will be
+        resolved to the commit it points at.
+      placeholder: main, or a 40-character commit SHA
+    validations:
+      required: true
+
+  - type: input
+    id: display-name
+    attributes:
+      label: Display name
+      description: The human-readable name shown in the store.
+      placeholder: Commit Oracle
+    validations:
+      required: true
+
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: >-
+        Plain text, no markdown. Two or three sentences describing what the app
+        does — this becomes the store `description`, which Discover truncates to
+        one or two lines and the detail page shows in full.
+    validations:
+      required: true
+
+  - type: input
+    id: categories-tags
+    attributes:
+      label: Category and tags
+      description: >-
+        Lowercase tags. These decide the app's Discover category (see section 3
+        of the publishing guide); pick tags that land it in the right one.
+      placeholder: developer-tools, code-quality, git, code-review
+    validations:
+      required: true
+
+  - type: input
+    id: author
+    attributes:
+      label: Author name and profile URL
+      description: >-
+        Shown as provenance next to the app's category and source. Include a
+        display name and a profile URL.
+      placeholder: reprodev — https://github.com/reprodev
+    validations:
+      required: true
+
+  - type: input
+    id: license
+    attributes:
+      label: License
+      description: SPDX identifier for the app's license.
+      placeholder: MIT
+    validations:
+      required: false
+
+  - type: textarea
+    id: entry-json
+    attributes:
+      label: Ready-to-paste entry (optional)
+      description: >-
+        If you have already drafted a published-schema catalog entry against the
+        schema served at `apps.crew.kiro.dev/official-registry.json`, paste it
+        here. This is a convenience for the maintainer authoring the entry — it
+        is not authoritative and the pipeline pins whatever commit it resolves.
+      render: json
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: review-checklist
+    attributes:
+      label: Review checklist (self-attestation)
+      description: >-
+        These mirror the review checklist in section 14 of the publishing guide.
+        Confirm each item for your app.
+      options:
+        - label: "`app.json` validates: kebab-case `name`, semver `version`, all required fields non-empty."
+          required: true
+        - label: "No `..` or absolute paths in `agents`, `skills`, `sops`, `ui.entry`, `ui.pages[].entryPoint`, `backend.entryPoint`."
+          required: true
+        - label: "UI bundle built and committed (`ui/dist/index.mjs`) if the app ships a UI."
+          required: true
+        - label: "Agent JSON files are valid, and each skill `SKILL.md` has proper frontmatter."
+          required: true
+        - label: "Opaque icon committed, square, 512x512, plus a hero image (16:9), a detail banner, and at least one screenshot committed."
+          required: true
+        - label: "`README.md` documents what the app does, how to use it, and the `agent.apps_allow_third_party` prerequisite if any executable surface is present."
+          required: true
+        - label: "The app installs and enables cleanly from a local clone."
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -55,9 +55,21 @@
 
 <!-- Link to relevant issues, e.g. Fixes #123 -->
 
+## Pattern harvest
+
+<!-- REQUIRED for fix/revert PRs (PR Hygiene checks that this section is
+     present); delete this section otherwise. Every fixed defect is a chance
+     to stop its whole class: say whether this one generalizes.
+
+     One of:
+       Rule candidate: <semgrep | lint | review-prompt | agents-md>
+       Pattern: <one line, e.g. "sentinel return value used in boolean context">
+     or:
+       Not generalizable: <one line on why this defect is a one-off> -->
+
 ## Checklist
 
-- [ ] Single commit with a Conventional Commits title (`feat|fix|docs|refactor|perf|test|chore|ci|build|revert: ...`)
+- [ ] At most two commits (one is the norm), with a Conventional Commits title (`feat|fix|docs|refactor|perf|test|chore|ci|build|revert: ...`)
 - [ ] Existing tests pass and new tests added for new functionality
 - [ ] Self-review completed; code follows project style guidelines
 - [ ] Documentation updated (if applicable)

.github/agent-sdk-boundary-baseline.txt

@@ -0,0 +1,82 @@
+# Imports of the ACP layer from application code, as `<count> <path>`.
+# Both `kiro_crew.acp` and `kiro_crew.providers` count: providers re-exports ACP
+# shapes (LLMEvent and the EVENT_* constants), so watching only `acp` would let
+# a consumer look migrated while still reading the backend's own types.
+#
+# The gate requires every OTHER file under src/ to be clean and none of these
+# counts to grow, so the list can shrink but never grow.
+#
+# It is a floor, not a countdown to zero. Most of these consumers are expected
+# to keep reading ACP directly: ACP is the foundation the SDK is built on, not
+# a layer being hidden behind it. What the gate buys is that the dependency
+# cannot SPREAD into a file that is clean today -- which is what makes it safe
+# to consolidate provider-specific logic gradually instead of in one sweep.
+#
+# There is no inline opt-out marker: "this consumer legitimately needs ACP" is
+# the claim the boundary refuses, so the baseline is the only exemption
+# mechanism.
+#
+# Do NOT add or raise a line to make a red gate green -- route the dependency
+# through kiro_crew.agent_sdk instead. Design of record:
+# docs/request-for-change/rfc-crew-agent-sdk-boundary.md
+#
+# Refresh (after removing something listed here):
+#   python3 scripts/check_agent_sdk_boundary.py --update-baseline
+1 src/kiro_crew/apps/builtins/auto_improvement/backend/pr_watchers.py
+1 src/kiro_crew/apps/builtins/auto_improvement/backend/runner.py
+1 src/kiro_crew/apps/builtins/auto_improvement/spine/agent_runner.py
+1 src/kiro_crew/apps/builtins/code_review_sage/sage_lib/followup.py
+2 src/kiro_crew/apps/builtins/code_review_sage/sage_lib/review_pool.py
+1 src/kiro_crew/channel.py
+3 src/kiro_crew/cli_chat.py
+3 src/kiro_crew/cli_doctor.py
+1 src/kiro_crew/cli_setup.py
+1 src/kiro_crew/config/loader.py
+1 src/kiro_crew/connections/mint.py
+1 src/kiro_crew/cron.py
+3 src/kiro_crew/dashboard/chat_handlers.py
+4 src/kiro_crew/dashboard/chat_runner.py
+1 src/kiro_crew/dashboard/chat_summary.py
+1 src/kiro_crew/dashboard/chat_utils.py
+2 src/kiro_crew/dashboard/handlers/agents.py
+2 src/kiro_crew/dashboard/handlers/core.py
+1 src/kiro_crew/dashboard/handlers/hooks.py
+1 src/kiro_crew/dashboard/handlers/optimizer.py
+2 src/kiro_crew/dashboard/handlers/sessions.py
+1 src/kiro_crew/dashboard/handlers/side.py
+1 src/kiro_crew/dashboard/handlers/taskrunner.py
+1 src/kiro_crew/dashboard/handlers/usage.py
+1 src/kiro_crew/dashboard/session_memory.py
+1 src/kiro_crew/dashboard/stall_enrichment.py
+1 src/kiro_crew/dashboard/state.py
+1 src/kiro_crew/dashboard/steer_settle.py
+1 src/kiro_crew/dashboard/turn_dispatch.py
+1 src/kiro_crew/discord/renderer.py
+1 src/kiro_crew/eval/judge.py
+2 src/kiro_crew/eval/runner.py
+1 src/kiro_crew/knowledge/llm_pool.py
+5 src/kiro_crew/llm_helpers.py
+1 src/kiro_crew/mcp_shared.py
+1 src/kiro_crew/messaging/auto_title.py
+1 src/kiro_crew/messaging/dispatch.py
+1 src/kiro_crew/messaging/driver.py
+12 src/kiro_crew/session.py
+2 src/kiro_crew/session_allocation.py
+2 src/kiro_crew/session_background.py
+1 src/kiro_crew/session_cleanup.py
+2 src/kiro_crew/session_compaction.py
+1 src/kiro_crew/session_map.py
+2 src/kiro_crew/session_pid.py
+1 src/kiro_crew/session_pool.py
+3 src/kiro_crew/slack/gateway.py
+3 src/kiro_crew/slack/handler.py
+1 src/kiro_crew/slack/transport_dispatch.py
+7 src/kiro_crew/subagent.py
+1 src/kiro_crew/subagent_manager/terminal.py
+2 src/kiro_crew/subagent_persistence.py
+2 src/kiro_crew/task_executor.py
+1 src/kiro_crew/task_planner.py
+1 src/kiro_crew/taskrunner.py
+1 src/kiro_crew/telegram/transport_dispatch.py
+1 src/kiro_crew/workflows/agent_pool.py
+2 src/kiro_crew/workflows/service.py