clawmates/docs/TEMPLATE-MATURITY.md

# Template maturity — what our agents can actually be asked to do

A review of the 6 workflow recipes and 12 team templates, on 2026-09-22.
Graded by evidence, not by what the TOML declares: a recipe is mature when a
mission built from it has completed and something checked the result.

## Workflow recipes

| recipe | phases | standing check | staffing | grade |
|---|---|---|---|---|
| `research_and_code` | 2 (research → coding) | **13 harness scenarios** | research→`topic_research`, coding→`rust_sdlc` | **Proven** |
| `research_only` | 1 (research, repo-less) | 2 scenarios | `topic_research` | **Proven** |
| `security_hardening` | 3 (scan → research → coding) | 1 scenario | +`rust_sdlc` | Exercised |
| `benchmark` | 1 | 1 scenario | `rust_sdlc` | Exercised |
| `refactor` | 1 | 1 scenario | `rust_sdlc` | Exercised |
| `continuous_research` | 2 (analysis → script) | **none** | `continuous_research` | Runs live, unguarded |

`research_and_code` is the workhorse: every delivery, gate, judge, memory and
triage scenario is built on it, so it is re-proven on every harness run.
`research_only` earned its grade differently — its staffing was **measured and
corrected**: under the old `rust_sdlc` default it delivered 5 roles, 14 skill
deliveries and ~50 KB of prompt with **1 of 9** skills applicable; on
`topic_research` it is 3 roles, 4 deliveries, 24 KB, **4 of 4**.

`continuous_research` is the outlier and the one to fix first. It has the most
moving parts of any recipe — harvest → triage → manifest → analysis → ranking
→ script → `episode.json` → vault commit — it ran twice today and produced
real output both times, and **nothing in the harness would notice if it broke
tomorrow.** Every other recipe has a standing check; this one has operator
attention, which is not the same thing.

## What the recipes declare that does not fire

`phase_config::DECLARED_BUT_UNREAD` is the honest list, and recipes lean on it:

| key | used by | status |
|---|---|---|
| `loop` | `research_and_code` (`until_no_more_int_items`), `refactor` (`single_pass`) | **inert** — iteration is `max_iterations` + `done_when` |
| `produces` | almost every recipe (`["md"]`) | **inert** — artifact rendering is not driven by it |
| `input_from_phase` | `security_hardening` | **inert** — phases share a checkout |
| `mcp_bundles` (phase level) | `security_hardening` | **inert** — bundles come from the TEAM template |

None of this is hidden: `security_hardening.toml` carries a "what is real here
and what is decoration" section and annotates its own dead keys inline. That is
the right pattern and the other five should copy it. The risk is not the dead
keys themselves — it is that a reader takes `loop = "until_no_more_int_items"`
for a loop.

## Team templates

All 12 are structurally sound and **every declared skill resolves to a real
file — 0 unbound across all of them**, which is the `skill-binding-repair` work
holding (it was 55 of 85 dangling once).

| team | slots | risk profile | skills | evidenced? |
|---|---|---|---|---|
| `rust_sdlc` | planner coder tester reviewer committer | coding_readwrite | 19 | **yes** — harness default |
| `topic_research` | lead_researcher evidence_checker report_writer | research_web_readonly | 4 | **yes** — measured |
| `continuous_research` | paper_reader signal_ranker script_writer | research_readonly | 11 | **yes** — live runs |
| `backend` | api_designer db_engineer coder tester committer | coding_readwrite | 20 | **yes** — first run 2026-09-22 |
| `frontend` | designer coder tester committer | coding_readwrite | 12 | no |
| `mobile` | designer coder tester committer | coding_readwrite | 11 | no |
| `gpu` | arch_analyst kernel_author bench_engineer coder committer | coding_readwrite | 13 | no |
| `threejs` | scene_designer coder shader_author perf_engineer committer | coding_readwrite | 13 | no |
| `codebase_research` | code_archeologist architecture_mapper flow_tracer vault_scribe | research_readonly | 11 | **yes** — first run 2026-09-22 |
| `papers_research` | domain_scout paper_reader library_curator | research_web_readonly | 8 | **yes** — first run 2026-09-22 |
| `insight_research` | implementation_tracker novelty_hunter publication_drafter | research_readonly | 8 | no |
| `continuous_improvement` | brain_inspector improvement_proposer improvement_evaluator | research_readonly | 7 | **evidenced** — `self_audit` recipe; diagnosed a planted cause and found a real one |

**Six of twelve are evidenced.** `backend` was exercised on 2026-09-22,
the first time anything had been staffed from it: all five roles
provisioned with real agents (api_designer, db_engineer, coder, tester,
committer), and the mission delivered cursor pagination — `Paged<T>`,
`paginate<T: Clone>`, module declared, `cargo test` 3 passed — judged
**met on the first pass**, 2 files pushed. It also gave the task-permission
shadow its first confirmed `Edit` call.

`codebase_research` was exercised the same day, against the real
`clawmates` repository rather than the toy scratch crate, with a task that
cannot be faked from filenames: trace every hop of a mission agent's tool
call from the guest hook to the recorded event, naming file, function and
whether each hop runs in the guest or on the host. It produced a 189-line
`research/GATE-MAP.md` describing code committed **the same day** — the
four-field `NODE_EXTRACT` including `agent_type`, the shadow-mode
`would-deny.jsonl` semantics, `install_with` — and **all six of its line
citations verify exactly** (`hook_script_with` 562, `NODE_EXTRACT` 789,
`TaskPolicy` 297, `ROLE_POLICIES` 261, `settings_hook` 809,
`install_command_with` 819). Nothing hallucinated. **Five of twelve.**

`papers_research` followed: asked for a bounded library on microVM and
sandbox isolation for agents, it delivered a README index and four notes
with complete frontmatter, judged met. The judge could only check the
frontmatter was *present*; a paper team whose container has no
pdf-to-text tool is exactly where invented citations live, so every
arXiv id was checked against arXiv itself — **all four exist, with exact
title matches**. One of them, `2603.02277` (SandboxEscapeBench), is a paper
the operator's own research pass had already cited, which is independent
evidence it found on-topic work rather than plausible filler. **Six of
twelve.**

`continuous_improvement` ran too, and gets a different grade, because
running and working came apart. All three roles handed off with
attributed commits, and it was scrupulously honest: it filed **zero**
level-up proposals, its proposer committed *"no proposals warranted,
evidence base too thin"*, and its audit opens by stating the problem
exactly — *"No `.brain` files are accessible within the repo or mission
filesystem — brains are held in the platform, not checked in."*

That is the defect, and it is structural rather than a matter of data.
The template's subject is "every project agent's `.brain`"; those live in
the server's `/data/brains` volume, and **nothing delivers them into a
mission** — the same shape as `research-has-no-delivery-channel` and
`skills-had-no-delivery-channel`. So it audited the only agent-shaped
thing in reach, a `ROSTER.md` in the scratch repo, and read that file's
`6.1.128` (a guest kernel version) as an agent version, having no way to
know better. It is not counted as evidenced.

A channel alone would not rescue it. Mission crews are minted per mission
(reuse is off by decision), and missions write memory to the *repo* brain,
so every agent brain is a ~2 KB seed with no history to audit. The
template assumes long-lived agents that accumulate a record; the platform
makes disposable ones. That is a design decision to resolve, not a bug to
patch.

**Retargeted (2026-09-22).** The decision taken: audit the *repo* brain,
which is where missions actually write what they learn. The server now
exports it as `/mission/memory/PROJECT-MEMORY.md`, one line per judged
phase, and installs it into every mission that has a repository.

Two runs followed, and they separate the channel from the steering:

- **v2 (01a0cad8) — channel works, steering does not.** The 2.4 KB record
  was installed. The agent made 50 tool calls, 0 of them touched it, 13
  went to the roster, and the judge passed it. The brief and `done_when`
  were reused from v1 ("read each agent's brain"), and the template's
  retargeted role prompts are **inert on mission turns** (see
  `prompt-injection-two-paths`). Rewriting `system_prompt` cannot aim a
  mission; only the brief can, and nothing supplies one for this team.
- **v3 (01a0cade) — right answer, failed by the judge.** With a brief and
  `done_when` pointing at the record, 3 of 7 tool calls read it. The audit
  states the record exactly (4 lines, MET 4 / UNMET 0), finds no pattern,
  and files **zero** proposals ("a single UNMET line would be an incident;
  this record has zero"), the correct result on an all-MET record. The
  judge failed it, correctly by the letter: the condition required each
  finding to *quote* the record lines, and the audit summarised them in a
  table instead. `max_iterations` was 1, so there was no retry.

So the subject is now reachable and the reasoning holds up. The unproven
part is the case this team exists for, a record *with* failures. That
needs a repository whose history contains UNMET verdicts, and a default
brief so no caller has to write one. Still not counted as evidenced.

**The `self_audit` recipe, and a record with real failures (2026-09-22).**
The brief now lives in `templates/workflows/self_audit.toml`, so a mission
naming only `template_kind = "self_audit"` and a repo is staffed and aimed
without the caller writing anything. To give it something to find, two
missions were planted on the scratch repo whose `done_when` required a
*Limitations* section their brief never mentioned. The judge marked both
UNMET for exactly that. The record then held 7 lines: 4 MET, 3 UNMET, the
third being v3's quoting failure, a natural single-incident control.

Mission 01a0cb3f, launched with no brief of its own, read the record (8 of
25 tool calls), stated 7 / 4 / 3, found the one pattern, quoted both lines
verbatim, and named the quoting failure as an incident with no proposal. The
judge passed it on iteration 1 of 2.

Its **diagnosis was wrong**, and the record is why. It concluded the agents
"produced the main content but omitted the final required section" and
proposed a write-then-check checklist. The recorded prompts show the agents
were never told: none of the three mentions *Limitations*, because working
agents are not shown their completion condition. The checklist would not have
helped. The record carried the condition and not the brief, so a
brief/condition mismatch was invisible to any reader of it. Three fixes
followed:

- verdict lines now carry the phase's **brief** beside its condition;
- the mission id in a line is the uuid **tail**: the two planted missions,
  launched 34 s apart, both rendered as `01a0cb38` (a UUIDv7 leads with its
  timestamp), and the audit read them as one mission;
- the recipe has the auditor **copy the record** into the checkout, since the
  judge cannot read `/mission/memory`. Iteration 0 failed as "could not verify
  the quotes" until the agent did this unprompted.

Counts, pattern-vs-incident discipline and verbatim evidence: shown. A
correct diagnosis of a cause: not yet shown, and until now not possible.

**Re-run with the fixes (mission 01a0cb54) — evidenced.** A second planted
pair, whose lines now carry their briefs, joined the record (11 lines: 5 MET,
6 UNMET). Launched again with nothing but `template_kind` and a repo, the
audit copied the record into the checkout, and the judge confirmed its counts
by grep against that copy. It passed on iteration 0. Its findings:

- **The planted pattern, diagnosed correctly.** *"The requirement appeared in
  the condition but not in the brief, so the agent was never asked to write
  it … a setup defect."* The proposal is the right one: the brief, old wording
  quoted, new wording asking for the section.
- **A pattern nobody planted.** Its own two earlier UNMET audits (v3, and
  01a0cb3f's first attempt) were judged for the same missing thing. It noted
  that their briefs predate the record carrying briefs, so it could not tell
  what those agents were told, and proposed "copy the record, quote verbatim".
  That is the fix made by hand in `9ca71e5`, found independently from the
  record alone.

**Seven of twelve.** Limits: the planted pattern is one shape (brief omits a
condition's requirement); the pre-fix lines still render two missions as
`01a0cb38`, which the audit counted correctly as two lines; and it proposes
into a markdown file. Nothing reads `research/IMPROVEMENT-AUDIT.md` or files
`level_up_proposals` from it.

**Two of the remaining six are still unevidenced**, and the other four
are blocked on a target stack. The other nine are well-formed scaffolding:
roles, prompts, brain seeds and resolving skills, and no run behind any of
them. They will probably work — they are structurally identical to the three
that do — but "probably" is the word, and this codebase has a name for the gap
between a thing being wired and a thing being proven.

Five of the nine need something we do not have: `frontend`, `mobile`,
`threejs` and `gpu` target stacks with no repository in the harness to point
them at, and `insight_research` needs a vault plus commit history. Those are
blocked on a target, not on the template. The remaining four —
`codebase_research`, `papers_research`, `continuous_improvement`, `backend` —
could be exercised against repositories we already have.

## One thing both runs showed: agents reach for Bash

Cumulative tool calls across every mission since the policy shipped:
**Bash 74, Read 34, Write 15, Glob 3, Edit 1, Agent 1**. A read-only
mapping mission that could have used `Grep` and `Glob` used `Bash` 33
times and `Read` 5. That matters for task permission: the allowlist's
dedicated-tool entries (`Grep`, `ToolSearch`, `WebFetch`, `TodoWrite`)
may simply never be exercised, so "unconfirmed by a real run" will not
converge for them — and it means the surface that actually needs
governing is `Bash`, which the floor rules already cover.

## What this means we can ask for today

**With confidence:** a repo-backed research→code loop on a Rust project, with
a judge, a commit gate, a verifier subagent and delivery to a branch. A
repo-less research report with sourced claims. Both are re-proven on every
harness run.

**With supervision:** a security scan and plan, a benchmark, a refactor. Each
has completed once under a standing check; none has the depth of evidence the
first two have.

**With attention:** continuous research. It works, it produced two good
digests today, and it has no guard.

**Not yet:** anything staffed from the other nine teams. Nothing is known to
be wrong with them; nothing is known to be right either.

## The two things worth doing next

1. **A `continuous-research` harness scenario.** The recipe with the most
   moving parts is the only one with no standing check, and it now also
   carries the paper triage (`kind` + `evidence`). A scenario that launches
   it, waits, and asserts the manifest has tags and a spread, `analysis.md`
   covers every paper, and `episode.json` parses would turn operator
   attention into a guard.
2. **Exercise the four unblocked teams once each**, against repositories we
   already have, and record what came out. Not to prove them mature — one run
   is not maturity — but to find out whether they run at all, which nobody
   currently knows.