clawmates/docs/TEMPLATE-MATURITY.md

Template maturity — what our agents can actually be asked to do

A review of the 6 workflow recipes and 12 team templates, on 2026-09-22. Graded by evidence, not by what the TOML declares: a recipe is mature when a mission built from it has completed and something checked the result.

Workflow recipes

recipe	phases	standing check	staffing	grade
research_and_code	2 (research → coding)	13 harness scenarios	research→topic_research, coding→rust_sdlc	Proven
research_only	1 (research, repo-less)	2 scenarios	topic_research	Proven
security_hardening	3 (scan → research → coding)	1 scenario	+rust_sdlc	Exercised
benchmark	1	1 scenario	rust_sdlc	Exercised
refactor	1	1 scenario	rust_sdlc	Exercised
continuous_research	2 (analysis → script)	none	continuous_research	Runs live, unguarded

research_and_code is the workhorse: every delivery, gate, judge, memory and triage scenario is built on it, so it is re-proven on every harness run. research_only earned its grade differently — its staffing was measured and corrected: under the old rust_sdlc default it delivered 5 roles, 14 skill deliveries and ~50 KB of prompt with 1 of 9 skills applicable; on topic_research it is 3 roles, 4 deliveries, 24 KB, 4 of 4.

continuous_research is the outlier and the one to fix first. It has the most moving parts of any recipe — harvest → triage → manifest → analysis → ranking → script → episode.json → vault commit — it ran twice today and produced real output both times, and nothing in the harness would notice if it broke tomorrow. Every other recipe has a standing check; this one has operator attention, which is not the same thing.

What the recipes declare that does not fire

phase_config::DECLARED_BUT_UNREAD is the honest list, and recipes lean on it:

key	used by	status
loop	research_and_code (until_no_more_int_items), refactor (single_pass)	inert — iteration is max_iterations + done_when
produces	almost every recipe (["md"])	inert — artifact rendering is not driven by it
input_from_phase	security_hardening	inert — phases share a checkout
mcp_bundles (phase level)	security_hardening	inert — bundles come from the TEAM template

None of this is hidden: security_hardening.toml carries a "what is real here and what is decoration" section and annotates its own dead keys inline. That is the right pattern and the other five should copy it. The risk is not the dead keys themselves — it is that a reader takes loop = "until_no_more_int_items" for a loop.

Team templates

All 12 are structurally sound and every declared skill resolves to a real file — 0 unbound across all of them, which is the skill-binding-repair work holding (it was 55 of 85 dangling once).

team	slots	risk profile	skills	evidenced?
rust_sdlc	planner coder tester reviewer committer	coding_readwrite	19	yes — harness default
topic_research	lead_researcher evidence_checker report_writer	research_web_readonly	4	yes — measured
continuous_research	paper_reader signal_ranker script_writer	research_readonly	11	yes — live runs
backend	api_designer db_engineer coder tester committer	coding_readwrite	20	yes — first run 2026-09-22
frontend	designer coder tester committer	coding_readwrite	12	no
mobile	designer coder tester committer	coding_readwrite	11	no
gpu	arch_analyst kernel_author bench_engineer coder committer	coding_readwrite	13	no
threejs	scene_designer coder shader_author perf_engineer committer	coding_readwrite	13	no
codebase_research	code_archeologist architecture_mapper flow_tracer vault_scribe	research_readonly	11	yes — first run 2026-09-22
papers_research	domain_scout paper_reader library_curator	research_web_readonly	8	yes — first run 2026-09-22
insight_research	implementation_tracker novelty_hunter publication_drafter	research_readonly	8	no
continuous_improvement	brain_inspector improvement_proposer improvement_evaluator	research_readonly	7	runs, cannot reach its subject

Six of twelve are evidenced. backend was exercised on 2026-09-22, the first time anything had been staffed from it: all five roles provisioned with real agents (api_designer, db_engineer, coder, tester, committer), and the mission delivered cursor pagination — Paged<T>, paginate<T: Clone>, module declared, cargo test 3 passed — judged met on the first pass, 2 files pushed. It also gave the task-permission shadow its first confirmed Edit call.

codebase_research was exercised the same day, against the real clawmates repository rather than the toy scratch crate, with a task that cannot be faked from filenames: trace every hop of a mission agent's tool call from the guest hook to the recorded event, naming file, function and whether each hop runs in the guest or on the host. It produced a 189-line research/GATE-MAP.md describing code committed the same day — the four-field NODE_EXTRACT including agent_type, the shadow-mode would-deny.jsonl semantics, install_with — and all six of its line citations verify exactly (hook_script_with 562, NODE_EXTRACT 789, TaskPolicy 297, ROLE_POLICIES 261, settings_hook 809, install_command_with 819). Nothing hallucinated. Five of twelve.

papers_research followed: asked for a bounded library on microVM and sandbox isolation for agents, it delivered a README index and four notes with complete frontmatter, judged met. The judge could only check the frontmatter was present; a paper team whose container has no pdf-to-text tool is exactly where invented citations live, so every arXiv id was checked against arXiv itself — all four exist, with exact title matches. One of them, 2603.02277 (SandboxEscapeBench), is a paper the operator's own research pass had already cited, which is independent evidence it found on-topic work rather than plausible filler. Six of twelve.

continuous_improvement ran too, and gets a different grade, because running and working came apart. All three roles handed off with attributed commits, and it was scrupulously honest: it filed zero level-up proposals, its proposer committed "no proposals warranted, evidence base too thin", and its audit opens by stating the problem exactly — "No .brain files are accessible within the repo or mission filesystem — brains are held in the platform, not checked in."

That is the defect, and it is structural rather than a matter of data. The template's subject is "every project agent's .brain"; those live in the server's /data/brains volume, and nothing delivers them into a mission — the same shape as research-has-no-delivery-channel and skills-had-no-delivery-channel. So it audited the only agent-shaped thing in reach, a ROSTER.md in the scratch repo, and read that file's 6.1.128 (a guest kernel version) as an agent version, having no way to know better. It is not counted as evidenced.

A channel alone would not rescue it. Mission crews are minted per mission (reuse is off by decision), and missions write memory to the repo brain, so every agent brain is a ~2 KB seed with no history to audit. The template assumes long-lived agents that accumulate a record; the platform makes disposable ones. That is a design decision to resolve, not a bug to patch.

Two of the remaining six are still unevidenced, and the other four are blocked on a target stack. The other nine are well-formed scaffolding: roles, prompts, brain seeds and resolving skills, and no run behind any of them. They will probably work — they are structurally identical to the three that do — but "probably" is the word, and this codebase has a name for the gap between a thing being wired and a thing being proven.

Five of the nine need something we do not have: frontend, mobile, threejs and gpu target stacks with no repository in the harness to point them at, and insight_research needs a vault plus commit history. Those are blocked on a target, not on the template. The remaining four — codebase_research, papers_research, continuous_improvement, backend — could be exercised against repositories we already have.

One thing both runs showed: agents reach for Bash

Cumulative tool calls across every mission since the policy shipped: Bash 74, Read 34, Write 15, Glob 3, Edit 1, Agent 1. A read-only mapping mission that could have used Grep and Glob used Bash 33 times and Read 5. That matters for task permission: the allowlist's dedicated-tool entries (Grep, ToolSearch, WebFetch, TodoWrite) may simply never be exercised, so "unconfirmed by a real run" will not converge for them — and it means the surface that actually needs governing is Bash, which the floor rules already cover.

What this means we can ask for today

With confidence: a repo-backed research→code loop on a Rust project, with a judge, a commit gate, a verifier subagent and delivery to a branch. A repo-less research report with sourced claims. Both are re-proven on every harness run.

With supervision: a security scan and plan, a benchmark, a refactor. Each has completed once under a standing check; none has the depth of evidence the first two have.

With attention: continuous research. It works, it produced two good digests today, and it has no guard.

Not yet: anything staffed from the other nine teams. Nothing is known to be wrong with them; nothing is known to be right either.

The two things worth doing next

1. A continuous-research harness scenario. The recipe with the most moving parts is the only one with no standing check, and it now also carries the paper triage (kind + evidence). A scenario that launches it, waits, and asserts the manifest has tags and a spread, analysis.md covers every paper, and episode.json parses would turn operator attention into a guard.
2. Exercise the four unblocked teams once each, against repositories we already have, and record what came out. Not to prove them mature — one run is not maturity — but to find out whether they run at all, which nobody currently knows.