Demo packs
crewship seed populates a fresh workspace with the four connected
Harbor Goods business stories plus Crewship Lab — local sample data, human
decision points, and crewship seed verify
as the acceptance test. See crewship seed for that catalogue,
and cmd/crewship/seeddata/stories/business/README.md in the repository for
the executable contracts, extension steps and limits.
The packs described here are the older, external-source demos the default
seed used to install. A pack is one real use case, run by one crew, that reads
a real public source and can be run again tomorrow — and checked. Each
followed the same shape, which is the shape most repeated work has once you
look at it: a cheap probe that costs nothing, an expensive judgement only
when there is something to judge, a human decision before anything
irreversible.
The packs are no longer installed — no crew scripts, routines, Pages or
issues are created for them, and nothing is scheduled. Their definitions,
deterministic scripts and the seed verify --pack acceptance path remain in
the source tree for regression use and for workspaces seeded before the
business demo; they are never silently installed.
Every pack shipped four things to its crew: the scripts (under
/crew/shared/scripts, with their own unit tests that go test runs), the
routines, a Page the report routine writes, and the issues that
walk a person through it. One crew per pack, deliberately: /crew/shared is
a per-crew volume, so a hand-off through files only works inside a crew.
Nightly CI watch
Scheduled workflows fail differently from PR checks: nothing blocks, nobody is paged, and the red sits there. Worse is the failure that is not red at all — a cron dropped in a YAML refactor, a workflow GitHub disabled after sixty idle days. No green appears and no red either.ci-probe is agentless. It reads the Actions API, classifies every scheduled
workflow as RED, STALE (no run for 48 hours), RUNNING or OK, and
returns wake. Scheduled as the wake gate of ci-nightly-triage, it costs
nothing on a green night:
COUNTS: regressions=… flaky=… infra=… stale=… unclear=…. Those numbers
must agree with the probe’s, and crewship seed verify --pack ci-watch
checks that they do.
The Page ci-watch shows the probe’s verdict per failure class and the
coverage line; the full triage with links is the notification.
Docs drift
docs_drift.py compares the YAML/JSON tags of Go structs with the
identifiers in backticks and YAML blocks of a documentation page, in both
directions: a phantom is a key the page describes and the code does not
have; a gap is a field the code has and the page never mentions. The
pairs are curated in config/docs_map.json on the quality crew’s shared
volume — keep them narrow, a whole package against one page is unreadable.
Candidates are not findings. Jordan reads the real files from the checkout
under /crew/shared/work, confirms or rejects every candidate with a path
and a line, admits any truncation, and ends with
COUNTS: candidates=… confirmed=… rejected=… truncated=…. verify
reconciles the candidate count with the scan and, given a local checkout,
checks that every cited path exists at the scanned commit.
A scan that cannot run — no token, no map, no checkout — exits zero with
state: critical and says why, so the routine still reaches the agent and
the page still says something true. Every exit path of docs_audit.sh builds
its panel in one place: the routine projects .panel.state, .panel.label
and .panel.sha_label out of that document with transform steps, and a
transform whose field is missing does not degrade — it fails the run and
takes the review and both page panels with it. On a failure path sha_label
says <repo> @ not checked out rather than inventing a commit.
Casey’s issue carried the human boundary: a confirmed finding that is a
security claim — an allowlist or validation the docs promise and the
code does not enforce — is escalated as a DECISION, not worded alone.
Credentials
The packs that read GitHub need a token. Put a read-only one (actions:read and repository read; the packs never write) in .env.local
alongside the model login selection:
SEED_ANTHROPIC_API_KEY instead of
SEED_CODEX_AUTH_FILE. The Codex variable is a path to a private 0600
file outside Git; never put the contents of auth.json in .env.local.
On an isolated development crew container whose Linux user-namespace sandbox
cannot start, the operator can set CREWSHIP_CODEX_SANDBOX_MODE=danger-full-access
for Codex runs. Leave it unset when the normal sandbox works; this setting
changes Codex’s isolation inside the crew container, not the seed data.
With SEED_GITHUB_TOKEN set, the seed creates a workspace GH_TOKEN mounted
as a 0400 file the in-container gh CLI reads directly. Without it no
GitHub credential is created, and seed verify --pack
reports the pack as skipped with the reason, never as green.
A re-seed over an existing workspace refreshes the stored value from the
variable, so a rotated token lands on the next crewship seed rather than
leaving last month’s token in place under the same name.
Verifying
crewship seed for the row-by-row
contract of both modes, and Demo use cases for the
per-pack script that shows the delivered files, runs the probe and calls
verify as one unit (scripts/demo/run.sh pack-ci-watch). In short: scripts
byte-identical to the seed, no routine of the pack already FAILED in this
workspace, the probe against an independent read of the source, the agent’s
counts against the probe, no secret in the report, the notification in the
inbox, the panels written by that run.
Where the packs came from
The packs are the demo-sized versions of the templates kept in the privatecrewship-manifests catalogue, whose market research found the same two
shapes of pain in every segment it looked at: clocks nobody watches
(a deadline running from a moment nobody recorded) and meters nobody
watches (something stops, and silence looks like calm). A wake gate is not
an optimisation there; it is the condition under which anybody lets an agent
run at all. The business stories carry the same shape indoors: a local
record instead of a public source, so the demo needs no third-party account.